Cyber crime investigators search for truth

  • Published
  • By Staff Sgt. Julie Weckerlein
  • Air Force Print News

Tech. Sgt. Jeff Barefoot has a strong presence in the courtroom.

Three times he's stepped up to testify in court, and three times the defendants suddenly took a plea deal to avoid Sergeant Barefoot on the witness stand.

Not because of his imposing stature or his 20 years of military experience, but from the knowledge he brings as an expert witness.

Sergeant Barefoot is a computer forensics examiner for the Department of Defense Cyber Crime Center located between Washington, D.C., and Baltimore, Md. The center is under the executive agency of the secretary of the Air Force, through the Office of Special Investigations.

Staying ahead of the game has been the Air Force’s computer crime mission since 1978, when enterprising OSI agents saw a need for an information forensics lab.

“Back then, they weren’t working with the computers or digital equipment we know today,” said Special Agent Robert Renko, center director of operations. “But there were cases, usually fraud, involving the need to examine information sources. And from that, the need for such a lab grew as technology and its uses evolved.”

In 2001, the center incorporated the new Defense Cyber Crime Institute with the existing Defense Computer Investigations Training Program and the Defense Computer Forensics Lab. The lab is the largest accredited lab of its kind in the world.

As executive director of the center, Steven Shirley says commercial products with digital storage technologies are driving the center’s mission.

“We’ve become a digital society and all the products people use on a daily basis can be a tool of a crime or an object of a crime,” he said. “We routinely handle computers and laptops of all varieties, of course, but also, MP3 players, thumb drives, cell phones, personal digital assistants and (Global Positioning Systems) as evidence in criminal and counterintelligence investigations.

"We do video and audio enhancements and (have) even examined a digital dive watch related to an underwater death," he said. "Pulling information from these sources is vital to solving these cases.”

The center assists all DOD and government organizations and evidence comes to the center from all over the world. Sometimes the evidence arrives in pieces, after criminals do their best to destroy it.

“I’ve seen things broken up, torn apart, saturated in fluids, scorched, everything,” said John Lancaster, senior forensics technician. “It’s my job to put it back together so we can go in and extract the data.”

And if the evidence doesn't come to them, sometimes they have to go get it. The center deployed agents to Iraq to help in the early days of Operation Iraqi Freedom.

A deployable forensics team "provided hands-on tactical support, and followed those kicking down the doors of Saddam's palaces, grabbing up his computers and seeing what he had on them. That team was a model for many others," said Special Agent Jim Christy, director of the Defense Cyber Crime Institute, an organization within the center that scientifically tests digital hardware and software tools and technologies for digital forensics.

The center is not about putting criminals behind bars, but rather gathering and interpreting the data and relaying the factual evidence.

In a recent case, an Airman was charged with possession of child pornography and the center helped clear him of the charges.

“An Airman was set up by his wife’s lover and framed,” said Jason Upchurch, section chief for the intrusion and information team. “The wife said she would never leave her husband unless he hurt the children, so the boyfriend took a photo of her younger daughter and planted it on the husband’s computer along with other child pornography. Our examination traced the origin of the files to the boyfriend’s computer.”

No matter the circumstances, finding the truth is the center's main objective.

A computer forensic examiner’s responsibilities are to go through any seized device that can store data; whatever is found can either confirm a person’s guilt or prove a person’s innocence.

Sergeant Barefoot is part of a joint-service team of self-appointed “computer geeks” who love nothing more than diving into digital evidence for clues to solve crime.

“We say (computer geeks) with affection,” Agent Christy said. “It’s because all the people who work here are passionate about technology. We have only the brightest and the best people in the field working here. We want to know all about the latest software, techniques and equipment, and if that makes us geeks, we’re proud of it.”