Cyber Crimes Center

One of HSI's top priorities is to combat criminal activity conducted on or facilitated by the internet.

HSI's Cyber Crimes Center (C3) delivers computer-based technical services to support domestic and international investigations into cross-border crime.

C3 is made up of the Cyber Crimes Unit, the Child Exploitation Investigations Unit and the Computer Forensics Unit. This state-of-the-art center offers cyber-crime support and training to federal, state, local and international law enforcement agencies. C3 also operates a fully equipped computer forensics laboratory, which specializes in digital evidence recovery, and offers training in computer investigative and forensic skills.

Computer Forensics Unit

As the use of computers and digital devices has become widespread, C3's Computer Forensics Unit (CFU) has grown to support the investigative challenges of a digital world. These devices have greatly increased the volume of data that HSI special agents must examine during the course of an investigation. In addition, HSI investigators now must securely manage digital evidence that is highly volatile, mobile and subject to encryption by any user. This makes recovery and stewardship of evidence challenging.

Computer forensics agents/analysts (CFAs) are HSI investigators or analysts trained to perform forensic examinations of seized digital storage devices, such as computer hard drives, flash drives, PDAs, mobile phones, DVDs, CDs and tape media. They use all available digital evidence recovery techniques to preserve an item's authenticity and integrity while maintaining a strict chain of custody.

CFAs work in HSI field offices throughout the world to provide expertise on investigative strategies and to assist case agents in preparing search warrants targeting digital evidence. They are also called upon to furnish expert computer forensic testimony in criminal trials and they provide support to state and local law enforcement.

The CFU at HSI Headquarters manages the following programs that assist with the investigation of child exploitation:

• The Human Exploitation Rescue Operative (HERO) Child Rescue Corp program. This program is designed to give ill, injured, or wounded members of our Armed Forces a chance to join a mission, continue serving and combat child exploitation. Under this one-year paid internship, participants receive three months of training to become computer forensic analysts and participate in a nine-month field internship in an HSI field office supporting child exploitation investigations. Upon successful graduation from the program, many are offered permanent positions with HSI.
• Computer/Mobile/Vehicle/Drone Forensics. HSI is a leader in the field of digital forensics and has the largest computer forensic program in the Federal government, with more than 400 computer forensic agents and analysts. HSI CFAs provide training to other federal, state, local and foreign law enforcement partners in all digital forensic disciplines and provide tier 1 support to field offices.
• 3-D Printing has been used to help identify victims of child exploitation in cases where unidentifiable human remains have been discovered. In these cases, an MRI image is taken and loaded into the 3D printer. A replica of the skull is then printed and given to a forensic anthropologist at the National Center for Missing and Exploited Children for forensic reconstruction. The reconstruction is then run through facial recognition and identification is attempted.
• Hard Drive Repair. In many cases, individuals will attempt to destroy evidence contained on their digital devices. In other instances hard drives become damaged at the scene, or damaged hardware is discovered in the course of an investigation. The experts at C3 are trained to repair these drives and acquire digital evidence for use in prosecutions.
• Encryption/Decryption. Privacy concerns and inexpensive encryption capabilities have led to the ability to obtain evidence from encrypted devices. C3 has a robust decryption program that is powered by a network of computers placed in each SAC office which not only allows for the secure/encrypted transfer of evidence, but also allows investigators to combine the processing power of these computers to assist in decrypting digital devices.

Child Exploitation Investigations Unit

C3's Child Exploitation Investigations Unit (CEIU) is a powerful tool in the fight against the sexual exploitation of children; the production, advertisement and distribution of child pornography; and child sex tourism.

CEIU personnel use sophisticated investigative techniques to target violators who operate on the internet, including the use of websites, email, chat rooms and file-sharing applications.

Major initiatives include:

• Operation Predator: HSI's flagship investigative initiative for targeting sexual predators, child pornographers and child sex tourists.
• The Virtual Global Taskforce (VGT): An international alliance of law enforcement agencies and private-sector partners working together to fight online child sexual exploitation and abuse. HSI is a founding member and current chair of the VGT.
• The National Child Victim Identification System (NCVIS): This system was developed to assist law enforcement agencies in identifying victims of child sexual exploitation.
• Victim Identification Program (VIP): The use of technological and investigative capabilities and resources to rescue child victims of sexual exploitation. The VIP focuses on identifying and rescuing children who have been depicted in child abuse material.
• In addition, ICE has partnered with other agencies (including the Internet Crimes Against Children Task Forces), foreign law enforcement agencies and non-governmental organizations (such as the National Center for Missing & Exploited Children). These partnerships have enabled C3 to successfully investigate leads and assist partners in identifying violators and associates all over the world.

Cyber Crimes Unit

C3's Cyber Crimes Unit (CCU) provides management and oversight of the agency's cyber related investigations by focusing on transnational criminal organizations that use cyber capabilities to further their criminal enterprise.

This unit provides training, investigative support and guidance to HSI field offices in emerging cyber technologies to further the most complex cyber investigations.

Current initiatives and priorities include:

• Darknet and Cryptocurrency Investigations: HSI targets centralized and decentralized darknet marketplaces as well as the illicit use of cryptocurrencies that facilitate a wide array or criminal activities.
• Network Intrusion: Oversight of the agency’s cyber response to incidents of network intrusion that impact core investigative responsibilities, such as financial fraud, intellectual property rights crimes and counter proliferation investigations.

Fast Facts

• HSI special agents also have the authority to investigate the illegal movement of people and goods across U.S. borders, and because the Internet is borderless, the sharing of contraband online is an international crime.
• With 200 U.S. offices and more than 70 offices overseas, HSI has the ability to follow a case wherever in the world it may lead. HSI special agents stationed internationally work with foreign governments, Interpol and others to enhance coordination and cooperation on crimes that cross borders.
• HSI has 400 computer forensics agents and analysts assigned to various field offices.
• In fiscal year 2018, HSI processed more than 7,300 terabytes (or 7.3 petabytes) of data. One petabyte is equivalent to 11,000 4k movies, more than 65 copies of the Library of Congress, or the equivalent of taking 4,000 pictures every day for a lifetime.
• In fiscal year 2014, more than 2,300 child predators were arrested by HSI special agents under Operation Predator and more than 1,000 victims identified or rescued.
• HSI participates on all 61 Internet Crimes Against Children (ICAC) Task Forces across the United States, which are led by state and local law enforcement agencies.
• HSI's Cyber Crimes Center has partnered with the National Center for Missing & Exploited Children’s NetSmartz and the Internet Crimes Against Children (ICAC) Task Forces to develop Project iGuardian, an initiative that provides children, teens, parents and teachers with information regarding the potential dangers of online environments and how staying safe online can help prevent many instances of child exploitation.
• ICE is the current chair of the Virtual Global Taskforce, an international alliance of law enforcement agencies and private sector partners dedicated to combating online child sexual abuse.
• In response to the President’s initiative in reduction of opioid demand in the United States, HSI developed training focusing on darknet investigations and illicit payment networks, associated with fentanyl smuggling and distribution. This training has been successful in improving collective law enforcement capabilities against online marketplaces and tools for illicit trafficking. Since October 2017, HSI has delivered this training course in over 70 locations worldwide to more than 8,000 state, local, federal, and international law enforcement personnel.