How the FBI Investigates Computer Crime

[Resurrection]

CERT®/CC: How the FBI Investigates Computer Crime

---------

Introduction

If you or your organization is the victim of a computer crime, what should you know before contacting the Federal Bureau of Investigation (FBI) for assistance or to report an incident? This document provides information about the federal investigative and prosecutorial process for computer crimes and explains some of the guidelines, policies, and resources the FBI uses when it investigates computer crime.[1]

Various FBI technical programs address the growing complexity of computer investigations. FBI legal attaché stationed in 45 countries use sophisticated methods to investigate and coordinate cyber incidents around the world. In the United States, the Internet Crime Complaint Center (IC3) is a partnership between the FBI and the National White Collar Crime Center (NW3C). IC3 processes complaints of cyber crime and then coordinates computer crime investigations.

The FBI’s Cyber Division at FBI Headquarters in Washington DC coordinates investigations in which networks or computers are exploited as instruments in criminal activity or as targets. High priority is given to investigations that involve terrorist organizations or intelligence operations sponsored by foreign governments. The FBI trains and certifies computer forensic examiners who work in FBI field offices to recover and preserve digital evidence. The FBI maintains a computer forensic laboratory in Washington, DC for advanced data recovery and for research and development. Most FBI field offices also have specialized cyber squads called Cyber Action Teams (CATS) which provide expert assistance to law enforcement and aid cybercrime investigations.

Cyber Crime Investigations

Computer crimes can be separated into two categories: 1) crimes facilitated by a computer and 2) crimes where a computer or network is the target.

When a computer is used as a tool to aid criminal activity, it may include storing records of fraud, producing false identification, reproducing and distributing copyright material, collecting and distributing child pornography, and many other crimes.

Technology has made it easier for criminals to hide information about their crimes. Because of the sophistication of the digital environment, evidence is collected and handled differently than it was in the past and often requires careful computer forensic investigation. Crimes where computers are the targets can result in damage or alteration to the computer system. Computers which have been compromised may be used to launch attacks on other computers or networks.

The FBI uses a number of federal statutes to investigate computer crimes. The FBI is sensitive to the victim's concerns about public exposure, so any decision to investigate is jointly made between the FBI and the United States Attorney in order to take the victim's needs into account.

Computer Crimes: Frequently Used Federal Statutes

The following statutes are used most frequently by the FBI to investigate computer-related crimes.

1. Federal statutes investigated by the FBI:

United States Codes (U.S.C.)
18 U.S.C. 875 Interstate Communications: Including Threats, Kidnapping, Ransom, Extortion
18 U.S.C. 1029 Possession of Access Devices
18 U.S.C. 1030 Fraud and related activity in connection with computers
18 U.S.C. 1343 Fraud by wire, radio or television
18 U.S.C. 1361 Injury to Government Property
18 U.S.C. 1362 Government communication systems
18 U.S.C. 1831 Economic Espionage Act
18 U.S.C. 1832 Trade Secrets Act

For more information about federal legal codes related to cybercrime, visit
cybercrime.gov

2. Local laws: Each state has different laws and procedures that pertain to the investigation and prosecution of computer crimes. Contact your local police department or district attorney's office for guidance.

Federal Investigative Guidelines

The FBI investigates incidents when the following conditions are present:

* a violation of the federal criminal code has occurred within the jurisdiction of the FBI
* the United States Attorney's Office supports the investigation and agrees to prosecute the subject if the elements of the federal violation can be substantiated

Federal law enforcement can only gather proprietary information concerning an incident in the following ways:

* request for voluntary disclosure of information
* court order
* federal grand jury subpoena
* search warrant

Gathering information

To ensure that your organization can react to an incident efficiently, make sure that staff knows who is responsible for cyber security and how to reach them. The following steps will help you document an incident and assist federal, state, and local law enforcement agencies in their investigation (be sure to act in accordance with your organization's polices and procedures):

1. Preserve the state of the computer at the time of the incident by making a backup copy of logs, damaged or altered files, and files left by the intruder.
2. If the incident is in progress, activate auditing software and consider implementing a keystroke monitoring program if the system log on the warning banner permits.
3. Document the losses suffered by your organization as a result of the incident. These could include the
* estimated number of hours spent in response and recovery. (Multiply the number of participating staff by their hourly rates.)
* cost of temporary help
* cost of damaged equipment
* value of data lost
* amount of credit given to customers because of the inconvenience
* loss of revenue
* value of any trade secrets
4. Contact law enforcement and
* provide incident documentation
* share information about the intruder
* share any ideas about possible motives

Contact Information

To initiate an investigation, contact your local FBI office or another appropriate federal, state, or local law enforcement agency. To report an incident to the FBI, you can submit a tip report at https://tips.fbi.gov.

Other links:
US-CERT: United States Computer Emergency Readiness Team

Department of Homeland Security | Preserving our Freedoms, Protecting America

[slikrapid]

lol, like anyone would want the feds snooping around their computers & data

[Renk]

To initiate an investigation, contact your local FBI office (...)

At this point, I realize we need additionnal smileys for holy water, clove of garlic, silver bullets, and UV generators (although I think gamma rays gen. would even be preferable in that case).

[SealLion]

This is a joke. Read this from the quote:

Computer crimes can be separated into two categories: 1) crimes facilitated by a computer ....

So in other words, inanimate objects can commit crime....uh...ya...ok.


Interestingly, Fox Mulder forgot that the FBI ....

..can only gather proprietary information concerning an incident in the following ways:

* request for voluntary disclosure of information
* court order
* federal grand jury subpoena
* search warrant

if there's been a real cyber-crime committed, then of course the FBI would be committed to be involved.
This includes cyber crimes being committed in one of their 40+ foreign offices.
It makes me wonder why this law enforcement from the States has to have foreign offices. Though it equally makes me ponder if the RCMP also has foreign offices as well.
But in particular interest is of the US's need for such foreign offices.
Supposed collusion for so called 'terrorist crimes' being potentially committed against the States when in fact there is no actual terrorist crime.

Much like with Israel, IMO,

....two Mossad operatives carrying Canadian passports entered Jordan under orders from Binyamin Netanyahu.......The botched attempt became the Mossad's most high-profile failure: Relations with Canada were strained once it was learned its passports were used in the operation

Link: http://english.aljazeera.net/focus/2010/02/201021818562529723.html

and second Link: http://www.sb-innovation.de/f50/al-jazeera-english-mossads-secret-wars-18999/

I'm sure that those relations weren't strained at all.
IMO such relations probably were only made to look like they were strained. You never know what goes on behind closed doors and drawn curtains.
Most especially when you consider how colluding Israel is with other countries. The same can be said of the US and a number of it's allies in this war on terror.
The States collude just as equally on the same level plane to give this false impression of constant fear, terror, anxiety, panic, and suspicion that almost every Muslim is a terrorist.
What an insult to Muslims.
That might be minor when one considers that a more serious goal in establishing this goal of global ascendancy and then submission of the world's population by just a few at the top.

Maybe thats why they have the FBI in all these foreign offices. As part and parcel of these colluding efforts to instill fear and chaos. I don't know for sure but there's nothing that prevents me from taking a guess.

and of course there's nothing that prevents the FBI from establishing foreign offices. Much like the UN had with Isreal a number of years ago.

.....the UN Security Council's resolution could not prevent Israeli intelligence agents from operating on foreign soil again.

That's taken from the AJE link above

So who's in collusion with whom, I wonder. .....
If one reads a little deeper into things that are made public by the media and consider some of the alternative news sources around. It doesn't take a rocket scientist to see such things.

.

[Resurrection]

At this point, I realize we need additionnal smileys for holy water, clove of garlic, silver bullets, and UV generators (although I think gamma rays gen. would even be preferable in that case).

I think that's in the case you are a victim...

[slikrapid]

@SealLion:

..can only gather proprietary information concerning an incident in the following ways:

i'd say those definitions were always pretty loose in actual practical application anyways and if needed could be re-adjusted/re-interpreted at will, not to mention that their powers have grown after 9/11, which would include a larger range of currently legal grounds for performing an investigation (btw. fox was intended to be the likable guy among feds )

But in particular interest is of the US's need for such foreign offices.

as centers of operation/communication, logistics, secure controlled areas, temporary storage facilities for smuggling operations (personnel, items), official front-ends,...

I'm sure that those relations weren't strained at all.

yeah, only in the public eye - a large number of these national/international strains are pre-arranged false flag operations or feigned efforts for manipulative purposes