National Computer Forensics Institute Reauthorization Critical to Security

HOOVER, Ala. — As the National Computer Forensics Institute comes up for congressional reauthorization, forensics and cybersecurity experts told The Well News how the institute’s standardized curriculum is critical to contemporary law enforcement activities.

Having a centralized hub for preparing police for handling incidents related to ransomware, computer hacking, trafficking, intellectual property and child pornography, is “paramount” to keeping up with the ever-changing dynamics of sophisticated cybercrimes, Amanda Fennel, digital forensics expert and adjunct professor at Tulane University’s School of Professional Advancement, told The Well News.

The current authorization for the institute is set to expire at the end of fiscal year 2022, and the reauthorization bill introduced in the House of Representatives in June by Rep. Elissa Slotkin, D-Mich., would require the institute to update its curriculum to cover investigations of cybersecurity incidents, forensic examinations, and utilization of digital evidence in court settings, according to its committee report.

Reauthorizing the institute for another 10-year term would cost $227 million over the next five years and $275 million after 2027, according to the Congressional Budget Office’s estimates. Receiving specialized training in cybercrime from a standardized entity will lead to more consistent findings of better evidentiary value, Fennell said.

“Imagine if everyone was given a laptop and told to find something. Everyone would approach it in a way that makes sense to them based on training and experience,” she said. “Having a standard for all of us to align on will ensure you will see the consistent gathering of artifacts and evidence for the various case types. More often than not, vendors have had to fill the space for training in this industry.

“This has led to many cyber employees aligning to certain tools and approaches as perpetuated by the vendors,” Fennel continued, “Starting from a place of standardization from a national curriculum will lead to better quality and consistency for all.”

Law enforcement officials can apply for training at NCFI by contacting their closest United States Secret Service field office, and prosecutors and judges can apply either by contacting the institute directly or through a USSS field office. Program attendees who travel to NCFI have their expenses and out-of-pocket costs reimbursed, including hotel, airline baggage fees, laundry, hotel parking, and by-the-day food costs.

The courses offered at the institute are taught by a mix of nationally recognized subject matter experts and Secret Service agents, and the classrooms are equipped with the necessary software and technology for training. Taking these steps and evolving the methods of instruction to counter bad actors’ efforts is crucial to staying ahead of the curve and ensuring law enforcement agencies can hold their own against a growing, complex criminal ecosystem, Fennel said.

“Cybercrime has continued to grow by leaps and bounds as more aspects of life become an increasingly digital world,” Fennel told The Well News. “This is often referred to as an increase in surface attack area. The more you have, the more you have to defend. More data is accessible and malicious actors are also becoming better trained and equipped.”

While there is not a direct correlation between more trained investigators leading to the deterrence of malicious activity, there is value to having more people prepared to investigate and prosecute cyber attacks, she said.

However, Fennel said the institute could do more in this area to provide additional value by training these investigators to learn preventative tactics in securing the agencies they would be supporting.

Steven Burgess of Burgess Consulting and Forensics told The Well News that it’s hard to provide the kind of training and instruction requiring the use of hardware and software in remote settings, so accommodating the trainees’ travel and stays makes sense.

“In my experience… it’s pretty hard to get law enforcement to investigate most potential [cyber] crimes,” Burgess said. “Not enough are trained well enough and budgets aren’t up to it. Of course, they also need to have gatekeepers who are well enough versed in the tech and in the issues to tell when a complaint is likely to bear fruit.”

Although it’s one thing to interrupt criminal actors’ operations, it is another thing entirely to dissuade them and prevent them from continuing their activities, he said. Without training on the use of digital evidence in court, cybercriminals are more likely to walk free and continue their endeavors.

Oversight is baked into the institute’s reauthorization as well, as the bill requires an annual report to be submitted to Congress that covers the NCFI’s activities, future demand, impact on jurisdictions and description of the nomination process for trainees. Further, the reports may include any “issues determined relevant by the Secretary [of Homeland Security],” meaning other issues not explicitly outlined in the provisions can be addressed.

“In the best of circumstances, law evolves after a need for it,” Burgess told The Well News. “With the speed at which computing evolves, law will always have trouble keeping up. And so, therefore, with both the law and the white hats always playing catch-up, someone needs to do the research and training so as to accelerate the rate of catching up, and to make it widespread.”

Reece can be reached at [email protected]