Annual Report 2013 - Home Bureau Of Justice Assistance

Annual Report 2013Bureau of Justice AssistanceU.S. Department of Justice

The mission of NW3C is to provide training,investigative support and research to agencies and entities involvedin the prevention, investigation and prosecution of economic and high-tech crime.This project was supported by Grant No. 2012-MU-BX-4004 awarded by the Bureau of Justice Assistance. The Bureau of Justice Assistance is a component ofthe Office of Justice Programs, which also includes the Bureau of Justice Statistics, the National Institute of Justice, the Office of Juvenile Justice and DelinquencyPrevention, the Office for Victims of Crime, and the Office of Sex Offender Sentencing, Monitoring, Apprehending, Registering, and Tracking. Points of view oropinions in this document are those of the author and do not necessarily represent the official position or policies of the U.S. Department of Justice. The NationalWhite Collar Crime Center (NW3C) is the copyright owner of this document. This information may not be used or reproduced in any form without expresswritten permission of NW3C. For questions or additional information, please contact Kimberly Williams, Communications Manager at 1-800-221-4424 ext.3320 or kwilliams@nw3c.org. NW3CTMand IC3 are trademarks of NW3C, Inc. and may not be used without written permission.Bureau of Justice Assistance 2014. NW3C, Inc. d/b/a the National White Collar Crime Center. All rights reserved.U.S. Department of Justice

Table of ContentsIntroductionFrom Our Leadership.4Executive Summary.5Integrity: The NW3C StoryAbout the National White Collar Crime Center.7Board of Directors.8NW3C’s Key Partnerships.9NW3C Leadership.10Funding the NW3C Mission.11Quality: Superior Training and ResearchTraining Advances Law Enforcement’s Fight Against Crime.12Research Serves the NW3C Mission.18Service: Supporting Law EnforcementWorking to Help Prevent, Investigate and Prosecute High-tech Crime.19Effective Case Support Leads to Favorable Case Outcomes.21Serving Law Enforcement by Supporting the NW3C Mission.23NW3C 2013 Member Agency Award for Excellence.24Appendix 1: Training Charts. 25Appendix 2: Membership Map and Charts.263

From Our LeadershipThe National White Collar CrimeCenter’s logo is underscoredwith the words “integrity, qualityand service.” Throughout the year, withthe support of the Bureau of JusticeAssistance (BJA) and other partners,NW3C incorporates these core valuesinto both its daily work and its projects.As a non-profit organization formed with the purpose ofsupporting state, local, federal and tribal law enforcement,“integrity” defines NW3C’s mission to assist with theprevention, investigation and prosecution of economic andhigh-tech crime. To advance this mission and stay currentwith technology, NW3C relies on “quality” research andtraining. “Service” characterizes the commitment of NW3Cstaff as they endeavor daily to provide analytical assistance andtechnical support to law enforcement as well as manage theroutine work necessary to keep NW3C running smoothly.Technology and society’s use of ithave changed exponentially sinceNW3C began its work in the1970s. Through the years, NW3C hashad to innovate and remain committed toresearch in order to ensure that our trainingadequately prepares law enforcement forits many challenges. Fortunately, NW3C’soutstanding personnel combined with funding from BJAand other partners have allowed us to continue to serveas law enforcement’s go-to organization for training andtechnical support.In 2013, NW3C began to combine online course work withclassroom instruction to render a more convenient and costeffective way for law enforcement to receive training. Weoffered several introductory courses online, saving traveltime and reducing expenses for students. We also deliveredsix webinars covering a variety of topics, including socialmedia, metadata and EXIF tags, criminals’ hiding places onthe Internet, and PerpHoundTM – a BJA-funded forensictool that simplifies the analysis of location informationfound in cell phone call detail records. And we created videoinstruction on special issues of concern for law enforcement,including one which focused on cyber threats.In addition to updating the ways in which NW3C deliverstraining, we also developed new courses which provideinformation directly related to unfolding trends andtechnologies. For example, a pair of classes created this4In 2013, NW3C kept pace with a rapidly changing world,adapting in both the ways in which training was delivered,the topics that were researched, and the support thatwas provided. This report highlights many of NW3C’saccomplishments during the past year and gives anindication of successes to be accomplished in 2014 andbeyond.Glen B. Gainer IIIChairman, NW3C Board of Directorsyear under an award from the Office of Juvenile Justice andDelinquency Prevention (OJJDP) demonstrates ways topreserve an Apple system at a crime scene and identify andcollect volatile data. These two courses reflect the popularityof these devices and their potential value to criminalinvestigators.NW3C also remains the premier provider of cybercrimetraining to the nation’s Internet Crimes Against Children(ICAC) task forces. To date, more than 3,000 ICACtask force members have matriculated through NW3C’scurriculum—a small army ready to wage war against thosewho would exploit society’s most vulnerable people, ourchildren.Whether working to halt crimes against children, stopthe sale of counterfeit medicines, or reduce cybercrime,NW3C remains actively committed to serving both thelaw enforcement community and the public. With thesupport of BJA and other partners, the NW3C Boardof Directors, and our own staff, NW3C will continue toprovide superior training and investigative support to lawenforcement, with a focus on integrity, quality and service.Don BrackmanDirector, NW3C

Executive SummaryThis Annual Report highlights NW3C’s manyaccomplishments during the period beginningJanuary 1, 2013 and ending December 31,2013, a year in which NW3C continued to supportlaw enforcement nationwide with integrity, qualityand service. With funding from the Bureau of JusticeAssistance (BJA), other agencies and companies,NW3C found innovative ways to train law enforcementprofessionals in new technologies and make them awareof the tactics currently practiced by the perpetrators ofeconomic and high-tech crime.In 2013, NW3Cdelivered435training courses to10,392 law enforcementprofessionals from 5,028trainingagencies in 39 states.coursesNW3C worked hard tomake its training accessiblethroughout the nation, both byoffering regional courses and alsowith expanded online classes andwebinars. In 2013, NW3C presentedsix webinars that received a total of 7,391registrations.435NW3C’s partnership with Leidos, Inc., Perlustro, L.P., andX1 Discovery, Inc., led to the development of specializedtraining related to various forensic products and platforms.Computer Network Defense, a new course facilitated by theLeidos CyberNEXS Cyber Network Training and ExerciseSystem (“the CyberNEXS Platform”), instructs students oncomputer network defense fundamentals; iLooKIX training,conducted in partnership with Perlustro, L.P., presentsan innovative way for investigators to examine computerhard drives; and X1 Social Discovery , training offered incollaboration with X1 Discovery, Inc., provides informationaimed at assisting investigators with gathering datafrom social media.10,392NW3C also distributes products developed withfunding from BJA and provides instruction inlaw enforcement their use. The software tool, TUX4N6 ,which was updated in 2013, permits a hardtraineddrive to be previewed without writingto or altering data on the system.The forensic tool, PerpHound ,also updated in 2013, allowscoordinates from call detailrecords to be plotted viaGoogle Maps , givingpublic recordanalyticala visual timeline of thesearchesproductslocation of a cell phoneNW3C stayed current with trends and cuttingcreatedwhen a particular calledge techniques and shared its research withwas made.law enforcement via numerous new and updated courses.Other training highlights this year included four courseCybercop 315 (Windows Artifacts/WinArt) nowofferings related to online salvage and vehicle auctioncombines NW3C’s former Windows NT File Systemfraud, a course on intelligence writing and briefing, and(NTFS) and Windows NT Operating System (NTOS)an aggressive training schedule in intellectual propertycourses. Topical areas include data streams, reparse points,theft investigations. In addition, NW3C remained theencrypted objects and a detailed examination of variouspremier provider of cybercrime training to the nation’sregistry artifacts. The update created a cost savings forInternet Crimes Against Children (ICAC) task forceNW3C in terms of instructor time and travel costs.personnel.Cybercop 101 and 201 also were updated, allowingstudents to transition easily into the WinArt course.Keeping with the increasing capabilities and reach of theInternet, NW3C this year expanded its online courseWith funding from the Office of Juvenile Justice andofferings and also presented several webinars. The aim is toDeliquency Prevention (OJJDP), NW3C developed thereach a greater number of law enforcement professionalsnew course Cyber Investigation 335 (Advanced Wirelesswhile also reducing travel time and expenses. WebinarsNetwork Investigations). This class focuses on techniquespresented this year included several focused specificallyand methods used to locate wireless devices connected toon social media and Internet investigations.wireless networks. Also funded by OJJDP, two other newcourses, Cybercop 215 (Macintosh Triage and ImagingNW3C also used the Internet to introduce a digital news(MTI)) and Cybercop 325 (Macintosh Forensic Analysis),magazine. NW3C News launched on December 12 as aadd to NW3C’s training related to Apple productforum for sharing up-to-date news, investigative tips andforensics, reflecting the popularity of these devices andtheir potential value to criminal investigators.141,623Introduction10,335Integrity Quality Service5