The Modern Evidence Trail
The FBI’s Regional Computer Forensics Laboratories Are Vital in the Digital Age
Technology and connected devices touch nearly every facet of modern life, and they often hold key evidence in criminal investigations. “Every single case now involves some sort of digital evidence,” said FBI Supervisory Special Agent Steven Newman, director of the New Jersey Regional Computer Forensics Laboratory (NJRCFL).
Digital evidence can be on any device and can follow subjects almost anywhere they traverse in the cyber world. As such, digital evidence is key in Internet-enabled crimes, but it is also critical in cases that range from terrorism to fraud.
In May 2018, three New Jersey men were sentenced to prison for conspiring to provide material support to the Islamic State of Iraq and al-Sham (ISIS), which is designated by the United States as a foreign terrorist organization. The FBI became aware of the men’s activities through a tip from an informant, according to Special Agent Suzanne Walsh with the FBI’s Newark Field Office.
Once that tip was deemed credible, digital evidence became key to investigating the men’s motives. The digital evidence left on the suspects’ computers and phones was crucial to showing criminal intent in the actions the men took—from planning to travel overseas to viewing ISIS propaganda online.
Alaa Saadeh, who was 24 at the time of sentencing, was given 15 years for his crimes. The evidence investigators uncovered showed he was actively planning to join ISIS and had supported his brother’s travel, both financially and logistically, to pursue that same goal.
Alaa’s brother, Nader Saadeh, 23 at sentencing, was given 10 years; and a third man, Samuel Rahamin Topaz, 24 at sentencing, was given eight years. The evidence showed all three had viewed ISIS materials, maps, and videos, including videos that depicted executions. Their communications also contained evidence that showed their desire to join ISIS and revealed some of the efforts they took to conceal their activities.
“Technology has changed what we do. It has impacted us in areas such as security and encryption, but it has pushed us to pursue the development of additional tools and techniques.”
FBI Supervisory Special Agent Steven Newman, director, New Jersey Regional Computer Forensics Laboratory
“Without digital forensics, it would be hard to get a conclusion in a lot of cases,” said Walsh, who noted the very nature of modern communications makes the work of the FBI more challenging. “Suspects aren’t talking on the phone anymore and our technical techniques are not working as well because so much more is encrypted. I pull in the NJRCFL very early in my investigative strategy.”
Within two decades, digital evidence went from a specialty handled by a few FBI personnel with the technical know-how to be digital forensics examiners to an absolute necessity in law enforcement agencies large and small. The FBI now has digital forensics experts in every field office and supports a network of digital forensics laboratories.
The FBI’s 17 RCFLs are strategically located throughout the country to support state and local agencies in the proper handling and examination of digital evidence, along with reporting and providing expert testimony on what is found. The newest RCFL opened just last month to better serve agencies in New England. RCFLs will take cases from non-participating agencies that are within their service area and sometimes non-participating agencies outside their service area, as resources allow.
Each RCFL works as a partnership, with participating agencies providing staff to the lab. In return, the entire participating agency is able to access the lab’s full services, and the personnel who work at the lab gain invaluable training and expertise to bring back to their home department. “RCFLs are an enhancement in manpower,” said Newman of his New Jersey facility. “The agency is not losing a person, but gaining many forensic experts.”
Newman describes the role of the digital forensics examiner as a “dispassionate scientist” who offers results from the examination without bias or prejudgment. “Our role is to make the data understandable and available in a readable format for the investigator,” he said. Walsh said in the case of the New Jersey men, she was in regular contact with the NJRCFL examiners to sort through and understand the evidence gleaned from the men’s devices and computers.
The examiners also act as technical witnesses in courtroom testimony if the case reaches trial. “One of the more challenging jobs during testimony is to explain very technical information to a non-technical jury,” said Newman.
The other challenge is staying on top of rapidly changing tools and technologies. Newman and Walsh both said those who seek to break the law work hard to stay a step ahead of investigative techniques.
“Technology has changed what we do,” said Newman. “It has impacted us in areas such as security and encryption, but it has pushed us to pursue the development of additional tools and techniques.”