MVPD launches cybercrime unit

Cybercrime has become in an increasing problem in Mountain View. More and more, criminals are turning to digital devices and the Internet to conduct illicit activities, and police evidence is starting to look less like dusted fingerprints and more like a hard drive or a smartphone.

In an effort to better handle reports of online fraud and tackle a growing backlog of digital evidence in criminal cases, the Mountain View Police Department announced the launch of a new cybercrime unit last month.

It was really born out of necessity, according to Sgt. Tim Dahl, a member of the unit. He said the police department has been handling increasing numbers of high-tech evidence suspected of containing important information, whether it be GPS locations, text messages or contact information. But processing that kind of information along the intricate requirements of a digital search warrant can be tricky and time consuming, and up until now the department has been outsourcing the work to regional agencies.

But in the last 10 or so years, the prevalence of smart phones and other digital devices have turned technology into an integral part of most Mountain View crimes. Typical street crimes like drug deals and prostitution used to be an offline illicit activity, Dahl said, but now these crimes almost assuredly leave some kind of digital trace.

“Back then you wouldn’t see technology touching those kinds of crimes,” he said.

On top of that, Dahl said the department has seen plenty of cases related to network intrusion, where a person gains unauthorized access to a server, email spoofing and fraud. Often, scammers will attempt to deceive unsuspecting victims by pretending to represent federal agencies in an attempt to get money. All of these cases couldn’t be handled in-house at the Mountain View Police Department until now.

The practice had been to send digital evidence to an outside forensic examiner, according to Det. Britton Moore, a cybercrime unit member and a computer forensic examiner himself. Sending off evidence to the Silicon Valley Regional Computer Forensics Laboratory (RCFL) or to a crime lab are perfectly viable options, Moore said, but getting anything back can take upwards of a year.

The way these regional forensic analysts prioritize cases is totally out of the control of the police department, Moore said, meaning a significant case in Mountain View may not get seen for a very long time. Anything short of a homicide investigation will likely get bumped to the end of the queue.

“It’s much more efficient to do it in-house,” Moore said.

The impetus for the new unit comes from the top. Police Chief Max Bosel put a higher priority on addressing cybercrime as tech devices continue to be more frequently used to assist in committing theft, intimidating people or even facilitating violent crime.

“Having dedicated capacity and resources to lead the effort in tackling cybercrime allows us to stay at the forefront of emerging trends, speeds our ability to obtain evidence, and ultimately makes the community a safer place to enjoy a quality life,” Bosel said in an email to the Voice.

Members of the cybercrime unit play an active role at the Mountain View Police Department, getting involved early on in cases where digital devices may need to be searched for evidence. Rather than off-load a hard drive or cellphone to the unit, Dahl said an officer might come to them after an arrest the night before, and mention that there may be evidence on the suspect’s cellphone. The unit can help to execute an appropriate search warrant and get started on mounting a case for the Santa Clara County District Attorney’s Office.

The forensic work itself is also pretty nuanced, warranting a unit that can work full-time on identifying evidence on a computer. There’s a particular set standards and procedures for how to extract the appropriate data outlined in the search warrant, Dahl said, and state laws are constantly changing how police are supposed to search digital devices. Botching the search means the evidence may be thrown out by a court.

“You need to know how to extract that digital evidence that’s relevant to the case,” Dahl said. “The evidence has to be handled both efficiently and effectively.”

Beyond handling evidence, the unit is the first stop for Mountain View residents who receive fraudulent, deceptive emails designed to scam people. Without the unit, it was standard procedure for the department to file these kinds of scam emails to a federal agency, Dahl said, and it was unlikely to yield any kind of follow-up. Even less likely, he said, was any chance of a prosecution.

With a local, in-house group of police staff now handling these cases, he said, there’s going to be a whole lot more outreach to victims, and a greater effort to follow up with residents on cybercrime cases.

Moore said a big component of the new unit comes down to outreach as well, teaching the public about best practices when using social media and online resources. Using passwords that can’t be cracked with brute force, and being mindful of what personal information is posted on social media, are just some of the strategies the cybercrime unit is advising residents to use to avoid becoming a victim of online criminal activity.

But good communication with the pubic needs to go both ways. The new unit can provide support and education to residents who fall victim to things like network intrusion or cyber-bullying, Dahl said, but only if the victims come forward. They can’t provide services for cases they don’t know about, he said, and the unit is encouraging anyone who feels they may have been victim to some kind of cybercrime to contact the police department.

“No crime is too small,” Dahl said. “If someone feels victimized, they should bring it to us.”

Moore agreed, and said anyone in the community who had a case they thought wasn’t worth reporting really ought to reconsider, because it helps give the Mountain View Police Department a better idea of how prevalent these cybercrimes really are.

“It really helps for us to know,” Moore said. “We’re not going to know what’s happening in the community unless it’s reported.”