Cybercrime investigators test computers and components that could have been used in a crime, such as counterfeiting.
A cybercrime investigator is a law enforcement official who specializes in evaluating cases involving computer crime. These personnel may work for law enforcement agencies as well as private companies and may also be known as computer forensic technicians. Work in this area requires information technology and law enforcement training so that people have the tools to locate evidence, as well as the skills to protect it and ensure it can be used in court.
Computer forensics experts can sometimes recover information that should have been destroyed or deleted.
When members of the public report a cybercrime, a cybercrime investigator participates in the investigation. This can include anything from testing a bank’s network to determine how and when a data breach occurred to evaluating an individual computer that may have been used in a crime. Cybercrime investigators can recover and reconstruct data if it is accidentally or intentionally damaged or destroyed. They can also scan computer networks as well as individual computers and hard drives to identify evidence of criminal activity.
In addition to working with ongoing investigators, a cybercrime investigator may testify in court about a case or assist legal teams in the discovery process. In eDiscovery, legal teams must locate and protect the evidence they will use to defend their cases in court, and rely on IT professionals to ensure this process is done correctly. Some companies employ internal cybercrime investigators, while others may use the services of an outside company.
This job may also involve making recommendations to combat cybercrime. Educating the public is often an important part of the mission, as is developing better legislation. A cybercrime investigator can identify emerging trends and security issues and provide advice on how to address them before crimes occur. This proactive part of the job is critical to protecting members of the public and national security, making it harder for criminals to identify and use exploits, such as holes in a security system.
As part of their job, cybercrime investigators often seek continuing education through conferences, workshops, and professional publications. Information technology is constantly on the move and it is not possible to rely solely on skills learned in school. Instead, the investigator must explore new areas of this field and apply these skills to criminal investigation and support of law enforcement personnel. A cybercrime investigator may also become an instructor at a law enforcement agency, college or university, training the next generation and providing continuing education to colleagues.