NW3C Board

C
of Directors
hairman

Glen B. Gainer, III

West Virginia State Auditor’s Office

Non-Regional Director Non-Regional Director

Attorney General Jim Hood Captain Bill Williams

Mississippi Attorney General’s Office Los Angeles (CA) Police Department

Northeast Mountain

Christopher Cotta, Administrative Director Lieutenant Tom Jarvie

Rhode Island Office of the Attorney General Green River (WY) Police Department
J:
K?i
'l
Great Lakes South Central

Major Larry Turner Assistant Attorney General Tom McCormick

Indiana State Police Louisiana Department of Justice

Mid-Atlantic Southeast

Sheriff Michael Brown Captain Corbett Lewis

Bedford County (VA) Sheriff’s Office South Carolina Law Enforcement Division

Midwest West

Detective Ken Nix Sean M. Rooney, Senior Enforcement Attorney

Clayton (MO) Police Department California Department of Corporations

The mission of the National White Collar Crime Center (NW3C) is to provide training, investigative support and research to agencies and entities involved in
the prevention, investigation and prosecution of economic and high-tech crime. NW3C is a non-profit organization serving more than 4,000 member agencies
in all 50 states, four U.S. territories and 15 countries. Membership in NW3C is free.

2 INFORMANT: FALL 2012

 Notes from the Director

Advocate for
NW3C Law Enforcement

A
s you can see from the scope of forcement. We also provide information
the articles in this issue of the about our new partnership with X1 Dis-
Informant, law enforcement covery and updates about existing part-
Executive Staff continues to face significant challeng- nerships with other agencies and entities
es in the ever-increasing number and that support law enforcement, such as the
Don Brackman, Director
Ken Brooks, Deputy Director types of economic and cybercrime that Internet Crimes Against Children Task
Dave Cummings, Deputy Director are committed every day. Because these Forces (ICAC), the National Institute of
Mark Gage, Deputy Director crimes impact every aspect of life in the Standards and Technology (NIST), and
Mary-Ellen Kendall, General Counsel United States, state, local and tribal law the West Virginia Cyber Crime Coop-
enforcement officers are on the front erative (WV3C).
Editorial Staff lines in the battle to protect their com- In addition to the challenges facing
Kim Williams, Manager munities from fraud. law enforcement in protecting their com-
Beth Singer, Senior Writer and Editor NW3C’s mission is to provide train- munities, we must always be aware of
Ty Bowers, Print and Multi-Media ing, research, and investigative support the dedicated men and women who gave
Content Coordinator to assist law enforcement in address- their lives in the performance of their du-
Lindsey Bousfield, Graphic Designer ing economic and cybercrime. As part ties. Unfortunately, August is now the
of NW3C’s ongoing efforts to support deadliest month this year with eighteen
Other Contributors law enforcement, this issue features in- law enforcement officers killed in the line
Nicole Stiles, Curriculum Developer formation and tips on crimes involving of duty. Please take a moment to read the
April Wall-Parker, Curriculum Developer the theft of intellectual property, prepaid names of our fallen heroes in this issue
cards, social media, online gaming, smart and reflect on their sacrifices for all of us.
Contact Us phones and identity theft, school sys- Even as we face cultural and eco-
On the Internet: www.nw3c.org tem embezzlement, and Internet–related nomic changes, NW3C will continue to
Member Services: 804-967-6210 frauds and scams. We also highlight the live up to its mission to serve state, lo-
membership@nw3c.org key contributions to NW3C and the State cal and tribal law enforcement agencies
of West Virginia that have been made by nationwide by expanding our support
Investigative Support: 800-221-4424, ext. Glen B. Gainer, III, State Auditor for West services and resources in order to keep
3520 Virginia and Chairman of NW3C’s Board law enforcement at the cutting-edge of
Training: 877-628-7674, ext. 2234 of Directors. the latest methods in training and white
IC3: 800-251-3221 To help law enforcement identify, collar crime investigations. NW3C is
www.ic3.gov investigate, and prosecute cybercrime, fortunate to have enthusiastic and hard-
https://icsis.nw3c.org NW3C has developed the training cours- working employees who truly believe in
es and forensic tools that are described our mission, and Board of Directors who
in the article discussing the services our unselfishly dedicate their time and talent
Computer Crime Section staff can pro- to help guide the organization.
vide to law enforcement agencies. I welcome your comments and ideas
Since its inception, NW3C has on how NW3C can work with your
Search: NationalWhiteCollarCrime worked to develop partnerships with law agency. I may be reached at dbrackman@
enforcement agencies, educational insti- nw3c.org or 877-628-7674. 
tutions and the private sector that enable
NW3C to offer additional cutting-edge Don Brackman
resources as they are needed by law en- Director, NW3C
@NW3CNews

This project was supported by Grant No. 2011-BE-BX-K002 awarded by the Bureau of Justice Assistance. The Bureau of Justice Assistance is a component of the Office of Justice Programs,
which also includes the Bureau of Justice Statistics, the National Institute of Justice, the Office of Juvenile Justice and Delinquency Prevention, the Office for Victims of Crime, and the Office of
Sex Offender Sentencing, Monitoring, Apprehending, Registering, and Tracking. Points of view or opinions in this document are those of the author and do not necessarily represent the official
position or policies of the U.S. Department of Justice. The National White Collar Crime Center (NW3C) is the copyright owner of this document. This information may not be used or reproduced
in any form without express written permission of NW3C. For questions or additional information, please contact Kimberly Williams, Communications Manager at 1-800-221-4424 ext. 3320
or kwilliams@nw3c.org. NW3CTM, IC3® and ICSISTM are trademarks of NW3C, Inc. and may not be used without written permission.
© 2012. NW3C, Inc. d/b/a the National White Collar Crime Center. All rights reserved. Bureau of Justice Assistance
U.S. Department of Justice

WWW.NW3C.ORG 3
 Remembering Our
Fallen Heroes*
April - August 2012
Deputy Sheriff Sergio Aleman
Milwaukee County Sheriff ’s Office, WI
Police Officer Kevin Ambrose
Springfield Police Department, MA
Trooper Amanda Anna
New York State Police, NY
Constable Brian Bachmann
Brazos County Constable’s Office - Precinct 1, TX
Corporal Marshall Lee Bailey
West Virginia State Police, WV
Trooper Aaron Beesley
Utah Highway Patrol, UT
V Correctional Officer Timothy Betts
Indiana Department of Correction, IN
Detective Jeremy Bitner
Englewood Police Department, CO
Correctional Officer Nikki Bostic-Jones
Cook County Sheriff’s Office - Department of Corrections, IL
Border Patrol Agent Leopoldo Cavazos, Jr.
United States Department of Homeland Security - Customs and
Border Protection - United States Border Patrol, US
Reserve Deputy Sheriff William Charles “Charley” Coen
Harper County Sheriff ’s Office, OK
Sergeant Robert Warren “Bobby” Crapse, Sr.
Bryan County Sheriff ’s Office, GA
Captain Leide DeFusco
Pueblo County Sheriff ’s Office, CO
Border Patrol Agent James R. Dominguez
United States Department of Homeland Security - Customs and
Border Protection - United States Border Patrol, US
Sergeant Maxwell Dorley
Providence Police Department, RI
Patrolman Avery Freeman
Chester Police Department, PA
Master Police Officer Jeremiah M. Goodson, Jr.
Lumberton Police Department, NC
Deputy Sheriff Brian Hayden
Choctaw County Sheriff ’s Office, OK
Deputy Sheriff Dewayne Charles Hester
Bladen County Sheriff ’s Office, NC
Police Officer Celena Hollis
Denver Police Department, CO
Police Officer Brian Lorenzo
Philadelphia Police Department, PA
Police Chief Michael P. Maloney
Greenland Police Department, NH
Police Officer Justin Maples
Cleveland Police Department, TN
Deputy Sheriff William Mast, Jr.
Watauga County Sheriff ’s Office, NC
4 INFORMANT: FALL 2012
Probation / Parole Officer Jeffrey McCoy
Oklahoma Department of Corrections, OK
Deputy Sheriff Josh Mitchell
Reagan County Sheriff ’s Office, TX
Police Officer Chad Morimoto
Honolulu Police Department, HI
Police Officer I Adrian Morris
Prince George’s County Police Department, MD
Senior Officer Jaime Padron
Austin Police Department, TX
Deputy Sheriff Robert Paris
Stanislaus County Sheriff ’s Department, CA
Postal Inspector Preston Boyd Parnell
United States Postal Inspection Service, US
Police Officer Robert A. Potter
New Mexico Motor Transportation Police, NM
Chief of Police Herbert Proffitt
Tompkinsville Police Department, KY
Agent Wilfredo Ramos-Nieves
Puerto Rico Police Department, PR
Patrolman Christopher Reeves
Millville Police Department, NJ
Deputy Sheriff Michael Smith
Upton County Sheriff ’s Department, TX
Agent Victor Manuel Soto-Velez
Puerto Rico Police Department, PR
Police Officer Forrest “Dino” Taylor
Baltimore City Police Department, MD
Police Officer Jose Torres
Westfield Police Department, MA
Deputy Sheriff Jeremy Triche
St. John the Baptist Parish Sheriff ’s Office, LA
Deputy Sheriff Ryan Tvelia
Norfolk County Sheriffs’ Office, MA
Police Officer Matthew Tyner
Colorado Springs Police Department, CO
Police Officer Moses Walker, Jr.
Philadelphia Police Department, PA
Investigator Michael J. Walter
Pearl Police Department, MS
Deputy Sheriff David Wargo
Maricopa County Sheriff ’s Office, AZ
Deputy Sheriff Josh Williams
Waxahachie Police Department, TX
Trooper Eric M. Workman
West Virginia State Police, WV
Correctional Officer William Wright
North Carolina Department of Public Safety -
Division of Adult Correction, NC
*Source www.odmp.org (as of 09/13/12)
 Table of Contents
Informant Fall 2012

6 Glen B. Gainer, III: Advocate for Law Enforcement Collaboration and Training

17 Law Enforcement Leaders Participate in State of the States Cybercrime Consortium

22 Theft and Money Laundering: Welcome to the Dark Side of Prepaid Cards

10 NW3C Members in the News 20 NW3C Outreach Training Highlights Social

Media Investigations
12 Fake Products, Real Crime: Intellectual
Property Theft 25 Targeting Fraud - Safeguarding Integrity
Conference
14 Kristen Mahoney Sworn in as Bureau of Justice
Assistance Deputy Director of Policy 26 Embezzlement - Another Problem Facing
Our School Systems
15 Confirmation Bias: Can We Really Avoid It?
28 Smart Phones and Identity Theft
16 X1 Discovery and NW3C Partner to Address
Social Media and Internet Evidence 30 Internet Crime Complaint Center
(IC3) Alerts
18 NW3C’s Computer Crime Section: A Key Ally
in the Fight Against Cybercrime

Who We Are
NW3C, a non-profit membership organization dedicated to supporting law enforcement in the prevention, investigation
and prosecution of economic and high-tech crime, has been continuously funded through competitive grants for over three
decades. NW3C’s membership consists of law enforcement agencies from all 50 states and four continents.
WWW.NW3C.ORG 5
 NW3C Feature

“Being a part of the early days of NW3C was so inspiring to me personally and
professionally because it brought together this group of talented and forward-
thinking people that really set the stage for the NW3C that exists today. The
infectious synergy of this organization is why I’m still involved. NW3C has driven
me to do more in my office because of the collaboration that happens.”

G
len B. Gainer, III, West Virginia State Auditor state millions of dollars while enhancing fraud preven-
and Chairman NW3C’s Board of Directors, tion and increasing accountability. The State Purchas-
has proven to be a loyal and dedicated ser- ing Card Program, recognized by VISA International as
vant to the state of West Virginia. In his own words, “one of the nation’s best,” has also improved relations
Auditor Gainer chose a career in public service simply
because he cares about people and their communities.
Prior to being elected West Virginia’s 19th State Audi-
tor in November 1992, Auditor Gainer worked with
the state Treasurer’s Office and the state Department
of Energy. As State Auditor, a position he has held for
two decades, Auditor Gainer serves as the state’s offi-
cial bookkeeper, Chief Inspector and Supervisor over
Public Offices, Securities Commissioner and over-
sees law enforcement activity within these areas. He
recognizes the importance of being in tune with the
community, which is evidenced by his prolific public
outreach and his exhibited passion for protecting the
financial well-being of the citizens in his state.
Among the many successful programs Auditor
Gainer has implemented during his time in office, the
West Virginia State Purchasing Card Program stands
West Virginia State Auditor and NW3C Board of
out. This initiative streamlined the payment process by
Directors Chairman Glen Gainer (left) visits with
bringing all state agencies into one program, saving the
NW3C Director Don Brackman.

6 INFORMANT: FALL 2012

 NW3C Feature
with vendors, attracting more busi-
ness to the state of West Virginia.
Launched in September 2011, the
West Virginia Transparency initiative
is a centerpiece of Auditor Gainer’s
proactive approach to transparency
and protection of the state’s data. The
TransparencyWV.org website (http://
transparencyWV.org) allows tax pay-
ers the ability to see how their tax
dollars are spent. The site contains
information about state budgets, rev-
enue and expenditures, and includes
tips for understanding budget terms.
It also provides an opportunity for
First Sergeant Chris Casto of the West Virginia State Police (left), West Virginia
consumer feedback. According to Au-
Congresswoman Shelley Moore Capito (center) and Auditor Gainer discuss the
ditor Gainer, “The public has a right to
benefits of the NW3C Outreach for law enforcement in West Virginia.
know this information. Taxpayers are
our Board of Directors.” Auditor Gainer promotes educating the public about
Auditor Gainer understands the importance of pro- what is going on in their state. For the past eight years,
tecting the state’s data while ensuring taxpayers have the West Virginia State Auditor’s Office (WVSAO), in
access to important information about their state gov- cooperation with the West Virginia Library Commis-
ernment. The TransparencyWV.org website employs sion, has written and produced The State Dollar. This
validation measures to protect the state’s data and the television program informs the public about current
individuals represented in that data. Because of this ini- news and events affecting West Virginia. All episodes,
tiative, West Virginia has been recognized as a leader current and archived, are made available through the
in transparency in government, and has received a top WVSAO channel at YouTube™.
grade by the U.S. Public Interest Research Group (PIRG). As a West Virginia leader, he serves on many state
boards and commissions. Auditor Gainer’s influence,
however, extends far beyond the boundaries of the state.
Auditor Gainer has held leadership positions on several
national boards and associations, including most recent
president of the National Association of State Auditors,
Comptrollers and Treasurers; past President of the Na-
tional Electronic Commerce Coordinating Council; past
president of the National Association of Comptrollers;
member of the National Executive Committee of the As-
sociation of Government Accountants; and, for the past
14 years, Chairman of the National White Collar Crime
Center (NW3C) Board of Directors.
In his national positions, he has the advantage of
communicating with leaders from law enforcement
and regulatory agencies from across the country. This
interaction helps him gain an accurate perspective
on issues that are relevant across the nation, a per-
spective that drives his office philosophy. As Auditor
Director Brackman, Congressman Nick Rahall (center)
and Auditor Gainer, attended the NW3C Outreach in Gainer puts it, “We all have to work together for the
Beaver, West Virginia this past August. same common goal.”

WWW.NW3C.ORG 7
 NW3C Feature
Raleigh County (WV) Sheriff Steve Tanner (left), co-host of the called the World Wide Web first began to be
NW3C Social Media Investigation Outreach, advised Auditor Gainer used widely and there was a huge migration
that several detectives were in attendance to benefit from the valuable to get a presence on the web. No one had any
information presented.
Part of his responsibilities as State Auditor and
Chairman of NW3C’s Board of Directors include
advocating for law enforcement and enhancing re-
sources for those who investigate, prevent and pros-
ecute economic and high-tech crime.
What started as Auditor Gainer’s attendance at a meet-
ing in 1993 and election to the Board of Directors in 1994
has turned into nearly two decades of dedicated service to
NW3C. By his own account, Auditor Gainer had no inten-
tion of serving on the Board of Directors but once he real-
ized the potential impact the organization could have on a
national level, there was no turning back. Auditor Gainer
explained, “Being a part of the early days of NW3C was
so inspiring to me personally and professionally because
it brought together this group of talented and forward-
thinking people that really set the stage for the NW3C that
exists today. The infectious synergy of this organization is
why I’m still involved. NW3C has driven me to do more in
my office because of the collaboration that happens.”
Under his leadership, NW3C membership has in-
creased from less than a hundred law enforcement
agencies to over 4,000. NW3C also expanded on its
key service areas - training, research and investigative
support - and is now regarded as the leading national
resource for state and local law enforcement in the fight
against financial and cybercrime.
“Originally our primary focus was analytical support
and then we made the decision to venture into training and
research, which was a turning point for this organization.
8 INFORMANT: FALL 2012
Today, NW3C offers over 25 training courses in
areas of financial and cybercrime. This training
is free to all state, local and tribal law enforce-
ment and a great benefit, especially in these cur-
rent economic times when training budgets are
being cut,” said Auditor Gainer.
Another monumental endeavor was the
creation in 1999 of the Internet Fraud Com-
plaint Center, today known as the Internet
Crime Complaint Center (IC3®) which was
developed to address the growing problem
of online crime. The Internet has completely
transformed the way we all live our personal
lives and the way we do business. “I was on
the Board when this new and exciting thing
idea of what the ramifications would be. Now
people see the necessity for security, safe-
guards and protection,” reflected Auditor Gainer.
With the ever-changing world of technology, any per-
son or company can be a target of fraud, making train-
ing and education a top priority. Using multidisciplinary
experts on staff who work with professionals from across
the country, NW3C stays on the cutting edge of the latest
technologies and trends to continue to develop state-of-
the-art financial and cybercrime training. NW3C train-
ing brings law enforcement, prosecutors, attorneys gener-
al and regulators together in one classroom and provides
an opportunity for students to interact with peers and
build relationships which is an invaluable take-away from
all NW3C trainings. Students also receive hands-on expe-
rience, empowering them with necessary knowledge and
skills. “NW3C’s training is what I consider ‘world-class.’ It
is not just face-to-face, it’s hands-on, and that to me is the
best of both worlds,” said Auditor Gainer.
Auditor Gainer added, “I am a strong proponent
of training at all levels. I make sure that my staff re-
ceives various trainings throughout the year. Learn-
ing is something that you need to do every single
day of your life and in the workplace you can not get
enough training.” The West Virginia State Auditor’s
Office not only encourages training within, but it
also promotes training for other agencies in the state.
For example, the WVSAO coordinates annual train-
ing for the West Virginia Sheriffs’ Association which
brings together all 55 sheriffs in the state. “The more
 NW3C Feature

training we can do, the more we are helping state and port we receive from BJA ensures the needs of state,
local law enforcement, which in turn, helps the citi- local and tribal law enforcement and regulatory agen-
zens of our state,” explained Auditor Gainer. cies are met. I really do see NW3C as law enforcement’s
Technology has enabled agencies to utilize the Internet number one advocate and their number one resource,”
for web-based training and webinars. This type of train- said Auditor Gainer.
ing has increased in popularity because of reduced agency Auditor Gainer explained, “As a nation, we need to be
budgets and the practicality and convenience of receiving more proactive in preventing white collar crime. We need
the training without leaving the office. It is also an attrac- to make financial corporations more accountable to the
tive alternative for agencies that do not necessarily have public and there needs to be stronger laws and penalties
the resources (financial and personnel) to obtain needed imposed for those who are not good citizens. For those
training. Auditor Gainer notes, “In the state of West Vir- of us working in public service, protecting those we rep-
ginia we have a lot of small agencies that may only have resent is our passion because they are our neighbors, our
one person – they have to be there to serve the people of friends, and we are tied to each other.”
their jurisdiction but at the same
time they still need training.”
While face-to-face training
“We are out there with the boots on the
is optimal, there clearly is a need ground and know what they need. The
for both modalities. NW3C will
continue to offer a wide variety
continued support we receive from BJA
of face-to-face training while ensures the needs of state, local and trib-
also increasing the number of
web-based training opportuni- al law enforcement and regulatory agen-
ties to meet the needs of today’s cies are met. I really do see NW3C as law
law enforcement community.
Law enforcement and regu- enforcement’s number one advocate and
latory agencies will always face
challenges, especially with white
their number one resource.”
collar crime. There will always
be a need for more personnel, equipment and resourc- Through his many years of outstanding service
es. NW3C should be one of those valuable resources. and implementation of programs that work, it is clear
Building relationships is the key to success. NW3C’s that Auditor Glen Gainer is committed and dedicated
partnerships with Department of Justice (DOJ) com- to the state of West Virginia and the National White
ponents, such as the Bureau of Justice Assistance (BJA) Collar Crime Center. Both entities are very fortunate
and the Office of Juvenile Justice and Delinquency Pre- to have his full support and leadership. He credits his
vention (OJJDP), are the reason why NW3C can fulfill success to the philosophy, “Don’t look at things how
its mission to be a resource for state, local and tribal law they are, look at things as you want them to be. Don’t
enforcement. “We are out there with the boots on the be afraid to venture in new directions and create new
ground and know what they need. The continued sup- frameworks for the future.” 

Explorethe
Explore New NW3C
the New NW3C Website
Website
igation and
1 -
1 > Better organiz ation and t
ITA > Updated cont
> Integration wi
ite combined with main site
nw3c.org
WWW.NW3C.ORG 9
 NW3C Members

NW3C Members in the News

A great deal of hard work, cooperation and ingenuity goes into preventing and fighting white
collar crime, but the hard work can pay off in the end. Each of these member agencies were
featured in local or national news for their efforts and successes.

Clayton Fraud Case Gets Man Five Years in Prison

Clayton (MO) Police Department
St. Louis (MO) Metropolitan Police Department
Town and Country (MO) Police Department

S
everal law enforcement agencies worked together to solve a credit card fraud case in Clayton, MO. Robert
Page from Massachusetts was suspected of having traveled to St. Louis several times in 2010 to take credit
cards from health club lockers and then use them to purchase electronics.
The Clayton Police Department, the U.S. Secret Service, the St. Louis Metropolitan Police
Department and the Town and Country Police Department collaborated on the case and
Page pleaded guilty to credit card fraud and conspiracy to commit credit card fraud.
Page was sentenced to five years in prison and will have to pay $38,000 in restitution.
Two co-defendants were ordered to pay restitution as well. Jonathan Vendituoli has been
ordered to pay more than $88,000, while Kevin Cooney has been ordered to pay nearly
$50,000 in restitution.
At the time, Clayton police Chief Tom Byrne said the two were suspected of having broken into lockers at
Wellbridge Athletic Club and Spa.

Rhode Island Attorney General Fighting Medicaid Fraud and Patient Abuse
Rhode Island Office of the Attorney General
Pawtucket (RI) Police Department

A
ttorney General Peter Kilmartin is urging the public and patients to report Medicaid fraud and patient abuse with a new
online complaint form that will be directed to the Attorney General’s Medicaid Fraud Control and Patient Abuse Unit.
The Attorney General’s Medicaid Fraud Control and Patient Abuse Unit recently completed a two month investiga-
tion into a home health care fraud case, and with the assistance of detectives from the Pawtucket Police Department, the suspect,
Medeline Hernandez, was arrested on felony charges and arraigned.
The investigation into this fraud case was initiated by a referral from the Rhode Island Department of Human Services. The
Medicaid Fraud Control and Patient Abuse Unit enforces the laws pertaining to fraud in the state Medicaid program and prose-
cutes cases of abuse, neglect or mistreatment of patients in all state healthcare facilities. The Unit’s attorneys, auditors, investigators
and health care professionals employ a multidisciplinary approach to combat health care fraud and patient abuse.
Attorney General Kilmartin submitted legislation to the Rhode Island General Assembly that would require national back-
ground checks and certification of personal care assistants in an effort to reduce home health care fraud and to protect those who
are in need of that type of care. 

10 INFORMANT: FALL 2012

 NW3C Members

Milwaukee’s ‘Mind Blowing’ Law Enforcement Website

Milwaukee (WI) Police Department

T
he Milwaukee Police Department was recently featured in a Smithsonian.com blog (posted by Rachel Nuwer) highlighting
its new and innovative website. This website tackles crime in a state-of-the-art way.
The blog describes it as “a first-of-its-kind site for any U.S. law enforcement agency.” It stated “the unit invites citizens
to engage with the police through the web interface in order to prevent crime and stay informed.” The Milwaukee Journal Sentinel
also reported that the Department eliminated its weekly press briefings, and will post current investigation information, crime
statistics and videos on the site for accuracy and easy access for both journalists and the community.
The website includes live streams of crime rates, profiles of officers, most wanted lineups and memorials to fallen heroes. Break-
ing news is updated around the clock, and 3-D images create a visual effect that adds depth and movement to some photos featured
on the site. This new site can be found at www.milwaukeepolicenews.com. 

Tennessee Department of Safety & Homeland Security Announces New Identity Crimes Unit
Tennessee Department of Safety & Homeland Security

T
he Tennessee Department of Safety & Homeland Security Commissioner Bill Gibbons announced the formation of
a new investigative unit to combat the increase in identity theft and related crimes in
Tennessee. The newly formed Identity Crimes Unit is comprised of employees from
three divisions of the Department: Tennessee Highway Patrol, Office of Homeland Security and
Driver Services Division.
“Identity crimes are a growing part of our crime problem, and many local law enforcement
agencies struggle with investigating these cases. In addition, the Highway Patrol has specific au-
thority under state law to investigate identity theft. There are obvious homeland security concerns
with such crimes, and many identity crimes relate to driver licenses. So, we see it as a great op-
portunity for all three divisions of the Department—our state troopers, homeland security agents,
and driver license examiners—to work together as a team,” Gibbons stated in a release.
Local news reported that the Identity Crimes Unit will provide support to local law enforce-
ment upon request, but will consider several factors to determine the level of involvement. Some of these factors include fraudulent
use of a driver’s license; a nexus to homeland security issues; cooperation of victims; violation of Tennessee’s felony theft law; the
number, financial amount and frequency of transactions; and referral from a federal agency. Investigators and staff assigned to the
Identity Crimes Unit have been training for months to increase skills in the area of identity crimes and collect best practices for
this type of investigating from other states.
The Unit has created a resource kit for identity theft victims and has linked it to www.tn.gov/safety. Investigators will also par-
ticipate in programs and events to encourage identity theft awareness, distribute educational materials to safeguard against identity
crimes, and encourage the public to take proactive steps to reduce the debilitating impacts of identity crimes. 

We Want to Hear from You

Email informant@nw3c.org your story, experiences and comments about NW3C and also share
your successes with economic and high-tech crime cases.

WWW.NW3C.ORG 11
 NW3C Training
Fake Products, Real Crime:
Intellectual Property Theft
Training brings important topic to Iowa law enforcement
R
obert Hartnett asked for a show of hands: How
many in the room were paid largely with tax dol-
lars? In the room full of state, local and federal law
enforcement personnel, every hand was raised.
The show of hands was yet another reason why every
law enforcement professional in that training room in Des
Moines, IA should care about intellectual property (IP) crime,
said Hartnett, a private investigator specializing in IP crime
investigations and a retired Richmond (VA) Police Depart-
ment detective. IP crime hurts local communities and gov-
ernments. The people who sell counterfeit sports jerseys,
luxury goods, consumer electronics or medicine do not just
harm consumers and businesses, but they also cost local com-
munities jobs and deprive them of valuable tax revenue.
More than 30 members of Iowa law enforcement – most-
ly veteran officers from local police and sheriffs’ departments
– attended a July 24 session of “Fake Products, Real Crime:
Intellectual Property Theft,” a training program presented by
NW3C and the National Attorneys General Training and Re-
search Institute (NAGTRI). Collectively, those who attended
the training in Des Moines had hundreds of years of experi-
ence investigating many types of crime. However, none had
experience pursuing IP crime investigations.
For most of the day, attendees heard from Hartnett and
Scott Bailey, a Chesterfield County (VA) Police Department
detective, on how to spot IP violations, conduct investiga-
tions and collect evidence.
At its core, intellectual property theft is nothing new.
NAGTRI Program Director Judith McKee jokingly referred
to it as the “second-oldest profession” in the world. Citing
a historical account, McKee said a scientific comparison of
wine bottles dating to 27 B.C. showed that a Gallic merchant
counterfeited the markings of a popular vintage produced by
the Roman Senator Cassius and passed it off as his own.
The U.S. Chamber of Commerce puts the global value
of pirated consumer goods and counterfeits at $650 billion
annually. The U.S. loses $58 billion annually on copyright
violations alone.
Increasingly, violent criminals – gang members, drug
dealers, organized crime figures – engage in IP theft be-
cause they see it as a low-risk/high-reward proposition.
But how can a local police department or sheriff ’s office
begin to investigate these types of crimes? What should in-
vestigators look for? How can they spot counterfeit goods?
Hartnett and Bailey sought to answer these questions and
many more during the training session.
12 INFORMANT: FALL 2012
By Ty Bowers
“The test of counterfeiting is it has to be popular and
it has to be worth something,” Hartnett told law enforce-
ment in Des Moines. “These are parasites. They need
host companies.”
Hartnett scattered a number of items – sports jerseys,
purses, accessories, prescription pills, shoes – throughout
the room prior to the training. He asked participants to
survey the items and determine which ones they thought
were fakes and which ones they believed to be genuine ar-
ticles. Few could distinguish real from fake.
“This isn’t traditional junk anymore,” Hartnett said. “It’s
no longer easy to tell.”
Hartnett urged law enforcement in the room to con-
sult experts as they built IP crime cases. “Don’t be your
own expert,” he said. Collaboration with other agencies,
investigators and businesses can prove vital when bring-
ing a case to court and a
perpetrator to justice.
Organization and
planning are also crucial
to conducting IP investi-
gations, Detective Bailey
told the group. IP crimes
rarely occur in isolation.
Perpetrators usually are
involved in other forms Image courtesy of Robert Hartnett
of financial crime and Price and location can determine
fraud. “Always ask yourself: whether an item is real or counter-
Where are you going with feit. High-end luxury goods and
clothing do not sell for bargain
this investigation? How big
prices or in flea markets, swap
is it? Who’s involved?” meets or gas stations.
Above all else, Bailey
reminded them: “Docu-
ment. Document. Document.”
Near the end of the day, participants were given vari-
ous details from a real-life IP crime case and tasked with
determining how they might investigate it. The goal of the
exercise was to get these law enforcement professionals to
pursue an IP crime as they would any other case. “What is
a counterfeit [item] after all?” Bailey asked them. “It’s con-
traband, like narcotics.”
The NW3C/NAGTRI IP crime training continues
throughout the country, with multiple courses planned
into 2013. To learn more about the training, go to http://
www.nw3c.org/training/financial-crimes/65. 
 FREE
UPCOMING ?
TRAINING .
Intellectual Property Crime Training
(For Law Enforcement)

[sad
n n
Columbus,OH - 10/ 19/12
Orange Beach,AL - 1 1/8/ 12
St. Charles Parish,LA - 11/ 13/12
-?L' Tampa,FL - 12/5/ 12
Topeka,KS - 1/8/ 13
Charleston, SC - 1/ 18/ 13

Training Topics Include:

• The health, safety, and economic threats resulting from IP crimes
• The variety of IP crimes and criminals
• Investigative techniques and prosecutorial theories
• Hands-on exercise
• And more!
To register,visit our training site at

MW
NA T I O N A L W HI T E C OL L A R C R I M E CENTER
Bureau of Justice Assistance
Y.S. Department of Justice
www.nw3c.org
C I NAGTI I
Ir7 National Association
;Attorneys General
ww Questions? Call an-sus-era
- -
This project was supported by Grant No. 2010 DB-BX.C076 and 2010.DB BX-K092 awarded by the Bureau of Justice Assistance. The Bureau of Justice As-
sistance is a component of the Office of Justice Programs,which also includes the Bureau of Justice Statistics, the National Institute of Justice,the Office
of JuvenNe Justice and Delinquency Prevention, the Office for Victims of Crime,and the Office of Sex Offender Sentencing,Monitoring,Apprehending, Reg-
istering, and Tracking. Points of v iew or opinions in this document are those of the author and do not necessarily represent the official position or policies
of the U.S. Department of Justice.The National White Collar Crime Canter (NW3C) Is the copyright owner of this fact sheet This Information may not be
used or reproduced Inany form without the express written permission of NW3C. NW3C"', IC3e, and ICSIS"' are trademarks of NW3C,Inc. and may not be
used without permission.
0 2012 NW3C ,Inc. dlblaf the National While Collar Crime Center. All rights reserved.
WWW.NW3C.ORG 13
 NW3C Insider

Kristen Mahoney Sworn in as Bureau of Justice

Assistance Deputy Director for Policy

O
n July 9, 2012, Kristen
Mahoney was sworn
in as the new Deputy
Director for Policy at the Bureau
of Justice Assistance (BJA). Prior
to this appointment, she served
as the Executive Director of the
Governor’s Office of Crime Con-
trol and Prevention (GOCCP)
for the State of Maryland and as
President of the National Crimi-
nal Justice Association.
Throughout her career, Mahoney has proven to be a
strong advocate of state, local and tribal efforts to improve
criminal justice programs in communities across the
country. While managing the GOCCP, Mahoney assisted
Maryland Governor Martin O’Malley in implementing
effective crime-fighting strategies to help state and local
law enforcement impact crime; resulting in significant
reductions in the state’s violent crime rate and property
crime rate. On her departure from GOCCP, Mahoney
said she was proud of the work that was accomplished
towards GOCCP’s goal to provide safe neighborhoods
for citizens and families across the state.
Mahoney has served as Chief of the Technical Ser-
vices Division of the Baltimore Police Department, as a
Senior Policy Advisor in the Community Oriented Po-
licing Services Office and as the State Administrative
Agent for Byrne Justice Assistance Grant funds. She has
also worked with staff in BJA’s Programs, Planning, and
Policy Offices and understands the importance of BJA’s
work to the communities the agency serves.
Having worked at the local, state and federal levels
of government, Mahoney brings a lot of knowledge, ex-
pertise and criminal justice policy experience to BJA.
“NW3C congratulates Kristen Mahoney on her new ap-
pointment to BJA. Her leadership and extensive experi-
ence will provide valuable guidance and support not only
for NW3C and other BJA partners, but also for state, lo-
cal and tribal law enforcement throughout the country,”
said NW3C Director Don Brackman. 

Have you thought about reaching out to

NW3C Investigative Support Services
for help on your case?
Did you know that a highly trained NW3C analyst can assist you with
your white collar, high-tech, cybercrime and crimes against children
cases?

Our analysts are available to assist member agencies working cas-

es crossing jurisdictions and states. Our analysts are frequently
called upon to assist in:
• Establishing financial transaction patterns;
• Developing possible links between criminal targets and associ-
ated criminal activity; and
• Providing link charts, timelines and graphs for court presentations

To learn more, call 800-221-4424 ext. 3520 or

visit www.nw3c.org
14 INFORMANT: FALL 2012

Confirmation Bias: Can We Really Avoid It?
I
often have students and inves-
tigators ask me what is the best
strategy to use when conduct-
ing an examination and analysis
of digital evidence. Is it better to
assume that person X did it and
search for evidence to support this,
or should one assume that person
X is innocent and search for evi-
dence that supports this investigative hypothesis? The third
option usually mentioned assumes nothing and we go in
with no prior expectations. This third option, while appeal-
ing to the rhetoric of “let the evidence decide the truth” (or
some other equally philosophical quip) is not realistic. It is
very rare that we do not know some of the backstory of the
investigation prior to conducting an examination and anal-
ysis. There is just too much potential evidence on today’s
storage devices to go in blind as we will soon become over-
whelmed with investigative “noise.” The examination and
analysis process has evolved into a more surgical, targeted
approach due to this “big data” problem.
That leaves us with really only two practical approach-
es: 1) Search for evidence that confirms the person did it
– they are guilty and 2) Search for evidence that proves
the person is innocent. However, one of these choices is a
potential minefield. If we proceed using Option 1 we can
easily fall into the trap of succumbing to confirmation
bias. The concept of confirmation bias as an error in the
forensic sciences has been debated and studied for some
time now. The overall consensus is that confirmation bias
can lead to invalid and erroneous conclusions.
Simply defined, confirmation bias is the tendency
for people to focus on information or data that supports
their hypothesis and ignore contradictory information.
This is very similar to having “tunnel vision” when con-
ducting an investigation. Latent fingerprint analysis,
questioned document analysis and arson investigations
(to name but a few) have been highlighted by critics as
being examples of where confirmation bias has led to the
conviction of near conviction or a person who was later
found to be innocent. Digital forensics, given the huge
amount of data to be examined, is also fertile ground for
this error. As the amount of data we examine becomes
NW3C Insider
By Dr. Marcus K. Rogers, CISSP, DFCP, CCCI, ACE
larger, we tend to see patterns where none actually exist
(a well-documented psychological phenomenon). If we
go with Option 1, by its very nature, we risk committing
the error of confirmation bias and most certainly pro-
vide opposing legal counsel with ammunition to chal-
lenge the validity of our conclusions or expert opinion.
Until machines take over the world and all of our
tasks are fully automated, we will always have bias. Bias
is part of the human condition. We cannot operate with-
out it. It is highly unlikely that any investigator will not
have some preconceived notions that could possibly
impact what they focus on. This bias can occur subcon-
sciously. So how do we navigate this potential minefield?
One answer is to approach an investigation in a very sci-
entific manner. This leaves us with Option 2. Assume the
person is innocent and try to prove this hypothesis. I use
the term hypothesis because, to me, when we conduct
an examination and analysis we are in fact conducting
an experiment and testing educated guesses as to what
we will find. The investigator then conducts the exami-
nation and analysis looking for evidence that exonerates
the person/suspect. If we find evidence to conclusively
support the hypothesis of innocence, we have our find-
ing. If, on the other hand, we find no evidence to support
that the person is innocent we have failed to support our
tested hypothesis and we now look for evidence to fur-
ther validate that the person is guilty. We should not just
jump to the conclusion that the absence of evidence that
someone is innocent is proof they are guilty.
As digital evidence becomes commonplace in our
investigations, so too will the challenges and criticisms
historically leveled at forensic sciences. Being aware of
of such challenges as confirmation bias, is a crucial step
in effectively dealing with them. Once an investigator
acknowledges that there is the potential of confirmation
bias, he or she can be sensitive to this error and follow
processes or methods, such as the one described here, to
reduce them.
Practically and scientifically, the correct answer to
our question is Option 2, until the evidence supports
shifting to Option 1, and, as always document, docu-
ment and then document some more.
WWW.NW3C.ORG 15
 NW3C Insider

X1 Discovery and NW3C Partner to Address

Social Media and Internet Evidence
By Cathryn Goodman

X
1 Discovery, a port NW3C for spearheading this training to local, state
leader in software and federal law enforcement,” says John Patzakis, Presi-
solutions for so- dent and CEO of X1 Discovery. “This partnership couples
cial media and website the world-class training operation of NW3C with the best
evidence search and col- available website and social media collection and analysis
lection, along with the Na- software in X1 Social Discovery to better serve law enforce-
tional White Collar Crime ment and the broader digital investigation community.”
Center (NW3C), have announced a strategic partner- This curriculum will provide best practices and new
ship to provide fee-based training to local, state and methods to collect, search, preserve and manage social
federal law enforcement agencies worldwide, as well as media evidence from social media networking sites and
to legal, corporate discovery and risk professionals. The other websites in a scalable, instantaneous and forensi-
partnership will focus on promoting best practices and cally sound manner.
advanced techniques for website and social media evi- Participants will learn about:
dence collection and analysis, based upon the X1 Social • Specific cases involving critical social media and
Discovery software.
TM
website data, as well as YouTube® video capture;
Data generated from social networks is relevant to just • How to collect and index thousands of social me-
about every criminal and civil legal matter and must be rou- dia items in minutes;
tinely addressed by law enforcement, regulatory agencies, • How to identify key metadata unique to social
law firms and corporate risk professionals. In a recent Lex- media; and
isNexis® survey of 1200 law enforcement professionals fo- • Ways to better authenticate social media evidence
cusing on the rising prominence of social media evidence, in a safe and defensible manner.
67 percent of respondents believed social media evidence The X1 Social Discovery software is designed to ef-
helps solve crimes more quickly. However, the respondents fectively address social media content from the leading
also pointed to lack of training and technical familiarity as social media networking sites such as Facebook®, Twit-
preventing their more widespread access to social media ter®, LinkedIn® as well as webmail, website crawling and
evidence. The NW3C and X1 Dis-
covery partnership is geared toward This partnership provides cutting edge support and
addressing this compelling need.
training for Internet and social media investiga-
“The National White Collar
Crime Center is pleased to partner tions and new curriculum for law enforcement and
with X1 Discovery to help provide corporate professionals covering advanced tech-
law enforcement and corporate niques for the effective analysis of evidence from
investigators with the necessary social networking and Internet sites.
training and tools to combat child
exploitation, financial fraud, drug
trafficking and other illegal activities involving the direct or YouTube® video capture. Unlike archiving and image cap-
indirect use of social media and the Internet,” stated Don ture solutions, X1 Social Discovery provides for a “matter-
Brackman, Director of NW3C. “A key part of our mandate centric” workflow and defensible chain of custody from
at NW3C is to identify, assess and validate new and cut- search and collection through production in searchable
ting-edge digital investigation technologies that uniquely native format, while preserving critical metadata not pos-
address a compelling need for the law enforcement com- sible through image capture, printouts or raw data archi-
munity, and X1 Social Discovery clearly fits that bill.” val of RSS feeds.
“The prevalence of social media evidence is exploding For more information about this training program,
in criminal and civil cases alike and we applaud and sup- please visit www.nw3c.org or call 877-628-7674. 

16 INFORMANT: FALL 2012

 NW3C Insider

Law Enforcement Leaders

Participate in State of the States
Cybercrime Consortium
By Beth Singer

T
he State of the States Cybercrime Consortium Attorney General’s Office said. “I have been amazed at
began 11 years ago as an offshoot of the Asso- the work these students are doing. Some have worked
ciation of State Criminal Investigative Agencies. on actual cases and assisted with apprehensions.”
The first meeting was held in Cleveland, OH, and was Each state presented an overview of their cyber
arranged by the Ohio Bureau of Criminal Investigation, programs and shared successes and lessons learned
Georgia Bureau of Investigation, Florida Department in a very open, honest and trusted forum. Success-
of Law Enforcement (FDLE), and others. Subsequent ful programs as well as innovative ideas and solutions
meetings were held in several locales across the nation. were shared and discussed, resulting in new partner-
This past May, representatives from 43 states and ships and cyber programs.
Puerto Rico attended this invi-
tation-only, Bureau of Justice
Assistance-sponsored meeting, Successful programs as well as innovative
in the suburban Washington, ideas and solutions were shared and dis-
D.C. area. Those attending in-
cussed, resulting in new partnerships and cy-
cluded law enforcement officers
from state agencies who are re- ber programs.
sponsible for managing their
agency’s computer crime/digital
forensics programs. “When you put 50 people in one room to discuss
Universities recognized nationally as cyber leaders a topic, the conversation evolves, questions are asked,
having close working relationship with their state’s crimi- and everyone benefits,” Special Agent Kinch said.
nal justice community, presented at this year’s meeting. Mike Phillips, FDLE Assistant Special Agent in
Dr. Sudhir Aggarwal, Professor of Computer Science Charge, spoke about a number of FDLE projects in-
with Florida State University, demonstrated a password- cluding state-wide responder training and the FDLE
cracking algorithm and cracking methodology developed Cell Phone Data Collection Kiosk System. This sys-
by his students. Dr. Sujeet Shenoi, Professor of Computer tem makes the hardware and software available, along
Science at the University of Tulsa, briefed the group on with detailed instructions for its use, to officers who
work his students have done in the area of cell phone fo- need data from cell phones. Making the kiosk sys-
rensics and damaged-device data recovery. tem available throughout the state has saved the FDLE
The cybercrime prevention field is growing dramati- Computer Forensic Unit hundreds of hours of work.
cally and young adults, who have grown up with com- “We are looking to implement the forensic kiosk
puters, are creating tools and ideas that enhance law en- in New Mexico after learning about it at the meet-
forcement’s ability to apprehend cyber criminals. ing,” Special Agent Kinch said. She also explained
“The presenters from academia have done incredible how she left the meeting with information on new
work with password cracking, hacking and more that re- forensic software and connections to a network of
ally benefit law enforcement and were on hand to share experts that she can reach out to if she needs ideas
this information,” Special Agent Lois Kinch, New Mexico or support. 

WWW.NW3C.ORG 17
 NW3C Profile

NW3C’s Computer Crime Section: A Key

Ally in the Fight Against Cybercrime
By Ty Bowers

W
hen law enforcement personnel look to boost collect data from cell phones, GPS-enabled devices and
their computer forensic and high-tech crime the popular suite of Apple® products (iOS® devices like the
investigative skills, they turn to NW3C’s Com- iPod Touch®, iPhone® and iPad®).
puter Crime Section (CCS). The newly developed Cybercop 215 (Apple® iDevice
With a training curriculum that caters to every skill Forensics) course is designed to help law enforcement
level – from frontline officers to analysts and forensic ex- better understand these devices and how to gather data
aminers – and a team of expert instructors, NW3C is well- from them for investigations. The course shows investi-
positioned to bolster law enforcement’s capacity to handle gators and examiners how to use forensically sound tools
the increasingly complex forms and varieties of digital evi- and techniques to analyze potential evidence from iOS®
dence found at today’s crime scenes. (Apple’s operating system) devices, including informa-
In the last five years alone, CCS has provided training tion from built-in applications, as well as popular third-
to nearly 26,000 law enforcement professionals nationwide. party applications.
NW3C also recently entered
“The section as a whole draws experience from a into a strategic partnership with X1
very diverse set of backgrounds — the military, po- Discovery to help provide law en-
forcement and corporate investiga-
lice, technology and government. If anybody needs tors with the necessary training and
help with anything related to digital evidence, they tools to combat child exploitation,
give us a call.” financial fraud, drug trafficking and
other illegal activity involving the
“We’re the premier provider of digital forensics train- direct or indirect use of social media and the Internet. A
ing in the country,” said NW3C Computer Crime Special- new training curriculum, developed through this partner-
ist Nick Newman. “The section as a whole draws experi- ship, will provide best practices and new methods to col-
ence from a very diverse set of backgrounds – the military, lect, search, preserve and manage social media evidence
police, technology and government. If anybody needs help from social media networking sites and other websites in
with anything related to digital evidence, they give us a call.” a scalable, instantaneous and forensically sound manner.
Not only does CCS provide free training and technical
support, the Section has also developed forensic tools that
it distributes to law enforcement free of charge. Addition-
ally, CCS has formed several key partnerships within the
law enforcement and private sector communities, to con-
tinually seek out new and innovative ways to stay ahead of
the technological curve. CCS continues to offer training to Internet Crimes
High-Quality Training Against Children (ICAC) investigators as well. ICAC units
must investigate some of the most heinous crimes target-
NW3C computer crime courses are organized into two ing our most vulnerable population. NW3C has been a
primary tracks – Cyber Investigation and Cyber Forensics. leader in providing these specialized units with the skills
Cyber Investigation courses were developed to address the and capabilities required to combat these crimes.
needs of first-responders who identify, and at times, seize The Section also trains law enforcement professionals
digital devices. The Cyber Forensics courses were devel- to deliver some of NW3C’s entry-level computer crime
oped to suit the needs of investigators who analyze and courses, a turn-key program that has helped expand the
process data. number of officers and investigators NW3C can reach
In recent years, NW3C has expanded its Computer with its curriculum.
Crime curriculum to address some of the newest trends
in digital forensics, especially the need for investigators to

18 INFORMANT: FALL 2012


State-of-the-Art Forensic Tools
A key contribution of NW3C’s Computer Crime Section
to law enforcement is in the area of forensic investigative tools.
Since its release in July 2009, NW3C’s TUX4N6™ has
been distributed to more than 5,000 law enforcement pro-
fessionals nationwide. TUX4N6™ is a bootable CD that
allows law enforcement to preview a hard drive without
writing to or altering data on the system.
“The big hallmark of TUX4N6™ is that it’s easy to use,”
Newman explained. “It’s right click, left click. It does the
heavy lifting for you.” The tool incorporates a Graphical User
Interface that allows officers of all experience levels to quickly
preview a machine for all types of data, including documents,
graphics, videos, Internet history, audio files and more.
TUX4N6™ works on most PCs and newer Mac® comput-
ers, Newman said. It serves as a preview tool that enables law
enforcement to get enough probable cause for a fuller exam-
ination of a device. Students taking NW3C’s Cyber Investi-
gation 101: Secure Techniques for Onsite Preview (STOP)
course receive the forensic tool, and a resource download/
update is available online to prior STOP students.
The proliferation of mobile devices has spurred greater in-
terest among law enforcement in the application and practice
of mobile forensics. NW3C is at the forefront of this trend
with three courses devoted to cell phone and GPS forensics
that utilize PerpHound™, an innovative tool that helps investi-
gators analyze call detail records from cell phone companies.
“At its most basic level, PerpHound™ is a data converter,”
explained NW3C Computer Crime Specialist Justin Wykes.
PerpHound™ uses call record information to plot coordi-
nates in Google® Earth for a visual timeline of the location of a
cell phone when a particular call occurred. Before PerpHound™
was released in 2010, “a lot of people never considered using
call detail records in their investigations,” Wykes noted. In
many cases, investigators might spend weeks compiling such
data – a task PerpHound™ has reduced to 20 minutes.
Combining the cell tower log information with GPS co-
ordinates allows investigators to pinpoint the precise loca-
tions of suspects, witnesses and victims, Wykes explained.
The kind of visual timeline PerpHound™ creates brings a
new level of specificity to investigator testimony. “For ex-
ample, not only does his cell phone signal put him at the
scene, GPS puts him driving down the street.”
Since 2009, CCS has partnered with Microsoft® to de-
NW3C Profile
velop and distribute the Computer Online Forensic Evi-
dence Extractor (COFEE™), which was designed to cap-
ture live computer evidence at the scene in cybercrime
investigations. Information that can be obtained using
COFEE™ includes open files, scheduled jobs, running
processes and much more volatile data.
COFEE
Ongoing Partnerships
When an investigator or examiner attends one of NW3C’s
computer crime courses, the relationship with NW3C does
not end with the last day of training, CCS Supervisor Mike
Flynn explained. “We routinely provide technical assistance to
law enforcement officers who have attended our classes. Many
times they will call to get clarification and guidance to assist
them with pending investigations. The CCS staff are always
available to assist law enforcement in their efforts to combat
computer crime.”
Even as NW3C begins offering online training and other
remote products, the expertise CCS staff can provide law
enforcement will remain just a
phone call or email away.
Beyond offering formal and
informal technical assistance,
NW3C is highly involved in a
number of cybercrime and digital forensic efforts. CCS ac-
tively works on behalf of state and local law enforcement and
regulatory agencies by expressing their needs to the National
Institute of Standards and Technology (NIST) through in-
volvement in the Computer Forensic Tool Testing Commit-
tee. This committee provides multiple validation studies con-
cerning the tools used in computer forensics today.
NW3C also partners with the West Virginia State Police
and West Virginia University, in the West Virginia Cyber
Crime Cooperative (WV3C). WV3C researches digital fo-
rensics and electronic crimes, provides investigative sup-
port and contributes to training development for all levels
of West Virginia law enforcement. It developed the Live
Encryption Analysis Program, an on-site live preview tool
that identifies potential encryption on computers and digi-
tal devices.
Through its many training courses, computer forensic
research, investigative tool development and key partner-
ships, NW3C’s Computer Crime Section continues to be a
leader in law enforcement’s efforts to combat cybercrime.
“We are constantly looking to the future to what law
enforcement will need to know,” Flynn said. “We are al-
ways trying to identify and meet their needs.”
For more information about NW3C’s Computer Crime
Section, go to http://nw3c.org/training/computer-crime. 
WWW.NW3C.ORG 19
 NW3C Events
NW3C Outreach Training Highlights
Social Media Investigations
T
he advent of social media has generated a valuable
resource of information and data for investigations
and intelligence. But the question is: How do in-
vestigators scour through thousands of sites to get the in-
formation that will support their cases?
Darrell McGraw, West Virginia Attorney General; Don Brack-
man, NW3C Director; First Sergeant Chris Casto, West Vir-
ginia State Police; Shelley Moore Capito, West Virginia Con-
gresswoman; Glen Gainer, West Virginia State Auditor; and
Chief Timothy P. Deems, Beckley Police Department support-
ed the outreach and were on hand to discuss the importance of
training like this for law enforcement.
On August 16 more than 150 law enforcement person-
nel came to see Indiana State Police Lt. Chuck Cohen’s pre-
sentation, “Online Social Media and Criminal Investiga-
tions” at NW3C’s Outreach Training event in Beaver, WV.
NW3C partnered with the Beckley Police Department and
the Raleigh County Sheriff ’s Office to present this program.
“I brought half of my Department here. We have already
used Facebook® to apprehend suspects, but there is so much
more to learn,” Clendenin Police Chief David Brinckman, said.
An 18-year veteran with the Indiana State Police, Cohen
is the commander of the Special Investigation and Criminal
Intelligence Section and also serves as the Indiana Internet
Crimes Against Children (ICAC) task force commander.
Cohen started the program with an overview of social
media and the vast world it encompasses. With more than
955 million active users on Facebook alone, the world of
social media can be overwhelming and intimidating.
Cohen used his knowledge of the medium to break
down the most popular sites like YouTube® (which has more
than 3 billion views per day) and other less-known sites like
20 INFORMANT: FALL 2012
By Beth Singer
Friendster®, a social gaming site — with a strong following
in Asia. People from different countries flock to different
types of online communities, he said.
Cohen then discussed the challenges and information
necessary to conduct an undercover investigation through
social media. It can be a challenge as it is easy for criminals
to glean information and discover where you are and who
you are if you do not have a well laid out plan before hand.
“You need to prepare for an undercover case on social
media just as you would for working undercover on the
street,” Cohen said. He explained further, if your Facebook
page doesn’t have pictures, friends and a real “identity” on
social media, it can make it easy to spot that your persona
is not real.
It may not always be necessary to go undercover online
and engage gang members or child predators. One of the
great benefits of social media is open-source intelligence.
Which refers to intelligence collected from publicly avail-
able sources.
Cohen used an example of a Facebook profile to show
that even though he was not friends with the person, he
could still gather data from the information that was made
public.
He showed several other profiles and looked at simi-
larities and connections. Cohen pointed out names and
acronyms used to describe activities that are connected
with child pornography like “PTHC” and “Vul Gnuoy.”
An Internet Crimes Against Children (ICAC) investiga-
tor, Cohen explained: “P-T-H-C” means pre-teen hardcore
and “Vul Gnuoy” is young luv spelled backwards. When in-
vestigating pedophiles it’s helpful to know the terms.
Chuck Cohen, a self-proclaimed “geek with a gun,” shares his
knowledge and experience on social media investigations.
 NW3C Events
The Internet is pseudo-anonymous, explained Cohen.
It brings people together despite language and other bar-
riers. It also helps catch criminals more quickly. Many
cases like the Behl case would have proved more difficult
to solve without the use of social media.
Lt. Cohen covered other aspects of tracking and inves-
tigating through social media. He also discussed topics like
online photos and metadata – file types, camera types, lon-
gitude and latitude – that can point investigators to crime
scenes or the locations of perpetrators, victims or witnesses.
Conversations about working with sites like Facebook to
Beckley Police Department Training Coordina-
subpoena information and understand what the signifi-
tor, Lt. J.R. Corey had the opportunity to speak
with West Virginia Congressman Nick Rahall. cance of profile numbers are also took place.
Cohen also brought attention to the fact that law enforce-
Cohen provided an overview of a profile of a man who
ment personnel use social networks. Their presence on these
lived in Maine. He was able to see from the Facebook pro-
sites can pose risks to both agencies and operations. For in-
file that this man was religious and had lots of friends.
stance, criminals could use an officer’s social media behav-
Other profiles pulled up showed the same person, but each
ior for blackmail, he suggested. Also, criminals could access
profile had a different identity and alluded to activities in-
facial recognition technology to expose undercover officers.
volving children. As he drilled further down, he showed
“I am connected to all of the officers in my Department
that this man, in fact, had multiple profiles on Facebook,
that have Facebook accounts. I have monitored their com-
and was involved in child pornography. The case involved
ments and posts and even asked some to remove something
John Wilson, 23, of Greenbush, ME, who was arrested in
that could be perceived as inappropriate,” Chief Brinckman
2011 on child pornography charges.
said. He asked an officer to remove a post he had made
The investigators in the case stated he had as many as
while on patrol. “They represent our Department on and
15 Facebook accounts and Facebook had been dealing
off duty. I just want
with him repeatedly and would find a profile and take it
them to be smart about
down, but he would go ahead and create a new one.
what they post.”
All of the preliminary information they gathered was
Social media has
through open source intelligence analysis. A subpoena
caused a huge change
to Facebook showed the IP addresses used, but it was the
in society and how
original intelligence that allowed them to get the subpoena
people communicate.
and eventually an arrest.
The outreach training
“The average predator has more at stake, so they are bet-
allowed law enforce-
ter at open-source investigation,” Cohen said. There are many
ment officials to get a
websites allowing predators to gather information and data
better picture of what
that could easily fool a victim. Sites like www.pipl.com, www.
they are dealing with
spokeo.com and www.peekyou.com allow people to find ad-
and how to use Web
dresses, names, relatives and even more. Most are free.
2.0 to their advantage.
On the other hand, this information can benefit law
“Anything high-
enforcement and enhance investigations.
tech, including social
“If I am looking for someone, the first place I look is
media, changes every
Facebook,” Chief Jeremy Bennett, a participant from Al-
day. We need to con-
derson (WV) Police said. “It is a good source of infor-
tinue to learn these Attendees received tips and informa-
mation, and this program has been very informative for
new things for tomor- tion on social media sites that are
working more in social media.”
row,” Raleigh County popular with criminals and how they
The training covered several more case studies includ-
(WV) Sherriff ’s De- can leverage it for investigations.
ing the 2005 murder of Virginia Commonwealth Univer-
partment Captain Gor-
sity student Taylor Behl. Cohen showed how investigators
don Gregory explained. “I know our detectives learned a
used data from social networking sites and digital media
lot at this event.”
(photos posted online) to identify suspect Ben Fawley and
Other outreach training events are being planned. Be
track his movements before and after the crime. Ultimate-
sure to visit www.nw3c.org for updates and information.
ly this evidence helped put Fawley behind bars.
WWW.NW3C.ORG 21
 Theft and Money
Laundering:
Welcome to the
Dark Side of
Prepaid Cards
By Nicole Stiles

P
repaid cards are not just a convenient gift anymore.
As with any type of payment system, prepaid cards
are being utilized for much darker purposes by
criminals. From theft to money laundering, authorities
are realizing the vulnerabilities prepaid cards pose when
it comes to criminal activity.
A good example of this is a 2010 case where a trio in
Baltimore, MD used prepaid cards to pay for advertise-
ments posted on Craigslist for sexual services, and used
fake names and identifiers for the cards to conceal their
activities. The group ultimately pleaded guilty to pros-
titution, drug conspiracy, sex trafficking, enticement to
travel in interstate commerce to engage in prostitution
and interstate transportation for prostitution, according
to a news release from U.S. Immigration and Customs
Enforcement (ICE).
In another case from 2010, Dubai asked the U.S. Fed-
eral Bureau of Investigation (FBI) to look into prepaid
cards issued by Meta Financial Group’s Metabank, a re-
gional American bank. These prepaid cards were used by
suspected Israeli agents to cover their tracks when they
assassinated a commander of the Palestinian militant
group Hamas.
The anonymity factor has proven to be a problem when
it comes to prepaid cards and criminal activity. However,
times are changing and, with the ink barely dry on the pa-
per, Financial Crimes Enforcement Network’s (FinCEN)
newly written rules are making it more difficult for crim-
inals to hide. FinCEN issued its final rule to amend the
Bank Secrecy Act (BSA) Regulations to include prepaid
access as a money services business in July 2011, with a
compliance date of March 31, 2012. Along with tradition-
al banks, money service businesses are now required to
have an Anti-Money Laundering (AML) program, which
requires them to file currency transaction reports (CTR)
and suspicious activity reports (SAR) on these cards.
22 INFORMANT: FALL 2012
 “One of the foundations of having a good AML pro-
gram is to know your customer. First of all, your customer
has to be who they say they are and you need to know what
kind of activity to expect from this customer,” says Steve
Hudak, Chief of Public Affairs at FinCEN. The idea is that
collecting information, maintaining records and filing re-
ports will help law enforcement to conduct criminal inves-
tigations and provide regulatory agencies with the ability
to monitor noncompliance.
FinCEN receives millions of CTR and SAR records
each year, which they review and maintain in a database.
Federal, state and local law enforcement agencies can ac-
cess this BSA data through a secure web connection after
their agency has entered into a Memorandum of Under-
standing with FinCEN. FinCEN provides training and
monitoring to ensure that the BSA information is properly
used, disseminated and kept secure.
“Law enforcement can go into our database and enter
an account number, Social Security number, phone num-
ber, name or whatever bit of information they have. They
can then follow the trail through our database and discov-
er connections that they otherwise would not have known
were there,” says Hudak.
Many money services began implementing the Fin-
CEN rules prior to the March 2012 date. To comply with
these new rules, customers may be required to show photo
identification at the time of the card purchase or provide
identifying information to activate the card such as a So-
cial Security number and address.
To understand the prepaid card world it is important
to differentiate between the two types of prepaid cards.
Prepaid cards come in two forms: closed-loop cards and
open-loop cards. Both types of cards are susceptible to
criminal activity. Closed-loop cards are gift cards or
phone cards for a specific store. They are usually sold
in preset denominations and additional value cannot be
added. Open-loop cards are network branded cards such
as Visa, MasterCard, Discover or American Express.
These can be used at multiple locations and some allow
cash withdrawals at ATMs.
FinCEN’s new rule sets limits on both open-loop and
closed-loop cards. Closed-loop prepaid access (includ-
ing in-store credit for merchandise returns) is regulated
if more than $2,000 can be associated with the prepaid ac-
cess device or vehicle on a given day. Low-value, ($1,000
or less) open-loop prepaid access is regulated if it can be
used internationally, transferred between or among other
persons within the prepaid program or reloaded by a non-
depository (nonbank) source.
To keep track of the prepaid cards crossing the border,
FinCEN is trying to change the border regulations. Cur-
rent regulations require anyone crossing the border with
$10,000 or more in cash must declare it; however, prepaid
cards are exempt from this regulation. Therefore, money
is easily disguised, transported and transferred using pre-
paid cards thus making the origin, ownership and crimi-
nal nature of “dirty” money hard to trace.
In a press release from October 2011, FinCEN “pro-
posed adding certain tangible prepaid access devices to the
list of monetary instruments to be reported when trans-
ported in or out of the United States.” This proposal would
include things such as prepaid cards, certain gift cards and
cell phones. The final rule is under development.
ICE reported that authorities in New Mexico have en-
countered instances where hundreds of prepaid cards were
found concealed in a compartment similar to those used
to conceal cash, drugs and other contraband. ICE also re-
ports customs authorities in Jamaica requested assistance
with hundreds of U.S. issued prepaid cards found in mail
from the United States. These particular brands of cards
have been associated with advance-fee scams which pri-
marily target elderly U.S. citizens.
Open-loop cards provide more opportunities for
criminal schemes as these cards can be used virtually
anywhere. Not only can these cards be cloned and used
to make purchases, but criminals have also found them
an easy alternative to scamming consumers out of their
money. Once criminals convince consumers to put mon-
ey onto a prepaid card and share the serial number with
them, funds can easily be drained from the account. Ac-
cording to the Better Business Bureau, these are some
common ways consumers are scammed:
• Consumers are asked to pay advance-fees on bo-
gus loans with a prepaid card;
• Consumers are told they have won a prize but first
must provide payment via a prepaid card; and
• Consumers are told they can purchase heavily dis-
counted items or services but must pay for it using
a prepaid card.
One example of this happened in Milwaukee, WI. A
man received a phone call from someone he thought was
a customer representative from a satellite television com-
pany. This person told the man for $430, he could receive
his current services plus premium channels for an entire
year, which was a considerable discount. The caller told
the man he must use a prepaid card to pay the amount. In
the end, the discounted services were just a scam and the
man was out $430.
There are several ways money is placed on open-loop
prepaid cards. Some of the ways money is transferred
onto an open-loop card include:
• Using cash, credit card, etc. at local merchants that
sell prepaid cards;
• Using a bank account transfer;
WWW.NW3C.ORG 23

• Using a credit card or PayPal® transfer;
• Purchasing a reload card such as the Visa Green
Dot MoneyPak® and then transferring money
from the reload card onto the prepaid debit card
either online or by phone; and
• Direct deposit from employers or government.
One highly publicized case involving prepaid cards
and government payments of tax refunds occurred in
2011 in Tampa, FL. Commonly referred to as “Operation
Rainmaker,” this year-long investigation by local and fed-
eral law enforcement resulted in the uncovering of a $130
million loss to taxpayers, hundreds of fraudulent tax re-
turns and dozens of arrests. Police, unaware the scam was
being conducted, noticed drug dealers had disappeared
from Tampa street corners. Also, routine traffic stops were
yielding an array of unusual items found in vehicles, such
as laptop computers and Green Dot credit cards.
The scam involved criminals obtaining someone’s iden-
tity, filing a tax return online and receiving the tax refund
with a prepaid debit card, check or direct deposit. During
a six-month span, police recovered nearly $10 million in
tax refund debit cards.
If law enforcement comes across prepaid cards in their
investigations, it is important to know records are available.
To understand prepaid cards better, Kevin Bleckley, Fin-
CEN Senior Intelligence Research Specialist, says it is es-
sential to know the typical life cycle of a prepaid card such
as: the card is purchased, loaded with money, products are
purchased, money is reloaded and so on. “During any phase
of the natural life cycle of that prepaid card, information is
being collected,” Bleckley says.
There are, typically, three entities involved with open-
loop prepaid cards. The merchant that sells the card, the
program manager (such as Green Dot) and the issuing
bank. If you look on the back of the card, you can usually
find a contact for the program manager or issuing bank.
The issuing bank is typically the entity that holds the re-
cords. But, if law enforcement can find no issuing bank to
contact, they use the first six digits on the card (BIN num-
ber) to ascertain which bank issued the card.
Time will tell if the FinCEN regulations are effectively
deterring criminal misuse. After the regulations have been
in place for 18 months, Cindy Baltierra, Regulatory Policy
Officer and co-author of the prepaid access rulemaking,
says, FinCEN research will determine the effectiveness of
the new rule. “We will look back to see if there are areas
left unaddressed or areas where we have been arduous in
requirements set forth. It helps to determine if what we
intended to do is actually what the rule has done among
all the affected parties.” 
24 INFORMANT: FALL 2012
‘Where There’s a Will,
There’s a Way’: Criminals
Find Ways to Benefit
from Department Store
Gift Cards
D
epartment store gift cards at the checkout coun-
ter might seem worthless to most people, but not
to a criminal. One technique used by criminals
involves stealing gift cards off store racks before any mon-
ey has been put on them. The criminal then uses an elec-
tronic card reader/writer to copy the information from
one gift card to another, making an identical copy. Then
they take the card back to the store for unsuspecting cus-
tomers to purchase. Once money is added to the card, the
criminal can then go on a shopping spree with someone
else’s money.
A 22-year-old man in Beaverton, OR used this very
scam, and in less than two weeks stole more than $7,000
from gift cards at a Fred Meyer store. In another case in
Plano, TX, a 30-year-old man took gift cards from a lo-
cal Walmart. Instead of cloning the card, he recorded the
16-digit numbers on the card; used a razor blade to re-
veal the secret PIN number and then returned the cards
to Walmart. The man then contacted the 800 number on
the back of the card to find out if any balance had been
added. When money was added, he would go to Walmart’s
website and buy items to pick up at the store.
While department store cards, otherwise known as
closed-loop cards, typically are not used in money laun-
dering, there are exceptions. A scheme uncovered by a
U.S. Immigration and Customs Enforcement (ICE) and
Internal Revenue Service (IRS) joint investigation revealed
a co-conspirator was paid by criminal organizations with
gift cards issued by U.S. retailers. The gift cards were then
used to purchase mobile phone cards, which were smug-
gled into Mexico and sold for a profit.
“Closed-loop cards can also be used like cash if you
have a stack of them with enough value,” says Steve Hu-
dak, Chief of Public Affairs at Financial Crimes Enforce-
ment Network (FinCEN). “They are easier to hide than
cash and contain more value per square inch than cash, so
they are easier to move in some respects.”
FinCEN recently amended the Bank Secrecy Act
(BSA) Regulations to include prepaid access as a money
services business. Within this rule, closed-loop is not to
exceed $2,000 maximum value associated with a prepaid
access device, such as a card. 
 Targeting Fraud - Safeguarding Integrity Conference
I
n observance of National Fraud Awareness Week,
Nov. 11 - 17, NW3C is collaborating with Franklin
University, the Ohio Ethics Commission, Ohio In-
spector General and Ohio Investigators Association to
present a two-day training conference in Columbus, OH
on Nov. 7 - 8.
The Targeting Fraud – Safeguarding Integrity Confer-
ence will explore a wide spectrum of topics related to the
investigative process of uncovering fraud.
The conference sponsors received approval for 16
hours of Continuing Professional Education (CPE) cred-
it from the Accountancy Board of Ohio and 13 hours of
Continuing Legal Education (CLE) credit by the Ohio Su-
preme Court for this training.
The following eight sessions will be presented during
the course of the two-day conference:
• Lessons Learned from the Cuyahoga County Cor-
ruption Investigation. Ann Rowland, Assistant
U.S. Attorney, and FBI agents R. Michael Massie
and Christine C. Oliver, will review the investigative
strategy leading to the prosecution of over 60 public
officials, including former Cuyahoga County Audi-
tor Frank Russo and Commissioner Jimmy Dimora.
• Malicious Website Investigation. Nick Newman,
a Computer Crime Specialist from NW3C reveals
the statistics and technical aspects of phishing and
Internet fraud, including how to recognize danger-
ous websites.
• National Intellectual Property Rights Coordina-
tion Center – Its Mission and Role. Jon Ruttencut-
ter will address intellectual property theft and the
multi-billion-dollar impact it has on the U.S. econo-
my, health, safety, and national security.
• Crime Fighting in the Virtual World. Rick Wells,
an investigator for the Ohio State Highway Patrol,
will explore how technology can serve as a means
to make criminal cases easier to understand, man-
age and prosecute. Investigator Wells has created a
?MSER 7-8, ?p
Date: November 7 & 8, 2012
ov j Location: Ohio Department of Transportation, 1980 West Broad Street, Auditorium,
? ?
Columbus, OH 43223
Cost: $125
Continental breakfast and afternoon break refreshments will be provided during the conference. Lunch cost
will be the responsibility of each attendee (on-site cafeteria available).
CP
9?
?6 For more information and a schedule that includes presentation topics and speakers,
UA
DING
go to http://watchdog.ohio.gov/Conference.aspx
By Kim Williams
web-based approach to
managing high-profile
criminal investiga-
tions, called the Virtual
Referral Presentation
(VRP), where all of the
information is acces-
sible at the click of the
mouse.
• How to Develop a Successful Social Media Strat-
egy. Dionne Waugh, of the Richmond (VA) Police
Department, will cover the benefits of new social
media and how to protect and guide an agency to
effectively share its message.
• Ohio Ethics Law: What We Need to Know. Susan
Willeke of the Ohio Ethics Commission will present
timely information regarding the restrictions in the
Ohio Ethics Law and related statutes that pertain to
all public sector employees and private sector parties
who are regulated or do business with public offices.
• The Electronic Communications Privacy Act (ECPA)
– Obtaining Electronic Evidence from the Internet.
Matthew Kall, Assistant U.S. Attorney, will review
types of court processes required for government
investigators to obtain various forms of electronic
evidence from Internet Service Providers under the
Electronic Communications Privacy Act (ECPA) in-
cluding connection logs, content of emails and GPS
data.
• Enhanced Methodology of Case Summaries. An-
drea Fausnaugh will discuss her experience as a
criminal analyst at the Ohio Inspector General’s Of-
fice in developing charts and diagrams to synthesize
information collected during the course of investiga-
tions. Criminal analysts need to be able to navigate
an overwhelming amount of readily available infor-
mation to identify patterns, break down complex
data and create easy-to-understand presentations. 
WWW.NW3C.ORG 25
 Embezzlement - Another Problem
Facing Our School Systems
By Kristin D. Koontz, CFE

M
onica Foote, a member of the Ozark City (AL) money. My life’s a mess and I just made it worse.” Even
Board of Education, embezzled $97,000 from though Foote admitted to taking the money, prosecutors
the local school system. This growing issue fac- needed evidence of the embezzlement to indict and then
ing school systems all over the country impacts the ability of try Foote.
teachers and adminis- Prosecutors were
trators to provide a The proliferation and severity of embezzlement concerned that a
quality education to has brought this issue to the attention of law judge or jury may
our students. sympathize with
The amount stolen enforcement officials nationwide, who must Foote’s personal and
in Ozark City rep- now determine the best way to investigate and financial situation,
resents only a small prosecute these crimes. which could adverse-
percentage of the to- ly affect the outcome
tal funds embezzled of the trial. Foote
by employees from comes from a well-
school systems na- known and respect-
tionwide. A recent ed family within the
news search uncov- community. She is
ered several exam- also an elderly, wid-
ples: owed mother who
• Gayle White, adopted a child with
a high school special needs.
secretary The State of Ala-
from An- bama Examiner of
chorage, AK, Public Accountants
faced charges conducted an audit
on two separate occasions for stealing. She embez- of the Ozark City Board of Education. Examiners con-
zled more than $100,000 from area schools. cluded that Foote embezzled approximately $97,000 from
• Benefits specialist Angela Potter from Greene the school board. Additionally, she filed $5,364.81 in false
County, NC was convicted of embezzling almost travel claims with the State of Alabama. Following the
a half-million dollars from the local school system. audit, prosecutors subpoenaed Foote’s personal bank re-
• In Lynwood, CA, Lynwood Unified School Dis- cords. These included records from her checking account,
trict’s former Chief Business Officer, William statements for all lines of credit and documents relating
Douglas Agopian, is facing charges for embezzling to her loans. Foote was indicted on the following charges:
over $700,000 in public funds. use of public position for personal gain; theft of property,
The proliferation and severity of embezzlement has first degree; theft of property by deception, first degree;
brought this issue to the attention of law enforcement of- and conversion of public revenue.
ficials nationwide, who must now determine the best way The Office of the Attorney General reached out to the
to investigate and prosecute these crimes. National White Collar Crime Center’s (NW3C) Investi-
Ozark City Case: From Beginning to End gative Support Section for analytical assistance with this
case. NW3C accepted the case and assigned two analysts
The Ozark City Board of Education brought the ac- to the investigation. The prosecutors set the following
tions of its Chief Financial Officer Monica Foote to the at- goals: demonstrate Foote’s spending habits, show how
tention of local law enforcement. Its financial institution Foote used school funds to cover personal expenditures
became suspicious of several checks written to Foote. The when her account would otherwise be overdrawn, identify
School Superintendent and board’s attorney confronted all incoming funds into Foote’s account, locate all checks
Foote about the checks. Foote immediately admitted to received from the school system, and generate products to
taking the money saying, “Well, I’m broke. I needed the demonstrate NW3C’s findings.

26 INFORMANT: FALL 2012

 The analysts began by reviewing the previously sub-
poenaed bank records. Once the data was entered into
a database, they were able to create withdrawal and de-
posit reports. These reports showed the source of each
deposit into the account, the payee for all funds leaving
the account, the total amount paid, and the number of
transactions included in that amount.
After reviewing these reports, prosecutors requested
the analysts produce a second report showing the top 10
entities receiving money from Foote’s primary checking ac-
count, along with a pie chart that easily conveyed this in-
formation. These transactions included transfers to other
accounts held by Foote and cash withdrawals as well as
payments to Wal-Mart, a local florist and a local animal
hospital. By reading the memo lines on her checks, which
the bank provided in compliance with the subpoena, the
analysts determined Foote used the funds she took from
the Ozark City Board of Education to make donations to
a local animal hospital. This is one example of how Foote
used the money not only for medical bills or necessary
living expenses, but also for personal expenditures and
charitable donations. Prosecutors used the information to
take away some of the sympathy the judge may have felt for
Foote’s personal and financial situation.
Using a daily running balance report, the NW3C
analysts showed how Foote deposited a check from the
school district at times when her personal account bal-
ance became low or overdrawn. This report demonstrat-
ed a pattern of Foote using the board of education’s funds
to boost her own account. Foote deposited 58 checks
from the school district between June 2008 and August
2009.
Foote ultimately pleaded guilty to one count of use of
public position for personal gain and one count of theft of
property, first degree. At the sentencing hearing, Alabama
Assistant Attorney General, Ben Baxley, used the work
products of NW3C analysts to show the judge how much
money Foote stole, the timing of the checks she issued to
herself and how she then spent those funds.
Alabama sentencing guidelines called for a two-year
sentence with straight probation. After hearing the prosecu-
tor’s arguments and seeing the products NW3C provided,
the judge chose to disregard these guidelines. He sentenced
Foote to 10 years with 24 months in the local community
correction program. Foote was also ordered to repay more
than $102,000. Assistant Attorney General Baxley stated
in a letter to NW3C Director, Don Brackman “There is no
question the work of [NW3C analysts] was a compelling
factor in the judge’s decision to reject the guidelines.”
Tips for Investigating an Embezzlement Case
Thorough investigation and illustrative evidence
are critical components in the successful prosecution
of embezzlement charges. NW3C makes the following
recommendations to investigators assigned to work
these types of cases.
• Subpoena all bank records of the suspects. Ensure the
subpoena covers signature cards, statements, deposit
tickets, checks (front and back) representing deposits,
checks drawn on the account (front and back), wire
transfers, withdrawal slips, records pertaining to debit
and credit card transactions and memos.
• Subpoena the suspect’s credit card statements. These
will demonstrate the type of lifestyle the suspect main-
tains.
This graph is an example of how NW3C’s Investigative Support
staff analyize pending habits of suspects and assist law enforce-
ment with examining embezzlement cases.
• Subpoena documentation related to any loans ob-
tained by the suspect.
• Work with the victim. The victim may be able to pro-
vide a report of the money they believe was taken un-
der false pretenses. Signature cards from the bank ac-
count from which the suspect wrote checks and a list of
the suspect’s duties, may provide clues as to how they
paid or issued reimbursements to themselves.
• Generate a daily running balance report. This may
show a pattern in the deposits made by the suspect.
• Create charts and graphs illustrating patterns and evi-
dence. Use these to present evidence, in a persuasive
manner, to the defendant, their legal team and a judge.
• Contact NW3C’s Investigative Support Section
(www.nw3c.org) when additional help is needed
with data analysis, association charts, graphs, time-
lines and reports. 
WWW.NW3C.ORG 27

W
e love our smart phones. Whether it’s an An-
droid®, iPhone® or Blackberry®, we just cannot
get enough of the technology - plugging in, up-
dating our Facebook® status, checking our email, listening
to or streaming music from a playlist - wherever we are,
whenever we desire. We can book a flight, hotel and rental
car while having coffee at Starbucks®.
Seriously, smart phones have changed our lives and
most of us have no idea what we ever did without them.
But 3G and 4G technology open us up to a new world of
identity theft, as well. Our iPhone may or may not store
credit card information directly, but all the sites we view au-
tomatically log us in where our card information is stored.
Our Droid is connected directly to our Facebook account
and merges data from multiple sources into a single con-
tact list. Our Blackberry automatically accesses our email at
work as well as home, keeping us productive and in touch
with our personal lives at the same time. What informa-
tion received via email would we rather not see fall into the
wrong hands?
We are putting more information on our phones and
using it for mobile banking, including depositing checks.
With the rise in credit card monitoring and sophisticated
policing by credit card companies, identity thieves are in-
creasingly targeting users of smart phones and social me-
dia, where consumers have a tendency to be less cautious.
About 65-70 percent of the users do not have password pro-
tection for their phones.
People should not let their guard down. The challenge
we have is criminals often change faster than everyday con-
sumers. If your phone was stolen a few years ago, the thief
could make prank calls and read your text messages. Today,
that person can destroy your social life and your finances.
28 INFORMANT: FALL 2012
Smart
Phones
and
Identity
Theft
By Sanjeev Shah, FCA, CFE NW3C Guest Contributor
Threats and Security
Your smart phone’s knowledge, if not protected, is a
potential risk to your security and privacy. The ultimate
question to ask: Is my privacy and security at risk? One
has to secure the phone by passcode, antivirus software
and software updates. Mobile malware is a rising threat to
privacy and security. It is a program especially created to
wreak havoc on your phone. Once installed on your device,
it disrupts the phone’s system to gain access to the device’s
operating system (OS) and takes over the phone to gather
stored information. Mobile malware may infiltrate through
mobile applications, web-browsing and text messages.
Here are some of the risks which occur when using a
smart phone.
• Phones are easily stolen or lost;
• Phones are associated with and linked to a specific
user for billing and account purposes, particularly
when GPS is enabled;
• While moving in and out of Wi-Fi service areas,
you also move in and out of firewalls and secure
hotspots; and
• Some apps used are unsafe, which can enable phish-
ing attacks.
Be careful while on an open Wi-Fi network: If you
connected to a public network before, your phone can
connect automatically to the same open Wi-Fi network.
Identity thieves will use this environment to snatch credit
card information or user names and passwords to start an
attack. The safest course of action is not to enter sensitive
data on a public network.
“Shred” smart phone’s data: If your phone is stolen,
all the information on it is valuable to an identity thief. To
overcome this, cell phone security applications are more
readily available. These allow you to log into a computer
and digitally “shred” (erase) your data.
Allow or deny Access: Before downloading any app,
you should carefully examine and pay attention to the per-
missions the app is asking to access. It is desirable to review
an app’s ratings regardless of whether it is free or paid. For
example, the app may request permission to access network
communication, system tools, phone calls, personal infor-
mation in form of owner, contact and storage data as well
as hardware controls. Android phone users have to either
allow or deny access, and in case of denial, the user will
not be able to download the app. For iPhone users, Apple®
does not allow app developers to disclose and access the in-
formation, while Blackberry allows the user to modify the
app’s permission levels.
Zero-day security hole: Zero-day vulnerabilities are not
yet known by manufacturers and antivirus companies. A
known security expert successfully commandeered malware
called Nickispy, a remote-access tool emanating from China.
Through a classic “spear phishing” attack in Android and Ap-
ple smart phone browsers, he controlled the device, recorded
its calls, pinpointed its location and accessed user texts and
emails. In theory, it could be used to infiltrate a corporate net-
work with which the phone connects. Per the report, there is
no security software to thwart it. It is also observed that free
phone apps are increasingly loaded with malware. Download-
ing from well-known app stores reduces the risk, but does not
eliminate it completely.
Coffee at Starbucks with no wallet: A new smart phone
app called “Pay with Square” may allow you to do just that.
As soon as you walk in without taking out your wallet, your
phone syncs with the Starbucks database. We all look for
convenience, but having this app may make you more sus-
ceptible to identity theft unless there is a lot of security be-
hind this network and database.
Beware… Virus steals money, then fools you by hid-
ing fraudulent transactions: A new computer virus, called
Gauss, was recently discovered in the Middle East. These
surveillance tools steal credentials for hacking online bank-
ing systems and hijack login information for social sites and
email/messaging accounts. Cyber security firm Kaspersky
Lab said, Gauss is the work of the same factory that built the
Stuxnet worm, which attacked Iran’s nuclear program. New
malware was released this year that not only steals money
from your bank, but also offers false reassurance that it is
still there. The malware is designed in a way that when one
visits his or her online bank, there is no trace of the transac-
tions cyber-criminals are using to empty the bank account.
Worse, the balance will be adjusted on screen so it looks
as if nothing is happening. High-tech cyber attacks such as
SpyEye are behind such crimes.
Photobucket Mobile - Not hacking but Fusking: An
alarming number of women have no idea their private,
nude photos posted on Photobucket have been made public
and available on Internet message boards. Skilled hackers
are bypassing Photobucket’s security settings and scouting
for naked photos users wanted to keep private. They use
software to retrieve the hidden snapshots called fusking -
not hacking. This kind of disturbing act is carried out with
the help of fusking engines available on the web.
Protect Yourself with Your Smart Phone
Smart phone users are about a third more likely to be-
come victims of identity theft than non-users. For every
advancement made on the protection side, consumers re-
main vulnerable due to the resourcefulness and penetra-
tion capabilities of crooks. Defensive tactics have tradi-
tionally relied on reactive technologies, such as antivirus
signatures, firewalls and intrusion prevention systems. But,
today’s threat landscape requires an approach that mixes
defense with offense. Here are some recommended defen-
sive and offensive tactics:
• Password-protect and lock your phone when not
in use.
• Install security software that offers antivirus and
malware designed specifically for smart phones
and make sure to download software updates.
• Install a “phone finder” app, which helps you to lo-
cate your stolen phone.
• Do not “jail-break” or use a “jail-broken” phone
since it has gone through a process which opens its
OS to apps which would otherwise not be compat-
ible.
• Before you throw away a device, clean it by making
sure none of your data is retrievable. Do a complete
reset of your phone to wipe out its data and restore
it to its factory settings.
• When installing an app on your smart phone, take
time to read the “small print.” Evaluate the infor-
mation the app requires for access.
• Enroll in a backup/wiping program that will back
up the information on your smart phone to your
home PC. Some of these services are also able to
“wipe” your phone if it is lost so no data remains
on the device. iPhones have a built in “wipe” fea-
ture that can be activated to wipe the phone after
10 failed log-on attempts.
• Limit your activities while in public Wi-Fi. Try not
to buy goods while using a public zone.
• Check URLs before making purchases. Any page
that requires credit card information should start
with https://. This means it is secure.
• Users should ensure the “anti-phishing option
is switched on” in their web browser, which will
check for “blacklisted” websites and prevent the
browser from being directed to the “fake” version
of the website. 
WWW.NW3C.ORG 29
 IC3 Alerts
Internet Crime Complaint Center (IC3®) Alerts
IC3 compiles complaint data to prepare public service announcements about the latest
trends in Internet fraud. The scam alerts are sent to the media, law enforcement and
other industry partners. Below are some of the latest scams and fraud alerts that IC3
has posted.
FAKE POLITICAL SURVEY OFFERS
FREE CRUISE
I C3 has been notified of a scam involv-
ing telephone calls conducting a mul-
tiple-choice “political survey.” Following
the survey, the recipients are told they
won a free cruise to the Bahamas. After
providing a website address for legiti-
macy, the caller requests the “winner’s”
email address for notification purposes
and credit card information to cover
port fees. The website has very limited
information, but does contain a few
photos, testimonials and a “Caribbean
Line” banner, in an attempt to convince
visitors it is legitimate. 
ONLINE PHONE BOOK
I C3 has received several complaints
regarding a phone book website.
Complainants reported that anyone
could post other individuals’ informa-
tion. Some reported being verbally bul-
lied, receiving uncensored comments,
or having false accusations posted
about them. Personal information that
can be listed on the website includes:
full name, unlisted cell phone num-
bers, email addresses, direct links to a
person’s private Facebook® account and
any other information or photos some-
one wants to add. The website also al-
lows users to anonymously call anyone
listed on the site directly from the web,
as well as track them with GPS. 
FREE CREDIT SERVICE WEBSITE
O ver 2,000 complaints have been
filed with IC3 regarding a par-
ticular website that is claiming to of-
30 INFORMANT: FALL 2012
fer “free” credit services such as credit
scores and credit monitoring. Custom-
ers reported being charged a monthly
service fee. However, the terms of the
agreement advised that the “free” re-
port only lasts for a limited time. At
the end of the free term, the website
used the customer’s supplied finan-
cial information to charge a monthly
membership service fee ranging from
$19.95 to $29.95.
The terms and agreement from the
website states the following:
“For Subscription Services which
include a free-trial period, if you do
not cancel your free trial within the free
trial period, you will be charged at the
monthly rate in effect at that time for
the Subscription Services for which you
enrolled. Your debit or credit card (in-
cluding, if applicable, as automatically
updated by your card provider follow-
ing expiration or change in account
number) will continue to be charged
each month at the applicable monthly
rate unless and until you cancel the
Subscription Services.”
The website, according to the Better
Business Bureau (BBB), has been given
an F rating by the BBB for the following
reasons:
• 1037 complaints filed against
the business.
• 8 complaints filed against the
business that were not resolved.
• 17 serious complaints filed
against the business. 
CITADEL MALWARE DELIVERS
REVETON RANSOMWARE IN AT-
TEMPTS TO EXTORT MONEY
O
n May 30, 2012, IC3 released
the following PSA to warn con-
sumers about a new Citadel malware
platform used to deliver ransomware,
named Reveton:
The ransomware lures the victim to
a drive-by download website, at which
time the ransomware is installed on
the user’s computer. Once installed,
the computer freezes and a screen is
displayed warning the user they have
violated United States federal law. The
message further declares the user’s IP
address was identified by the Comput-
er Crime & Intellectual Property Sec-
tion as visiting child pornography and
other illegal content.
To unlock their computer the user
is instructed to pay a $100 fine to the
US Department of Justice, using pre-
paid money card services. The geo-
graphic location of the user’s IP address
determines what payment services are
offered. In addition to the ransomware,
the Citadel malware continues to oper-
ate on the compromised computer and
can be used to commit online banking
and credit card fraud. 
EXPOSING BAD CLIENTS IN THE
ESCORT COMMUNITY
I
C3 has received several complaints
regarding an escort website. Com-
plainants report their identities were
stolen and photographs were posted
on the site along with slanderous and
inaccurate comments about them.
 IC3 Alerts

The victims then received extortion
emails from subjects offering to re-
move the information from the web-
site for a fee. This scam is extremely
detrimental to victims on a personal
and professional level. Some victims
reported their marriages and reputa-
tions have been damaged.
The website disclaimer states in-
dividuals named on this website
provided their information freely to
verify and confirm their identity for
the purpose of making arrangements
to meet and spend time with a paid
companion. The website also states
they are located outside the United
States and Europe, and they do not
have to respond to any subpoena
(court order) from these countries.
US AIRWAYS PHISHING EMAIL
CONTAINING MALWARE
made. The email contains a link to
“check-in” online for the flight, a fake
confirmation code, and flight details.
The phishing scam is deceiving be-
cause it looks authentic, even includ-
ing the US Airways logo.
The Better Business Bureau post-
ed information from US Airways
that reminds customers that official
emails often include personal infor-
mation such as names and Dividend
Miles numbers. However, their web
check-in emails will not contain a
name, but will have a valid confirma-
tion code that will either be alphanu-
meric or all letters.
If you receive the email:
• Check any links by hovering your
mouse pointer over the link to
identify the URL. A legitimate
link will have a URL with “usair-
Sample Fake email:
From: US Airways - Reservations
[mailto:reservations@myusairways.
com]
Sent: Wednesday, April 04, 2012 9:51
AM
Subject: [BULK] Confirm your US air-
ways online reservation.
Importance: Low
You can check in from 24 hours and
up to 60 minutes before your flight (2
hours if you’re flying internationally).
Then, all you have to do is print your
boarding pass and go to the gate.
We are committed to protecting your
privacy. Your information is kept pri-
vate and confidential. For information
about our privacy policy visit usair-

T here’s a new phishing scam be-

ing reported to IC3 that is made
to look like it is an itinerary for a US
•
ways.com.”
Do not click on any links or
ways.com.

US Airways, 111 W. Rio Salado Pkwy,

download any attachments. Tempe, AZ 85281 , Copyright US
Airways flight. • Delete the email. Airways , All rights reserved. 
The scam involves an e-mail contain-
ing a phony itinerary for a flight res-
ervation the recipient never actually

Training Online
TM

Get the information and skills you need to extract investigative leads and case-related infor-
mation from the IC3 database.
The Internet Complaint Search and Investigation System (ICSIS) training is now available online.
The course gives you an expanded knowledge of the database and introduces you to tools
that can be used to build cases during investigations and much more.
To obtain access to the ICSIS online training, please contact IC3 Manager Kathryn Malbon Rinker
at kmalbonrinker@nw3c.org. Or to learn more about the ICSIS training, go to:
www.nw3c.o rg/training/specialty-tra ining
www.nw3c.org/training/specialty-training

WWW.NW3C.ORG 31
 National White Collar Crime Center
www.nw3c.org

10900 Nuckols Road, Suite 325 5000 NASA Blvd., Suite 2400
Glen Allen, VA 23060 Fairmont, WV 26554
(800) 221-4424 (877) 628-7674

In our next issue:

• The United Nations crime-fighting office stated that 2.4 million people across the globe
are victims of human trafficking at any one time and 80 percent of them are being ex-
ploited as sexual slaves. This is not limited to third world countries, but is rampant across
the United States as well. The main motivator for human trafficking is money. Because
the web makes it easier to operate these criminal activities, NW3C is becoming more
involved in educating law enforcement on human trafficking’s nexus to white collar
crime. Several articles will be featured on various aspects of this topic.

• It is clear the professionals who respond to scenes where people are victimized in our
communities are themselves, particularly over time, subject to the impact of traumatic
stress. It is key to identify this stress and how it affects the everyday lives of law enforce-
ment. Also, understanding the latest research and ways to combat this stress can help
keep law enforcement healthy and on the job.

• The Social Media and Internet Law Enforcement (Smile) Conference was held this past
September and law enforcement from around the world gathered to discuss best prac-
tices, share ideas on how they can use social media to improve law enforcement, en-
gage citizens and prevent and solve crime.

All this and more in the Winter 2013 issue

of the Informant

Find us on
Facebook
Search: @NW3CNews
NationalWhiteCollarCrime

32
NAT IONA L WH IT E COLLAR C RIM E CENTE R

INFORMANT: FALL 2012

,BJA
q Bureau of Justice Assistance
U.S. Department of Justice