The National Strategy for Child Exploitation Prevention and Interdiction
The National Strategy for Child Exploitation Prevention and Interdiction The National Strategy for Child Exploitation Prevention and Interdiction
a user-friendly software tool developed by the FBI CART Program and deployed in conjunctionwith the RCFLs at CART offices and RCFLs across the country. It is specifically designed tolocate graphic image files such as child pornography–without altering any data on the electronicdevice. Through the CART/RCFL Training Program, which provides training to LawEnforcement Personnel free of charge, ImageScan software and training have been provided toover 10,000 Law Enforcement Personnel throughout the United States in the past 6 years.There are numerous free training initiatives the RCFL Program uses to educate the lawenforcement community on a variety of topics ranging from the use of the freely distributedImageScan software, to distributing free field guides on handling digital evidence to providingfree web-based world-wide training events in handling mobile devices properly. The use of freepreview tools such as ImageScan and DriveQuest provides investigators and prosecutors withmore actionable information early on in the investigation. The strategy of providing free,continuing education, over time, will minimize the need later in the investigation to absorbadditional forensic resources for “full” forensic examination and thus reduce the overall backlog.Other initiatives from the CART and RCFL programs that have enhanced service offerings whileincreasing efficiency with very limited resources include a network of self service kiosks at FBIfield offices and RCFLs around the country. Cell Phone Investigative Kiosks (CPIK) areavailable to all law enforcement officers wishing to merely extract readily retrievable data fromcell phones, such as contacts, calendars and recent calls. The cell phone kiosk allows users toextract data from a cell phone, insert that data into a report, and burn the report to a CD or DVDin as little as 30 minutes. In FY 2009, the Heart of America RCFL (HARCFL) was able toreduce its backlog by 60 percent in part by making extensive use of their Cell Phone Kiosk forcell phones and videos. Currently 13 of the 14 operational RCFLs have these kiosks. TheCART and RCFL programs are also prototyping Loose Media Kiosks (LMK) in testing at WFOand San Diego RCFL (SDRCFL). This tool enables investigators to quickly review removablemedia in a forensically sound manner and analyze evidence related to child exploitationinvestigations to determine its value in an investigation without waiting for the availability of aforensic examiner.The FBI is also developing new tools, including, DriveQuest, which is now nearing completionof it development phase and should begin BETA field testing soon. DriveQuest is a programthat has been designed to provide investigators with new, configurable, capabilities whileconducting consent or triage searches on-scene including; text string search on user defineddictionaries to user defined areas of a computer system, view and search through Internet HistoryFiles, view Windows Registry Information, and search and Identify Encryption, Data Hiding,and Data Destruction Utilities.3. U.S. Postal Inspection Service Digital Evidence UnitThe Digital Evidence Unit (DEU) has offices throughout the country. The unit is led by anAssistant Inspector in Charge located at Dulles, Virginia and is comprised of Inspector ProgramManagers, Forensic Computer Analysts and Ad Hoc analysts domiciled in each of the eighteenInspection Service Field Divisions. In addition, there are Audio/Video Forensic Analysts locatedat the USPIS National Forensic Laboratory.133
The DEU is the principal group responsible for the collection, preservation, and examination ofcomputer digital evidence in support of all Inspection Service investigations. Digital evidenceanalysts are tasked with examining computer evidence and any digital media for information ordata pertinent to Postal Inspection Service investigations. Examples of cases that mayincorporate this type of evidence are: child pornography/exploitation, homicide, rape, suicide,mail theft, fraud, identity theft, or other related crimes against the Postal Service. Approximately26% of the digital forensic work conducted by the DEU involves child exploitation cases. In FY2008, the DEU conducted 269 child exploitation forensic examinations; in FY 2009, it conducted260; and in the first six months of FY 2010, it has conducted 105. In addition to processingcases, the Digital Evidence Unit is available for technical advice and assistance in seizing andpreserving evidence at the crime scene.4. ICE Computer Forensics ProgramThe ICE Computer Forensics Program (CFP) was formalized under the legacy U.S. CustomsService in 1997 under the Office of Investigations. The ICE CFP continues to operate under theICE Office of Investigations as a Section within the ICE Cyber Crimes Center (C3).The Computer Forensics Section (CFS) provides programmatic oversight, equipment, technicalsupport, guidance and training to the entire ICE Computer Forensics Program (CFP). The ICECFP is comprised of ICE Special Agents and Criminal Research Officers, trained and equippedto conduct analysis of digital evidence in furtherance of criminal investigations. The successfulinvestigation and prosecution of criminal violations by ICE is largely dependent on the ability toquickly seize, process, and analyze evidentiary digital data obtained from seized electronicdevices and digital media. To meet the goals and objectives of the overall ICE mission, the ICECFS draws upon a long-standing, comprehensive training curriculum that provides ComputerForensics Agents/Analysts (CFA) with basic and advanced computer forensics training skills.To support the CFP, the CFS also conducts research and development and initiates projects innew and challenging technologies. The CFS continually procures software, equipment, supplies,upgrades, storage media, and new digital forensic equipment to support the CFP in meeting thedemands posed by these ever-changing technologies. The CFS also monitors and tracks theefficiency and production of the CFP and responds to requests for assistance and operationalsupport. The CFS promotes continuing education, such as professional and industry-standardcertification initiatives, in an effort to ensure that CFAs in the field are trained and certified inthe most current computer forensics techniques. There are currently 240 trained ComputerForensics Agents in 105 field offices worldwide.The Treasury Computer Forensics Training Program (TCFTP) is at the core of the ICE CFP andis a joint training initiative funded by the Treasury Executive Office of Asset Forfeiture(TEOAF). The TCFTP is comprised of the respective computer forensics and training programsof ICE, the U.S. Secret Service, and Internal Revenue Service. Since the inception of the TCFTPin 1997, approximately 325 ICE Special Agents have been trained.In FY 2005, ICE initiated a Regional Computer Forensic Storage Program with funding from aCongressional earmark. During the past four years, ICE has provided funding for the project,134
- Page 89 and 90: has developed highly successful ini
- Page 91 and 92: field offices, both domestic and fo
- Page 93 and 94: 2. Department of Defense’s Effort
- Page 95 and 96: of a mail circular. Since the progr
- Page 97 and 98: • The Street Outreach Program fun
- Page 99 and 100: the Defense Computer Forensic Labor
- Page 101 and 102: • Distributes photographs and des
- Page 103 and 104: iii. Enough Is EnoughEnough Is Enou
- Page 105 and 106: 1. Overarching Efforts to Coordinat
- Page 107 and 108: combine resources and expertise on
- Page 109 and 110: United States has submitted annual
- Page 111 and 112: CEOS has worked with foreign law en
- Page 113 and 114: . Department of Homeland Security
- Page 115 and 116: Finally, G/TIP has worked extensive
- Page 117 and 118: F. Review of Internet Safety Progra
- Page 119 and 120: the accessibility, cost, and effect
- Page 121 and 122: activity by predators searching for
- Page 123 and 124: 3. Federal Trade Commission and Dep
- Page 125 and 126: Funder: • U.S. Department of Agri
- Page 127 and 128: Delivery: • Online games; printab
- Page 129 and 130: TABLE 1: FEDERALLY FUNDED INTERNET
- Page 131 and 132: Program/Product NameandContactInfor
- Page 133 and 134: TABLE 2: SAMPLE OF PRIVATE NONPROFI
- Page 135 and 136: Program/Product NameProducerFor Kid
- Page 137 and 138: TABLE 1: PARTICIPANT EVALUATIONS OF
- Page 139: FY 2011. The primary forensics resp
- Page 143 and 144: CD/DVDs. The CFS has the capability
- Page 145 and 146: First, the Department will continue
- Page 147 and 148: and the Innocence Lost task forces,
- Page 149 and 150: deconflict cases, and share informa
- Page 151 and 152: with the ICACs to help increase the
- Page 153 and 154: from Landslide’s business premise
- Page 155 and 156: victimized children worldwide, incl
- Page 157 and 158: association, was arrested after the
- Page 159 and 160: is transnational in scope; cooperat
- Page 161 and 162: Over the course of their communicat
- Page 163 and 164: An ICE investigation resulted in th
- Page 165 and 166: U.S. v. RichardsonICE PRESS RELEASE
- Page 167 and 168: APPENDIX C THREAT ASSESSMENT: ACADE
- Page 169 and 170: Selected Quotes from Appendix C of
- Page 171 and 172: * * * “Sheldon and Howitt (2007)
- Page 173 and 174: McCarthy, J. and Gaunt, N. (2004).
- Page 175 and 176: high-profile jobs. Some seemed isol
- Page 177 and 178: Trends 2008, http://www.iwf.org.uk/
- Page 179 and 180: Source: National Center for Missing
- Page 181 and 182: Federal Bureau of Investigation (FB
- Page 183 and 184: scientific survey process, but rath
- Page 185 and 186: • 42 percent of respondents repor
- Page 187 and 188: The Effect of the Lack of Internet
- Page 189 and 190: • 44 percent of respondents repor
a user-friendly software tool developed by the FBI CART Program <strong>and</strong> deployed in conjunctionwith the RCFLs at CART offices <strong>and</strong> RCFLs across the country. It is specifically designed tolocate graphic image files such as child pornography–without altering any data on the electronicdevice. Through the CART/RCFL Training Program, which provides training to LawEn<strong>for</strong>cement Personnel free of charge, ImageScan software <strong>and</strong> training have been provided toover 10,000 Law En<strong>for</strong>cement Personnel throughout the United States in the past 6 years.<strong>The</strong>re are numerous free training initiatives the RCFL Program uses to educate the lawen<strong>for</strong>cement community on a variety of topics ranging from the use of the freely distributedImageScan software, to distributing free field guides on h<strong>and</strong>ling digital evidence to providingfree web-based world-wide training events in h<strong>and</strong>ling mobile devices properly. <strong>The</strong> use of freepreview tools such as ImageScan <strong>and</strong> DriveQuest provides investigators <strong>and</strong> prosecutors withmore actionable in<strong>for</strong>mation early on in the investigation. <strong>The</strong> strategy of providing free,continuing education, over time, will minimize the need later in the investigation to absorbadditional <strong>for</strong>ensic resources <strong>for</strong> “full” <strong>for</strong>ensic examination <strong>and</strong> thus reduce the overall backlog.Other initiatives from the CART <strong>and</strong> RCFL programs that have enhanced service offerings whileincreasing efficiency with very limited resources include a network of self service kiosks at FBIfield offices <strong>and</strong> RCFLs around the country. Cell Phone Investigative Kiosks (CPIK) areavailable to all law en<strong>for</strong>cement officers wishing to merely extract readily retrievable data fromcell phones, such as contacts, calendars <strong>and</strong> recent calls. <strong>The</strong> cell phone kiosk allows users toextract data from a cell phone, insert that data into a report, <strong>and</strong> burn the report to a CD or DVDin as little as 30 minutes. In FY 2009, the Heart of America RCFL (HARCFL) was able toreduce its backlog by 60 percent in part by making extensive use of their Cell Phone Kiosk <strong>for</strong>cell phones <strong>and</strong> videos. Currently 13 of the 14 operational RCFLs have these kiosks. <strong>The</strong>CART <strong>and</strong> RCFL programs are also prototyping Loose Media Kiosks (LMK) in testing at WFO<strong>and</strong> San Diego RCFL (SDRCFL). This tool enables investigators to quickly review removablemedia in a <strong>for</strong>ensically sound manner <strong>and</strong> analyze evidence related to child exploitationinvestigations to determine its value in an investigation without waiting <strong>for</strong> the availability of a<strong>for</strong>ensic examiner.<strong>The</strong> FBI is also developing new tools, including, DriveQuest, which is now nearing completionof it development phase <strong>and</strong> should begin BETA field testing soon. DriveQuest is a programthat has been designed to provide investigators with new, configurable, capabilities whileconducting consent or triage searches on-scene including; text string search on user defineddictionaries to user defined areas of a computer system, view <strong>and</strong> search through Internet HistoryFiles, view Windows Registry In<strong>for</strong>mation, <strong>and</strong> search <strong>and</strong> Identify Encryption, Data Hiding,<strong>and</strong> Data Destruction Utilities.3. U.S. Postal Inspection Service Digital Evidence Unit<strong>The</strong> Digital Evidence Unit (DEU) has offices throughout the country. <strong>The</strong> unit is led by anAssistant Inspector in Charge located at Dulles, Virginia <strong>and</strong> is comprised of Inspector ProgramManagers, Forensic Computer Analysts <strong>and</strong> Ad Hoc analysts domiciled in each of the eighteenInspection Service Field Divisions. In addition, there are Audio/Video Forensic Analysts locatedat the USPIS <strong>National</strong> Forensic Laboratory.133