RCTA Cryptocurrency in Drug Investigations

Prerequisites: None

Description: This 3 day course is designed to focus on boots on the ground law enforcement to recognize, trace and seize cryptocurrency in the field when duly authorized to do so. It is of utmost importance when passing information to higher elements. At least one attendee in each course since March 2019 has recognized something missed in a previous search or realized they had such a device in evidence. Field agents, (be they local, state or federal) do not in general, possess the knowledge to immediately recognize, identify, target and potentially sweep illicit value to safety in the field. With this course, field agents will become exponentially better sources of crypto information on an SSE (Sensitive Site Exploitation) site and gain the capability of highlighting and shaping information passed on to cyber and forensic personnel. This course will cover basic Darknet investigative techniques. Upon leaving this course, all attendees will be able to materially contribute to or lead a cryptocurrency investigation.

The course will cover all the objectives listed below. All practical exercises will involve actual coin transactions conducted and analyzed by attendees. Exploitation of phones, computers and coin hardware storage devices will also be executed by attendees as well as hands on use of Linux, Windows and Chrome operating systems. Note: It is important that each attendee bring a laptop computer where you have the administrator rights (for specialized software install) and no internet filters whatsoever. USB ports should be set to active. Attendees should have permissions to install apps on phones. Attendees are encouraged to bring their own Wi-Fi hubs to reduce bandwidth draw during transactions. Personal equipment is authorized but only recommended if no PII is on the device.

Note: FOLLOWING THIS COURSE, NEVER CONNECT THE COMPUTER YOU USE IN THE COURSE TO GOVERNMENT NETWORKS WITHOUT EXPRESS CONSENT FROM YOUR RESPECTIVE IT MANAGER.

Course Objectives:

• The basics of Bitcoin and other popular coins.
• Coin wallets & exchange services.
• Using blockchain explorers in the field to run discovered coin addresses forward and backward.
• Google Dorking to find a transaction on the blockchain quickly from as little as one data point.
• Transacting with subjects (suspects) or machines to analyze their coin transactions.
• Creating alerts to monitor specific coin address activity.
• Pseudo anonymous vs. anonymous coins.
• Coin hard forks. What are they? What did you miss in a search?
• How to discover crypto resources in your operational area using publicly available resources.
• The evolution of Coin ATMs and why it has never been more important.
• How to create, receive and spend coin from select paper wallets requiring zero identity.
• How to convert one coin to another using decentralized conversion platforms requiring zero identity.
• Why it is important to still monitor decentralized exchanges that have implemented KYC.
• The best app for sweeping funds from wallet private keys should you discover one in the field.
• Conducting hands on exploits of coin hardware storage devices.
• Splicing in a power supply to keep an encrypted hard drive alive for exploitation. A Faraday bag is lacking a very key component.
• Coin debit cards. This is an ever-changing landscape. Understand the implications.
• Cell phone top up with Crypto. Why this is important.
• Building and improving a cryptocurrency SSE checklist.
• Understanding how Decentralized Exchanges and Non-Fungible Tokens are used in drug trade.
• A brief overview of other non-crypto exchange platforms such as WebMoney and Transferwise. You will see these in your investigations.
• Developing and coordinating a cryptocurrency policy within your department, agency or task force.
• The Capstone Exercise will is designed to flex all subjects covered during the training period.
• Practical Exercises with be used throughout the training to gauge participation and proficiency.