On the Internet, criminals are shrouded in anonymity, making cyber investigations a difficult task for police. The Canadian Police College (CPC) in Ottawa is trying to stay one step ahead of those cyber-criminals by adding a new course to their arsenal: the Cyber Crime Investigator's Course (CCIC).
Related link
The 10-day course began in 2016 and gives participants the tools and skills to launch and run an advanced cyber investigation. The CCIC zeroes-in on cases where technology itself is the target, addressing crimes such as unauthorized use of computers, mischief to data and hacking.
"If officers have at least a general understanding of the concepts and technologies at play in their investigation, it helps them know what to seize, what to preserve, and to understand which cases require urgency," says Sgt. Nicolas Bernier, a senior cybercrime instructor at the CPC.
Cst. Scott Noseworthy, an RCMP investigator in Alberta, took the course earlier this year. He says it provided him with invaluable information and ultimately helped him deal with a ransomware attack — which is when a malicious software blocks access to a computer system until money is paid.
"After we did the course, we got a big file from a significant critical infrastructure partner, and we were able to respond to it more effectively because of what we learned," says Noseworthy. "Knowing what resources were available and how to co-ordinate with other police forces was a big advantage, not only to help us investigate, but to assist the victims."
Teaching tech
The amount of cybercrime in Canada is increasing, according to the latest RCMP statistics. In 2013, the force had about 4,400 reported incidents, up 40 per cent from 1,300 reported incidents in 2011. This spike in cybercrime has prompted the CPC to continually update and add new courses for international police officers and federal partners.
The CCIC is the newest cybercrime course offered through the Technological Crime Learning Institute (TCLI) at the CPC. The TCLI offers 14 specialized courses about digital forensics, technology and cybercrime geared for officers in the RCMP and other police agencies, along with civilian employees who are in intelligence or investigative positions.
These various programs, courses and workshops can lead police officers down one of two specialization paths — one for investigators looking to refine their techniques when handling Internet crimes, and one for those who want to specialize in digital forensics, or analyzing and extracting data from technological devices. All courses teach officers and civilians about how to enforce the law in this new technological era.
"Some of the traditional search-and-seize mentality applies but a lot of it is different with new technologies at play," says Bernier. "It's important that officers can hit the ground running and go in the right direction for these investigations because oftentimes evidence is ephemeral — it could be gone if you don't look for it right away."
A better response
The CCIC is taught by Sgt. Alex Baron, an RCMP senior cybercrime instructor. Baron says he brings in about 20 subject matter experts from the field to help him teach the course, including representatives from the Federal Bureau of Investigation in the United States.
"It's a good way to network — making contacts in the cyber world is very important," says Baron. "It's also important to get together because we need a common denominator for how cyber investigations proceed, especially between agencies. It's all about making things run more smoothly."
Baron and the other experts give participants real-life scenarios to work through, allowing the group to work together to gather information. In many cases, hackers leave a trail of digital breadcrumbs, so Baron teaches investigators how to follow the evidence and ask the right questions to solve a case.
After encountering several cybercrime cases since taking the course, Noseworthy can attest to the value of learning more about the intricacies of the Internet and the technologies involved.
"This course has made us more comfortable taking on cybercrime files, and made us better able to respond when we get those big cases," he says. "Given that these crimes are not only happening at a small scale — the $200 scams affecting your grandma — but also targeting major businesses and critical infrastructure across the country, it's now a basic skill for police to be able to deal with cybercrime files."