To effectively manage border security, the GNA has to solve cases faster, and also do their detective work across an immense geographical area. Today, nearly all of these cases involve digital devices, including mobile phones and computers. To process the steady stream of digital devices and glean evidence from them, the GNA put together a unique combination of technology and teams – centered on Cellebrite’s Digital Intelligence solutions and a network of digital forensics labs around the country. Digital Intelligence (DI) is the data that is extracted from ever-expanding digital sources and data types —smartphones, computers, and the Cloud— and the process by which agencies access, manage, and leverage data to more efficiently run their operations.

Reducing time and travel for digital investigations

“It’s a big country, and it's hard to cover with one lab,” says Antonio Maza, “Experto” (expert) for the GNA’s Departamento Análisis Forense Digital. “The number of devices is always increasing because of digital adoption, and we can't keep up with the demand.” The process of delivering devices to the GNA’s national forensics laboratory in Buenos Aires for data extraction and analysis was slow, since the force’s five regional headquarters were scattered around Argentina, and often thousands of miles away from the capital city.

A new network of forensics labs, all equipped with Cellebrite solutions, is intended to reduce the Digital Intelligence burden on the national lab in Buenos Aires. The regional labs, of which five may be opened by the end of 2020, are sorely needed to keep pace with the mushrooming number of digital devices connected to border crime cases.

“In 2019, we analyzed about 2,000 devices over all Argentina,” Maza says. “It’s not just mobile phones – it’s also computers, DVRs, and more. A few years ago, we had to analyze 1,000 devices – now it’s 2,000, and next year, it will be much more. It’s a problem to solve for the future.”

It’s not just about the proliferation of devices – it’s about the time it takes to ship devices to Buenos Aires across a very large country. That distance slows down encryption and analysis of data that could be crucial to border security cases.

“We don’t have days and days to finish investigations,” Maza says. “And we don’t want evidence to be lost.” By placing labs closer to where investigators are working on cases, the devices and data can be analyzed more rapidly, closing cases quickly and bringing suspects to justice.

Technology that cracks cases

The regional forensics labs will be equipped with the same Cellebrite technology used by officers use at the GNA’s national lab. When investigators in the field first obtain digital devices at crimes scenes or in the course of their investigations, they use UFED, Cellebrite’s mobile forensic solution, to extract data from the devices.

But increasingly, investigators don’t just need data from the physical devices connected to crimes; they need data from messaging apps and cloud computing tools that suspects are likely to use to communicate with each other, and to share evidence like photos and videos. What’s more, there’s data hidden in web browsing history, mapping applications, online search history, and WiFi connections. This, too, is evidence that can place suspects at crime scenes or indicate who suspects are interacting with.

For this reason, GNA investigators also use tools such as Cellebrite UFED Cloud to find, analyze, and preserve information in the cloud, such as chats from messaging services like WhatsApp and Telegram, online calendars, location data, and user profile information.

In addition to using solutions that help locate and analyze data, investigators at the new regional labs will also tap into Cellebrite solutions that help them work together effectively. For example, they use Cellebrite Pathfinder to create a unified forensics environment across the lab network. As investigators extract evidence from devices, forensics experts apply a layer of digital analytics, allowing them to identify relevant evidence from a large volume of data.

That evidence is then forwarded to investigators and prosecutors through Cellebrite Physical Analyzer. The combined Cellebrite tools will help investigators access, analyze, and manage data so they’re prepared for the onslaught of digital data in their cases.

A rapid result for a student’s threat of violence

Collecting and analyzing the mix of data from devices as well as the cloud is now crucial to keeping Argentinean citizens safe. In March 2019, a 17-year-old college student in northeast Argentina posted a Facebook message saying he would kill fellow students and would broadcast the “massacre” live; the social media post included a photo of firearms.

GNA investigators raided the student’s home and seized his mobile phones and computer. With Cellebrite solutions, investigators found more firearms photos the student had downloaded from the Internet, as well as social media messages alerting friends to the proposed attack.

“In just two hours, we solved the case,” Maza says. “We knew that this was the person, and we found credit card numbers belonging to him as well as other people connected to the proposed attack.” The Digital Intelligence also allowed Maza and his colleagues to build a timeline of the suspect’s movements as he made plans for the attack. The teenager was charged with making anonymous threats involving weapons.

Staying on top of digital advancements

For every successful case where digital forensics investigators are able quickly access and analyze Digital Intelligence, there are more cases where technology advances can threaten to confound investigators.  

“Our greatest challenge is the vertiginous technological advances, as is the case with mobile devices,” Maza says. “On top of that you have security measures to protect data privacy that have hardened over time, putting up barriers to obtaining evidence that could be of vital importance in investigations.”

Now, with the combination of advanced technology, well-trained investigators, and the new network of forensics labs, GNA investigators are better equipped to keep pace with digital trends. “Tech’s impact on society is continuously reflected in our GNA activities,” he says. “As experts in forensic analysis, we have to dive into these mountains of evidence. One thing I can say for certain today is that there are no simple cases, thanks to a complex ecosystem that makes up digital evidence.”