By Paul Morrissey, Assistant Director, Office of Investigations, U.S. Secret Service
or almost 150 years, the U.S. Secret Service has led the government’s efforts against financial crimes and worked to protect the United States from criminal networks striving to exploit its financial infrastructure. The investigative mission of the Secret Service has continually evolved to keep pace with the information revolution and an increasingly globalized economy. The migration to the world’s use of advanced technology and the Internet has provided an environment for increased transnational cybercriminal activity. These actions not only harm individual consumers, but also diminish confidence in the digital financial systems upon which global economies rely. International criminal networks are proliferating and striking new alliances at an accelerated rate. The result is a convergence of threats that are becoming more complex, volatile, and destabilizing and require an increasing level of cooperation and partnership among all levels of law enforcement to effectively counteract the threats.
Recognizing the successes resulting from the Secret Service’s Electronic Crimes Task Force (ECTF) model embedded within its field offices, the USA Patriot Act of 2001 mandated that the Secret Service establish a nationwide network of task forces to prevent, detect, and investigate “various forms of electronic crimes, including potential terrorist attacks against critical infrastructure and financial payment systems.”1 Today, the Secret Service maintains 33 ECTFs worldwide, which leverage the combined resources of academia; the private sector; and local, state, and federal law enforcement in a coordinated effort. These trusted partnerships—now more than 6,000 members strong—enable the ECTFs to identify and address potential cyber vulnerabilities before the criminal element takes advantage. This proactive approach has successfully prevented cyber attacks that otherwise would have resulted in large-scale financial losses to U.S.-based companies, widespread financial harm to U.S. citizens, and the disruption of critical infrastructures.
The continued success and support of the Secret Service’s ECTF methodology relies heavily on the training of state and local law enforcement member personnel. In 2003, as part of the ECTF framework, the Secret Service established the Electronic Crimes State and Local Program (ECSLP) in an effort to support state and local law enforcement partners and to increase the number of electronic crime investigators while advancing information-sharing initiatives. The program provided Secret Service law enforcement partners with computer forensics training and hands-on experience with electronic crimes investigations. However, between 2003 and 2008, the ECSLP did not have a dedicated training facility and many local departments were forced to acquire the skills and equipment at great cost to their respective agencies. Due to these obstacles, only 80 students graduated annually during those years.In 2008, to enhance the ECSLP and its continued support of state and local law enforcement officials, the Secret Service; the State of Alabama; the Alabama District Attorney’s Association; and the city of Hoover, Alabama, collaborated with the U.S. Department of Homeland Security to create the National Computer Forensics Institute (NCFI). The NCFI is a national training facility dedicated to providing state and local law enforcement with training, equipment, and expertise in computer forensics and digital evidence acquisition and analysis. The NCFI is the only federally funded training center dedicated to instructing state and local officials in digital and cybercrime investigations in the United States. The institute opened with a mandate to provide state and local law enforcement, prosecutors, and judges with comprehensive training on current cybercrime trends, investigative methods, and prosecutorial challenges.
To further facilitate this program, the State of Alabama provided $5 million to build a 32,000 square foot state-of-the-art NCFI cyber training facility. Located in Hoover, a suburb of Birmingham, the NCFI boasts three multi-purpose classrooms, two network investigation classrooms, a mock courtroom, administrative work areas, and an operational forensics lab. The configuration and technological features in the classrooms are distinct from any other training facility within the federal government because they are expressly designed for cybercrime and digital crime instruction, featuring desks with built-in monitors, high-speed network connections, video teleconferencing, server access, and the capability to link the instructor to each student’s machine.
The 2007 proposal for the establishment of the NCFI projected the facility would offer five courses of study and train 250 students on a $4 million annual budget. Through the leadership of Secret Service and State of Alabama personnel assigned to the facility, the institute currently trains over 650 students in 13 different cyber investigation course disciplines annually. These courses result in local or state law enforcement officers who are fully trained and equipped with the latest cyber expertise and equipment. The officer is encouraged to conduct cyber investigations, computer forensics, and digital evidence recovery in furtherance of his or her department’s investigative priorities. Upon graduation, officers are also encouraged to join their local Secret Service ECTF.
In 2012, the Federal Bureau of Investigation (FBI) recognized the capabilities and resources of the NCFI and petitioned the Secret Service for authorization to enroll its state and local law enforcement partners in courses at the facility. Beginning in August of 2012, Secret Service instructors conducted four mobile device and basic computer forensic investigation courses at NCFI for state and local law enforcement investigators assigned to the FBI’s National Domestic Communications Assistance Center Program (NDCAC). The NDCAC network comprises state and local law enforcement-staffed facilities that assist in investigations regarding court-authorized telecommunication surveillance.
The Secret Service is committed to safeguarding U.S. financial infrastructure through the investigation and dismantling of criminal groups involved in criminal cyber activity. Responding to the growth of these types of crimes and the level of sophistication these criminal networks employ requires significant training, resources, and greater collaboration among law enforcement and its public and private sector partners. Accordingly, the Secret Service dedicates significant resources to improving investigative techniques, providing training for law enforcement partners, and raising public awareness. The U.S. Secret Service will continue this collaboration and support the U.S. law enforcement community in the fight against criminal cyber activity. ♦
1USA PATRIOT Act of 2001, Pub. L. 107-56 115 Stat. 272 (2001).
Please cite as:
Paul Morrissey, “Training and Equipping Cybercrime Investigators: U.S. Secret Service, State, and Local Law Enforcement Partnership,” From the Assistant Director, The Police Chief 81 (February 2014): 18–19.