2017 course catalog - national white collar crime - nw3c · pdf filea nationwide support...

Version 3.1

Updated May 2018

Cybercrime │ Financial Crime │ Intelligence Analysis

Classroom & Online Instruction │ Tools & Resources

2018 Resource Guide

Phone 877-628-7674

Email [email protected]

[email protected]

Web www.nw3c.org

Facebook NationalWhiteCollarCrimeCenter

Twitter @NW3CNews

NW3C Offices Wilton Park West

4905 Dickens Road

Suite 106

Richmond, VA 23230

5000 NASA Blvd.

Suite 2400

Fairmont, WV 26554

© 2017, 2018. NW3C, Inc. d/b/a the National White Collar Crime Center. All rights reserved.

Contact us

National White Collar Crime Center NW3C provides a nationwide support system for law enforcement and regulatory

agencies tasked with the prevention, investigation, and prosecution of economic

and high-tech crime. For over 40 years, NW3C’s comprehensive training and

technical assistance programs have helped law enforcement professionals mas-

ter the principles, concepts, and skills they need to fight these and related

crimes.

About NW3C

In 2017, NW3C launched the International Association

of Cyber & Economic Crime Professionals (IACECP).

The IACECP brings together the law enforcement com-

munity, the private sector, and academia to combat cur-

rent and future cyber and economic crimes.

1

In the last five years, NW3C has trained more

than 67,000 students in all 50 states. Our in-

person training features student-centered, hands

-on practical exercises.

In-person training

Every year, NW3C provides hundreds of hours of

technical assistance to law enforcement agen-

cies investigating economic and high-tech

crimes.

Technical assistance

Since 2014, NW3C has made high-quality train-

ing available around the clock via a robust in-

house online learning platform that reaches

thousands of students every month.

Online training

NW3C’s webinars present a low-cost opportunity

for criminal justice professionals to enhance their

skills and learn from expert presenters. Webinars

NW3C distributes valuable forensic tools to law

enforcement professionals free of charge. Re-

sources like the Law Enforcement Cyber Center

(LECC) provide news and information.

Tools and resources

NW3C reaches out to prosecutors and judges

with specialized training to ensure that cases

involving economic and high-tech crimes are

treated effectively and fairly in the courtroom.

Prosecutors and judges

BJA-supported training, resources, and tools

2

This project was supported by Grant No. 2015-BE-BX-0011 awarded by the Bureau of Justice Assistance. The Bureau of Justice Assistance is a component of the Department of Justice's Office of Justice Programs, which also includes the Bureau of Justice Statistics, the National Institute of Justice, the Office of Juvenile Justice and Delinquency Prevention, the Office for Victims of Crime, and the SMART Office. Points of view or opinions in this document are those of the author and do not necessarily represent the official position or policies of the U.S. Department of Justice.

NW3C’s work is funded primarily by grants

through congressional appropriations from

the Bureau of Justice Assistance (BJA) and

other federal agencies.

NW3C’s BJA-supported training is availa-

ble to state, local, tribal, and territorial law

enforcement personnel.

Classroom courses 6 CI 101 STOP Secure Techniques for Onsite Previewing 6

CI 115 DC Dark Currency 6

CI 121 CRA Cellular Records Analysis 7

CI 150 ICI Introduction to Cellular Investigations 7

CI 201 SMOSI Social Media & Open Source Intelligence 8

CC 101 BDFI Basic Digital Forensic Imaging 8

CC 201 DEEP Digital Evidence Examination & Processing 9

CC 250 LOSF Linux Open Source Forensics 9

CC 315 WinArt Windows Artifacts 10

CC 325 MFA Macintosh Forensic Analysis 10

CC 350 MDFA Mobile Device Forensic Analysis 11

CC 450 AMDA Advanced Mobile Device Acquisition 11

CS 235 BNII Basic Network Intrusion Investigations 12

FC 101 FIPS Financial Investigations Practical Skills 12

FC 105 FREA Financial Records Examination & Analysis 13

FC 110 FCAS Financial Crimes Against Seniors 13

FC 122 IPTT Intellectual Property Theft Training 14

FC 201 FRIS Financial Records Investigative Skills 14

IA 101 FIAT Foundations of Intelligence Analysis Training 15

IA 105 IWAB Intelligence Writing & Briefing 15

3


Online courses 16 CI 091 ITP-WB Introduction to Previewing 16

CI 099 BCS-WB Basic Computer Skills for Law Enforcement 16

CI 100 ISEE-WB Identifying & Seizing Electronic Evidence 17

CI 102 HDS-WB How Computers Work & Store Data 17

CI 103 ICPI-WB Introduction to Cell Phone Investigations 18

CI 104 VC-WB Virtual Currency 18

CI 106 AI-WB Apple Introduction 19

CI 110 Dark-WB The Dark Web 19

CI 131 SMB-WB Social Media Basics 20

CI 142 ENC2-WB Encryption 20

CI 151 LC1-WB First Responders & Digital Evidence 21

CI 152 LC2-WB Search Warrants & Digital Evidence 21

CI 153 LC3-WB Searching Without a Warrant 22

CI 155 LC5-WB Online Undercover 22

CI 156 LC6-WB Post-Seizure Evidentiary Concerns 23

CI 157 LC7-WB Mobile Digital Devices & GPS 23

CI 210 GPSI-WB GPS Interrogation 24

CS 100 ICN-WB Introduction to Computer Networks 24

CS 110 UDF-WB Understanding Digital Footprints 25

FC 100 WCC-WB Overview of White Collar Crime 25

FC 115 MORF-WB Introduction to Mortgage Fraud 26

FC 141 HTA-WB Human Trafficking Awareness 26

FC 151 BSA-WB The Bank Secrecy Act 27


4

Resources and tools 31 Interactive Online Resources 31

Mobile-Friendly Investigative Field Guides 31

Mobile-Friendly Law Enforcement Cyber Alerts 31

Podcasts 32

Cyber Alerts 32

PhotoHunter 32

Report Generator 32

PerpHound 32

Law Enforcement Cyber Center 33

5


See page 35 for additional

For prosecutors and judges 28 PT 152 PT2-WB Search Warrants & Digital Evidence 28

PT 153 PT3-WB Searching Without a Warrant 28

PT 160 LCCI-WB Legal Challenges to Criminal Investigations 29

PIFR-WB Prosecuting Insurance Fraud Resource 29

PT 201 DEB Digital Evidence Basics & the CLOUD Act 30

Training Presentations for Judges 30

BJA-supported classroom courses

6

STOP

This course covers the usage and configuration of two tools (Paladin/Autopsy and

osTriage) designed to preview a non-mobile digital device and export files of eviden-

tiary value. DAY ONE is designed to preview a non-mobile digital device and export

files of evidentiary value from a device that is powered on. DAY TWO is designed to

preview a non-mobile digital device and export files of evidentiary value from a de-

vice that is powered off.

Students who bring an external USB hard drive (32GB minimum) will be able to

leave with the same setup shown in class. Other topics include a detailed examina-

tion of the process of previewing: what previewing is, why and when it should be

done, who can conduct a preview, and differences in procedure for starting a pre-

view depending on whether a device is on or off.

Secure Techniques for Onsite Previewing CI 101

Cyber Investigation 2 days Prerequisites:

CI 091, CI 142

DC

This course covers foundational topics related to the dark web and virtual currency,

with a focus on criminal investigations. Instructors discuss crimes committed on or

through the dark web, as well as how the dark web can be used as an investigative

tool. Virtual currency is covered both as a general topic and with an emphasis on

Bitcoin: how it works, how it is used (both legitimately and in criminal activities), and

how it is like or unlike other virtual currencies. Search and seizure issues are also

addressed, as well as best practices for tracing Bitcoin transactions.

Dark Currency Investigating the Dark Web & Virtual Currency CI 115

Cyber Investigation 2 days Prerequisite:

None

7


CRA

This course is for officers, investigators, and analysts who encounter cell phone

evidence that includes information external to the phone. Class concepts include

instruction on how to request, read, and analyze call detail records from cellular pro-

viders; and how to plot cellular site locations to determine the approximate position

of a suspect during a given period. No special hardware or software is required.

However, this course focuses heavily on analysis; as such, a strong working

knowledge of Microsoft Excel is highly recommended. Students are provided with a

free copy of NW3C’s PerpHound™ tool, which assists in the plotting of call detail

record locations.

Cellular Records Analysis CI 121


None

ICI

This course covers the acquisition and analysis of the various types of call detail

records obtained from cellular providers. It focuses on data analysis using Microsoft

Excel, as well as techniques for presenting findings in case reports or in court. Stu-

dents receive a copy of PerpHound™, NW3C’s free software tool for the analysis of

call detail records. This course also covers the best practices for seizing, preserving,

and acquiring evidence internal to a cellular phone. Topics include the attributes of

mobile devices, the basics of cellular technology, the challenges of preserving data

stored on cellular phones, techniques for conducting manual cellular phone investi-

gations, extracting data from cellular phones, and reviewing the extracted data. Stu-

dents gain practical experience through hands-on exercises with widely-used inter-

rogation tools.

Introduction to Cellular Investigations CI 150


CI 150

This course will not be offered after June 2018. Starting in July

2018, students should register for CI 121 (CRA) – Cellular Rec-

ords Analysis.


8

SMOSI

This course covers the skills investigators need to conduct successful online investi-

gations involving social media. Topics include internet basics such as IP addresses

and domains, an overview of currently popular social media platforms, and best

practices for building an online undercover profile. Instructors demonstrate both

open-source and commercially-available investigative tools for social engineering,

information gathering, and artifacts related to social media; as well as automated

utilities to capture information and crawl websites.

Social Media & Open Source Intelligence CI 201


None

BDFI

This course covers the fundamentals of computer operations, hardware function,

configuration, and best practices for the protection, preservation, and imaging of

digital evidence. Presentations and hands-on exercises cover topics such as parti-

tioning, data storage, hardware and software write blockers, the boot-up and shut-

down processes, live imaging, encryption detection, and duplicate imaging. This

course incorporates computer forensic applications that experienced practitioners

are currently using in the field.

Basic Digital Forensic Imaging CC 101

Cybercop 2 days Prerequisites:

CI 102, CI 142

9


DEEP

This course builds on the concepts introduced in CC 101 (BDFI). It covers the archi-

tecture and functionality of the Windows NT File System (NTFS), the FAT and the

ExFAT File System, and related directory entry information for locating files on elec-

tronic devices. Topical areas include file headers and file hashing, recovery of delet-

ed files and long file names, and techniques for discovering potential evidence that

might otherwise be overlooked. This course incorporates an investigative scenario,

providing hands-on experience with examination of hard drive images.

Digital Evidence Examination & Processing CC 201

Cybercop 4 days Prerequisite:

CC 101

LOSF

This course teaches students how to use free and open-source software to conduct

digital forensic examinations of Windows OS platforms. Students learn to locate and

install free Linux-based forensic software. After covering key forensic concepts as

applied to open source software, basic forensic analysis techniques are covered.

Topics include imaging and mounting, review and examination of live and deleted

files, hash analysis, keyword searching, Windows Registry, report creation, and

identification and extraction of file metadata, scripting, local and environmental vari-

ables.

Linux Open Source Forensics CC 250


CC 201


10

WinArt

This course covers the identification and extraction of artifacts associated with the

current versions of Microsoft Windows operating systems (Vista through Windows

10) and the NT file system. Topics include the change journal, BitLocker, and a de-

tailed examination of the various artifacts found in each of the registry hive files.

Students examine event logs, volume shadow copies, link files, and thumbnails.

This course uses a mixture of lecture, discussion, demonstration, and hands-on

exercises.

Windows Artifacts CC 315


CC 201

MFA

This course provides the fundamental knowledge and skills necessary to identify

and collect volatile data, acquire forensically-sound images of Apple Macintosh com-

puters, and perform forensic analysis of macOS operating system and application

artifacts. Students gain hands-on experience scripting and using automated tools to

conduct a simulated live triage. Students will use multiple methods to acquire foren-

sically-sound images of Apple Macintosh computers and identify unique challenges

that this task may present. Students will also learn how the macOS's default file

system stores data, what happens when files are sent to the macOS Trash, where

operating system and application artifacts are stored, and how they can be ana-

lyzed. The forensic artifacts covered include password recovery, recently-opened

files and applications, encryption handling, Mail, Safari, Messages, FaceTime, Pho-

tos, Chrome, and Firefox.

Macintosh Forensic Analysis CC 325


CI 106, CC 201

11


MDFA

This course provides the fundamental knowledge and skills necessary to preserve,

acquire, and analyze data on iOS devices (iPod Touch, iPhone, and iPad), as well

as various Android devices. Students use forensically-sound tools and techniques to

acquire and analyze potential evidence. Topics include identifying potential threats

to data stored on devices, available imaging options, accessing locked devices, and

the default folder structure. The forensic artifacts covered include device infor-

mation, call history, voicemail, messages, web browser history, contacts, and pho-

tos.

Mobile Device Forensic Analysis CC 350


CC 201

AMDA

This course equips digital forensics professionals with the skills, utilities, and meth-

ods necessary to acquire data from otherwise-inaccessible devices. Students learn

the advanced acquisition hierarchy and when to elevate the method of acquisition—

from advanced custom recovery usage to bypass passcodes, to device encryption

and other security measures, and ultimately to the acquisition of a physical forensic

backup of the device. Hands-on instruction and practice includes the JTAG (Joint

Test Action Group) acquisition method, and both cold and hot device ISP (In Sys-

tems Programming) acquisition techniques. Students utilize both JTAG and ISP

boxes to the fullest extent, including “flashing” capabilities. Finally, students perform

thermal kinetic chip off extractions, with a capstone analysis block on proper meth-

ods for handling acquired data.

Advanced Mobile Device Acquisition CC 450


CC 350


12

BNII

This course covers the skills and techniques involved in responding to a network

security incident. The course focuses on the identification, extraction, and detailed

examination of artifacts associated with network and intrusions. Memory analysis,

host machine forensics, network traffic and log analysis, malware analysis, and vir-

tual machine sandboxing are covered through lecture, discussion, and hands-on

exercises. Additional topics include key cybersecurity concepts and issues, as well

as the various classifications and types of network attacks.

Basic Network Intrusion Investigations CS 235

Cybersecurity 4 days Prerequisite:

CS 100

FIPS

This course provides hands-on investigative training at a basic level. Students de-

velop the practical skills, insight, and knowledge necessary to manage a successful

financial investigation from start to finish, including the acquisition and examination

of financial records, interview skills, and case management and organization. Addi-

tional topics include forgery and embezzlement, financial exploitation of the elderly,

working with spreadsheets, financial profiling, and state-specific statutes and legal

issues.

Financial Investigations Practical Skills FC 101

Financial Crime 3 days Prerequisite:

None


13

FREA

This course covers the acquisition, examination, and analysis of many types of fi-

nancial records, including bank statements and checks, wire transfer records, and

business records. Topics include recognizing and investigating common indicators

of fraud, using spreadsheets to facilitate analysis and pattern recognition, and finan-

cial profiling. There is a strong focus on presenting financial evidence in multiple

modalities: spreadsheet data outputs, graphic representations, and written/oral

presentations.

Financial Records Examination & Analysis FC 105


None

FCAS

This course promotes a multi-agency approach to the problem of financial exploita-

tion of senior citizens. Bringing together law enforcement personnel and adult pro-

tective services investigators, the course enhances students’ investigative skills and

interviewing techniques while facilitating networking and cooperation that can extend

out of the classroom and into real cases. Topics include recognizing elder abuse,

working with victims, identifying perpetrators, and resources for investigation and

community awareness. Students work together to conduct a mock investigation into

a hypothetical case.

Financial Crimes Against Seniors FC 110


None


14

IPTT

This course introduces the problem of intellectual property theft and provides tools,

techniques, and resources for investigating and prosecuting these crimes. A combi-

nation of lecture, discussion, and interactive exercises illustrates the potential dan-

gers and economic repercussions of counterfeit products, as well as best practices

and techniques for investigating IP theft. Students are provided with relevant stat-

utes, sample organizational documents for IP investigations, and additional re-

sources for investigators and prosecutors.

This course is presented in collaboration with the National Association of Attorneys

General (NAAG).

Intellectual Property Theft Training FC 122

Financial Crime 1 day Prerequisite:

None

FRIS

This course builds on the concepts introduced in FC 101 (FIPS) and FC 105

(FREA), introducing investigators and prosecutors to emerging issues in financial

crime. Topics include money laundering, analyzing large financial data sets, con-

ducting effective interviews, and managing large amounts of financial evidence. This

course consists of a mix of lecture, discussion, and hands-on exercises. Students

conduct a mock investigation that includes interviews, data analysis, and the con-

struction of an electronic case file.

Financial Records Investigative Skills FC 201


None


15

FIAT

This course addresses the critical need for well-trained intelligence analysts to inter-

pret growing amounts of information. This introductory course covers the history and

purpose of intelligence analysis, the intelligence cycle, analytical thinking skills, and

the importance of strategic analysis. The course was developed by a consortium

that included NW3C, Law Enforcement Intelligence Unit (LEIU), the International

Association of Law Enforcement Intelligence Analysis (IALEIA), and the Regional

Information Sharing System (RISS).

This course has been certified by DHS/FEMA as course number WV-001-PREV.

Foundations of Intelligence Analysis Training IA 101

Intelligence Analysis 5 days Prerequisite:

None

IWAB

This course covers basic intelligence writing and briefing principles as well as meth-

ods to facilitate increased intelligence sharing. Topics include creative/critical think-

ing and critical reading skills, source evaluation, privacy and civil rights, intelligence

product writing structure and style, and creating and presenting intelligence brief-

ings. An instructor and peer feedback process is applied to the reports and briefings

produced in class.

This course was developed in partnership with the U.S. Department of Homeland

Security (DHS), Federal Emergency Management Agency (FEMA), under the Na-

tional Training and Education Division (NTED).

Intelligence Writing & Briefing IA 105

Intelligence Analysis 5 days Prerequisite:

None

BJA-supported online courses

16

ITPWB

This interactive online module provides an overview of the basic concepts behind

secure previewing of digital devices. Students become familiar with both on-site and

off-site secure previewing, and learn to identify the two states in which a preview

can be conducted (live-box and dead-box previewing). At the completion of the

course, students will be able to recognize the recommended collection order of vola-

tile data (the “order of volatility”).

This course serves as a prerequisite for CI 101 (STOP) but can also be completed

as a stand-alone course.

Introduction to Previewing CI 091

Cyber Investigation ½ hour Prerequisite:

None

BCSWB

This course covers the fundamental skills involved with operating a computer using

the Windows 7 or Windows 8 operating systems. Topics include components of

computer hardware, Windows File Explorer, file management in Windows, and pro-

gram installation.

The course consists of six sequential instructional modules. After completing each

module, students should proceed to the next.

Basic Computer Skills for Law Enforcement CI 099

Cyber Investigation 3 hours Prerequisite:

None


17

ISEEWB

This course introduces the information and techniques law enforcement personnel need to safely and methodically collect and preserve electronic evidence at a crime scene. Topics include recognizing potential sources of electronic evidence; planning and executing a digital evidence-based seizure; and the preservation, packaging, documentation, and transfer of digital evidence. CI 100 (ISEE-WB) is a Department of Homeland Security Approved Course.

Identifying & Seizing Electronic Evidence CI 100

Cyber Investigation 2½ hours Prerequisite:

None

HDSWB

The first module of this course covers fundamentals such as recognizing computer

components and their functions, accessing computer firmware, and the startup and

shutdown processes. The second module covers how a hard disk drive works, how

data is converted into digital information, how to calculate the storage capacity of a

device, partitioning and how that is used for storage, and how a solid state hard

drive functions.

This course serves as a prerequisite for CC 101 (BDFI) but can also be completed


How Computers Work & Store Data CI 102

Cyber Investigation 3 hours Prerequisite:

None


18

ICPIWB

This course provides an overview of the two phases of a cell phone investigation:

the preservation, extraction, and analysis of data within the phone; and the acquisi-

tion and analysis of data external to the phone (call detail records and other infor-

mation). Students become familiar with several forensic tools currently in use in the

field, as well as NW3C’s PerpHound, a specialized tool that assists in plotting histor-

ical cell site locations. Other topics include cell phone components, cellular network

components, and mobile device identification.

Introduction to Cell Phone Investigations CI 103

Cyber Investigation 1 hour Prerequisite:

None

VCWB

This course covers basic information and concepts that serve as an introduction to

virtual currencies and their relationship to other types of currency. It covers various

types of virtual currency, including the difference between decentralized and central-

ized currencies, with a strong focus on Bitcoin: what it is, how it is stored, and

Bitcoin-specific investigative tips and techniques.

Virtual Currency CI 104


None


19

AIWB

This online course provides the fundamental knowledge necessary to identify differ-

ent types of Apple hardware and to use the macOS operating system. Students

learn what hardware devices are currently available from Apple including laptops,

desktops, wireless hardware, and mobile devices. Students are also introduced to

the macOS graphical user interface and its four major components: Desktop, Finder,

Menu Bar, and Dock.

This course serves as a prerequisite for CC 325 (MFA) but can also be completed


Apple Introduction CI 106


None

DarkWB

This course introduces the dark web and some of the most popular darknets, includ-

ing the Tor Project, Freenet, and Invisible Internet Project (I2P). Basic topics include

what Tor is, how it works, and who uses it; as well as dark markets within Tor, and

the hidden services they provide. The course concludes with brief case studies cov-

ering some of the largest dark market seizures in history.

The Dark Web CI 110


None


20

SMBWB

This course introduces learners to the world of social media, including fundamental

concepts, trends, and benefits for law enforcement organizations. This course ex-

amines how the most popular social media platforms like Facebook and Instagram

work, and how people tend to use them. This course also introduces other social

media platforms and apps, such as Snapchat and Periscope. There is a strong fo-

cus on social media as a tool for law enforcement, including designating a social

media officer and establishing an agency social media policy for official and person-

al use.

Social Media Basics CI 131


None

ENC2WB

This course provides an introduction to data encryption, covering the purpose of

encryption as well as the process of encrypting data, and clarifying the distinctions

between encryption and other operations like password protection and encoding. It

explores the confusion, diffusion, and secret key encryption methods. Topics include

detecting encryption (including recognition of some of the most popular types of

encryption software), as well as proper procedures for law enforcement profession-

als who detect that encryption may be present on a device. The course also pro-

vides an overview of some of the best and most common encryption detection soft-

ware tools.

This course serves as a prerequisite for several classroom courses and can also be

completed as a stand-alone course.

Encryption CI 142


None


21

LC1WB

This course provides basic information for first responders who may encounter digi-

tal evidence in the course of their duties. Topics include the definition of digital evi-

dence, where it can be found, the importance of getting digital devices to a forensics

expert, and the ways in which digital evidence can be compromised. This course

also addresses the issue of when a warrant is required to seize and/or search digital

devices.

This course is part of the training series Legal Concerns for Digital Evidence Re-

sponders. It can be completed as a stand-alone course or in combination with the

other courses.

First Responders & Digital Evidence CI 151


None

LC2WB

This course provides information on obtaining and executing search warrants in

cases involving digital evidence, with a focus on the similarities and differences be-

tween these and other search warrants. The course covers establishing probable

cause, particularity, scope, and nexus; the use of outside experts; and out-of-state

warrants for remote evidence.



other courses.

Search Warrants & Digital Evidence CI 152


None


22

LC3WB

This course provides legal information on situations involving digital evidence in

which the Fourth Amendment does not apply. Topics include reasonable expecta-

tion of privacy in a digital context, private searches, “reasonable” government

searches, and searches with consent.



other courses.

Searching Without a Warrant CI 153


None

LC5WB

This course provides a legal overview of what investigators are and are not permit-

ted to do while conducting online undercover investigations. Topics include terms of

service, entrapment and outrageous government misconduct, and wiretapping law

as it relates to the recording and documenting of online activities. This course also

covers defense strategies commonly used to counter online undercover investiga-

tions.



other courses.

Online Undercover CI 155


None


23

LC6WB

In contrast to the other courses in this series, which deal primarily with the acquisi-

tion of digital evidence, this course addresses legal issues that appear relatively late

in the investigative and judicial process. Topics include the Fifth Amendment as it

applies to passwords and login credentials, determining the ownership of files on

digital devices, and the admissibility of online evidence.



other courses.

Post-Seizure Evidentiary Concerns CI 156


None

LC7WB

This course addresses the legal issues surrounding mobile digital devices including

cell phones and GPS devices. Topics include seizing and searching mobile devices,

the process of obtaining both historical and current location information from cellular

service providers, and legal process needed to install a GPS unit on a suspect’s

vehicle.



other courses.

Mobile Digital Devices & GPS CI 157


None


24

GPSIWB

This course establishes a basic understanding of the concepts and components of

the Global Positioning System (GPS). Students are introduced to a wide variety of

GPS devices. Topics include best practices for seizing and preserving the vast

amount of location information stored on GPS-enabled hardware, the use of forensi-

cally-sound tools and techniques to extract and analyze GPS data effectively, and

proper methods for documenting and presenting location-based data.

GPS Interrogation CI 210


None

ICNWB

This course introduces fundamental concepts and terminology related to computer

networks. Topics include the importance of computer networks, types of computer

networks, common network components, network topologies and media, the OSI

and TCP/IP models of communication, and IP addressing. The course also address-

es law enforcement’s role in cybersecurity within the current landscape of digital

crime.

This course serves as a prerequisite for CS 235 (BNII) but can also be completed as

a stand-alone course.

Introduction to Computer Networks CS 100

Cybersecurity 3 hours Prerequisite:

None


25

UDFWB

This course introduces learners to the concept of digital footprints and best practices

in protecting personally identifiable information (PII). Topics include limiting an indi-

vidual’s digital footprint, protecting privacy on social media, and the consequences

of oversharing personal information; as well as steps to take after becoming a target

of doxing.

Understanding Digital Footprints CS 110

Cybersecurity ½ hour Prerequisite:

None

WCCWB

This course presents awareness-level information on a variety of topics related to

white collar crime. The course covers basic definitions and terminology, common

types of white collar crime, and the effects of white collar crime on society. Students

learn to recognize and respond to common internet scams, provide assistance to

victims of white collar crime, and recognize warning signs and red flags of criminal

behavior. This course emphasizes law enforcement’s role in preventing and re-

sponding to white collar crime, and includes additional resources for combating this

widespread problem.

Overview of White Collar Crime FC 100

Financial Crime 2 hours Prerequisite:

None


26

MORFWB

This course presents awareness-level information on mortgage fraud. The course

covers basic definitions and terminology, common types of mortgage fraud

schemes, components of fraud, roles in the mortgage process, and legal explana-

tions. Students also learn to recognize fraud indicators associated with a variety of

schemes and opportunities to commit fraud throughout the mortgage process. A

sample mortgage loan application and other forms used in the process are available

to download within this course.

Introduction to Mortgage Fraud FC 115

Financial Crime 1½ hours Prerequisite:

None

This course provides law enforcement personnel with an overview of the various

elements involved in the crime of human trafficking. The course covers the major

types of human trafficking, the scope and extent of human trafficking, and resources

for law enforcement who encounter human trafficking. Topics include physical and

behavioral indicators of human trafficking, trafficked victims’ rights, the elements of a

human trafficking operation, and information about several federal and private or-

ganizations making efforts to combat human trafficking.

HTAWB

Human Trafficking Awareness FC 141

Financial Crime 1 hour Prerequisite:

None

This course presents awareness-level information on the Bank Secrecy Act (BSA)

and how it is used to aid law enforcement investigations into terrorism and criminal

activity. Students are introduced to the BSA, the USA PATRIOT Act, and definitions

of commonly-used terms. This course also explains the various documents and

forms filed by financial institutions under the BSA. The Financial Crimes Enforce-

ment Network (FinCEN) is discussed with an emphasis on services and resources

provided to law enforcement. Proper application of BSA forms is reinforced through

scenario-based exercises at the end of this course.

BSAWB

The Bank Secrecy Act FC 151

Financial Crime 1 hour Prerequisite:

None


27

BJA-supported training for prosecutors and judges

28

PT3WB

This course provides legal information on situations involving digital evidence in

which the Fourth Amendment does not apply. Topics include reasonable expecta-

tion of privacy in a digital context, private searches, “reasonable” government

searches, and searches with consent.

Searching Without a Warrant PT 153

Prosecutor Training 1 hour Prerequisite:

None

PT2WB

This course provides information on obtaining and executing search warrants in

cases involving digital evidence, with a focus on the similarities and differences be-

tween these and other search warrants. The course covers establishing probable

cause, particularity, scope, and nexus; the use of outside experts; and out-of-state

warrants for remote evidence.

Search Warrants & Digital Evidence PT 152

Prosecutor Training 1 hour Prerequisite:

None

This resource provides information about investigating and prosecuting insurance

crime in the Property and Casualty (P&C) arena. P&C insurance crime involves au-

to, homeowners’, and commercial policies; and spans a wide range of property- and

medically-related fraud. This resource includes examples of insurance fraud; indica-

tors and red flags of fraud; investigative guides and aids; and contact information for

regional, state, and local resources for investigators and prosecutors.

This resource is presented in partnership with the National Insurance Crime Bureau.

PIFRWB

Prosecuting Insurance Fraud Resource

Prosecutor Resource 1 hour


29

LCCIWB

This course provides information regarding the legal principles involving the rights of

defendants and witnesses. This course will cover a number of topics pertaining to

criminal investigations including admissible evidence, exculpatory evidence, and the

exclusionary rule. There is a strong focus on the Fourth, Fifth, and Sixth Amend-

ments to the U.S. Constitution.

Legal Challenges to Criminal Investigations PT 160

Prosecutor Training Prerequisite:

None

Prosecutors and defense attorneys know that almost every criminal investigation

today involves some digital evidence—or the potential for it. This means that in or-

der to fairly adjudicate today’s cases, judges in all jurisdictions must be up to speed

on the latest technological developments and case law. NW3C’s newest training

initiative reaches out to judges via 90-minute presentations that can be delivered at

professional conferences, as stand-alone lectures, or in a webinar format.

Training Presentations for Judges

Judges’ Training Prerequisite: None


30

DEB

This course provides the technical and legal information prosecutors need to see

cases involving digital evidence through the entire criminal justice process, from

seizure and extraction to admissibility to verdict. Topics include digital evidence

commonly seized during the execution of a search warrant, digital evidence stored

remotely (“in the cloud”), and the processes investigators use to obtain this evi-

dence, such as the interrogation of digital devices. There is a strong focus on case

law, ethics, and other legal issues surrounding the collection and custody of digital

evidence, as well as its use at trial. The course also examines new legislation like

the CLOUD Act, which is reforming the digital evidence landscape just as rapidly as

the ever-changing case law.

Digital Evidence Basics & the CLOUD Act PT 201

Prosecutor Training 2 days Prerequisite:

None

Full text of state statutes relating to certain

types of white collar crime.

White Collar Crime

Statutes by State

Gaming consoles and handheld gaming de-

vices that may contain digital evidence. Gaming Devices

Facts, statistics, stories, and resources related

to intellectual property theft.

Intellectual Property

Theft

Interactive Online Resources

Instant access to investigative information related to cyber and economic crime.

BJA-supported resources

31

Mobile-Friendly Products

Interactive resources on topics related to cyber

and economic crime. Current topics include

Bitcoin and other cryptocurrencies.

Investigative

Field Guides

Need-to-know information on emerging apps

and other cyber investigative trends. Recent

topics include Sarahah, Houseparty, Roblox,

and other mobile apps.

Law Enforcement

Cyber Alerts

A continually updated group of products and tools designed for your phone or tablet.

Apple iOS and Android compatible; also accessible via desktop PC.

Publications and Media

Download or stream these informative products from NW3C’s website.

These brief, downloadable documents intro-

duce popular mobile applications that are of

particular interest to law enforcement, with

information on extracting data as well as serv-

ing legal process.

Cyber Alerts

Law enforcement-specific commentary and

advice from experts on topics relating to the

investigation and prosecution of white collar

crime, with a special focus on intellectual prop-

erty theft.

Podcasts

Specialized Software

PhotoHunter allows the user to view and plot

images and their associated EXIF information.

Current version: v1.0.2.

Report Generator allows the user to generate an

HTML-based report from separate data files.

Current version: v2.0.1.

PerpHound aids in the processing and plotting of

call detail records, and allows the user to view

and plot images and their associated EXIF infor-

mation. Current version: v4.0.1.

Distributed free of charge to law enforcement.


32

The Law Enforcement Cyber Center (LECC) is an online toolkit designed to meet

the specific and practical needs of chiefs, investigators, line officers, digital forensic

examiners, technical support staff, and other practitioners. LECC enhances the

awareness, expands the education, and builds the capacity of justice and public

safety professionals towards the global goal of combating high-tech crimes.

Under the direction of the Bureau of Justice Assistance, NW3C works in close col-

laboration with the International Association of Chiefs of Police (IACP) and the Po-

lice Executive Research Forum (PERF) to manage and support the LECC.

www.iacpcybercenter.org

Law Enforcement Cyber Center

Model policies, guides, and white papers to

help your agency detect, prevent, and investi-

gate high-tech crime. Investigative Resources

Understand recent legal decisions affecting

the preservation, handling, and admissibility of

digital evidence. Legal Resources

Search for upcoming online and in-person

training classes, conferences, and other

events in a single database.

Training & Conference

Search

A curated news feed on the ever-evolving

world of technology and digital evidence. Cyber News


33

34

Pages 1–33 of this resource guide describe NW3C’s BJA-supported training and re-sources. Additional training products are described on pages 36 and following. Some of these prod-ucts are available to a wider audience (beyond U.S. law enforcement personnel). International and private sector professionals should contact NW3C to learn more about the training opportunities currently available to them.

NW3C’s work is funded primarily by grants

through congressional appropriations from

the Bureau of Justice Assistance (BJA) and

other federal agencies.

NW3C’s BJA-supported training is availa-

ble to state, local, tribal, and territorial law

enforcement personnel.

35

Additional training and resources

Additional training and resources 36 FC 111 Financial Crimes Against Seniors Seminar 36

FC 130 Targeting Investment Fraud 36

ICAC Task Force Training 37

CP CC2C Cybercrime: From Crime to Courtroom 38

CP DKWEB Investigating in the Dark Web 38

CP HUNT “How to Hunt” Criminals & Terrorists: The Actionable Intelligence

Workshop 39

CP IIT Internet Intelligence Training 39

CP OSNII Successful Use of Online Social Networking for Investigations &

Intelligence 40

IPS EDW-WB Exploring Dark Web 40

IPS ENC2-WB IPS Encryption 41

IPS Virtual Currency 41 IPS VC-WB

Virtual Classroom 42

Webinars 42

Customized Training Solutions 43

NW3C Certifications 44

International Association of Cyber & Economic Crime Professionals 45

36

Additional classroom training

This course promotes a multi-agency approach to the problem of financial exploita-

tion of senior citizens. Topics include working with senior victims, examining docu-

ments like bank records and power of attorney, and resources for investigation and

community awareness. Detailed examination of a case study from initial complaint to

prosecution reinforces and illustrates the course content. With a dual focus on finan-

cial abuse by trusted persons and common scams aimed at seniors, the course in-

troduces senior-specific investigative skills while facilitating networking and coopera-

tion that can extend out of the classroom and into real cases.

Financial Crimes Against Seniors Seminar FC 111

Financial Crime 1 day FREE

This course provides investigators and prosecutors with the knowledge and tools

they need to respond to the growing problem of investment fraud. Topics include

what constitutes a security, using the Howey Test to determine if a particular offering

is a security, identifying investment fraud schemes, and investigative strategies for

working with victims and perpetrators. The course also covers fraud prevention

strategies, and students are provided with additional resources for both prevention

and investigation.

This course is presented in partnership with the FINRA Investor Education Founda-

tion.

Targeting Investment Fraud FC 130

Financial Crime 1 day FREE


37

ICAC Task Force Training ICAC

NW3C provides training opportunities for law enforcement professionals who are

affiliated with an Internet Crimes Against Children (ICAC) Task Force. These train-

ing opportunities are funded through the Office of Juvenile Justice and Delinquency

Prevention (OJJDP). Attendees must agree to comply with the Best Practices and

Standards established by ICAC. If you have any questions about the ICAC Best

Practices and Standards, please contact your ICAC commander.

Cybercrime 2–4 days FREE

38


Instructor Steve Mancini

The National Cyber-Forensics and Training Alliance (NCFTA) offers training courses

for law enforcement that optimize learning via a combination of lectures and hands-

on work.

This course covers the current cyber-criminal threat landscape on both the clear net

and the dark web, including profiles of the threat actors and how they operate. Stu-

dents learn how to conduct basic online investigations, how to interact online without

compromising oneself, and how to become operational across both the clear net

and the dark web. This hands-on course involves leveraging a variety of open

source tools to assess and profile international threat actors.

NCFTA provides laptops for use during class.

Investigating in the Dark Web CP DKWEB

Cybercrime 2 days $399

The objective of this course is to focus on how internet/cyber/computer technology-

based criminal cases (and criminal cases reliant upon digital evidence) unfold in a

courtroom; and why it is vital for investigators, prosecutors, and digital forensic tech-

nicians to comprehend these elements throughout the entirety of their investigations

and prosecutions. Topics include: comprehending the ever-changing online environ-

ments where crimes occur; locations of evidential repositories; how to consider and

utilize different forms of testimony (custodian of records, nexus, fact, expert, and

rebuttal); understanding anonymization and its increasing usage by criminals online

and how it is woven into cases in court; and learning about recent criminal cases in

court and how to appropriately investigate and prosecute them. The format is inter-

active.

Instructor Don Colcolough

Cybercrime: From Crime to Courtroom CP CC2C


Instructor Paul Smith

This one-day workshop is designed to instruct police commanders, their police offic-

ers (assigned to both patrol and investigative functions), and their analysts on how

to aggressively collect and use actionable intelligence. The same intelligence tech-

niques can be used against both criminal and terrorist targets. The intelligence train-

ing taught in this workshop is designed to supplement the existing operational pro-

fessionalism, skills, and experience within the audience. Topics include current ter-

rorist threats, countering violent extremism, terrorists’ modus operandi, the intelli-

gence cycle, intelligence collection platforms, counter terrorism scenarios, actiona-

ble intelligence, and counter terrorism contingency planning.

How to “Hunt” Criminals & Terrorists:

The Actionable Intelligence Workshop CP HUNT

Intelligence Analysis 1 day $199

39


Instructor Cynthia Hetherington

This course offers a comprehensive program for internet investigations and open-

source intelligence gathering. Students learn how to enhance their search skills to

effectively use internet resources for locating information online. Topics include: an

introduction to online investigations & open source primer, hacking Google (learn

professional Google skills), social & other search engine resources, drugs and hu-

man trafficking websites online, images online and basic tracing IP introduction,

advanced social media investigations, dark web defined for investigators, removing

your personal identifying information, and using anonymity: working undercover for

investigators.

Internet Intelligence Training CP IIT


40

Additional classroom and online training

IPSEDWWB

This course introduces the dark web and some of the most popular darknets, includ-

ing the Tor Project, Freenet, and Invisible Internet Project (I2P). Basic topics include

what Tor is, how it works, and who uses it; as well as dark markets within Tor, and

the hidden services they provide. The course concludes with brief case studies cov-

ering some of the largest dark market seizures in history.

This course is open to students from the international law enforcement community

and the private sector.

Exploring Dark Web IPS EDW-WB

Private Sector 1 hour $39

Instructor Chuck Cohen

This course provides students with an up-to-date understanding of how social net-

working sites work and how members act and interact. Students learn what infor-

mation is available on various sites and how to integrate that information into crimi-

nal investigations and criminal intelligence analysis. Topics include the phenomena

of virtual worlds and massively multi-player games, and how criminals recruit, com-

municate, and launder money in these environments; the operation of the largest

sites; ways of concealing the location from which the internet is accessed; how crim-

inal organizations use online social networks to interact, identify victims, and con-

ceal their identity; and the risk to law enforcement officers (especially undercover

investigators) posed by online social networking, social media, and viral videos.

Successful Use of Online Social Networking

for Investigations & Intelligence CP OSNII


IPSENC2WB

This course provides an introduction to data encryption, covering the purpose of

encryption as well as the process of encrypting data, and clarifying the distinctions

between encryption and other operations like password protection and encoding. It

explores the confusion, diffusion, and secret key encryption methods. Topics include

detecting encryption (including recognition of some of the most popular types of

encryption software), as well as proper procedures for law enforcement profession-

als who detect that encryption may be present on a device. The course also pro-

vides an overview of some of the best and most common encryption detection soft-

ware tools.



IPS Encryption IPS ENC2-WB

Private Sector 1 hour $39

41

Additional online training

IPSVCWB

This course covers basic information and concepts that serve as an introduction to

virtual currencies and their relationship to other types of currency. It covers various

types of virtual currency, including the difference between decentralized and central-

ized currencies, with a strong focus on Bitcoin: what it is, how it is stored, and

Bitcoin-specific investigative tips and techniques.



IPS Virtual Currency IPS VC-WB

Private Sector ½ hour $39

42

Virtual classroom training and webinars

Virtual Classroom

Instructor-led online courses are delivered via NW3C’s virtual classroom. Students

use their own computers to interact live with the instructors and each other.

Use your own computer and network connec-

tion to log on from your desk.

No need to travel

to a training site.

Use video chatting and instant messaging to

connect with instructors and other students.

Interactive,

small-group training.

All you need is a computer with a webcam

and a microphone.

Minimal technology

requirements.

Virtual classroom training covers various top-

ics related to cyber and economic crime. In-demand topics.

Webinars

NW3C’s webinars present a low-cost opportunity for criminal justice professionals to

enhance their skills relating to the investigation and prosecution of cyber and eco-

nomic crime without a large time commitment or the need to travel to a training site.

$49 per person per event. The cost includes

individual access to the live event, unlimited

individual access to the recorded event for 30

days, and an individual certificate of training for

CEUs. Group rates are available.

Attending a webinar

Cell Phone Location Data

Intelligence Collection Tips & Tricks

Financial Crimes Against Seniors

Neuro-Linguistic Programming

Recent topics

Customized training solutions

43

The National White Collar Crime Center specializes in the development and deliv-

ery of courses in the areas of cybercrime, financial crime and intelligence. However,

we have developed courses on other topics outside the scope of our traditional dis-

ciplines. Over the past decade, we have used our proprietary instructional-design

model to effectively develop and deliver over 4,000 courses to over 100,000 stu-

dents. With this experience we are confident we can develop a training solution that

will meet your organizational needs.

Learn to conduct cyber investigations, pro-

cess digital evidence, and investigate network

intrusions. Cybercrime

Learn to examine documents, recognize fraud

indicators, and bring financial crime cases to

prosecution. Financial crime

Learn to analyze and report on criminal intelli-

gence data in cases ranging from local crime

to terrorism. Intelligence Analysis

Customized training solutions

Contact NW3C for pricing.

44

NW3C certifications

Available for professionals in both law enforcement and the private sector, this certi-

fication attests to the holder’s ability to investigate and analyze information related

to financial conduct of all types. Holders of this certification have demonstrated that

they possess the working knowledge and skills needed to detect, respond to, and

investigate illegal financial activity.

CECFE Certified Economic Crime

Forensic Examiner

Available for professionals in both law enforcement and the private sector, this certi-

fication attests to the holder’s knowledge of proper digital forensic techniques and

best practices for working with digital evidence. Holders of this certification have

demonstrated their knowledge of the identification and proper handling of digital

evidence; types of digital hardware technologies; common file systems; best prac-

tices in forensic imaging; documenting and reporting; and legal considerations.

CCCE Certified Cyber Crime Examiner

For over 40 years, NW3C’s comprehensive training programs have helped law en-

forcement professionals master the principles, concepts, and skills they need to

fight cyber and economic crime. Our newest initiative offers law enforcement and

the private sector the opportunity to earn professional certifications. NW3C certifica-

tions, backed by our industry-leading expertise and reputation, attest to demonstrat-

ed competence in digital forensics and/or the investigation of illegal financial activi-

ty.

www.nw3c.org/certifications

NW3C certifications

IACECP

45

The IACECP strengthens its members’ ability to combat cyber and economic crime

through professional credentialing that engages innovative and robust learning plat-

forms to certify participants in several specialized fields. Acquired skill sets are rein-

forced through the active exchange of ideas and resources among IACECP’s inter-

national membership.

For four decades, NW3C’s premier training and technical support has enabled all

spectrums of law enforcement to prevent, investigate, and prosecute cyber and

economic crimes. The IACECP’s resources and solutions adhere to NW3C’s estab-

lished high standards of integrity and quality.

The IACECP offers a number of benefits to its members.

Discounts on all fee-based training products

offered by NW3C. Training discounts

Members receive one fee-based webinar of

the member’s choice on emerging trends,

technology, case studies, best practices, tools

and product demos at no cost per year.

Webinars

A members-only, moderated, shared ex-

change of resources, solutions, and methodol-

ogies for combating cyber and economic

crime.

LISTSERV

A members-only repository of specific infor-

mation and resources related to cyber and

economic crime. Resource library

www.nw3c.org/iacecp

NW3C’s work is funded primarily by grants through congressional appropriations from the Bureau of Justice Assistance (BJA) and other federal agencies. NW3C’s BJA-supported training is available to state, local, tribal, and territorial law enforcement personnel. This project was supported by Grant No. 2015-BE-BX-0011 awarded by the Bureau of

Justice Assistance. The Bureau of Justice Assistance is a component of the Department of Justice's Office of Justice Programs, which also includes the Bureau of Justice Statistics, the National Institute of Justice, the Office of Juvenile Justice and Delinquency Prevention, the Office for Victims of Crime, and the SMART Office. Points of view or opinions in this document are those of the author and do not necessarily represent the official position or policies of the U.S. Department of Justice.

www.nw3c.org

Additional support provided by the following organizations: The Microsoft Corporation has

provided financial and material

support to NW3C through a

generous software donation.

© 2017, 2018. NW3C, Inc. d/b/a the National White Collar Crime Center. All rights reserved.

2017 course catalog - national white collar crime - nw3c · pdf filea nationwide support...

Documents