By Mitch Kajzer and Charles R. Crowell
In the history of law enforcement, few things have been as transformative in criminal investigations as technology. New technologies have fueled new ways to commit old crimes, while emboldening those who may have never committed a crime before to hide behind the perceived anonymity of technology to engage in criminal activity. Technology has also created new crimes such as ransomware, sextortion and virtual theft. But the most transformative change to criminal investigations is something most people carry with them 24 hours a day, seven days a week – a mobile device.
Mobile devices act as digital evidence force multipliers
Due to mobile devices, there is now a technology nexus in nearly every crime. It is estimated that 85% of police investigations involve some sort of digital evidence. This digital evidence includes items such as conversations of crimes, photos, videos, phone calls, social media postings and GPS location information. Given the pervasiveness and capabilities of technology, you would think that digital evidence is being used in every investigation. Yet it is not, primarily for two reasons:
- Police administrators have been slow to respond to digital evidence and the benefits it can bring to investigations due to costs and manpower. Throughout the country, we hear the same two concerns voiced by administrators. They don’t have the money in their budget to fund a digital examiner, equipment and training, and they don’t have the manpower to cover the streets, so they cannot dedicate personnel to conduct digital examinations or be part of such a unit. And for those agencies that have funded and trained digital examiners, they often lose those individuals to the private sector for higher salaries.
- With the proliferation of technology in every investigation and few resources dedicated to digital evidence, the large electronic footprint generated by investigations overwhelms law enforcement. This results in only major cases receiving digital examinations. Even if a case does get a digital examination, case backlogs mean that those results likely won’t be available for six to eight months. By itself, law enforcement falls critically short of the skills and resources needed to effectively deal with technology in criminal investigations.
Student investigator program may be a solution
In St. Joseph County, Indiana, the Office of the Prosecuting Attorney implemented a solution to address this problem. Through a partnership with the University of Notre Dame’s Computing & Digital Technologies (CDT) program, students were interviewed and selected to intern for the St. Joseph County Cyber Crimes Unit. While students interning with law enforcement is not new, our method is. The students are not considered to be interns, they are student investigators.
Prior to selection, each student goes through a screening process similar to applying for a law enforcement position. Those who pass and receive offers of positions are then sworn in as investigators by the elected prosecutor, giving them law enforcement powers. The students then go through 200-hour training program that includes multiple academic courses along with specific law enforcement courses such as legal issues, cyber crimes and the law, electronic discovery and digital evidence processing, along with introduction and advanced digital forensic courses. This training culminates with students testing for the forensics certification of Magnet Certified Forensics Examiner (MCFE).
By being sworn investigators, all investigative roadblocks are removed, allowing the students to work on every investigation in which the Cyber Crimes Unit is involved. This includes homicides, drug offense, frauds, domestic violence cases and online exploitation. As they are going through the formal training, students also work with officers on active investigations, applying the theoretical knowledge they learn in the classroom to practical casework. They conduct online research, write warrants, process scenes and examine digital evidence.
“I was surprised by how much faith they had in us and the amount of work they expected us to do,” said one student. “They said we’d be officers with full police power. I figured not really, but they trained us properly and expected us to operate at the level of full investigator, which was really cool and a little daunting at first.”
Our student investigators are not just actively involved in digital investigations; they are involved in 95% of all cybercrime cases. In 33% of those cases, they are the primary investigators. The only involvement of full-time law enforcement in these primary cases assigned to student investigators is reviewing the work of the student. Finally, student investigators conduct 65% of all digital examinations. The benefits of this program have been immediately recognizable.
Prior to beginning this program three years ago, the Cyber Crimes Unit maintained a backlog of approximately 30 cases with a turnaround time of 14 days. Today there is no case backlog and the turnaround time for digital examinations is routinely same day, typically within four hours. This means that digital evidence is immediately in the hands of an investigating officer and the prosecuting attorney, resulting in better investigations and charging decisions. This is now the expectation in our jurisdiction. If a digital examination takes longer than one day, the investigator wonders why.
In addition to the benefits to local law enforcement, this program also benefits the students and community. Once students graduate, they typically have multiple years of real-world forensics experience along with industry certifications. Coupled with their degree, they are highly coveted in the job market. Recruiters typically visit the Cyber Crimes Unit to meet with our students and then routinely try to persuade them to apply to their organizations for jobs. For the community, student investigators provide manpower and a high level of expertise at no cost to taxpayers. All student investigator salaries are paid through the CDT Program or through private donations.
Digital footprints will only increase in the future. Moving into the mainstream are wearable devices, home automation systems and a plethora of Internet of Things devices. Coupled to those devices are data that is being maintained in the cloud. Each of these sources potentially harbors important digital evidence and learning how to extract and exploit it will be critical for the future of police investigations. For law enforcement to keep up, we need innovative solutions. Given that criminals are using technology to their full advantage, shouldn’t we be doing the same to find the truth and bring them to justice? Tech-savvy student investigators are helping us achieve that goal.
About the authors
Mitch Kajzer is director of the St. Joseph County (Indiana) Cyber Crimes Unit and has been in law enforcement since 1989. He holds associate and bachelor’s degrees from Indiana University and a master’s degree in cognitive psychology from the University of Notre Dame. Mitch has been investigating cybercrimes since 2003 and currently holds several computer industry technology certifications. He has investigated over 2,000 technology-related cases and has conducted over 2,500 digital examinations, resulting in hundreds of arrests and convictions. Mitch also directs and coordinates the student investigator program between the University of Notre Dame and the Cyber Crimes Unit and is a contract trainer with Magnet Forensics. Email him at mkajzer@stjoepros.org.
Professor Charles R. Crowell is a professor in the Department of Psychology at the University of Notre Dame. He also directs the Computing & Digital Technologies Program, an information technology-related minor in the College of Arts & Letters. Along with his empirical and theoretical work on basic mechanisms of learning and motivation, Professor Crowell has been involved for some time in applications of psychology and technology to learning, productivity, and performance improvement in organizations. As part of this work, he has investigated how technology can be used to augment human performance in various learning and work settings. Professor Crowell oversees the eMotion and eCognition lab at Notre Dame that is devoted to investigating a spectrum of psychological phenomena ranging from the basic mechanisms underlying human movement and imitation to the ways in which humans interact with and are influenced by modern technological tools and devices. Email him at ccrowell@nd.edu.