Mounties seek to expand tech team in response to growth of cybercrime
From investigating a major security breach at a federal agency to sifting through tons of emails in the Senate expenses probe, it’s been a busy year for the RCMP’s national cybercrime team in Ottawa.
So busy, in fact, that the Integrated Technological Crime Unit is looking to grow. While officials won’t say so publicly, a source told Postmedia News that the RCMP is seeking to almost double the size of the 12-member team.
While most RCMP divisions have cybercrime units, the one located in National Division is unique in that it specializes in responses to security breaches involving federal departments and assists in “sensitive” investigations of national interest.
Insp. Jeff Beaulac, officer in charge of technical investigation services at National Division, said he couldn’t discuss expansion plans but acknowledged that the team is in high demand.
“In the past we would seize one computer and analyze the data, now we deal with a multitude of devices and the data examination has grown substantially. We’ve gone from gigabytes to terabytes,” he said.
One crisis the team had to respond to was a major data breach in April at the Canada Revenue Agency due to the Heartbleed bug. More than 900 social insurance numbers were taken during a six-hour window.
Retracing a suspect’s digital footprints is rarely straightforward, Beaulac said. A cyber attack might appear to have originated in a different country, but the culprit could be sitting next to you at the coffee shop.
Another big case the team handled is the RCMP’s fraud and breach-of-trust investigation surrounding a $90,000 payment Prime Minister Stephen Harper’s former chief of staff, Nigel Wright, made to Sen. Mike Duffy to cover questionable housing expenses.
Beaulac said he could not discuss specifics but confirmed that his team “provided all the digital forensic support,” including the search, seizure and analysis of data, such as emails. The RCMP cleared Wright of wrongdoing. Duffy is set to go to trial next spring.
Digital forensics — the process of sifting through data and extracting the parts relevant to an investigation — is the biggest part of what the cybercrime unit does.
In 2012, an RCMP audit found that cybercrime teams across Canada were dealing with serious backlogs and “devices that had been received but not yet analyzed.”
Beaulac said the force has started to give front-line officers tools and training to gather evidence from devices on their own.
Cybercrime investigators are required to complete a twoyear understudy program, which involves a mix of classes at the Canadian Police College and work experience under a certified mentor.
Even as technology and threats evolve, one thing hasn’t changed, Beaulac said.
Cybercriminals “still make mistakes.”