STOP course teaches cops computers

GRANITE FALLS – There is scarcely an area of our lives that is not touched by computers in some way anymore, even our cell phones and wrist watches contain computers. So it is particularly important for law enforcement agencies to keep up on computer crime.

Minnesota West Community and Technical College this week presented two courses on computer crime for law enforcement personnel from Minnesota, Wisconsin, South Dakota and as far away as Arizona.

Cyber Investigation 101 – Secure Technology for Onsite Preview (STOP) is a course created by the National White Collar Crime Center (NW3C) headquartered in Missouri.

“The STOP class is not a forensic examining class,” said instructor Cindy Gonella. “It’s a preview class to determine if there is probable cause. It’s for when you don’t have a warrant, you’re going on a ‘knock and talk’ to see if you can get a warrant.”

According to co-instructor Michael Stern, computer crime is a criminal offense in which a computer is the instrumentality, target, or fruit of a crime. It can be anything from criminal hacking for vandalism or theft, to keeping records of a crime on a computer, or stealing a computer.

“Is there any crime which doesn’t involve a computer these days?” Stern asked. “We have seen criminals use computers in unbelievable ways.”

The STOP course introduced the attendees to software that can be used to open a computer without booting up the operating system and how to find and copy data.

“It’s a previewing tool that allows you to preview the computer in a forensically sound manner,” Gonella said. “You don’t want to change anything, you might accidentally overwrite a smoking gun or exonerating evidence. When booting up Windows, hundreds of files are changed. This doesn’t allow Windows to boot up.”

While Gonella and Stern had examples of using the technology to search for everything from child pornography to images of cars to be stolen concealed on digital picture frame chips, many rural officers had concerns seemingly commonplace but of vital importance to every parent.

“Runaways,” said Officer Adam Hansen of the Tracy Police Department. “I’ve dealt with runaways on Facebook. Someone will say, ‘I’m going to see my boyfriend.’ We need to find out who the boyfriend is.”

In such a case, parents are usually more than happy to give consent to search a missing child’s computer to find when he or she last logged in, if he or she may have logged in since he or she went missing, or thoroughly search his or her room for small data storage devices.

It gets more complicated in something like a shaken baby case Gonella cited, where a search showed the parents had been online for several hours searching for other conditions that would explain the symptoms, before calling for medical help.

In such cases, police need to know how to get the proper consent by legal means, and what constitutes probable cause for a search warrant.

After spending Monday and Tuesday on the STOP course, attendees spent the rest of the week in Cybercop 101: Basic Data Recovery and Acquisition where they learned the basics of how computers work and store data and how to successfully collect, protect and preserve electronic evidence at computer crime scenes.