Primer: The U.S. Secret Service maintains Electronic Crimes Task Forces, which focus on identifying and locating international cyber criminals connected to cyber intrusions, bank fraud, data breaches, and other computer-related crimes. The Secret Service’s Cyber Intelligence Section has directly contributed to the arrest of transnational cyber criminals responsible for the theft of hundreds of millions of credit card numbers and the loss of approximately $600 million to financial and retail institutions. The Secret Service also runs the National Computer Forensic Institute, which provides law enforcement officers, prosecutors, and judges with cyber training and information to combat cyber crime.
HOOVER, Ala. — The classrooms, tucked above a municipal court here in the Birmingham suburbs, are a long way from the White House. But walk through a set of secured doors and into the futuristic-looking work space, and you will find an important wager by the agency best known for protecting presidents, the Secret Service.
Only it has almost nothing to do with earpiece-wearing agents or armored cars.
Though the Secret Service may be better known for keeping government executives safe, it also has a mandate to investigate and fight financial and other cybercrimes. And in an era of overworked protection details and nonstop cybercrime, it could use some help.
So here at the National Computer Forensics Institute, the pupils are hardened police officers, prosecutors and, occasionally, a judge. Instruction mimics what the agency teaches its own special agents. And tuition is not only free, but the Secret Service throws in travel, room, board and, for police officers, tens of thousands of dollars of technology to set up their own forensics labs back home.
Data is extracted from mobile phones for use in a class on prosecution in Hoover. Kevin D. Liles for The New York Times
In exchange, the Secret Service has quietly empowered a network of thousands of law enforcement officers across the country capable of processing digital evidence and indebted to the agency that taught them.
“The threat nature has increased in the world, and the threats are all more and more integrated with the digital world,” said Ben Bass, the special agent in charge of the institute. “So assimilating that into what we do is really important.”
The institute opened in 2008 as a partnership between the Secret Service and the state of Alabama, which contributed space and money for its construction. At the time, few state and local law enforcement agencies had the capability to process digital evidence found on computers and cellphones, even as it was exploding in volume and importance. That left agencies heavily reliant on the Secret Service and the F.B.I. for processing and created a years long backlog in many cases.
The Secret Service reasoned that it would be critical to the future of its mission — not to mention the effectiveness of local and state law enforcement — to try to change that. The program remains the only one of its kind and scale in the country.
Though its protective mission occupies the public’s attention, the Secret Service has been investigating crimes since 1865, when President Lincoln saw the need to create a small force of investigators within the Treasury Department to combat counterfeit currency that was undermining American markets. That mandate has changed and widened in the decades since, along with threats to the country’s financial systems, and the agency now investigates bank fraud, credit card fraud, identity theft, child exploitation as well as counterfeiting.
It does so with a reasonably small force. The majority of the Secret Service’s 3,300 agents work out of field offices. The F.B.I., by comparison, has more than 13,000. To amplify its effect, the agency relies on dozens of electronic and financial crimes task forces across the country, where local and state law officers and people in academia and businesses work alongside its own agents.
The help has arrived at the right time for the agency, where in recent years low morale, high attrition and more people to protect in more places have conspired to pinch resources. Because protection is a nonnegotiable task, investigations often take the hit.
The effect can be significant. In the 2016 fiscal year, the agency spent 65 percent of its time on protection and 35 percent on investigative work, according to calculations it shared with members of the House Oversight Committee. That was an election year, when protection demands are highest. But it appears the ratio for this fiscal year — which only included the last month or so of the campaign — has not changed much, with 60 percent of time going to protection through the end of May. Typically it would be about 40 percent for a post-campaign fiscal year.
Robert Novy, the deputy assistant director for investigations, said the task forces help ensure that cases continue to move forward regardless of protection demands. He also said that they have begun to free the Secret Service’s own staff to focus on larger-scale cyberthreats and high-dollar financial crimes.
“By elevating their capacities and capabilities, it allows us to focus on finding ways to counter more significant financial threats,” Mr. Novy said.
Still, building the program has proved challenging. A decade after it first opened its doors, the institute trains about 1,100 people a year. But it is running at between 30 percent and 40 percent of capacity because of a shortage of federal funds. For some programs, would-be enrollees can wait as long as three years.
Its financial outlook remains uncertain. President Trump’s 2018 budget proposal zeroed out the program, though Randolph D. Alles, the agency’s new director, told lawmakers last month that he considered it “critical” to the agency and would move money from elsewhere in his budget to pay for it if need be. At the same time, lawmakers in the House and Senate have introduced legislation that could stabilize its funding.
The institute’s finances appeared to be on few minds on a recent early summer day in Hoover, where a class of two dozen prosecutors sat in neat classroom rows, computers humming beside their feet, as data from the cellphone of a fictitious drug smuggler flashed onto their computer screens. The evidence was all there in ordered folders: call logs, texts, even compromising photographs of a would-be drug dealer, made visible by powerful software and a few patient instructors.
One room away and a few hours later, two dozen police officers packed into a wood-trimmed mock courtroom listened to another instructor hold forth from the witness stand on the ins and outs of being a good forensics witness. The key, he said, is balancing the use of technical details like “master boot records” and “disk partitions” with the bigger picture a less tech-savvy jury can more easily grasp.
“I need to be able to understand it so I can translate it when I go before a panel of 12 people,” said Jennifer Eugene, a prosecutor from New Jersey, describing her experience in front of a jury. “The law has not caught up with where the technology is.”
A five-week course for police on the basics of computer evidence recovery is the most popular, and graduates of the course leave here with $28,000 worth of technology and the ability to search seized computers for evidence of a crime. A similar course on mobile devices is growing in popularity. And more advanced courses cover network intrusion.
Prosecutors and judges can take shorter courses meant to familiarize them with digital evidence, which is still relatively new to many courtrooms.
But the mutual benefits of the program were on display, too. Frank Garibay, a detective with the San Antonio Police Department who had returned to the institute as a proctor after taking coursework himself, said his training here had transformed what his department could do.
It had also meant that when officials from the Texas Rangers and Homeland Security Investigations zeroed in on an illegal gambling ring in Texas, they could turn to the Secret Service’s San Antonio-based electronic crimes task force, including Mr. Garibay, for help.
The Secret Service paid for members of its task force to travel to the small South Texas town of Falfurrias for a weekend to set up a war room to process digital evidence.
The operation ended up taking down about a dozen illegal casinos, recovered almost $6 million, exposed drug and human trafficing rings, and ultimately public corruption.
