A Technical History of the SEI

Operational Support for Digital Intelligence and Investigation
The Challenge: Catching and Convicting Perpetrators of Cyber Attacks
Attacks on internet-connected systems put government, business, and consumers at risk. The nature
of the internet makes their networked systems and the information on them vulnerable to
compromise. At first, computers were the objects of attacks. Law enforcement investigators could
examine all the data on a hard drive and had commercial tools to assist them. Now computers are
used to facilitate crime, and the traditional tools and methods cannot keep up with the velocity of
investigations, preventing law enforcement agents from establishing timely leads. The attackers
are sophisticated and the attacks are complex. Their targets include the Department of Defense
and other federal computers, commercial organizations, educational institutions, and critical U.S.
infrastructure. Huge volumes of data are involved, more data than an investigator could examine
in its entirety even with the commercially available tools. Complicating the investigation are volatile
data and criminals’ use of encryption. Law enforcement investigators need tools, techniques,
and training that enable them to extract important data, analyze it, and catch the perpetrators. Administrators
of attacked systems need to be able to identify intrusions and recover from attacks
while preserving the chain of evidence that leads to the attackers’ arrest and conviction.
A Solution: Tools and Techniques for Digital Investigations
The SEI became involved in forensics in response to the August 2003 U.S. Northeast blackout
and, subsequently, expanded its operational support for investigations into cyber attacks. From the
start, SEI experts have focused on how to preserve evidence and present it in a way that leads to
the apprehension of the criminals, and their approach has included comprehensive and efficient
analysis of evidence, supported by technology and tools. The SEI continues to identify gap areas
to address while supporting law enforcement operations such as these:
The SEI assisted an investigation of the theft of more than 90 million credit and
debit card numbers from T.J. Maxx, Marshall’s, Barnes & Noble, OfficeMax, and
other major retailers [Houser 2008]. Referred to as the TJX case, the theft occurred
in 2005 and constituted one of the largest instances of credit card fraud and identity
theft in history [Moore 2010]. While assisting with law enforcement’s analysis, the
SEI developed a new tool for recovering and organizing credit card numbers from
digital evidence. Two SEI staff members received the U.S. Secret Service Director’s
Recognition Award for their contributions to the TJX case. U.S. representatives also
recognized the team’s efforts during a visit to Carnegie Mellon University
[FedNews 2008]. Eleven individuals were indicted in 2008 for the data breach, including
the leader, Albert Gonzales. The government claimed in its sentencing
memo that companies, banks, and insurers lost close to $200 million and that Gonzalez’s
credit and debit card thefts “victimized a group of people whose population
exceeded that of many major cities and some states” [Zetter 2010].
A similar attack by the same perpetrators occurred in the Heartland case [Barrett
2009]. The SEI assisted the U.S. Secret Service with investigation into intrusions
and credit and debit card theft at Heartland, Hannaford Bros., 7-Eleven, and three
other retailers. The leader, Albert Gonzales, and two Russian accomplices were indicted
in August 2009. Gonzales, who led both major attacks, received two 20-year
sentences and was required to make restitution to victims.
CMU/SEI-2016-SR-027 | SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY 276
Distribution Statement A: Approved for Public Release; Distribution is Unlimited.