5 June 1997
Source: Federal Law Enforcement Training Center, Catalog of Training Programs, Fiscal Years 1997-1998; pp. 31-43.
ftp://ftp.fedworld.gov/pub/tel/97fedcat.w52 (full document 327K)

Contents

1  Computer Evidence Analysis Training Program

2  Criminal Investigations in an Automated Environment Training Program

3  Financial Crimes Investigations Training Program

4  Financial Forensics Techniques Training Program

5  International Banking and Money Laundering Training Program

6  International Financial Fraud Training Program

7  Microcomputers for Investigators Training Program

8  Money Laundering and Asset Forfeiture Training Program

9  Seized Computer and Evidence Recovery Specialist

10  Telecommunications Fraud Training Program

11  White Collar Crime Training Program

12  Windows Applications for Investigations Training Program

     The staff of the FLETC Financial Fraud Institute (FFI) has the responsibility for designing, developing, coordinating, and administering training programs devoted to the prevention, detection, investigation, and prosecution of complex financial and computer-related frauds. These programs are for personnel of the various organizational components within the Federal, State, and local law enforcement communities.

     The FFI takes the proactive role of arming the student with specialty skills and techniques to develop solid prosecutable cases in a range of crimes. Included are crimes involving government contracts, procurement fraud, illegal tax shelters, complex financial transactions supporting terrorism and criminal conspiracies, asset removal/seizures, money laundering activities involving drug smuggling organizations and other illegal enterprises, insurance frauds, electronic funds transfer fraud, and employee embezzlement. Also addressed in training are technical crimes involving computers and networks such as unauthorized access to government data systems and complex fraud cases using or involving computer systems.

     Although criminal investigators are the primary benefactors of these advanced training programs, others who will benefit from FFI training include those assigned to major case investigations units such as: analysts, inspectors, auditors, and technical specialists assigned to law enforcement functions in the financial and computer fraud areas.

     For further information, please contact:

Division Chief
Financial Fraud Institute
Federal Law Enforcement Training Center
Building 210, Room A-17
Glynco, GA 31524
Telephone: 912-267-2314
FAX: 912-267-2500

     For enrollment information, contact your agency training officer or the FLETC on-site representative through the appropriate chain of command.

1  Program Title: COMPUTER EVIDENCE ANALYSIS TRAINING PROGRAM (CEATP)

Program Description: The CEATP deals with computer search and seizure and forensic analysis of computer systems that are not IBM compatible.

Instruction is provided in the following areas:

• Local Area Network configurations and topographies as well as seizure techniques and standards;

• Novell NetWare Network Operating System menus and commands to assist with preserving and accessing data on the network server;

• Apple Macintosh file structure, boot processes and suggested seizure/analysis techniques;

• Unix file structure and typical commands to be used to access data on a computer system running the Unix operating system;

• Various utilities that can be used for downloading data from minicomputers or mainframes, and for converting the data into a format for analysis;

• Encryption/Decryption concepts and programs;

• Windows NT file structure and typical configurations;

• Windows 95 file structure and comparison to IBM compatible/DOS based systems.
  
  

Length of Training: 5 class days

Prerequisites for Attendance: The applicant must be a full-time journey-level criminal investigator who has completed the CIAETP (Criminal Investigations in an Automated Environment Training Program), or who is fully knowledgeable about the file structure of the DOS operating system, and who is familiar with recovery of computer generated evidence. Applicants who have not graduated from the CIAETP must qualify credentials directly with the program coordinator in order to demonstrate his/her knowledge of the information taught during the CIAETP, and acquire a waiver of the CIAETP prerequisite. Non-investigators are authorized to attend the program if they routinely work as a part of a technical investigative team. Qualified personnel from nonparticipating Federal agencies and State and local law enforcement organizations are admitted on a space-available basis.

2  Program Title: CRIMINAL INVESTIGATIONS in an AUTOMATED ENVIRONMENT TRAINING PROGRAM (CIAETP)

Program Description: The CIAETP is an intensive training program that introduces participants to the principles and techniques governing the acquisition of computer data files during the course of an investigation, and the subsequent search and seizure of computer related equipment/media, and its analysis for investigative leads. The training program begins with the presentation of one week of intensive disk analysis techniques used on IBM compatible computer systems. Participants use state of the art IBM-compatible computer systems running MS-DOS (Microsoft Disk Operating System), and application programs such as Windows, File Viewers, Norton Utilities, and various other utilities to locate data relevant to an investigative scenario. Students learn techniques to recover erased data which has not been overwritten, partially overwritten and fragmented data using various utility programs. Participants are presented with two software programs used during the first week of this training program: QuickView Plus and Norton Utilities (version 8).

During the second week of the training program, students are presented with a continuing case investigation with the predication that sensitive and classified government data has been compromised. Within the investigative scenario, students are exposed to legal issues, investigative techniques in requesting computer files through subpoenas, and composition of an affidavit for a search warrant using appropriate wording, directed toward computer equipment. As a series of final practical exercises, students execute a search warrant in an automated environment, seize computer data and magnetic media, perform an analysis of the computer media, and prepare for direct/cross examination in court regarding the techniques used during the search/seizure and analysis and the actual information found that contributed to the arrest of the defendant.

Courses in the CIAETP include the following:

• Disk Analysis: DOS/Batch Files

• Disk Analysis: Windows/File Viewers

• Disk Analysis: DOS/Batch Files, Windows/File Viewers Practical Exercise

• Disk Analysis: Boot Process and Configuring a Boot Disk for use at the Search Site

• Disk Analysis: Recovering Erased Data from Disks

• Disk Analysis: Miscellaneous Investigative Utilities

• Continuing Case Investigation Practical Exercise

• Disk Analysis: Final Practical Exercise

• Computer Related Statutes

• Computer Evidence

• Computer Search and Seizure

• Electronic Communications Privacy Act/Personal Privacy Act

• Duplicating/Converting data files from multi-user systems

• Backing up data from computer systems at the search site

• Computer Investigative Techniques/Evidence Preservation

• Execution of a Search Warrant Practical Exercise

• Prosecution Considerations/Expert Witness Testimony
  
  

Length of Training: 10 class days

Prerequisites for Attendance: Applicants should be criminal investigators with practical experience in criminal law, court procedures, applying rules of evidence, and other related investigative areas. Completion of FLETC's MITP or a similar course is considered an adequate background for this training program.

3  Program Title: FINANCIAL CRIMES INVESTIGATIONS TRAINING PROGRAM (FCITP)

[FORMERLY ADVANCED FINANCIAL FRAUD TRAINING PROGRAM - AFFTP]

Program Description: This program is designed for senior level field investigators. The FCITP focuses on the critical elements and techniques required for the successful investigation and prosecution of complex white collar or financial investigations. New investigative techniques and considerations, designed to enhance investigative skills in gathering, analyzing, and presenting financial information, are presented during the first week of the program. During week two, money laundering and asset forfeiture statutes are introduced and applied to non-drug-related fraud cases and to investigations that cross international boundaries. Week two instruction also includes training in various computer software packages for managing, searching, and presenting case information. Students are provided with the Quicken, Central Office, and ZyIndex software to take home. Students will be exposed to current prosecution strategies for civil and criminal cases and will be given an opportunity to present a criminal case to a Federal Prosecutor using both conventional methods and computer presentation software programs. A 17-hour practical exercise, simulating an actual financial fraud case, runs throughout the 2-week period to illustrate and reinforce the objectives of each course of instruction.

Courses included in the training are as follows:

• Contract Fraud

• Computerized Case Management Electronic Sources of Information

• Computer Related Investigations

• Indicators of Financial Fraud

• Financial Institutions

• Money Laundering

• Asset Forfeiture

• International Investigations

• Federal Sentencing Guidelines

• Civil Litigation

• Conflicts of Interest

• DOJ Considerations

• Telecommunications Crimes
  
  

Length of Training: 9 class days

Prerequisites for Attendance: The training is designed for experienced (GS-11/12) Criminal Investigators who have graduated from the FLETC Criminal Investigator Training Program or equivalent. However, the training program is also open to certain non-investigators (e.g., senior auditors) who routinely work as part of the investigative team.

4  Program Name: FINANCIAL FORENSICS TECHNIQUES TRAINING PROGRAM (FFTTP)

Program Description: One of the most difficult problems an investigator faces in prosecuting sophisticated financial crimes is explaining to the Assistant U.S. Attorney (AUSA) the significance of various accounting documents. If the AUSA is to convince the jury that the defendant is guilty of a specified crime, he or she must understand and appreciate not only the significance of the accounting documents, but how they are related and how they substantiate the elements of the crime. In a complex case, especially one involving fraud and money laundering, this problem can be compounded by the need to present hundreds of exhibits to prove individual financial transactions.

Due to many requests for a program that explains the relationship among, and purpose of, many accounting documents, the FFI staff developed the FFTTP. Geared for the journey-level financial investigator in Federal law enforcement, the program offers investigative tips and techniques that can be applied to the most sophisticated financial crimes.

Topical areas addressed in FFTTP include the following:

• Fraud and Money Laundering Statutes (elements of proof required for each statute)

• Accounting System Documents

• Types of Financial Frauds and Schemes (including arson, fraudulent real estate schemes, planned business failures, use of stocks, bonds, and commodities, and the use of sham/ shell corporations)

• Exposing Concealed Income

• Net Worth Analysis and Financial Calculations

• Printing Relevant Reports
  
  

Length of Training: 10 class days

Prerequisites for Attendance: Completion of either the International Banking and Money Laundering Training Program (IBMLTP) or the Domestic Money Laundering Training Program (DMLTP) is considered a prerequisite for registration.

5  Program Title: INTERNATIONAL BANKING AND MONEY LAUNDERING TRAINING PROGRAM (IBMLTP)

Program Description: The National Drug Policy Board's Financial Enforcement Committee recommended establishing this training program to address trends and current developments concerning international banking and money laundering. The program curriculum was developed by a task force consisting of representatives from law enforcement, intelligence, banking, and the Police Executive Research Forum (PERF).

A working example of interagency cooperation, this training program is managed by the FLETC's FFI staff. Instructional support is provided by staff members from the Federal Reserve Bank Board, Financial Crimes Enforcement Network, office of Financial Enforcement, Drug Enforcement Administration, Internal Revenue Service, Office of the Comptroller of the Currency, Organized crime Drug Enforcement Task Force, Bureau of Engraving and Printing, office of International Affairs (DOJ), Federal Bureau of Investigation, and U.S. Customs Service.

Participants are taught to recognize money laundering and cash flow indicators in foreign banking. Courses included in the IBMLTP are as follows:

• Bank Secrecy Act

• Money Laundering Statutes

• RFPA

• FinCEN

• International Banking Framework

• Tracing Money Through Financial Networks

• Mechanics of International Money Movement

• INTERPOL

• Tax Havens

• Case Study
  
  

Length of Training: 5 class days

Prerequisites for Attendance: The program is designed for Federal criminal investigators and law enforcement intelligence analysts involved in financial investigations.

6  Program Title: INTERNATIONAL FINANCIAL FRAUD TRAINING PROGRAM (IFFTP)

Program Description: This advanced training program, designed for non-United States law enforcement officers, deals with the many aspects of financial crime and its investigation. Students are introduced to the topics of money laundering, domestic and international banking, indirect methods of proving income, analysis of financial books and records, international treaties, and using the computers as investigative and analytical tools.

Courses offered in IFFTP include:

• Indicators of Financial Fraud

• Sources of Information (U.S. and Abroad)

• U.S. Bank Secrecy Act

• Questioned Documents and Document Fraud

• Documentation and Evidence

• Money Laundering

• Analysis of Books and Records

• International Banking

• Specific Item Method of Tracing Funds

• Bank Deposit Method of Tracing Funds

• Net Worth Method of Tracing Funds

• Advanced Interviewing Techniques

• Arrest Techniques

• Investigative Charting Techniques

• Credit Card Fraud

• Cellular Phone Fraud

• Undercover Operations

• International Treaties and Agreements

• Computers as Investigative Tools (Spreadsheets and Databases)

• Computer Security
  
  

Length of Training: 23 class days

Prerequisites for Attendance: Students are foreign financial crime investigators, or non-investigators attached to an investigative team. All students are senior field-level officers who are fluent in English reading, writing, and possess group conversation skills. Class size is limited to 24 students.

7  Program Title: MICROCOMPUTERS for INVESTIGATORS TRAINING PROGRAM (MITP)

Program Description: The MITP is an entry-level computer training program for criminal investigators. The focus of the program is on developing the abilities of the law enforcement officer in using the computer as an investigative tool. Using a combination of lecture, demonstration, and extensive hands-on application, the student will gain a familiarization with personal computers, the MS-DOS operating system, computer filing and retrieval techniques, and a variety of computer applications, including word processing, electronic spreadsheets, and data base managers.

Courses of instruction include:

• Introduction to Computers

• Introduction to MS-DOS

• Introduction to Microsoft Windows

• Introduction to Word Processing

• Introduction to Electronic Spreadsheets

• Introduction to Data Base Managers

• Introduction to Telecommunications

• Introduction to Seized Computer Evidence Analysis
  
  

Length of Training: 9 class days

Prerequisites for Attendance: Applicants should be experienced Federal law enforcement officers. No technical or computer experience required. Non-law enforcement support personnel and officers from State and Local agencies may register on a space-available basis.

8  Program Title: MONEY LAUNDERING AND ASSET FORFEITURE TRAINING PROGRAM (MLAFTP)

[FORMERLY DOMESTIC MONEY LAUNDERING TRAINING PROGRAM - DMLTP]

Program Description: The MLAFTP is designed for investigators and prosecutors who are knowledgeable of the basic methods of investigating and prosecuting white collar crime cases, although experience in conducting money laundering investigations is not a prerequisite for attendance. The focus of this program is on defining money laundering by statute, identifying indicators of money laundering, collecting evidence, analyzing financial records, prosecuting these violations, and pursuing forfeiture action. Instruction is provided by both FLETC and guest instructors. This program is exported regionally throughout the United States in coordination with district offices of United States Attorneys and the Law Enforcement Coordination Committee (LECC).

Courses taught in the MLAFTP include the following:

• Money Laundering Statutes

• Sources of Information (EPIC, IRS Computer Center)

• Asset Forfeiture Statutes and procedures

• Bank Secrecy Act

• Financial Crimes Enforcement Network (FinCEN)

• Methods and Techniques of Money Laundering

• Domestic Banking

• Financial Accounting

• Domestic and International Fund Transfers

• Investigating Money Laundering Practical Exercise (8 hours)
  
  

Length of Training: 4 class days (noon Monday thru noon Friday)

Prerequisites for Attendance: This training is available to all Federal, State and Local investigators and prosecutors. Analysts and Examiners may attend on a space available basis.

9  Program Title: SEIZED COMPUTER AND EVIDENCE RECOVERY SPECIALIST (SCERS)

Program Description: Businesses and individuals are increasingly relying on computers for a variety of uses, such as word processors to produce texts, databases to manage records, and spreadsheets to manage financial functions. Criminals with access to computers will likely use them in virtually every type of criminal activity, including narcotics trafficking, money laundering, memorialization by serial rapists and murderers. As a result, computers are being encountered today during the execution of most search warrants. Therefore, there is a critical need for law enforcement officers to be able to successfully seize, process, and recover computer evidence without compromising the integrity of the computerized evidence.

Responding to increasing demands from many law enforcement agencies, the FFI has assembled a comprehensive curriculum for the Seized Computer and Evidence Recovery Specialist Training Program. As they develop an in-depth knowledge of how computer data is created, stored, modified and manipulated, students will, during training, access and extract evidence f rom microcomputers. This computer evidence will be protected from destruction by viruses, planned malicious devices and careless manipulation.

During practical exercises, these necessary skills will be used to successfully process computer evidence. Computer processing will be from DOS-based microcomputers, using floppy and hard disks. Students will work extensively with the following forms:

• Named Files (at the DOS Level)

• Erased Files (Unfragmented)

• Erased Files (Fragmented)

• Locating Data in Unallocated Space

• Hidden Files and Sub-Directories using Camouflage Methods

• Locating Data Unreadable by Standard DOS Commands and Procedures

• Data Unknowingly Written to Disk from the Computer's Memory

• Data Hidden by Special Programming Techniques

• Disguised Data
  
  

Participants will make exact copies of the original evidence found on computer disks, document computer evidence and recovery procedures for credible testimony at trial. Completion of the program is intended to assist in qualifying students as expert witnesses in the processing of seized computer evidence and data recovery.

Length of Training: 15 class days

Prerequisites for Attendance: Trained law enforcement officers experienced in the rules of evidence and the interpretation of investigative leads who, with an in-depth knowledge in DOS, are required to seize and process computer evidence and maintain the evidentiary integrity of recovered data.

10  Program Title: TELECOMMUNICATIONS FRAUD TRAINING PROGRAM (TCFTP)

Program Description: The TCFTP introduces the student to the investigative opportunities and complexities of today's flourishing telecommunications systems and the "Information Superhighway."

Anonymous, instantaneous, worldwide communications are immediately available to both the investigator and to the criminal. This program describes the difficult and intimidating relationships of local and long distance carriers, resellers, providers, and end users and demonstrates their affiliations. Students will be introduced to emerging technologies and discuss their applications to crimes of today and criminal trends of the future.

Students will investigate and discuss complex case material in a practical exercise, presented as a continuous thread scenario throughout the program. This realistic application of skills introduces the student to many facets of highly technical investigations in the computer and information age. Additionally, the training is augmented by classroom presentations from subject matter experts in law enforcement and the communications industry.

The world is moving onto the Internet. Students are introduced to some of the capabilities of this "network of networks" where information is a commodity. Crimes can be committed from another country and the victim may never know that a crime has been committed against them.

Most important, agents will receive up-to-date information on the emerging mysteries of telecommunications law. They will learn the requirements for liaisons with their counterparts from the telecommunications industry within these new laws. Also, agents will have the opportunity to begin their own network of sources of telecommunications information.

Courses in the TCFTP include the following:

• Techniques of Telecommunications crimes

• Hackers & Phreakers - Who are the Cyberspace Criminals

• Basic Telephony - Terminology and History

• Electronic Fraud Devices - Boxes Customer Premises Equipment - Fraud at Home

• Obtaining Carrier Records - Subpoena Management Centers

• Cellular Communications Fraud - Capturing ESNIMIN information

• Dealing with Hackers - Social Engineering

• Future trends in Telecommunications Technology

• Dialed Number Recorders - Practical Applications

• Voice Mail - Fraud and Abuse

• Electronic Communications Privacy Act - Updates and Problems

• FISA/PPA/18 USC 1029 & 1030 and other applicable laws

• Digital Telephony - Law Enforcement Assistance Act

• Preparing Telecommunications search Warrants - Federal and State applications

• Current Topics (as trends develop)
  
  

Length of Training: 10 class days

Prerequisites for Attendance: Applicants are experienced investigators, analysts, prosecutors, judicial officers and their non-Federal counterparts. They should have a basic understanding of and a need to participate in computer and telecommunications crime investigations and prosecutions.

11  Program Title: WHITE COLLAR CRIME TRAINING PROGRAM (WCCTP)

Program Description: The WCCTP has been designed to provide the basic tools with which to identify sophisticated white collar schemes to members of Federal investigative teams. The curriculum has been developed around three major areas: financial investigative techniques, legal concerns, and case development. Through a training blend of theory and practical exercises, the student will develop a heightened awareness of the myriad of white collar crime schemes being worked by criminals. The students will also gain the technical skills useful in the successful investigation of these schemes.

Courses taught in the WCCTP include the following:

• Sources of Information

• Orientation to Financial Investigations

• Tracing Funds through Financial Institutions

• Computer Fraud Analytical Investigative Techniques

• Computers as an Investigative Tool

• Indicators of Financial Fraud

• Civil Litigation

• Evidence

• Privacy Act/FOIA

• Privileges

• Conspiracy

• Administrative Law

• Federal Court Procedures

• Courtroom Testimony

• Constitutional Law

• Criminal Law

• Parallel Proceedings

• Interviewing

• Victims of Financial Fraud

• Questioned Documents

• Bribery

• Money Laundering

• Contract Fraud
  
  

Length of Training: 10 class days

Prerequisites for Attendance: The training is designed for general investigators, auditors, inspectors, analysts, or other personnel who assist in the investigation of white collar crimes.

12  Program Title: WINDOWS APPLICATIONS for INVESTIGATIONS TRAINING PROGRAM (WAITP)

[FORMERLY ADVANCED MICROCOMPUTER TRAINING PROGRAM - AMCTP]

Program Description: The overall objective of the WAITP is to demonstrate and provide instruction in the microcomputer's use as an advanced investigative tool to improve productivity in criminal investigations. The most technically advanced software available is applied to help investigators in such areas as computer customization, file management, case management, file analysis and program integration. The students' skills will be developed and enhanced through a continuing thread investigation and a final computerized case presentation project at the conclusion of the program.

The primary tool for instruction in the program is the Microsoft Suite of software, including Word, Excel, Access, and PowerPoint programs.

Courses offered in the program are as follows:

• Orientation and Advanced Features of Microsoft Windows

• Customization of the Microcomputer System

• Advanced Features of Integrated Software

• Advanced File and Case Management Features

• Case Presentation Using Computer Graphics
  
  

Length of Training: 5 class days

Prerequisites for Attendance: The program is designed for law enforcement personnel who have graduated from FFI's Microcomputer For Investigators Training Program (MITP) or who have equivalent knowledge.

[End]

Hypertext by JYA/Urban Deadline.