FBI Lab Clues Police In — Portland center trains local officers on investigating in digital age

PORTLAND – Police investigators have been digging into computers for years, but now a digital crime scene can include a cell phone, a GPS unit, an Xbox game system ... or a teddy bear. That's why the FBI has established a regional laboratory to assist more than 100 police agencies in Oregon and Southwest Washington.

Source: Columbian.com
Wednesday, February 11 9:30 p.m. 
BY TOM VOGT
COLUMBIAN STAFF WRITER 

PORTLAND – Police investigators have been digging into computers for years, but now a digital crime scene can include a cell phone, a GPS unit, an Xbox game system ... or a teddy bear. 

That's why the FBI has established a regional laboratory to assist more than 100 police agencies in Oregon and Southwest Washington. 

But ultimately, it's about assisting justice, an FBI official said Wednesday morning during a media tour of the Northwest computer forensics laboratory. 

A single piece of digital information can make the difference in a death penalty case, said Thomas Gregory Motta, who oversees the FBI's digital evidence section in Washington D.C. 

"The product of this lab is about finding the truth," Motta said. "If it leads to conviction or to acquittal, so be it." 

Motta was visiting Portland to celebrate the lab's accreditation from the American Society of Laboratory Directors for its work in processing digital and multimedia evidence. It's only the 30th lab in the world to earn the honor. 

While the center is maintained and funded by the FBI, many of the investigators are from police agencies in the Portland area. The Clark County Sheriff's Office previously has used the lab, and all Southwest Washington police agencies can tap it for help. 

One of the lab's recent cases was a high-profile Oregon crime in which two policemen were killed and another was seriously injured. 

"In the bombing in Woodburn, the initial evidence was from cell phones," said Andy Schroder, the lab director. 

A Northwest eco-sabotage investigation involved examining 150 computers. 

The lab has a pilot program for processing evidence from cell phones, providing local officers with the training and tools to do their own investigations. 

If a police officer went through the typical process of filing a request for help, it could take a month or two to get back the report. 

"If they just want the call records, we can offer them this room, and the training and the tools," said Kent Hughes, an FBI forensics examiner. "They don't need to submit a request, and the turnaround time can be an hour or less. And if they do have problems, we're here." 

The lab also provides expertise for officers who aren't up to speed on all the tricky little places where people can store data. 

"On a search scene, a lot of investigators don't know what to look for," Hughes said. "They might miss a pen or a watch or jewelry" that has a place memory storage site. 

...Which explains the small teddy bear sitting on the counter. 

"There is a USB (data storage) device in the teddy bear when you pull the head off," Hughes said. "Stick this in a toy box, and you'd never find it." 

In the nearby evidence intake area, Portland police officer Steve Johns described some of the items, wrapped in pink plastic, stacked on shelves in the evidence room. 

"Cell phones, iPods, hard drives," he said, as well as one Xbox video-game system. It can be modified to store data, and it's evidence in a homicide, Johns said. 

The heavy digital lifting gets done in the forensics lab, where investigators excavate evidence from computers and other devices – including data the user deleted. 

Actually, it's not easy to delete computer data, said Chris Kitto, a Beaverton police detective. 

It helps that most of the people they deal with "aren't savvy enough to cover their tracks," Kitto said. "For the most part, they're not rocket scientists." 

And even a felonious NASA engineer might not be able to evade justice. 

"We do come across some high-end users, but even those guys can't cover everything," Kitto said. "Somebody might have written an embezzlement letter from home, printed it out, but didn't save it. There are three or four places on the hard drive where we can recover it," Kitto said. 

Then, during a trial, the investigators can provide an exact copy of the material that would have appeared on the defendant's computer screen. 

"It shows exactly how they operated the computer," said Schroder, who described that sort of evidence as "one of our coolest geeky things." 

Original article: Columbian.com