'Freddie' - Operations

IN A NUTSHELL –

I tell my friends I work in law enforcement, specialising in Cyber security. I explain I spend my days working on serious cyber operations. I seek to assist organisations that are impacted by cyber crime. This could involve working with small independent businesses or much larger organisations, serving a critical service to the UK.

ON A GREAT DAY -

A great day for me is when I get to be out in the field and hopefully making an arrest. The time we start could vary from being early, or very late, depending on our aims, but will always start with a briefing. The briefing is led by the case team responsible for the investigation and we’d be joined by other teams such as Digital Forensics, Intelligence and Financial Investigators. The briefing would cover the background to the investigation, the items of interest on our search warrant and other critical information. It is likely we’d have to travel and conduct additional briefings with local teams and discuss our approach with the method of entry team. We plan our entry meticulously and depending on the operation, we’d make the arrest(s) and conduct a property search, seizing materials of interest. If an arrest has been made it’s then my responsibility, along with other colleagues to conduct the interviews. It’s a long day and we’d finish up with a team debrief before heading back home or to a hotel for the night before travelling back the next day.

ON A TYPICAL DAY –

On a typical day and after being out in the field, I’d be back to the office. Once an arrest has been conducted, the next steps involve case building. Before starting a review of digital devices seized, we provide an update to our International partners who have been assisting us. The review of digital devices is an important part of our work and I have to make sure that I could say with absolute confidence that I’d identified any piece of data that would be critical to presenting the case in court. This can be incredibly time consuming and is very high stakes and so having a good attention span and attention to detail is really important here. It’s a busy day at my desk and I know I’ve got more of it to come tomorrow, so I make sure I leave on time – or, in current time of writing (2020), put my laptop away as I’m working from home.

Seven years ago I left my job as a construction project manager and started works at the NCA’s predecessor, the Serious and Organised Crime Agency (SOCA).  Since that time I have mainly been involved in drugs and corruption investigations, but have also spent two years working abroad in Afghanistan. I transferred to the NCA’s National Cyber Crime Unit (NCCU) nine months ago, having always been interested in the technical aspects of investigations.   Work here is by no means simple, as we are dealing with an ever changing threat which does not care about international borders. This means as investigators we need to be flexible and innovative in our approach. 

I then travel to the local Crown Court, to swear in a Production Order to obtain a copy of a UK based server that is controlling a particularly nasty piece of malicious software (malware).

On returning to the office I just have time to grab a sandwich before I go into a conference call regarding my operation.  Also on the call are representatives from other foreign law enforcement agencies and a private industry partner.  We discuss new potential avenues of investigation how we could work in collaboration with private industry to help better protect the UK.

I go and have a quick chat with our technical team regarding their analysis of a computer seized earlier in the week.  I need to take my time going through their material, as it is often the small things that catch people out and are vital in helping to secure a conviction.

Just as I’m heading out the door, I get a call from one of the other NCCU operational teams.  They have just identified and arrested an individual who is believed to be using a piece of malware linked to millions of pound worth of fraud. They ask me to interview him.  I pick up my warrant card and notebook and get back to work.