Impact Magazine June 2011 - Office of Inspector General - U.S. ...

IMPACT Magazine • June 2011
Spotlight on CCU: “First In, Last Out”
OIG OPERATIONS
That is the moto of the OIG's Computer Crimes Unit
(CCU), a specialized unit responsible for (1) identfying, collect-
ing, and analyzing digital evidence in support of criminal, civil,
and administratve investgatons throughout the naton; and (2)
investgatng allegatons and issues related to cybercrimes.
Today, individuals and businesses live and work on
computers. Yesterday’s paper trails have become today’s electronic
trails. OIG has long recognized the importance of digital
evidence. Startng in the 1990s, OIG used select special agents
trained as Seized Computer Evidence Recovery Specialists
(SCERS) to perform forensic analyses of computer media as a
collateral duty. In order to meet the demands of ever-increasing
digital evidence, OIG created CCU in 2007. It now consists of
four full-tme Computer Crimes Agents and two full-tme Computer
Crimes Technicians, all with advanced computer training
and experience to more fully exploit digital evidence.
CCU supports case agents and investgators across
the naton by processing and imaging computer media. As
Assistant Special Agent in Charge Bill Swallow says, "When out
on search warrants, we like to be the frst ones in the door, and
we are almost always the last ones to leave." This is ofen due
to the fact that processing and imaging of computer media at
a search site can take a long tme. It is common for CCU to fnd
William Swallow, Assistant Special Agent in Charge, OIG Computer Crimes
a dozen or more computers during a search with more than
Unit, conducts a forensic examination of departmental computers
a terabyte (equal to 1024 gigabytes) worth of data. Since its
incepton, CCU has seen a signifcant increase in the amount of
digital evidence associated with OIG cases natonwide. In fscal year 2009, CCU processed approximately 170 pieces of digital evidence.
Currently, CCU has seized and is examining approximately 300 pieces of digital evidence amountng to almost 32 terabytes.
CCU's second mission, cyber investgatons, takes computer crimes agents into the dark underbelly of the Internet. This is
a relatvely new area for OIG, driven by the dramatc increase in cyber intrusions at DOT. OIG also plays a role in DOT's overall cyber
security efort in its programmatc oversight. OIG has a role in ensuring efciency by conductng IT audits to determine if the Department
is following DOT and Government policy and ensuring the integrity of the Department's programs by conductng computer intrusion investgatons.
CCU works closely with DOT's Ofce of Chief Informaton Ofcer, Cyber Security Management Center, U.S. CERT, and the FBI
to identfy and thwart cyber criminals. CCU's investgatons and operatons ofen identfy previously unknown computer system compromises
that improve DOT's overall ability to mitgate this threat.
13