U.S. Department of StateBureau of Diplomatic SecurityOffice of Antiterrorism Assistance ProgramMichael C. Alcorn – Cyber Training Program Manager
DS/ATAOffice of Antiterrorism Assistance3Created by U.S. Congress in 1983Provide antiterroism assistance to strengthen bilateral ties between U.S. and foreign allies.Provide training and equipment to deter terrorism.Trained over 57,000 people from 151 countries since 1984Implemented by the Bureau of Diplomatic SecurityOperates through U.S. Embassies
Course OfferingsResponseManagementInvestigationsMajor Case ManagementTerrorist Crime Scene InvestigationsFraudulent Travel DocumentsIntro to Digital Forensics and InvestigationsInvestigative Information ManagementBorder Control ManagementCritical Incident ManagementSenior Crisis ManagementCombatting Domestic and Transnational TerrorismExecutive Seminar on Digital InvestigationsExplosive Incident CountermeasuresCanine Explosive Detector CourseCrisis Response Team TrainingWeapons of Mass DestructionOffice of Antiterrorism Assistance4
Office of Antiterrorism Assistance5Enter your own text hereATA Cyber Training Program
ATA Cyber Training MissionProvide skills-based investigative, policy, IT security training and equipment to partner nations that culminates in a tangible and long-term increase in their ability to mitigate cyber threats from terrorists and criminals.Office of Antiterrorism Assistance6
Office of Antiterrorism Assistance7JordanThailandKenyaTurkeyKazakhstanMoroccoTrinidadColombiaSenegalUgandaEgyptIndonesiaMalaysiaIndiaPakistanGeorgia
ATA Cyber Training TimelineOffice of Antiterrorism AssistanceEquipment grants and capacity building became the norm.Regional information sharing and terrorist use of the internet conferences began.Program started with single cyber terrorism overview course.Cellular forensics, Internet and audio/video forensics courses developed.Program shifted to become more hands-on in nature.8
Create and enhance awareness among top level government and law enforcement executives.Provide expertise in the prosecution of cyber crime.Promote regional and global information exchange and collaboration.Provide first responder and incident response training.Provide guidance on basic investigative skills and evidence preservation.Progress country from basic to advanced computer forensics.Establish professional networking among international peers.Assist with staffing, training, and operating procedures.Nexus between CERTS and law enforcement.Provide fundamental IT Administrative and network security training.IT SecurityThree Areas of FocusOffice of Antiterrorism Assistance9Law EnforcementExecutive and Policy Level
ATA Cyber Training ProcessStep 1Conduct cyber assessments and establish relatinships.
Establish senior level awareness and buy-in to broad training strategic plan.Step 2Deliver courses related to basic evidence recognition and seizure. Establish train-the-trainer program.
Provide enabling equipment grant - operationalizeStep3Provide basic, intermediate and advanced technical skills – Hands-on forensics, investigative skills, network security.
Cyber unit management training.Step4Provide prosecutorial training.
Professional networking and regional integration.Office of Antiterrorism Assistance10
Office of Antiterrorism Assistance11
Office of Antiterrorism Assistance12
Executive Seminar on Digital Investigations and SecurityCyber Awareness Seminar for ProsecutorsRegional Conference Terrorist Use of the InternetCyber Unit Management Consultation – Washington D.C.Identification and Seizure of Digital EvidenceIntroduction to Digital Forensics and InvestigationsProactive Internet Investigations CourseCellular Communication Forensic ConsultationDigital Forensic Grant and ConsultationAdvanced Digital Forensic ConsultationCyber Unit Management ConsultationEncase and FTK training and certification coursesAudio/Video Forensics ConsultationFundamentals of Network SecurityInformation Security Technology ConsultationCERT and Law Enforcement ForumATA Cyber CoursesIT SecurityOffice of Antiterrorism Assistance13Law EnforcementExecutive and Policy Level
Regional Conference on Terrorist Use of the InternetOffice of Antiterrorism Assistance14Three-Day Event – Senior Law Enforcement, Legislators, and Government Officials  Create and foster regional relationships among the participating countries.Emphasize the importance of regional and eventual global multilateral collaboration in combating terrorist use of the Internet.Suggest and discuss specific regional policies and strategies essential to disciplined information sharing, building of critical relationships, investigatory and prosecutorial cooperation and resource sharing.  Develop a useful, cost-effective model that can be replicated in other regions, and that can contribute to an eventual globally-connected network.
SustainmentEstablish productive and trusting relationships at all levels.Provide channels of communication to key law enforcement and U.S. based corporations.Provide organizational advice and global perspective on cyber issues.15
Questions & AnswersOffice of Antiterrorism Assistance16
Thank you!ContactU.S. Department of StateBureau of Diplomatic SecurityOffice of Antiterrorism AssistanceMichael C. AlcornCyber Training Program ManagerPhone: 1-571-236-3272Email: alcornm@state.gov2230 Gallows RoadDunn Loring, Virginia 22027USAOffice of Antiterrorism Assistance17
CybercrimeA Global Overview of the Role of “Borderless Partnerships” in assisting Law Enforcement and Public Safety efforts.
Since we are dealing with human beings-LET’S NOT FORGET…The Seven Deadly sins of Anger, Greed, Envy, Sloth, Pride, Gluttony and Lust all exist in the ‘online’ world and have been automated and magnified……basically the GLOBALIZATION OF CRIME over the Internet has occurred….and is accelerating.There are almost no ‘new crimes’ under the sun….just new twists….like exploiting trust electronically…
Would YOU click on this email if it were sent to you from a “Trusted Source”-like your lawyer?
If you did, your bank account details, then your money, went on a world tour...all in 10 minutes.UkraineGhanaSeychellesNo Cyber crime law or extradition treaty for Cyber Crimes exists in many countries but GREAT Internet Connections and Electronic Funds Transfer networks are everywhere!
FBI Threat Focus Cell model used to leverage global co-operationLargest computer intrusion threat to US financial industry – past 21 monthsFinancial Threat Focus CellPending cases:	390Attempted losses:	$220 millionActual losses:		$70 millionTrident BreACH – three prong approach	- Virus/Malware creators	- Malware exploiters / Core organizers	- Money Mule organizations
Global Reach of ACH Fraud390$220M $70M300+3500+Total FBI cases:Attempted loss:Actual loss:Victims:Mules: mule organizationmalware coder/malware exploiters victimsLaw Enforcement Response To Date:United States:  92 charged and 39 arrested
United Kingdom:  20 arrested and 8 search warrants
Ukraine:  5 detained and 8 search warrants
A classic case of Global Co-Operation.Excellent Multi-Agency PartnershipsIC3-www.ic3.gov-Internet Crime Complaint Center, a collaboration between FBI, Bureau of Justice Assistance and the National White Collar Crime Center.DHS-US Computer Emergency Response Team (US-CERT) and the G-First portalFBI-Department of State Anti-Terrorism Assistance Cyber outreach and training initiatives globally.U.S.S.S. Electronic Crimes Task Forces in 24 regions around the the U.S.
The worlds Electronic Economy and communications networks have become fully borderless.….Yet all criminal and civil laws of every nation state are defined by national borders….High Speed-High Bandwidth Internet connectivity is expanding rapidly to all corners of the earth.Second and Third world nations have jumped past landlines and are installing 3G and 4G wireless networks-Africa is on the cusp of the Internet revolution….
Remember when Africa seemed really, really far away….Don’t worry, Africa is coming to you and can instantly be in your ‘electronic’ back yard…or living in your computer at work or home.
African Undersea CablesLatest update: 17 Aug 2010                                                                                                                                                                                                                                                                           
African FBI Legal Attaches
How many FBI Agents do you think are posted on the entire African Continent??On a good day…maybe 20.  Add to that maybe another 10 Other U.S. Government Law Enforcement Agency personnel….to cover 56 countries in Africa.Geography and mathematics alone dictate that ‘we’ must work closely with local law enforcement agencies and develop effective and efficient partnerships.
The Virtual Jihad: Terrorist Use of the Internet
Exploitation of Internet-Based TechnologiesWhy terrorists use the InternetFastEasy accessBroad audienceLittle or no regulation or censorshipRich multimedia environmentInexpensiveAnonymousInternet is a battlefield in the Global War on TerrorismInternet tools and services enhance terrorist capabilitiesCommunicationCommand and controlPropaganda and psychological warfareRadicalization and recruitmentTrainingOperational planningFundraising
Successful U.S. led Global Coordination effortsThe established group of 8 (G8)- 24 hour/7 day a week network contact list links national police agencies or Justice ministry officials-currently 54 countries out of 187 countries represented by Interpol actively participate.DHS-USCERT has taken the lead in coordinating with over 20 national CERT’s globally to share actionable  intelligence, threat vectors and mitigation strategies.FBI has 62 Legal Attache offices worldwide, staffed with between 2 and 6 Agents. They are the liaisons for US and Interpol law enforcement requests.  USSS has 17 offices overseas.

Mike Alcorn presentation

  • 1.
    U.S. Department ofStateBureau of Diplomatic SecurityOffice of Antiterrorism Assistance ProgramMichael C. Alcorn – Cyber Training Program Manager
  • 2.
    DS/ATAOffice of AntiterrorismAssistance3Created by U.S. Congress in 1983Provide antiterroism assistance to strengthen bilateral ties between U.S. and foreign allies.Provide training and equipment to deter terrorism.Trained over 57,000 people from 151 countries since 1984Implemented by the Bureau of Diplomatic SecurityOperates through U.S. Embassies
  • 3.
    Course OfferingsResponseManagementInvestigationsMajor CaseManagementTerrorist Crime Scene InvestigationsFraudulent Travel DocumentsIntro to Digital Forensics and InvestigationsInvestigative Information ManagementBorder Control ManagementCritical Incident ManagementSenior Crisis ManagementCombatting Domestic and Transnational TerrorismExecutive Seminar on Digital InvestigationsExplosive Incident CountermeasuresCanine Explosive Detector CourseCrisis Response Team TrainingWeapons of Mass DestructionOffice of Antiterrorism Assistance4
  • 4.
    Office of AntiterrorismAssistance5Enter your own text hereATA Cyber Training Program
  • 5.
    ATA Cyber TrainingMissionProvide skills-based investigative, policy, IT security training and equipment to partner nations that culminates in a tangible and long-term increase in their ability to mitigate cyber threats from terrorists and criminals.Office of Antiterrorism Assistance6
  • 6.
    Office of AntiterrorismAssistance7JordanThailandKenyaTurkeyKazakhstanMoroccoTrinidadColombiaSenegalUgandaEgyptIndonesiaMalaysiaIndiaPakistanGeorgia
  • 7.
    ATA Cyber TrainingTimelineOffice of Antiterrorism AssistanceEquipment grants and capacity building became the norm.Regional information sharing and terrorist use of the internet conferences began.Program started with single cyber terrorism overview course.Cellular forensics, Internet and audio/video forensics courses developed.Program shifted to become more hands-on in nature.8
  • 8.
    Create and enhanceawareness among top level government and law enforcement executives.Provide expertise in the prosecution of cyber crime.Promote regional and global information exchange and collaboration.Provide first responder and incident response training.Provide guidance on basic investigative skills and evidence preservation.Progress country from basic to advanced computer forensics.Establish professional networking among international peers.Assist with staffing, training, and operating procedures.Nexus between CERTS and law enforcement.Provide fundamental IT Administrative and network security training.IT SecurityThree Areas of FocusOffice of Antiterrorism Assistance9Law EnforcementExecutive and Policy Level
  • 9.
    ATA Cyber TrainingProcessStep 1Conduct cyber assessments and establish relatinships.
  • 10.
    Establish senior levelawareness and buy-in to broad training strategic plan.Step 2Deliver courses related to basic evidence recognition and seizure. Establish train-the-trainer program.
  • 11.
    Provide enabling equipmentgrant - operationalizeStep3Provide basic, intermediate and advanced technical skills – Hands-on forensics, investigative skills, network security.
  • 12.
    Cyber unit managementtraining.Step4Provide prosecutorial training.
  • 13.
    Professional networking andregional integration.Office of Antiterrorism Assistance10
  • 14.
  • 15.
  • 16.
    Executive Seminar onDigital Investigations and SecurityCyber Awareness Seminar for ProsecutorsRegional Conference Terrorist Use of the InternetCyber Unit Management Consultation – Washington D.C.Identification and Seizure of Digital EvidenceIntroduction to Digital Forensics and InvestigationsProactive Internet Investigations CourseCellular Communication Forensic ConsultationDigital Forensic Grant and ConsultationAdvanced Digital Forensic ConsultationCyber Unit Management ConsultationEncase and FTK training and certification coursesAudio/Video Forensics ConsultationFundamentals of Network SecurityInformation Security Technology ConsultationCERT and Law Enforcement ForumATA Cyber CoursesIT SecurityOffice of Antiterrorism Assistance13Law EnforcementExecutive and Policy Level
  • 17.
    Regional Conference onTerrorist Use of the InternetOffice of Antiterrorism Assistance14Three-Day Event – Senior Law Enforcement, Legislators, and Government Officials Create and foster regional relationships among the participating countries.Emphasize the importance of regional and eventual global multilateral collaboration in combating terrorist use of the Internet.Suggest and discuss specific regional policies and strategies essential to disciplined information sharing, building of critical relationships, investigatory and prosecutorial cooperation and resource sharing.  Develop a useful, cost-effective model that can be replicated in other regions, and that can contribute to an eventual globally-connected network.
  • 18.
    SustainmentEstablish productive andtrusting relationships at all levels.Provide channels of communication to key law enforcement and U.S. based corporations.Provide organizational advice and global perspective on cyber issues.15
  • 19.
    Questions & AnswersOfficeof Antiterrorism Assistance16
  • 20.
    Thank you!ContactU.S. Departmentof StateBureau of Diplomatic SecurityOffice of Antiterrorism AssistanceMichael C. AlcornCyber Training Program ManagerPhone: 1-571-236-3272Email: alcornm@state.gov2230 Gallows RoadDunn Loring, Virginia 22027USAOffice of Antiterrorism Assistance17
  • 21.
    CybercrimeA Global Overviewof the Role of “Borderless Partnerships” in assisting Law Enforcement and Public Safety efforts.
  • 22.
    Since we aredealing with human beings-LET’S NOT FORGET…The Seven Deadly sins of Anger, Greed, Envy, Sloth, Pride, Gluttony and Lust all exist in the ‘online’ world and have been automated and magnified……basically the GLOBALIZATION OF CRIME over the Internet has occurred….and is accelerating.There are almost no ‘new crimes’ under the sun….just new twists….like exploiting trust electronically…
  • 23.
    Would YOU clickon this email if it were sent to you from a “Trusted Source”-like your lawyer?
  • 24.
    If you did,your bank account details, then your money, went on a world tour...all in 10 minutes.UkraineGhanaSeychellesNo Cyber crime law or extradition treaty for Cyber Crimes exists in many countries but GREAT Internet Connections and Electronic Funds Transfer networks are everywhere!
  • 25.
    FBI Threat FocusCell model used to leverage global co-operationLargest computer intrusion threat to US financial industry – past 21 monthsFinancial Threat Focus CellPending cases: 390Attempted losses: $220 millionActual losses: $70 millionTrident BreACH – three prong approach - Virus/Malware creators - Malware exploiters / Core organizers - Money Mule organizations
  • 26.
    Global Reach ofACH Fraud390$220M $70M300+3500+Total FBI cases:Attempted loss:Actual loss:Victims:Mules: mule organizationmalware coder/malware exploiters victimsLaw Enforcement Response To Date:United States: 92 charged and 39 arrested
  • 27.
    United Kingdom: 20 arrested and 8 search warrants
  • 28.
    Ukraine: 5detained and 8 search warrants
  • 29.
    A classic caseof Global Co-Operation.Excellent Multi-Agency PartnershipsIC3-www.ic3.gov-Internet Crime Complaint Center, a collaboration between FBI, Bureau of Justice Assistance and the National White Collar Crime Center.DHS-US Computer Emergency Response Team (US-CERT) and the G-First portalFBI-Department of State Anti-Terrorism Assistance Cyber outreach and training initiatives globally.U.S.S.S. Electronic Crimes Task Forces in 24 regions around the the U.S.
  • 30.
    The worlds ElectronicEconomy and communications networks have become fully borderless.….Yet all criminal and civil laws of every nation state are defined by national borders….High Speed-High Bandwidth Internet connectivity is expanding rapidly to all corners of the earth.Second and Third world nations have jumped past landlines and are installing 3G and 4G wireless networks-Africa is on the cusp of the Internet revolution….
  • 31.
    Remember when Africaseemed really, really far away….Don’t worry, Africa is coming to you and can instantly be in your ‘electronic’ back yard…or living in your computer at work or home.
  • 32.
    African Undersea CablesLatestupdate: 17 Aug 2010                                                                                                                                                                                                                                                                           
  • 33.
  • 34.
    How many FBIAgents do you think are posted on the entire African Continent??On a good day…maybe 20. Add to that maybe another 10 Other U.S. Government Law Enforcement Agency personnel….to cover 56 countries in Africa.Geography and mathematics alone dictate that ‘we’ must work closely with local law enforcement agencies and develop effective and efficient partnerships.
  • 35.
    The Virtual Jihad:Terrorist Use of the Internet
  • 36.
    Exploitation of Internet-BasedTechnologiesWhy terrorists use the InternetFastEasy accessBroad audienceLittle or no regulation or censorshipRich multimedia environmentInexpensiveAnonymousInternet is a battlefield in the Global War on TerrorismInternet tools and services enhance terrorist capabilitiesCommunicationCommand and controlPropaganda and psychological warfareRadicalization and recruitmentTrainingOperational planningFundraising
  • 37.
    Successful U.S. ledGlobal Coordination effortsThe established group of 8 (G8)- 24 hour/7 day a week network contact list links national police agencies or Justice ministry officials-currently 54 countries out of 187 countries represented by Interpol actively participate.DHS-USCERT has taken the lead in coordinating with over 20 national CERT’s globally to share actionable intelligence, threat vectors and mitigation strategies.FBI has 62 Legal Attache offices worldwide, staffed with between 2 and 6 Agents. They are the liaisons for US and Interpol law enforcement requests. USSS has 17 offices overseas.
  • 38.
  • 39.
  • 40.
  • 41.
  • 42.
  • 43.
    American LawEnforcement and Public Safety authorities cannot succeed without the active support, cooperation and technical assistance of other Law Enforcement Agencies around the world.