A Technical History of the SEI

Introduction to Computer Forensics: Digital Intelligence and
Investigation
In the early days of the internet, protection against cyber attacks was not a high priority for the researchers
using it. Cybersecurity became more important with the expansion into commercial and
international internet use. At the same time, attacks became more sophisticated and the demand
for cyber forensics experts increased. In the 1980s and 1990s, computers were the objects of
crimes, and investigative procedures were straightforward. Techniques and policies focused on
computer drives, which investigators inspected in their entirety. Some commercial tools were
available to facilitate their work. Investigators were self-taught as formal training had not yet been
developed.
A series of changes rendered this early approach ineffective. Rather than being the objects of
crimes, computers were used to facilitate crimes. The technology itself changed; computers were
able to store massive amounts of data, and some technology did not even exist in the 1990s—
cloud computing, for example. Crimes were committed by entities such as nation-states and not
just individuals. Criminals were often sophisticated technical experts; for example, individuals
with PhDs in computer science “gone rogue.” Many attacks were so complex and large in scope
that the commercial tools became ineffective. As both dependence on the internet and the sophistication
of attackers grew, law enforcement investigators faced many challenges, including a huge
backlog of computers waiting for analysis, a growing volume of digital evidence, and attackers’
use of encryption. The investigators needed highly technical training and more effective tools and
techniques.
SEI Entry into Digital Intelligence and Investigation
The SEI became involved in forensics in response to the August 2003 U.S. Northeast blackout
and, subsequently, expanded its operational support for investigations into cyber attacks. With the
hiring of a former law enforcement professional, the SEI established a separate team, with the former
law enforcement agent as the team lead.
The SEI was in a good position to provide support to law enforcement investigators and help them
meet their challenges. Through the CERT/CC, SEI researchers had experience with responding to
computer security compromises, with vulnerabilities and ways they could be exploited, and with
malicious code. Through the malicious code work, in particular, the SEI had well-established,
trusted relationships with law enforcement agencies.
Evolution of the SEI Approach
The SEI continued to gain operational experience by assisting federal law enforcement agents
with their cases. One example is the Iceman case. A former computer security consultant, Max
Ray Butler (also known as the Iceman), attacked computers at financial institutions and credit
card processing centers, stealing account information and selling the data to others. Federal law
enforcement agents enlisted the SEI’s assistance in acquiring and decrypting the Iceman’s data,
thus providing critical evidence for the case that resulted in a three-year sentence for wire fraud
and identity theft, plus five years of supervised release and $27.5 million in restitution payments
to victims [Mills 2009, McMillan 2010].
CMU/SEI-2016-SR-027 | SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY 273
Distribution Statement A: Approved for Public Release; Distribution is Unlimited.