Phone Forensics: Diving Into Digital Evidence

This is the seventh installment in a series of profiles featuring DEA special agents, diversion investigators, chemists, and more. Learn about the tough but fulfilling, fascinating, and vital work these DEA personnel do, as well as the many different ways to get involved in fighting drug misuse. For our seventh profile, we will be interviewing Senior Examiner Laura from the Digital Evidence Lab.

What motivated you to join the DEA?

When I was in college, I knew I wanted to end up in law enforcement forensics. I was not interested in the other options at the time such as incident response, network forensics, or private/contract work. There are a lot of different opportunities for digital forensics in law enforcement, but the types of cases vary between organizations. I had previously worked other case types that were emotionally draining and I was looking forward to a change of ‘scenery’ while still working on criminal cases. The diversity of case types and the ability to travel globally were major selling points for me. I also really enjoy working with case agents in the field, either when I’m on-site with them or analyzing evidence that they couldn’t get into.

What does an average day on the job look like for you?

There’s a lot of variety in an average day. Generally, at our lab we support law enforcement investigations by acquiring (copying and preserving), processing, and analyzing digital evidence such as computers, phones, and servers. Any given day could be a combination of these. We occasionally get called to testify in court as expert witnesses.

I have specialized training in mobile device processing and analysis, so those are the types of exhibits I typically handle now. In addition to case work, my group and I have been working to develop and present training to the field (non-digital forensics folks) regarding digital evidence and mobile devices. The schedule at the lab is flexible but we have core hours during the day when we can be reached. Most recently I’ve been focusing more on training than exhibit handling, but when I have mobile devices, I check them to see if any are finished processing so I can review the data. I make sure to communicate with the submitting case agent to find out what kind of information they’re specifically interested in. Report writing and detailed notes are part of our everyday life at the lab.

What has been your proudest moment at the DEA thus far?

My proud moments come anytime I help someone. I reach out to colleagues to get their input if I’m stuck on something, so it’s nice to be able to return the favor. It’s difficult to describe, but I am also proud when I am able to get into a particularly difficult device- whether it’s locked, encrypted, broken and needs repair, or generally troublesome. I try not to give up easily on difficult devices and it is always nice when perseverance pays off.

How can young people who are interested in becoming a forensic examiner at DEA best prepare themselves for the positions?

DEA has three different forensic disciplines: digital, chemistry, friction ridge/fingerprints; first you’ll have to decide what kind of forensics you’re interested in. If you choose digital forensics, you should be familiar with the fundamental principles for digital forensics. A passion and willingness to learn are really important in our field because technology changes so fast, you have to be willing to keep up. We have a lot of processes and procedures that require a keen attention to detail. Being a team player is helpful because we rarely work alone, and constantly talk to colleagues about what we’re working on. Other than those skills, a degree or certifications would help set you apart from other applicants but aren’t a requirement to start working at the lab. We have a robust training program here; we’re willing to teach you as long as you’re willing to learn.

The synthetic opioid fentanyl – often mixed into other drugs – is now responsible for tens of thousands of American deaths per year. How has the fentanyl epidemic changed your job?

There have been drastic changes in the amount of evidence we’re seeing related to fentanyl. When someone overdoses, we often get their phone for any number of reasons: to get information about the source of the drug (the potential dealer, recent contacts, unknown numbers, locations, etc.) or to figure out who it belonged to if there were multiple victims. Fentanyl has made drug use so much more dangerous than it was to begin with and we see the unfortunate consequences all too often here at the lab.

DoD CIO Discusses Pentagon Wireless, Mobility Programs

By Cheryl Pellerin

DoD News, Defense Media Activity

WASHINGTON, July 15, 2015 – Part of Defense Department Chief Information Officer Terry Halvorsen’s work these days involves launching the Pentagon’s first wireless network and managing the rollout of “secure enough” mobile devices, he told an audience here recently.

Halvorsen opened July 9’s DoD CIO Mobility Industry Day with keynote remarks to an audience of more than 600 attendees, about half of them from government and half from industry.

“I think Wi-Fi is our big growth [area] for the department in terms of being able to move data,” Halvorsen said, adding that January 2016 is the target date for launching a wireless network in the Pentagon.

Unclassified Wireless

Halvorsen said putting unclassified wireless in the Pentagon is a technical and a cultural change. The Pentagon has many sensitive compartmented information facilities, or SCIFs, he said, referring to areas or rooms where classified information is used, discussed or stored.

“My office is a SCIF, … but at least 50 percent of the time I'm not doing anything that's SCIF-able,” the CIO said. “People who visit me ought to be able to come in and use their devices. … I want to be able to use my devices in my office. I do. But I have to be able to ensure some things.”

Halvorsen said he and his team are looking to automate systems that control the wireless network and, among other things, sound an alarm in a restricted room if someone leaves a cell phone or mobile device on. The Pentagon’s wireless system will be two-tiered, he added: one for users connected to DoD networks, and a guest network for visitors. The rollout includes deploying capability to monitor the wireless network, he explained.

DoD Mobility

About the Pentagon’s ongoing mobility effort, Halvorsen said two components of mobility are users, who want mobility, and data, which has to be mobile -- and what the CIO called “point of execution” mobility.

“Point of execution says what we really want to do is get the data right to the individual -- whether they're on the battlefront, whether they're a medical technician or a data analyst -- right to them when they need the data” to execute their mission, Halvorsen said.

During a media roundtable in March, the CIO said the department had distributed about 1,500 unclassified smartphones and a lesser number of classified devices. After the Mobility Industry Day, Halvorsen said, users designated by their agency activity or command will get BlackBerry or other smartphones, tablets and laptops, depending on mission need.

Secure Enough

DOD also is working to make more applications and services mobile friendly while maintaining appropriate levels of security, the CIO added. At Mobility Industry Day, Halvorsen told the audience that they should replace the term “secure mobility” with the term “secure-enough mobility.”

“Part of what we've got to understand is, what is secure enough?” the CIO said, adding that DoD and private industry both will have to make that determination.

The department also is working to create a pilot program for an effort called Bring Your Own Device, or BYOD, in which people use their own mobile devices if the devices meet minimum security requirements.

Pilot Program Running Behind

The pilot program was supposed to begin this summer, Halvorsen said, but it’s behind schedule. “I thought I would have a BYOD larger pilot started by now, [but] I don't,” he added. “My fault, [but] … we will get one started.”

The CIO said he thinks there will be places within DoD that BYOD can be used, but he doesn’t think it will be a major part of DoD operations “because of the complexities of trying to manage that, even in a secure-enough [environment].”

Ultimately, Halvorsen said, the BYOD pilot will help the department understand what service applications may be able to be made available to the workforce on their own mobile devices.