Military investigators are encountering a growing number of cases involving drones

Terry Gerton Brian, let me ask the first question to you. We talk a lot about drones and they’re being used in lots of different ways these days from surveillance and cargo delivery to military operations, and now in some cases, criminal activity. Why has the criminal investigation community become so interested in drones?

Brian Sharman It’s a great question. Thank you for asking. Because drones have become both a tool and a potential source of evidence, they’re inexpensive, widely available, and increasingly capable. It can be used for completely legitimate purposes, but they can also support surveillance, smuggling, reconnaissance, and other criminal activity. From an investigative standpoint, what makes them particularly interesting is that a drone often creates a digital record of what it did, where it flew, when it flew and potentially what it saw. So investigators increasingly have to understand drones the same way they’ve had to understand phones and computers and other digital media.

Terry Gerton And so when we talk about drone forensics, what exactly does that mean? What are you digging into and what are you finding?

Brian Sharman Well, if you think about a drone, it’s almost like a flying computer. A lot of the components are similar and the same, and you might find a SD card that has flight data on it, you might have a internal memory storage device that has pictures or videos or flight logs or records, so it just depends on the type of drone, but each of them contain clues and evidence that can piece together what happened when some type of criminal activity has occurred.

Terry Gerton And that requires you to recover the drone on site somewhere, right?

Brian Sharman And that does, that’s the first piece. And this is where investigators rate investigation 101, recovering evidence. So while we’re talking about a drone that might be something special or different for our investigators, right? This is a very textbook elementary type investigative work where, hey, there’s a type of device, the drone. Parts of a drone if it’s crashed, maybe a controller or a phone or an iPad or something like that, but collecting those evidence items and then sharing them with the lab where we can process and do digital forensics is what we need the investigators to do.

Terry Gerton So Colin, let me go to you because Brian’s just described investigation 101. That’s not anything new, but now DC3 and NCIS are conducting specialized training. So that kind of suggests that the traditional investigative skills aren’t quite enough anymore. What new knowledge are you finding that investigators need when drones are involved?

Colin Lennon Well, thank you for the question and thanks for having me. So we have, so as Brian mentioned, a lot of the investigative techniques really haven’t changed or need to change for drones. It’s really platforms of the drone themselves that we are focusing on with our training. So we have a 5 day course and in that 5 day course, we provide an overview of many of the different drones that exist today because It’s expensive to buy a drone, for example. So a lot of the folks that are using these in criminal incidents are making their own, basically piecemealing drones from purchases from Amazon and things like that. They kind of buy pieces and they put them together or to use the drone in a critical activity. And so what we do in our training is kind of expose students to the different kinds of drones that are out there. We provide them the ability to fly a drone within the classroom so they see what the experience is like, so they can capture some data. And then we back to the classroom and take that data and have them investigate what they would normally look for in a drone.

Terry Gerton Brian Sharman is the deputy director of the DC3 Forensics Lab. And Colin Lennon is the deputy director of DC3’s Cyber Training Academy. Brian, let me come back to you. When a drone is connected to an incident, what’s the most important question investigators really want to answer? Is it who was operating it or where did it come from? Or, what did it see, or all of the above?

Brian Sharman Thank you for the question. They’re all important because they answer different parts of the investigation. Where it flew can establish a connection to a location or event. What it did can tell us about the activity itself. Was it something innocent or was it some kind of criminal activity that it was helping to facilitate. But ultimately investigators often want to understand attribution. Who was responsible for operating the drone or directing the activity? The strongest investigations come from correlating the digital evidence from the drone with other evidence items rather than relying on any single data point. But if you force me to pick one, I would tell you ultimately attribution, who was responsible for operating the drone is often the question investigators are coming to us in the lab and asking us to answer for them.

Terry Gerton It seems like it might be really tough to figure that out if what you’re finding is bits and pieces of a crashed drone at a crime site.

Brian Sharman It is absolutely very challenging and in particular where this ties in with the training is trying to teach investigators about the different types of drones and what’s important. For example, a lot of the drones don’t contain flight records on them. The flight records are actually on a mobile device or a phone or something like that. And so it is so pivotal when investigators are out on scene, they know, hey, I don’t just need to grab the aircraft. I also need to get the mobile device or whatever is using to operate the drone. So when they send it here to the lab, we can do a full forensic workup and try and get very clear answers for our investigators.

Terry Gerton Colin, let me come back to you as you’re designing curriculum here. Drones are changing so quickly. The technology that’s embedded in them is rapidly advancing. Plus you mentioned that people are building their own. So how do you keep current in the curriculum in a field that is moving so fast?

Colin Lennon So luckily, the curriculum doesn’t change as much as drones that are being produced. So they like to say every three to six months, software, AI models, electronic warfare, countermeasures, payload sensors, tactics change substantially. Within six to eight months, you can see major changes in autonomous navigation, GPS denied operation, computer vision. Communications, first-person view systems, counter UAS technology and manufacturing. So the curriculum doesn’t really change because it’s more of the technology of the drones, but the investigative processes and software tends to remain the same.

Terry Gerton That’s a helpful differentiation. And what are you seeing students have the most difficulty with in the course, or what is most intriguing to them?

Colin Lennon We don’t really find the students don’t have any problems within the course, because they usually come in with an extensive background with investigative techniques. So that’s not really a problem for our students. It’s really more them coming in and learning about each of the different drones, and they actually provide the course a lot of more benefit because they’re bringing in their own experience in the field of the different drones that they’ve seen.

Terry Gerton And so Brian, as you’re thinking ahead and watching all of the changes here and thinking about it from a forensics perspective, what do you think investigators that Colin’s team are training need to start preparing for now that may actually be a challenge three or four years down the road?

Brian Sharman We think about this a lot in the lab. I think the biggest challenge will be increasing autonomy and complexity in the drones themselves. We’re already moving towards systems that can operate with less direct human control using artificial intelligence, communicate with other systems and store information across the aircraft, mobile devices and cloud services. It’s getting very sophisticated. Investigators will also encounter larger numbers of different platforms and attempt to conceal or manipulate digital evidence, maybe even using encryption. So we need to develop the technical expertise, tools and partnerships now, rather than waiting for those technologies to become commonplace. We say a lot here in the lab that in digital forensics, you don’t get to learn the technology once and declare victory. It’s all types of technology and digital forensics are constantly evolving, and we have to adapt with it.