Covering one’s tracks
The concept of cyberoperational security, or cyber-opsec, is both a thread running through every session and a standalone lecture during the course.
Many people don’t realize that investigating e-mail and Web sites also leaves identifying traces, unless you take steps to hide your tracks.
Consequently, in tracking terrorists, protecting one’s identity is paramount, especially for agents with families.
“Pedophiles won’t hunt you down, but these guys will—there have been documented cases,†Grubb warned the class. “Every time you sit down, use opsec.â€
A detective with a large metropolitan police department in the Northeast was a guest lecturer for this segment. On the front lines of terrorist-hunting himself, he laid out the best way to approach the task.
“Buy a computer with no ties to you,†the detective said. “Buy one at a flea market,†then wipe the hard drive completely. Buy a bunch of network interface cards and swap them out, so the machine will look different each time, he suggested, and use a different operating system each time. Never use your home computer for investigative work.
Go to the library
Grubb added other suggestions: Go to different places, such as public libraries, to do the work. Use a safe house if you are conducting major operations. And most important, don’t become predictable.
There is software available that will configure a “virtual machine†within a computer, the detective said, so that transactions can’t be traced back to a real computer. He suggested setting up a virtual machine for every single case. Set up undercover Internet accounts and use anonymizers—free services available on the Internet to further cover one’s tracks.
There are a wide range of software applications, most of them shareware or freeware, that can be used for “network penetration,†actually peering into a suspect Web site or the contents of an individual’s computer.
Other tools can capture every action an agent takes as he probes cyberspace, recording keystrokes or caching Web pages as they are viewed, to allow for more leisurely examination later on. Yet other tools will capture e-mail traffic, even instant messages.
“All of these steps to date must be done before going to your first [suspicious] Web site,†Grubb told the class. “When you’re taking a ‘snapshot,’ be sure to be anonymous, because you’re actually finally touching them. ... When all of a sudden every single page is being hit, you’re lighting them up like a Christmas tree.â€
The enemy’s tools
The agents in the class were given disks with many of these tools, and the detective directed them through some exercises so they could begin to get familiar with their use.
“This is our arsenal, and if you don’t think the bad guys have these, you’re dreaming,†he said.