Fighting cybercrime on a shoestring budget

In cramped, dingy offices near New York's East River, a couple dozen detectives and analysts hunch over computers, plowing their way through hundreds of criminal cases.'We investigate anything from computer intrusions to terrorist leads to the computer of a person in a murder investigation,' said Det. Tony Reyes.This is the home of the New York Police Department Computer Crime Squad. The heart of this or any other computer crimes unit is computer forensics, the conservation, deconstruction and analysis of electronic evidence contained on personal computers, networks and, increasingly, handheld devices such as cell phones and personal digital assistants.These officers are deconstructing the computers of murderers, pedophiles, con artists, suspected terrorists and other criminals, looking for evidence that will help at trial.If there's a network intrusion at a Wall Street financial company, the computer crime squad will respond.But at the same time, 'if a little old lady calls because some spam put porn on her computer, we investigate,' Reyes said. 'We don't have the luxury of choosing which cases to take'we take everything.'Lt. John Otero commands the squad of 25 officers, down from 32 thanks to retirements and the lure of big bucks in the private sector.'Our biggest problem is finding people with the right experience and education. ... I'll take a guy with strong investigative skills over' a computer expert without the field experience, Otero said. 'It takes about a year to train someone, who then becomes very valuable' in the job market.'Computers may not be the target of crime, but they certainly are the tool of most sophisticated crimes,' said Mike Gibbons, former head of the FBI's computer analysis response team, now vice president of federal security solutions for Unisys Corp.'s U.S. Federal Government Group.'Intuitively, the biggest challenge in computer forensics is the 'recency' of the data'getting to the data before it's overwritten or stepped on or erased,' Gibbons said. 'Knowing what you're trying to find can be a needle in a haystack.'Otero said the squad is divided into three modules'online forensics, investigations and so-called 'post-mortem' forensics.'The online module is more proactive. We look for the crime or the individual,' Otero said.The secure room dedicated to online forensics is a controlled environment where everything a detective does online is monitored in order to produce results that will be admissible in court.The online room is where forensics happen in 'real time,' Reyes said. While the computers in the room have direct access to the Internet (those in the other modules do not), software records every keystroke, and every screen shot can be captured. This is where detectives surf Islamist sites, looking for clues to sympathizers' identities, or looking for a money trail, trying to anticipate whether terrorists are planning another attack.Or, a detective might pose as a preteen boy or girl, looking to lure sexual predators into a conversation. In one recent case, the squad got a court order for a computer wiretap in a major Mafia case, Otero said.'We took over the bad guy's IP identity,' Reyes added. 'For all intents and purposes we were him for 180 days.'That investigation spun off more than 40 other investigations around the world, Otero said. He could not say anything more about the status of those investigations.The online room also serves as a resource for investigators and forensic analysts, Reyes said. If the forensic examination of a personal computer turns up evidence of child pornography downloaded from a Web site, for instance, the analyst will use the Internet connection in the online room to verify the existence of the site.In the investigations module, officers both conduct their own investigations and assist others throughout the police department in examining digital devices.In addition to its own workload'dozens of preliminary investigations and full-blown cases'the squad will have '40 or 50 cases helping homicide, for rapes, robberies, missing persons, etc.,' Otero said.'We had a case in here once where a detective was assisting with a homicide case. Every time there was a murder, he found evidence of computer searches' by the suspect beforehand, Reyes said.The forensics team has the herculean task of creating exact duplicates of all data from all kinds of hardware and software, analyzing the massive quantities of information, and recording every step taken.As criminals have become more sophisticated in using computers, finding the relevant information out of an entire hard drive's content becomes harder.'It's very challenging. We don't have the kind of time a 13-year-old kid has' to hide stuff, Otero said.Sometimes the analysts will turn up possible evidence of crimes other than those they were looking for.'We'll go and look for whatever's asked of us. But, for instance, there was a case where we were looking for drugs and we found child porn,' Otero said. 'The officer stopped right there, before even opening the JPEG file, and got an amended search warrant.'Because of the squad's resource limitations, the officers partition their computers into 'virtual machines,' so that each case can be handled in its own pure environment. This is to keep defense attorneys from successfully challenging the results of the analysis by claiming data contamination from other cases.The 'evidence room' for equipment waiting to be analyzed is little more than a large storage closet, packed from floor to ceiling with computer equipment and disks. A quick look at the labels indicates the magnitude of the backlog'some tags are from 2002.Otero said the squad's operational budget, excluding manpower, is about $75,000 annually.'What we depend on is grants,' he said. 'Officers spend thousands of dollars of their own money on training, spend their own vacation time. ... We're waiting for a $1 million budget to redo the labs.'But it's a game of catch-up, where the bad guys can move to take advantage of technology faster than law enforcement.'Computer crime is the wave of the future criminal world,' Otero said. 'I think the time is coming where a 50-year-old criminal will hire a 13-year-old kid.'The two biggest issues Otero is concerned about are Microsoft Corp.'s plans to include encryption in next year's release of Vista, the operating system to succeed Windows, and the spread of wireless networks.'If [Vista] does full implementation of encryption, we have to move from post-mortem to live forensics,' he said. 'And Verizon is moving to implement wide-open access points' in Manhattan. 'That's a very unique challenge. We might have to run around Central Park looking for a hacker.'