Joining Forces

Champlain College and local police pool their talents to catch criminals and spawn future investigators.

by / August 31, 2007
Joining Forces

Law enforcement investigators everywhere suffer from too few resources to deal with the variety of computer crimes being committed and the amount of digital evidence on computers and cell phones.

One police agency is getting help from the local college. The college, in turn, parlayed the relationship into a training program for future forensic examiners, an area where law enforcement desperately needs help.

Champlain College, located in Burlington, Vt., offers a bachelor's degree program in computer and digital forensics, including an online degree option. In addition, two faculty members divide their time between the college and the Burlington Police Department, where they work as forensic examiners.

It's a symbiotic relationship in which both entities benefit. The college gains from the real-life experiences of the two faculty members/forensic examiners, and the Police Department increases its capacity to examine digital evidence.

"It's a creative and innovative partnership that we think is really valuable," said Mike Schirling, deputy chief of the Burlington Police Department. "It certainly bolsters our capacity to perform computer forensics. Just having folks who aren't distracted by other things, like investigations as our sworn folks have to do, is great."

Schirling said without the partnership, Burlington police investigators would spend more time finding forensic evidence, which essentially slows down investigations.

"There would be a longer backlog. Right now our backlogs are measured only in weeks, whereas in most of the country, they're measured in months and sometimes years. The more folks we can have working on forensics the better off we are because they can bring more specialized knowledge to the table."

The proliferation of digital devices exponentially increased investigators' workload, Schirling said, especially over the last decade.

"Police departments have difficulty handling the challenge posed by digital forensics in cyber-crime because we're no longer policing, in our case, a community of 680,000 in Vermont. It's now 1.2 billion," he said. "That's a lot of people."


A Quick Ascent
The program started with a couple of classes in 2002 that promptly filled with students, and quickly swelled into a full-fledged, Computer and Digital Forensics (CDF) degree program in the fall of 2003. By the following spring, the National Institute of Justice (NIJ) had already touted the CDF degree program as a model undergraduate curriculum for computer forensics.

The NIJ put its money where its mouth was by awarding Champlain College $185,000 in grant money to further develop the CDF program. That recognition, and the continued development of the program, helped the department land a $650,000 grant from the U.S. Department of Justice's Bureau of Justice Assistance in 2004.

That allowed Gary Kessler, associate professor and program director of the college's Computer Networking, and Computer and Digital Forensics majors, to hire two new faculty members and establish an online training program. In addition, the grant money helped the college create the Champlain College Center for Digital Investigation in 2006, which was chartered to assist law enforcement agencies in Vermont and throughout the nation in computer forensics and other digital investigations.

It's natural in a world where digital devices are mainstream because almost any crime can be traced to a digital device in some way.

"Computers are increasingly the target, the instrument or the record keeper of criminal activity," Kessler said. "Now, of course, with mobile devices such as PDAs, cell phones and cameras, increasingly there is information of value to an investigation found on one of those devices.

"Kick down the door to arrest someone, and there's probably a computer or cell phone in there," he continued. "If any sort of nexus can be drawn between that device and the activity, you can get probable cause and get your search warrant."

Kessler and the two faculty members physically work at the

Burlington Police Department and handle any case a sworn officer would work on.

"They do everything," Schirling said. "Because they're under law enforcement supervision and they're in law enforcement space, there are no restrictions on the kinds of things they can work on. All the analysis is done here in government space."


Far-Ranging Cases
The cases investigated by the Champlain College faculty members vary from homicide, financial crimes and larceny to child pornography and child exploitation, two major areas of concern for investigators.

Kessler carved out a niche for himself as one of the few investigators in the state who can analyze a cell phone for its contents. Most of the cases that come through the Burlington Police Department involving cell phones wind up in Kessler's lap.

Few courses exist on cell-phone data analysis, and Kessler took one of the first - offered last year by SEARCH, the National Consortium for Justice Information and Statistics. The lack of training and the difficulty in analyzing cell phones combine to make the work a dicey proposition.

"The interfaces from the phones to the computer are all different," Kessler explained. "All of the phone models are different so you need different software. It's a little more of an art than a science, and you can't always get the stuff to work. It's like rolling dice when you're examining phones."

Sometimes investigators get a search warrant first before opening up the phone, then go through the phone's various menus and collect information that way. It's not necessarily the best way to get information out of a phone, Kessler said.

"In fact, you miss information that way," he explained. "There is a fair amount of information you [can] get off a phone if you're going through the data port that you can't get if you just open it up, press the keys and go through the menu."

Dissecting a computer for evidence may be more straightforward than analyzing a phone, but there are still many nuances to learn, Schirling said, which is why it's helpful to assemble intelligent minds.

"If somebody does a [Macintosh] exam specific to a fraud case and they learn a few nuances from doing that case, they can bring that knowledge to the table for other investigators the next time there's one of those exams. Not everybody has to become a specialist in every kind of computer application."

Not everybody could become a specialist because there's so much to learn, Schirling added. "There are myriad hardware and software combinations, potentially millions of combinations, and just having a couple of people working on [forensics] makes it difficult to get that broad base of knowledge. We're building a bigger base of knowledge and experience by having more people involved."


A Critical Need
That knowledge is also being fed online to future forensics examiners. All CDF program courses are offered online, and it's becoming a popular way to get the degree. Kessler said of the estimated 160 undergraduate students involved in the major, 90 take the courses online.

Kessler said he's hard pressed to say that the online course works better or worse for the student than being present in a classroom.

"Online works well for an adult, motivated, disciplined learner," he said, noting that online students log on, download a PDF file for lecture notes, then use other links to see slides and hear an instructor.

"There's homework, where we have them using a lot of demo software and freeware, shareware, which is the exact same thing we're doing in our live classes," Kessler said, "and we give them assignments based on those demos."

Students get an education that, it is hoped, will alleviate a growing national problem. "We could [confiscate] a computer from every crime scene, but we don't have anywhere near the capacity to deal with it," he said. "It's a critical national need that needs to be filled."


Jim McKay, Justice and Public Safety Editor Justice and Public Safety Editor