FBINAA MARAPR MAG.2019.FINAL

NARCOTICS CASES PRODUCE MOUNTAINS OF MOBILE DATA: WHAT NEXT?

F B I N A A . O R G | M A R / A P R 2 0 1 9

LOUIS QUIJAS

This January, the U.S. Customs and Border Protection intercepted a tractor-trailer that appeared to be transporting Mexican produce into Arizona. But it turned out the truck was carrying much more—250-plus pounds of the addictive opioid fentanyl, a painkiller that has been linked to the deaths of Prince , Tom Petty and thousands of Americans.

I t was the largest fentanyl bust the agency had directed, amounting to a street value of around $3.5 million. The truck also contained a stash of nearly 395 pounds of methamphet- amine, adding over a million dollars more to the value of the drug bust. This was no isolated case. The nation’s opioid crisis has demanded law-enforcement attention in recent times more than ever. Deaths from drug overdoses have risen significantly in the past 10 years, with opioids gaining national attention as “hot spots” of the opioid epidemic continue to emerge across the country. Narcotics overdoses have killed nearly four times as many people in the U.S. than murder and non-negligent man- slaughter, according to the National Institutes of Health. The carnage is so severe that it is incumbent upon investiga- tors to do everything in their power to track down the sources to stop drug deals and prevent future overdose deaths. Often, the answers lie within a cell phone or other mobile device recov- ered at the scene—as was the case in Orlando, Fla., where law enforcement officials were able to track a 2017 fentanyl overdose case back to the drug dealer where the drug was obtained, lead- ing to a conviction for first-degree manslaughter. The drug dealer is now serving a life sentence. TOO MUCH DATA, TOO LITTLE TIME Seizing a cell phone from a scene like the one in Arizona sets in motion what ultimately must be a high-speed, tightly choreo- graphed investigation. The clock starts ticking immediately; if investigations don’t have solid leads, suspects or arrests within 48 hours, the chances of solving a case drop by half. With the advent of digital forensics, it is now possible to extract terabytes of data from a single cell phone, tablet or other device used by victims, witnesses and others involved. Buried

within that mountain of data are clues that could hold the key to solving the most complex narcotics cases, like a drug dealer’s lo- cation, text messages that may reveal future deals in the making, and images or videos that might help law-enforcement officials identify other people of interest. Extracting evidence from a device is just the first step in the investigative process. The real challenge is then to sort through and make use of a tremendous—and growing—amount of data frommultiple devices seized during a drug bust, without losing time. Mobile devices are getting more complex by the day, with people using not just text messaging but chat applications such as Kik and Snapchat to communicate. The inability to extract data from encrypted apps, as well as the sheer amount of data that must be extracted, have been identified as two of the top three digital forensics challenges for investigators. The problem is clear: more data is available now than ever before, but operationally, investigating teams often struggle with accessing and analyzing the daunting volumes of it. AUTOMATION SPEEDS UP INVESTIGATIONS Traditionally, sorting through data obtained frommobile devices at a crime scene has been a largely manual and time-in- tensive process. If information can’t be identified quickly, teams have to move on, leaving critical evidence undiscovered. The process hasn’t just been slow, but inefficient. The data extracted frommobile devices is usually processed in a siloed, static way, without being able to combine insights for a high-lev- el view. That’s important when, for example, investigators need to piece together clues from a drug dealer’s social media posts or external sources along with data stored on a phone.

continued on page 30

15