HomeNewsArticle Display

Clues in cyberspace catch criminals in the real world

Scott Lalliss uses a magnifying lens to check a hard drive that is being cleaned in a sonic cleaner with 91 percent alcohol solution at the Defense Computer Forensic Laboratory Sept. 9, 2010, in Linthicum, Md. The 9 percent of water in the solution develop bubbles that gently move dirt and other organic matter away from the disks that may contain valuable evidence in an investigation. Mr. Lalliss is a senior forensic technician. (U.S. Air Force photo/Lance Cheung)

Scott Lalliss uses a magnifying lens to check a hard drive that is being cleaned in a sonic cleaner with 91 percent alcohol solution at the Defense Computer Forensic Laboratory Sept. 9, 2010, in Linthicum, Md. The 9 percent of water in the solution develop bubbles that gently move dirt and other organic matter away from the disks that may contain valuable evidence in an investigation. Mr. Lalliss is a senior forensic technician. (U.S. Air Force photo/Lance Cheung)

Scott Lalliss's reflection is seen on the platen disk of a hard drive being cleaned in a sonic cleaner with 91 percent alcohol solution at the Defense Computer Forensic Laboratory Sept. 9, 2010, in Linthicum, Md. The 9 percent of water in the solution develop bubbles that gently move dirt and other organic matter away from the disks that may contain valuable evidence in an investigation. Mr. Lalliss is a senior forensic technician. (U.S. Air Force photo/Lance Cheung)

Scott Lalliss's reflection is seen on the platen disk of a hard drive being cleaned in a sonic cleaner with 91 percent alcohol solution at the Defense Computer Forensic Laboratory Sept. 9, 2010, in Linthicum, Md. The 9 percent of water in the solution develop bubbles that gently move dirt and other organic matter away from the disks that may contain valuable evidence in an investigation. Mr. Lalliss is a senior forensic technician. (U.S. Air Force photo/Lance Cheung)

Courtney Lancaster, positions a cellular flip phone in a Faraday box at the Defense Computer Forensic Laboratory on Sep. 9, 2010, in Linthicum, Md. Ms. Lancaster, a computer forensic technician, uses the signal blocking box to charge and extract data information from memory cards or chips inside it, without fear of the phone sending or receiving data or commands that might alter or erase possible evidence. (U.S. Air Force photo/Lance Cheung)

Courtney Lancaster, positions a cellular flip phone in a Faraday box at the Defense Computer Forensic Laboratory on Sep. 9, 2010, in Linthicum, Md. Ms. Lancaster, a computer forensic technician, uses the signal blocking box to charge and extract data information from memory cards or chips inside it, without fear of the phone sending or receiving data or commands that might alter or erase possible evidence. (U.S. Air Force photo/Lance Cheung)

A hard drive read/write head at the Defense Computer Forensic Laboratory Sept. 9, 2010, in Linthicum, Md. Read/write heads ride on a microscopic layer of air that develops on the surface of the platter(s), some that spin up to 10,000 rotations per minute inside a hard drive. The slightest touch of a head onto a platter disk will cause physical damage and render that side of the disk unreadable. (U.S. Air Force photo/Lance Cheung)

A hard drive read/write head at the Defense Computer Forensic Laboratory Sept. 9, 2010, in Linthicum, Md. Read/write heads ride on a microscopic layer of air that develops on the surface of the platter(s), some that spin up to 10,000 rotations per minute inside a hard drive. The slightest touch of a head onto a platter disk will cause physical damage and render that side of the disk unreadable. (U.S. Air Force photo/Lance Cheung)

Jon Beasley peers through a disk platter stack Sept. 9, 2010, at the Defense Computer Forensic Laboratory in Linthicum, Md. Mr. Beasley is an image and extraction technician who makes disk images of computer memory storage devices. (U.S. Air Force photo/Lance Cheung)

Jon Beasley peers through a disk platter stack Sept. 9, 2010, at the Defense Computer Forensic Laboratory in Linthicum, Md. Mr. Beasley is an image and extraction technician who makes disk images of computer memory storage devices. (U.S. Air Force photo/Lance Cheung)

LINTHICUM, Md. (AFNS) -- For many, cyberspace is a vast and intangible place. A land of green ones and zeros floating on a sea of black, where an e-mail originated in Switzerland can travel to a server in Mozambique within a matter of seconds.

In the ever-changing landscape of cyberspace, information can be hidden anywhere and information can be passed in a variety of ways. Criminals and terrorists can disguise themselves as friends and break into vital information systems and even the personal lives of anyone who ventures into the realm.

That's where the men and women of the Defense Cyber Crime Center Defense Computer Forensics Laboratory step in. Servicemembers and civilians here are trained to find the clues in cyberspace to solve crimes.

"DC3 is the national center of excellence for digital forensics, digital investigations (and) cyber crime investigations," said Jim Christy, the DC3 director of future exploration. "Almost every crime has a digital nexus. You have wrist watches that can store data, your cell phone. Just about everything you have in your life today in your office, your home or your car now collects a lot of data and captures it digitally. We need digital forensic examiners to be able to find what's relevant to an investigation forensically so it'll stand up in court."

DC3 comprises the Defense Industrial Base Collaborative Information Sharing Environment, Defense Cyber Crime Institute, Defense Cyber Investigations Training Academy, National Cyber Investigative Joint Task Force Analytical Group and Defense Computer Forensics Laboratory.

In 2010, analysts from DC3 have combed through almost 300 terabytes of information. That's 13 Libraries of Congress worth of information: more than 144,500,000 items including books, photos, audio CDs, pamphlets, newspapers, sheet music and more.

One recent triumph for the Air Force Office of Special Investigations and DC3 analysts was their involvement in an investigation that led to the trial and conviction of a spy for the Chinese government, Nashir Gowadia. He is now facing multiple life sentences.

Air Force officials and the DC3 team often work hand-in-hand on a variety of cases.

"The Air Force and (Department of Defense) are a microcosm of society," Mr. Christy said. "Unfortunately, we're going to have criminals in the Air Force and people outside the Air Force that victimize us. Whether it be a fraud case, espionage or terrorism. We (also) work with the aircraft mishap program to recover the digital video or audio tapes for the safety boards."

And when the proper technologies aren't available, DC3 teams create them.

Mr. Christy said, in 1991 he and his deputy at the time, were working on a case where they needed to retrieve some information from cut up floppy disks, but there was no process to do it at the time, so they created it.

Their innovation led to the suspect being convicted of homicide.

Just as in other forensic specialties, when a search warrant is executed cyber evidence must be handled carefully to maintain its integrity.

"The academy trains investigators . . . to maintain the integrity of that evidence," Mr. Christy said. "Then it will come here to the lab and it's processed. There's always a chain of custody, it's always under control. Unlike other forensic disciplines, we can clone evidence. We can make as many scientific clones as we need to work on. Then we do our forensic examination on that clone."

Analysts must ensure their findings follow a repeatable and sustainable process. To help with that, there are laboratory support staff members like Master Sgt. Monty St. John who works as the quality assurance chief.

"As the QA chief I have a couple different roles. My primary one is for the laboratory," Sergeant St. John said. "As our analysts and forensic scientists work through a case and they finish it, the last step before we send it to our customer is to make sure that everything is in order and also that we've met with everything they've requested. Additionally, I look at it to make sure that what we're giving them complies with the policies that we've put together both from DC3 and Air Force wise. Of course what the court requires is very important as well, so we want to make sure we meet their requirements as well."

Teams at DC3 also handle a more tangible side of cyber crimes. Agents at the center received a computer hard drive that had been thrown into the Potomac River and lay in there in the murky water for months before it was recovered. The credulous suspect thought the information on the computer would not be retrievable from the water-logged machine. But the experts at DC3, after months of gently removing debris using an alcohol bath and sonic vibration machine, are almost ready to be put the drive into a new machine to retrieve the information.

But the mission of the team at DC3 is not to prove people guilty. It's to unveil the truth.

"What we do is more than looking for the 'bad guy', to coin a term," Sergeant St. John said. "We're also trying to make sure that the people that we're looking at, there's not a chance that we can exonerate them, that they're actually innocent of everything that's being put against them as a charge. We scrutinize to a very detailed level that that's actually the case. So if there's an allegation against someone, we make sure there's evidence to back that up."

Engage

Facebook Twitter
Enlisted leaders from around the world converge in #Jordan for the 4th annual Sergeants Major Symposium.… https://t.co/XMwVjiAAQp
RT @AirmanMagazine: Help us select the "Airman Top Shot" of the week by liking, commenting and sharing your favorite @usairforce photo. The…
Listen in as the first #Airman to refuel a KC-46A Pegasus from a KC-135 Stratotanker recounts his experience! @22ARW https://t.co/qAWLiQsHdo
RT @DOD_Outreach: .@NASCAR driver @BubbaWallace is used to acceleration, but got to experience 9 G’s during a @USAirForce F-15 flight at @S
RT @USAFCENT: @iqAirForce #F16 Fighting Falcon #aircraft flies a mission above the Iraqi-Syrian border alongside Co… https://t.co/1gZfXiMi2O
#VandenbergAFB aids during exercise Patriot Hook 2019, trains for real-world scenarios in the event of a regional e… https://t.co/IqnN00cJv1
.@SecAFOfficial underscores space strategy and partnerships with allies. https://t.co/X391mBc6E6 https://t.co/CFk69M8WW4
RT @SecAFOfficial: Thanks for inviting me to be part of @Policy_Exchange’s launch of the space policy unit #PXSpace! Great dialogue on #spa
#USAF's new rules on the #OCP uniform aims to better fit our #Airmen's needs as they perform the mission, while hol… https://t.co/cd6hd13Y21
As we continue the #MonthoftheMilitaryChild, check out how @341MissileWing youth build resiliency through gymnastic… https://t.co/kphokVfZTq
Things are heating up at #MountainHomeAFB! Watch as #Airmen @366FW fire department conduct #LiveFireTraining to ens… https://t.co/WRqHdMKdQs
RT @AusAirForce: Friends in high places... literally! Glad to continue the strong cooperation & mateship with @usairforce 🇦🇺🇺🇸 #AusAirForce
#Congrats to the #USAF 2019 Secretary of Defense Environmental Award winners! https://t.co/5j07VznEsc
RT @DeptofDefense: For 41 years, the Global Positioning System has helped us find our way in the world. It’s a system that our modern way o…
#DYK: In 2015 the worldwide C-17 fleet reached 3 million flying hours. The equivalent of flying around the #Earth 5… https://t.co/U01R6Y1gPe
#USAF and @Nationals partner up to teach 40 new commanders and their spouses leadership techniques.… https://t.co/doApMhiIWX
#Airmen & #Soldiers in #Kuwait teamed up to train military working dog handlers on decontamination of their K9s in… https://t.co/QtlvQGUgyF
.@179AW #Airmen know the hardest part isn't the jump, it's the preparation for the heavy drop beforehand. https://t.co/WMV2fBXN2x
.@HQUSAFEPA #Airmen combined their capabilities to provide disaster relief to those affected by #CycloneIdai, deliv… https://t.co/kzkdQA8TOS
The results are in as #USAF announces findings from a year-long review on electronic warfare. Read on for more on t… https://t.co/wAEDCRjj5L