A cybercrime investigator is primarily concerned with gathering evidence from digital systems that can be used in the prosecution of internet-based, or cyberspace, criminal activity. In today’s world, many crimes include the use of the world wide web. A cybercrime investigator can be used to gather crucial evidence to help solve these crimes.
While possessing and utilizing many of the same skills as a computer forensics investigator, the cybercrime investigator is more focused on and adept at investigating crimes that use the internet as the primary attack vector.
The cybercrime investigator takes the lead for investigating cyber-attacks by criminals, overseas adversaries, and terrorists. The threat from cybercriminals is serious — and growing. Cyber intrusions are becoming more common, more menacing, and more advanced.
Both private and public sector networks are targeted by adversaries every minute of every day. Companies are targeted for trade secrets and other sensitive data and universities attacked for their research and development. Citizens are targeted by identity thieves and children by online predators. The ability to preserve and recover digital evidence can be critical for the successful prosecution of these crimes.
Steps to becoming a cybercrime investigator
A combination of both education and experience are needed to become a cybercrime investigator. This education and experience, or a combination of each, should be in both cybersecurity and investigations.
Education A bachelor’s degree in criminal justice or cybersecurity is generally required to qualify for a position as a cybercrime investigator. Some community colleges offer two-year associate degrees in criminal justice, which allow aspiring cybercrime investigators to then transfer to a four-year college or university to earn a bachelor’s degree. Pursuing a degree in computer science is also desirable for work as a cybercrime investigator.
Career path A common career path for this investigative specialty passes through several years as an integral part of a cybersecurity team. A sound understanding of cybersecurity defenses arms the applicant with the basis for understanding how cybercriminals will react in a variety of circumstances. Work in a discipline that has helped the applicant acquire skills related to investigative work are valuable within the industry.
Professional certifications While there is no industry-wide prescribed professional certification required for a career as a cybercrime investigator, two certifications stand out as desirable qualifiers. The Certified Information Systems Security Professional (CISSP) demonstrates that an applicant has a sound understanding of security architecture, engineering, and management. The Certified Ethical Hacker (CEH) further demonstrates an in-depth knowledge of cyberattacks and mitigation methods.
Experience Because the knowledge base required to be a successful cybercrime investigator is, in many aspects, cross-functional it is a position best suited for the experienced cybersecurity or criminal investigations professional. Even coming out of college with one of the above-mentioned bachelor’s degrees it is unlikely that a candidate would possess the experience needed in both cybersecurity and investigations. Experience in the field will allow for adding a solid knowledge of investigation principles and practices on top of cybersecurity skills or vice versa.
What is a cybercrime investigator?
A cybercrime investigator is a highly-skilled and specially-trained investigator or detective. Sought after in both the private and public sectors, these investigators bring the skills needed to unravel today’s sophisticated internet crimes.
Billions of dollars are lost every year repairing systems hit by cyberattacks. Some take down vital systems, disrupting and sometimes disabling the work of hospitals, banks, and emergency call centers around the country. The cybercrime investigator gathers the information necessary to stop cybercriminals from continuing their nefarious activities.
Cybercrime investigator skills and experience
This is a multi-functional role in that both investigative techniques and cybersecurity skills must be deployed to correctly gather and preserve evidence for later prosecution.
The ability to work in a multi-jurisdictional or cross-jurisdictional environment is important. An important aspect of cybercrime is its nonlocal character. Illegal activity can occur in jurisdictions separated by vast distances. This poses severe challenges for cybercrime investigators since these crimes often require international cooperation. For example, if a person accesses child pornography located on a computer in a country that does not ban child pornography, is that individual committing a crime in a nation where such materials are illegal? The cybercrime investigator must be able to ask and answer questions related to understanding exactly where cybercrime has taken place.
What do cybercrime investigators do?
Most cybercrime investigators work for law enforcement agencies, consulting firms, or business and financial companies. In some cases, cybercrime investigators can be hired, either full time or freelance, as white hat hackers. In this role, while often providing penetration testing (pen testing) services, the investigator has the responsibility to examine the defenses of a specific network or digital system. The objective is to find vulnerabilities or other security weaknesses that could be exploited by real adversaries.
Once investigators gather digital evidence, it must be recorded and cataloged. The evidence is also used to create reports and presented in a court of law, as well. These can all be functions of a cybercrime investigator.
Cybercrime investigator job description
While a detective or law enforcement investigator may investigate various types of crimes, a cybercrime investigator is a specialist that is focused primarily on cyber, or internet-based, crimes.
A cybercrime investigator investigates a number of crimes that range from recovering file systems on computers that have been hacked or damaged to investigating crimes against children. In addition, cybercrime investigators also recover data from computers that can be used in prosecuting crimes.
Once the necessary electronic evidence is gathered, cybercrime investigators write reports that will later be used in court. Cybercrime investigators must also testify in court.
Cybercrime investigators may also work for large corporations to test security systems that are currently in place. Investigators do this by trying various ways to hack into the corporation’s computer networks.
Job responsibilities may include:
- Analyzing computer systems and networks following a crime.
- Recovering data that was either destroyed or damaged.
- Gathering evidence.
- Gathering computer and network information.
- Reconstructing cyberattacks.
- Working in a multi-jurisdictional or cross-jurisdictional environment.
- Preparing expert reports on highly complex technical matters.
- Testifying in court.
- Training law enforcement on cyber-related issues.
- Drafting expert testimony, affidavits, and reports.
- Consulting with clients, supervisors, and managers.
- Continually developing investigative and cybersecurity skills through research and training.
- Recovering password-protected/encrypted files and hidden information.
- Assessing software applications, networks, and endpoints for security flaws.
- Identify and recommend methods for the preservation and presentation of evidence.
- An ability to work and collaborate well with a team.
Outlook for cybercrime investigators
Because of the early and widespread adoption of computers and the internet in the United States, most of the earliest victims of cybercrime were Americans. By the 21st century, though, hardly a community remained anywhere in the world that had not been touched by cybercrime of one kind or another. Today, the need for cybercrime investigators is worldwide and rapidly growing. There are no indications that the demand for cybercrime investigators will slow in the foreseeable future.
The proliferation of criminal activity on the internet, such as identity theft, spamming, email harassment and illegal downloading of copyrighted materials, will increase the demand for investigators. Opportunities are expected to be excellent for cybercrime investigators.
How much do cybercrime investigators make?
The US Bureau of Labor Statistics (BLS) reported that the 2018 median annual salary for information security analysts (a closely-related specialty to cybercrime investigator) was $98,350, while police and detectives, in general, earned a median salary of $63,380 (www.bls.gov). BLS believes that the demand for this closely-related specialty is projected to grow 32 percent from 2018 to 2028, much faster than the average for all occupations.
Other sources indicate career will grow at a rate of at least 22 percent (the projected rate of growth for private investigator jobs) and probably higher than 27 percent (the projected rate of growth of computer-support-related jobs).