The International Councilor Spring 2017 President’S Message

The International Councilor Spring 2017 President’s Message

In this Issue Sachit Kumar, CII Lioness of CII Dear CII Family, Nancy Poss Hatchl President’s Message 1 1934—2017

Nancy Poss Hatchl Spring is here and with spring Nancy Barber, CII In Memoriam 1 comes the Nancy Swaim, CII

From the Editor 2 planting of seeds Nancy Poss-Hatchl was born on and subsequent November 20, 1934. She joined the Panamania 2017! 3 growth. This also Council of International Investiga- Panama Agenda 4 & 5 applies to CII. tors in 1982, and took Emeritus Some of our planters are: status just three years ago. She was Europe Regional Meeting 6 awarded the International Investi- Anne Styren, who has put together gator of the Year Award in 1994; Canada Regional Meeting 7 and the Malcom Thompson Award a survey of the members to facilitate in 2000. She served as CII’s presi- Asia Regional Meeting 8 that growth by considering your input. dent in 1995 and Chair in 1996. However, if you don’t respond, we’ll A legacy is told just in those Other Regional News 9 never know. To take the survey click facts, but the back story is ever so much more. CII Survey 10 here 2017 Member Survey . She is also now, along with her team, finalizing the The strength and joy of her spirit will always be with us. She was a Advertising opportunities 10 second phase of the bylaws. Renaissance woman who wrote Membership News 12 Ryan Colley continues his efforts to poetry, learned to solder while working undercover in an industrial connect the CII with two international Marketing the CII 13 facility, she had a BA in chemistry associations: The Alliance of Business and a M.A. in anthropology. She Watching the Detectives 14 Lawyers and Integra International. If all spoke Spanish fluently. She lived goes as planned these initiatives will in Mexico and always loved meet- Feature Articles 15-23 present increased opportunities for ing folks from around the world. Spring Forecast—Jack Devine business for all CII members. There are Cyber Warfare—Lauren Sowers also plans to recruit clients as Affiliate Web Evidence—Lauren Sowers members of CII.

Toine Goorts and the Education The International Committee are looking to grow our educational website with outstanding Councilor written articles and video presenta- Editor tions. Please send us your contribution Lois Colley and if you haven’t visited the education Associate Editors portal do so now at Nancy leads the flag procession Ruth Hoffmann Sales www.ciieducation.org at the San Francisco AGM 2014 Lauren Colley-Sowers Bernarda Skrabar, is hosting the Eu- She leaves in her wake a legacy ropean Regional Meeting in Ljubljana that includes a cadre of private in- Spring 2017 Slovenia May 12-14. Chris Nielsen and vestigators whom she mentored and organized. Continued on page 11 All Rights Reserved Rick Quinn are putting on the Continued on page 11

Editor’s Message by Lois Colley

Greetings, fellow investigators! I trust that your 2017 is your clients when the time is right that no company is off to a good start. As our businesses evolve, database immune to hiring folks who “boost” their resumes with providers continue to ramp up their offerings and our falsehoods. An organization that doesn’t complete competition is ever changing! Speaking of our competi- quality pre-hire due diligence will eventually be made tion, I wanted to share with you a recent news story to regret it. And plus, PI’s are a little cheaper than years that made waves in the U.S. involving some teenagers of restorative PR, right? doing some solid background work. In our Spring 2017 Councilor, we first and foremost Given that the tenets of good reporting and analysis pay tribute to the wonderful spirit of Nancy Poss bode well for an investigative career, one of these Kan- Hatchl. She will be missed by all. We look forward to sas high school students may have a future as an inves- toasting Nancy when we connect in Panama City at tigator. After all, their diligent background research and what will surely be an outstanding AGM. reporting unveiled that their newly hired principal had falsified credentials, including three higher education Our Resource of the Month covers several tools for degrees that didn’t check out. preserving digital media in legally admissible formats, and the Spring 2017 “FYI” column covers the “Spear The story began innocently enough- student journalists Phishing” cyber espionage attacks that dominated 2016 first began writing a simple profile about the admin- and promise to be problematic for years to come. istration’s new hire. They noticed some details of the new hire’s resume didn’t seem to line up, and they fol- We thank Jack Devine for his astute analysis and geo- lowed the proverbial “bread crumbs” from there. They political forecast of 2017, a must-read. Also, please interviewed the new principal, who seemed evasive take a moment to complete the member survey pre- and offered incomplete answers, increasing their suspi- pared by Anne Styren. Your input benefits your col- cions. leagues and he organization at large.

Student journalists are protected by Kansas law, so Kind regards, they were able to continue their research despite pushback from the administration. Their teacher and Lois Colley advisor eventually had to recuse herself from the position of advising them, since she was on the committee that had hired the principal. It was discovered that one Submissions Wanted of the universities the new hire claimed to have attend- Your hard working Editor-in-Chief, ed, Corllins, was depicted widely in the media as a “diploma mill”- an institution where people could easily Lois Colley, is looking for well written, well procure a degree or certificate. The students also noted researched, informative articles for future editions of that Corllins was not accredited by the U.S. Depart- the Councilor. Please forward them to Lois at ment of Education. Their research led to the new prin- [email protected]. cipal’s resignation only days later. ******* So, perhaps you’re thinking, other than feeling proud of We are also looking for more extensive articles for some high school kids, what does this have to do with the CII educational website as well as tutorial videos. us? This is the best kind of press possible for our indus- For more information about how to share your try. When the media covers that teenagers in Kansas are unveiling false credentials, the message to organi- knowledge contact zations is clear: do your homework on your hires. Keep Steve Kirby at [email protected] a backlog of these events in your brain- you can remind

2 Panamania 2017 ! Outstanding events scheduled for the 63rd Annual General Meeting 2017 AGM Registration Form

Registration is now open for the Council’s Annual General Meeting being held at the luxurious El Panama Hotel, September 12-16, 2017. The base registration fee is only $450 USD, which is what it has been the past three years. That fee includes opening cocktail reception; seminars; coffee breaks; awards luncheon; two evening social outings; gala banquet; and hospitality suite. Golf outing and canal tour are optional with additional fees. What more could you want? To register right now, just click here:2017 AGM Registration Form The venue is set for the classic El Panama Hotel, located in the heart of Panama City. Most amazing is that the rates for this luxurious hotel are $90 for a single and $160 for a luxury full suite. For those who want a quick trip to the pool, poolside cabanas are also available. To register at the El Panama at the incredible rates just click on the following link: Panama_Hotel_registration_63rd_AGM

This will be a classic CII AGM, full of fun and education with a Latin flavor. Brett has arranged for a perfect mix of social networking outings including: a local cuisine dinner at the renowned Las Tinajas, with a cultural show; a Panama pub crawl by bus; golf outing: and more. Complimenting all the fun, Brett has arranged an amazing group of seminar speakers on such timely topics as intellectual property investigations; the takedown of WISA, one of the largest money laundering schemes in the world; the back story of the Panama Papers; and much, much more. Of course no trip to Panama would be complete without a tour of one of the 7 Wonders of the World, the Panama Canal. Brett has arranged for a tour of the Panama Canal locks on Saturday, after the official close of the conference. See you there at Panamania 2017!

3 Provisional Program CII’s 63rd AGM Panama 2017

Tuesday, September 12

0900-1800 Registration

1000-1600 Bert Falbaum Memorial Golf Tournament - Summit Golf and Resort

1300-1700 Board Meeting

1900-2200 Welcome Reception

2200-0000 Hospitality Suite

Wednesday, September 13

0900-1000 Opening Ceremony

1000-1030 Coffee Break

1000-1500 Spouse Tour: Multiplaza Coupon Shopping

1030-1200 Seminar 1: Steven Kleppe or Eric Hyatt from Homeland Security – Intellectual Property issues in the region and how to work together with your local US Embassy to support your IP Investigations.

1330-1430 Seminar 2: Ramon Fonseca More, partner from Mossack Fonseca – The Truth Behind the Panama Papers

1430-1500 Coffee

1500-1600 Seminar 3: Juan Abarca from Ethical Hackers (technical investigators investigating the Mossack Fonseca information hack) – how Panama Papers came about and why the world’s focus is completely off track on “who did what wrong”.

1600-1800 Off – rest up for a great evening out on the town

1800-2200 Chiva Parrandera (Party bus outing)

2200-0000 Hospitality Suite

Thursday, September 14

1000-1230 Spouse / Partner Tour

0900-1030 AGM

1030-1100 Coffee Break 1100-1230 AGM Continues Networking 1300-1430 Awards Luncheon

1430 -1630 New Board Meeting

1430-1800 Tour Panama City on your own

1800-2300 Las Tinajas (Panamanian Cuisine and Folkloric Dance presentation)

2300-0000 Hospitality Suite 4 Provisional Program CII’s 63rd AGM Panama 2017

Friday, September 15

0900-1000 Seminar 4: Omar Pinzon, Republic of Panama Chief of Police – From the top 10 list of “Most Dangerous Countries in the World”, Latin American holds 8 of these positions. Mr Pinzon will talk about why Panama is the safest country in the Region amidst so much violence from our neighbours. Executive Board 1000-1030 Coffee Break 2016—2017 1030-1130 Seminar 5: “Surprise Speaker”: The toppling of WISA. A 10 year investigation that lead to the dismantling of one of the world’s Officers largest money launderers in history, Sachit Kumar— India 1200-1300 Lunch on your own President

1300-1430 Seminar 6: Business concepts round table: Learn the best busi- Anne Styren—Sweden ness tips from those who’ve “been there and done that!” Vice President 1430 -1900 Off – rest up for the Gala Banquet Marc Reed—Canada 1900-0000 Gala Banquet & cocktail reception Secretary Jacob Lapid—Israel Saturday, September 16 Treasurer 0830 – 1300 Optional tour of Panama Canal locks Board Members

Toine Goorts—Netherlands Sant Kaur Jayaram—Singapore Ryan Colley—USA Bob Fenech—USA David MacLeod– Australia

Executive Regional Director Galen Clements—USA

5 Europe Regional Meeting 2017 Ljubljana, sLOVEnia Friday, May 12th – Sunday, May 14th Hosted by Bernarda Skrabar To register contact Bernarda at [email protected]

Regional meeting 2017 will be held in the centre of the city of Ljubljana, the capital of Slovenia. Ljubljana is European Green Capital 2016 https://www.visitljubljana.com/en/visitors/).

The main events will take in Grand Hotel Union. Grand Hotel Union is located in the center of city. The Grand Union is a 4 star hotel boasting a premier location in the heart of Ljubljana, only steps away from Old Town and less than 30 minutes from the airport. The Grand Union is an Art Nouveau masterpiece built in 1905 and one of the most elegant hotels in the city.

For hotel booking click here GrandHotelBooking

Please let Bernarda Skrabar [email protected] know as soon as possible for reservations, because in May is the high season and the Hotel will be booked soon.

Schedule of Events Friday, 12 May 2017

14.00 – 18.00 Check in (transport from the airport will be organized according to your arrivals) 18.30 – 20.00 The ceremonial opening event. Among the invitees at the opening ceremony will be: the dean of the Faculty of Criminal Justice and Security; a representative of Slovenian managers; and a representative of the Slovenian government. 20.30 - Dinner with recognized Slovenian chef in JB Restaurant. Dinner will be held in JB Restaurant in downtown Ljubljana, Slovenia, which is S. Pellegrino’s Top 100 World’s Best Restaurant.

Saturday, 13 May 2017

10.00 – 11.00 Boat ride on the Ljubljanica River 11:00 - 12:00 Guided walking tour 12:00 - 16:00 Free time for optional lunch (we will recommend some restaurants with typical Slovenian food). 16:00 - 18:30 CII Meeting + short lecture with coffee break included 18:30 - 21:30 Dinner at the Ljubljana castle tower with a recognized Slovenian chef

Sunday, 14 May 2017

9.00 - Trip to Lake Bled

If you want to stay in Slovenia for more days, we will prepare special options sightseeing, accommodation at different places.

For any information, recommendations, and booking we will be [email protected]

We are looking forward to seeing you in Ljubljana!

6 Canada Regional Meeting—May 26—28 Agenda in Brief For full agenda with hotel details click here Canada Regional Meeting Agenda Thursday, May 25, 2017: Optional golf day – Fairways for Heroes Charity Golf Tournament – held at Royal Ontario golf course in Milton, On- tario (approximately one hour from Niagara Falls) Not a CII event. Contact Martin Jaekel for details and registration.

Friday, May 26, 2017: 1000 – 1500 hours – Optional golf at Niagara Falls Whirlpool golf course. 1800– 2000 hours - Welcome Social at Niagara Brewing Company – 2000 – 2300 hours Hornblower Night Cruise. (Sponsored by Nielsen & Associates) 2300 hours – Bar crawl, free time around the Falls or try your luck at two casinos.

Saturday, May 27, 2017:

0900 – 1200 hours – Educational seminars Mr. Brian D. King, CII, CFE of King International Advisory Group Inc. (Toronto - Canada) Topic: International Investi- gations- 1.5 hours – Mr. Brian King will share some fantastic stories of his global investigations and how other CII members helped him along the way. Every country has their rules and Brian highlights the talent out there around the C.I.I. world.

Mr. John Sexton of Sexton Executive Security. (Fairfax, Virginia, United States) Author of “The Big Yank” Topic: The Pros and Cons of publishing a book. As John stated “All CII members are capable of writing a book”. John will take you though the steps of self publishing and advice on what works and what doesn’t. Book signing to follow.

0900 – 1430 hours – Spouses’ trip to Niagara-on-the-Lake, including lunch at the beautiful Prince of Wales of Vin- tage Hotels

1200 – 1500 hours - Lunch / Networking on your own. Walking tour of Clifton Hill.

(Free time in afternoon, two casinos)

1830 hours – Sheraton on the Falls dinner. Sheraton on the Falls: Room Reservation Procedure: 2000 hours – Bar crawl, free time around the Falls or two casinos. Individuals are to call the hotel directly at 1-800-519- 9911 and request the special convention rate using Sunday, May 28, 2017: code: Council of International Investigators, or C.I.I. 0900 – 1500 hours – Optional wine tour, lunch and free time Also, they created a link to make reservations online. https://www.starwoodmeeting.com/Book/

council17 1500 hours – farewell to CII friends *** Important *** Use code: Council of Internation- To register contact: al Investigators. (C.I.I.) to book rooms Rick Quinn of Quinn Investigations at Traditional Room= $205.00 Canadian = $154.00 USD) [email protected] or Cityview Room = $269.00 Canadian = $201.00 USD) Chris Nielsen of Nielsen & Associates at [email protected] Fallsview Room = $369.00 Canadian = $276.00 USD)

7 CII’s Flag Flies High In Asia Thanks to Mainguard, Asia regional meeting a roaring success Submitted by Sheila Ponnosamy, CII

The CII Regional Meeting in Singapore was an astound- tion on Executive Protection. The afternoon sessions were ing success with over 30 members in the region in attend- devoted to The Forensics Experts Group scientists who dis- ance. We were graced by the presence of members from cussed Hazardous Materials, Explosives and Questioned Hong Kong, Indonesia, Malaysia, India, Australia, and most Documents analysis. of our CII members in Singapore. Even Leena Aavameri It was a productive day of learning, with some time de- joined us all the way from Finland! We had another 10 voted after lunch to visit to our CII exhibition booth at the non-CII members who were keen to know of our organisa- prestigious Milipol-Asia Pacific Exhibition. Milipol is the tion, and are looking forward to joining our CII family! exhibition showcasing products for law enforcement and The Asian CII Regional Meeting kicked off with a Wel- military. Over 226 exhibitors were present from all the come Reception at the Padang Terrace of the Singapore world – USA, France, UK, Germany, Singapore etc. Trade Recreation Club on 4th April 2017, overlooking the skyline visitors swarmed the halls in thousands daily. Many are of Singapore city. The Marina Bay area was our backdrop. buyers from the various government offices in the Asia- Pacific countries, and also the commercial trade sector. The following day, we had a full day of deliberation at SECUREX-ASIA 2017 – the education programme of our CII CII collected over 100 business cards from people who Regional Meeting. After the Welcome Address by Region- have expressed interest in our association. The booth at al Director for South East Asia, Major (retd) P. Kalastree, the Milipol Exhibition was a great branding exercise to cre- and President of CII, Sachit Kumar, the President of Singa- ate an awareness of CII’s existence. New members can pore Security Association,Mr Raj Joshua Thomas shared already be expected. the progress that Singapore is making towards Public and The 6 April 2017 was reserved for those who were keen Private Sector Alliance. to learn gain more technical knowledge on cyber security The program continued with expert presentations on from Troy Wilkinson. It was an inspiring session with fel- world wide terrorism and cyberterrorism. Associate Pro- lowship. fessor Kumar shared his insights on ISIS building a Cali- Overall, the general feedback was the 2017 Asian CII phate in his presentation on Terror Beyond Borders. Regional meeting was an astounding success. There was Troy Wilkinson from the USA introduced the reality of much knowledge exchange and social interaction. Mem- Cyber Warfare today with Ransomware among some of bers renewed acquaintances and made new friends who the increasing cyber crimes being committed. David are potential CII members. The CII flag continues to run Shanmugam discussed the Cyberlaws in Practice. high in Asia! Two CII members then presented to the audience. Alison Chong kept us awake after lunch with Windows Dressing of fi- nancial state- ments, the col- lapse of Barings Bank and how Nick Leeson did it. David Chu followed with an insightful presenta- CII Members and Guests at the 2017 Asia Regional Meeting

8 Photo Journal from the 2017 Asia Regional Meeting

Other Regional News

US West Region Meets in San Diego Marc Reed appointed Thanks in large part to US West Regional Director Regional Director of Canada Nancy Barber and George Michael Newman, the US West Regional Meeting had something for everyone. President Sachit Kumar, with unanimous con- From the outstanding seminars arranged by Mr. sensus of the Executive Board, has appointed Newman, to whale watching and dining at a fine Marc Reed of Toronto as Regional Director of Mexican bistro, the entire meeting, held that the Region 1, Canada. Marc replaces Ken Cahoon, classic Bahia Resort in sunny San Diego was out- who served the Canadian members well during standing. his several year tenure as RD. The meeting was held in conjunction with the Na- Marc is a long time CII member and is current- tional Association of Legal Investigators (NALI) mid ly serving as Secretary of the Council. Marc has year meeting. NALI’s National Director, Don Johnson been active in promoting the Council and his of Bloomington Indiana, USA, is a longtime CII mem- generous donations of time and money have al- ber. There were several CII members who were also lowed the Council to market itself and the CII attending the NALI meeting. members at the Association of Certified Fraud Examiners (ACFE) international conferences in All in attendance agreed that it was a fantastic en- 2016 and again this year in Nashville. deavor and again, thanks to Nancy and George Mi- chael.

9 CII wants to hear from you Member Advertising CII Board investigates opportunities From the desk of There’s an old adage in business, “Don’t hide Anne Styren your light under a basket.” In an effort to allow you to shine light on your I kindly ask for 5 minutes of your time and that you use those minutes to answer the CII sur- business practice, the Executive Board is exploring vey, today. the possibility of allowing some form of advertising You might ask if this is really needed – what’s on the CII website. While still working on the logis- the use? I can assure you that your input will tics, fees, and guidelines, the Board hopes to have a immediately be put to use. The Executive program up and running in the next month. Infor- Board is for example working on better mar- mation will be sent out over the listserv as soon as keting and co-operation for the CII membership. Updated knowledge will enable the possible. Board to target the best possible client mar- kets so that you can get more clients and bet- Please don’t advertise services or ter value from your CII membership! Correct products on the listserv facts and updated figures are needed for our presentations. Occasionally members forget and use the CII Another example is the last survey in 2013 listserv to announce a product or service. The that focused on questions regarding meetings listserv is not the appropriate forum for advertising. and networking. The survey told us that more You can imagine if all 370 members decided to send regional meetings was wanted. Since then out announcements it would clog everyone’s inbox. we’ve had several regional meetings and this So, please—no self promotion on the listserv year we have four; US West in January; Sin- gapore this month; Slovenia and Canada in May – so your input in the survey is read and Advertise in the used. And we need answers! Last time almost 50% Councilor! of the membership helped out. This time, so far, not so many yet, but we’re still hoping to surpass the old turnout. So I ask, basically beg The Councilor is offering members only you to click here 2017 Member Survey and the opportunity to advertise their ser- then enter your username and password. vices in the Councilor for the 4 editions (You can also find this link on the home page being published in 2017. Rates are: of the CII website). Your input is important. Please help mak- 1/2 page—4 editions—$500 ing the CII even better; assist the Executive Board by entering your answers in the 2017 1/4 page—4 editions—$300 survey. 1/8 page—4 editions—$200 And to those that have already answered – THANK YOU! Bus. Card—4 editions—$150

To advertise contact Steve Kirby at [email protected]

10 President’s Message (continued) Nancy Poss Hatchl The glass ceiling was not a stopping point for her, but an Canada Regional Meeting in Niagara Falls, May 25-26. All obstacle to on to negotiate around. She was one of the are welcome and more information can be found in this is- very first women to serve on boards and as an officer of sue of the Councilor and on the CII website. private investigator organizations. While, this feat may not seem such in today’s world, it A special thanks to Nancy Barber who hosted the US was by no means easy. She confronted the obstacles with West Regional meeting in San Diego last January and to warmth, patience and openness that melted any resistance. When they say a woman has to do twice as much as a man Ponno Kalastree and the Mainguard Associates for an out- to succeed, this woman did three times as much with a standing regional meeting in Singapore that I had the pleas- cherubic smile and always a good story to tell. And, she ure of attending. always knew when bad-ass was the only way to go. And, part of that story is told by another of her col- Of course, our gala event, the 63rd Annual General leagues, Nancy Swaim, who tells us some of the tale that Meeting will be held this year in Panama from September lives on in all of us: 12-16, 2017. Host Brett Mikkelson is planning a fun filled We learned this week of the passing of Nancy Poss- Hatchl, an extraordinary woman many were fortunate to and educational event with a distinct Latin flavor. If you call a friend and a mentor. Nancy was a skilled investiga- have never been to an AGM you are missing value in your tor, an author, poet, video producer, humanitarian, cham- membership. AGM’s are the best way to leverage your pion for animal rights and a really funny person. The choice of Helios for her company name was apt and spoke membership by making contacts, continuing your educa- to her love of language, of ideas, of a bigger sense of pur- tion, and improving your business and professional skills in a pose for us all and a centering force. relaxed, fun, family-like setting. You can find out more At every turn, Nancy’s contributions cannot be ade- about the AGM on page three of this issue as well as the CII quately measured: an always-available mentor; a pioneer for women’s emergence as leaders in this industry; a tire- website. To register click here now 2017 AGM Registration less advocate for the modern role of private investigators Form in business and legal matters; a trusted advisor; a sound- ing board. Nancy’s work in maritime investigations set Thanks to all of our members who are recruiting and in- the bar. She was a frequent contributor to educational troducing CII to qualified applicants our membership has books, manuals and articles on investigative procedures. never been greater, in quality and quantity. We currently She was a key figure in developing PI test materials and a have 370 members in 66 countries on all 6 inhabitable conti- member/officer of key professional organizations. Her work with international PI groups was beneficial in creat- nents. A list of current 10 applicants and the 10 new mem- ing a global resource network. The very fact that she had bers accepted so far in 2017 can be found on page 12 of this her own company was a huge incentive to encourage oth- issue. Special kudos to Galen Clements for his amazing dili- er women to start their own PI firms. Moreover, Nancy was a friend. She was rightfully gence in vetting all CII applicants. designated as Nancy #1 in the “Nancy Club”, an informal Jacob Lapid has also been hard at work for the Council term adopted by women PI’s with the same first name, and it was a code by which we referred to each other. in investigating and implementing ways to increase income More often than not, conversations about casework would to the Council without raising dues and to grow Council begin with the status of our dogs’ health and the most membership in a responsible manner, never compromising recent travails of her cherished Bruno. In a business that is the quality of our membership. dictated by “just the facts,” there was always recognition of the whole self, family and pet priorities, political As the old saying goes , “You reap what you sow.” I am thought, the buzz. I learned so much from Nancy-she guided me through pleased with what we are sowing and look forward to the my PI test training, not by revealing any information from harvest. the test she had helped write (which she did not tell me until after I took the test) but by a Yoda-like advice to Respectfully submitted think the question through and choose the most logical answer. In a world where we expect trick questions, it was Sachit Kumar, CII a guiding principle that got me through. President My call to her was the first when I emerged from the test. Only then did she tell me about the curve and that it was very likely I passed. I had. She was a sly one, that Nancy P-H. Her love for fact-finding and process helped instill in me the rudiments by which my company operates today. I dare say that my experience was duplicated by many in the business, female and male. I am only one of many wondering what life without Nancy #1 will be like. Fortunately for them, the Sun god Helios and his sisters. Selene and Eos, have a new, wise partner in the solar hemisphere. 11 PENDING APPLICANTS

MEMBERSHIP NEWS Leo Campos Blackhawk Security & Intelligence Co. Batangas, Philippines New Members 2017 Aziz Akbar WELCOME ECS International Security & Investigations North Parramatta (Sydney) Australia Eric Flores, CII Corinproinca Group Andrew Duffin Caracas Venezuela Absolute Partnership, Ltd. Royal Turnbridge Wells, UK

Cypri Yu, CII Michael Gilliam Binary Solutions Limited Thompson & Toresen Investigations Hong Kong China Auckland, New Zealand

Don Haworth Gerald Smith, CII Chicagoland Detective Services (former member) Chicago IL, USA BPG Consultants North Williamstown Victoria Australia Wojciech Koszczynski Invest Protect Gdansk Poland James Klingensmith, CII (former member) Walter Lindsey Protective Circles Unity One East, Inc. Fort Meyers Florida USA Chattanooga TN, USA

Maxwell Ojelede Adam Rangotis, CII Oldstone & Greene Asvalia Detective Agency Lagos Nigeria Warsaw Poland Daniel Landis Alexis Pfefferle, QII D.L. Investigating Heptagone Digital Risk Kuna Idaho, USA Geneva Switzerland Goro Koyama Japan PI, Inc. John J. Redmond, QII Tokyo Japan John Redmond & Associates Chicago IL USA More information about the applicants can be found on the CII website. Anyone with knowledge of these appli- Daniel Toresen, CII cant’s qualifications can contact Galen Clements at Thompson & Toresen [email protected] Auckland New Zealand (Remember no posting about applicants on the listserv) Martin Coyne, CII Digitpol Current Membership Numbers Hong Kong Certified 309 Affiliate 10 Qualified 18 Honorary 7 Tom Ho Zhong Han,CII Associate 1 Emeritus 4 Form Tean Consultancy Pte. Ltd. Senior 21 Applicants 11 Singapore Total Membership 370 Countries Represented—66 Continents Represented—6

12 CII to promote members’ skills at The Council looks for the ACFE global fraud common ground with two conference in Nashville USA international associations For the second year members of the Council will be Under the direction of board member Ryan Colley, exhibiting at the Association of Certified Fraud Examin- the CII Executive Board is looking to form a synergy ers (ACFE) annual fraud conference being held June 18- with two international associations, the Alliance of 23. Over 3,000 investigators, attorneys, fraud auditors, Business Lawyers and Integra International. The pur- and corporate security executives from around the globe pose is to seek opportunities to work together in areas are expected to gather in Nashville. Last year we exhib- such as business development, education, and net- ited at the ACFE conference in Las Vegas and our booth working. had countless numbers of interested visitors, and potential clients and members. As the name implies, the Alliance of Business Law- yers (ABL) is an international association of attorneys CII’s participation in this conference is designed to who specialize in international legal matters. In No- showcase our international reach, promoting our ser- vember, Ryan Colley and Executive Director, Steve vices, and showing visitors to our booth how our mem- Kirby met with the Board of Directors of the ABL to bers can assist in investigating and defeating fraudsters discuss if there was an interest in the two associations throughout the world. Hopefully by highlighting our col- working together. The initiative would include speak- lective and individual skills to attendees, it will increase ing at each other’s conferences; providing links on each business for many members. Our message will be when association’s website; having members allowed to you have need of an investigator in any corner of the attend, as non-member guests, to each other’s confer- world, contact CII. ences. The goal would be to encourage members of We are also looking to re- the ABL to use CII members for all their investigative cruit highly qualified mem- Our message needs and for CII the be able to refer clients to a broad bers into our organization, spectrum of lawyers with an international practice. will be when whose skills will make our The ABL has approximately 900 attorneys as members you have need association stronger and and is a potential gold mine for CII members. more viable. of an investi- Integra International is similar to the ABL except gator in any Exhibiting at this confer- that its members are accountants and auditors with an ence is made possible by the corner of the international practice. Ryan and Steve will be meeting generous assistance of Marc with the Board of Integra at their annual meeting in world, contact Reed of Reed Research of Philadelphia on May 18, to discuss a possible alliance. CII. Ontario Canada. This is the As with the ABL, the goal would be to market the CII second year that Marc has brand and the CII member’s talents, hopefully increas- supported this endeavor. ing business contacts and prospects. A number of CII members are also expected to attend The Council owes Ryan a debt of gratitude for his as members of ACFE and will enhance our presence at time, effort and money expended in increasing CII’s this venue. Those members include (but are not limited brand to these two organizations. By showcasing our to) Mick Symons of Australia; Melissa Kelley-Hilton, organization we are at the same time showcasing all USA; Steve Levine, USA. If you are planning on attending members’ talents and professionalism, with a goal to this conference please do not hesitate to contact the CII increase business for all members. office so we can possibly make plans for an evening out. 13 Watching the Detectives Submitted by Steve Kirby

Our overworked and underpaid Vice President, Anne Styren, who has spent countless hours working on fixing our bylaws and designing two surveys, somehow still has time to run a successful investigative business, as she is celebrating 30 years in the profession (Ed. Note - she must have started at age 10). Anne started in the field in 1987 as an investigator/researcher for Interfact AB, a subsidiary of a newspaper. She bought the company in 2000 and renamed it Profile Intelligence. The rest, as they say, is history. Anne will be stepping down from the Board after serving for the last 5 years including a year as Secretary and two years as Vice President...Another member is also celebrating. Kelly Riddle of Anne looking San Antonio Texas recently announced on Facebook that his well known firm KelMar forward to an- Global just had it’s 28th birthday. Kelly is a well sought speaker on several topics and other 30 years we are looking forward to having him on the dais in Panama...Martin Jaekel from Cana- da also deserves kudos as he was recently elected President of the Canadian Association of Private Investigators (CAPI). CAPI, which was formed in 2010, is acknowledged as the official national voice for all recognized provincial private investigative services...CII Kelly Riddle member Louis Laframboise, who leads the provincial Quebec private investigators Associ- ation, is the 2nd Vice President of CAPI. Very nice to know that CII members are so involved in leading the profession in Canada...While others are still charging forward, after an incredible career, Joan Beach-Reistetter is spending less time in the detective business and more time running her new venture, The Shop on Main Street in Edinburg VA. Joan’s shop offers unique artwork, pottery, antique furniture, as well as yarns and fibers. Martin Jaekel I know a lot of us have yarns to tell but Joan has yarns to sell, Next time you are in the area stop in to visit...Emery Reistetter, Joan’s husband, and regular AGM attendee, couldn’t be much prouder as his grandson is following in his footsteps and entering the US Naval Academy. Quite an accomplishment ...Speaking of accomplishments, Sandra Stibbards is new Chairman of the ASIS Investigations Council...Two CII members are involved in manag- ing the National Council of Investigative and Security Services (NCISS). Francie Koehler was elected Sec- retary and Steve Rambam was elected as Director at Large...Jacob Lapid, our diligent Treasurer is beaming over his first grandchild. I expect that he has already painted a picture as Jacob is an accomplished artist...and last but not least—a real major accomplishment, Honorary Member Michael “Mick” Bennett and his lovely bride Colette just celebrated their 40th wedding anniversary. And they said it would never last. Unfortunately, Mick had to temper the celebration as he took a serious gall bladder hit but is on the road to Proud recovery…Until next issue—keep watching those detectives. grandfather Jacob Lapid

Joan always looked up to John! If you haven’t paid your 2017 dues yet you’re late! Click here or go to the Members Only Page of the CII website to pay now

If you are unsure if you paid your 2017 dues feel free to contact the CII office at [email protected] John Sexton & Joan Beach Reistetter at John’s book signing, hosted by Joan at her Shop on Main Street

14 Feature Article Spring 2017 Forecast Jack Devine, CII

Jack Devine is a retired CIA operative, with a storied career in all parts of the globe, helping make the world safe for democracy. Among many assign- ments, Jack served as both Acting Director and Associate Director of CIA’s op- erations outside the United States from 1993-1995; Chief of the Latin American Division from 1992-1993; and headed the CIA’s Afghan Task Force, which successfully countered Soviet aggression in the region. During his 30 + year career with the Agency, he received numerous meritorious awards, including the Dis- tinguished Intelligence Medal. After retiring from the CIA, Jack joined forces with Stanley Arkin and founded the Arkin Group, a business specializing in risk analysis, business intelligence, due diligence, investigations, and consulting. Jack is a regular contributor to many prestigious publications, including the Wall Street Journal. His 2014 book, “Good Hunting! An American Spymaster’s Sto- ry”, is a New York Times bestseller. Jack has been a member of the Council of International Investigators since 2001 and has served on the Board of Directors. This current analysis was published for clients of the Arkin Group and is reprinted here with Jack’s permission.

As anticipated, Trump is controlling the political tackling the more serious geopolitical and econom- agenda at home and abroad. It is no surprise that ic issues America is really confronting. This doesn't he continues to tweet, nor that the media and po- mean there isn't a very serious problem with Rus- litical world are still having great trouble dealing sian hacking. The use of cyber tools to penetrate with his unorthodox approach to presidential poli- the military, political and economic infrastructure tics. What we haven't seen yet is any sign of self- of potential adversaries is universal. What is new discipline which would take the edge off his popu- in the case of the Russians is a violation of the list approach in dealing with the electorate. If this "Moscow Rules;" namely, using these breaches to doesn't change, Trump should expect to get burnt directly influence internal political elections. This is regularly by his open-ended use of Twitter, and a potentially dangerous game-changer that has to face a commensurate drop in popularity ratings. be walked back behind closed doors in Moscow and Over time, this will compel him to moderate his Washington. Hopefully, this is being done. tweets, especially those that have a direct impact on national security matters. Because of the FBI investigation and the overall dust-up about Russia, Trump's plans for a reset In the meantime, the media pundits will remain in with Putin are going nowhere fast. high dudgeon. The growing frustration with the Foreign Policy Team Will Steady lack of objectivity across the political spectrum and the press, as well as a heightened skepticism The good news for Americans unsettled by the di- about what is news and what is "fake news," will visive 2016 presidential election and a tumultuous gradually push Americans to tune out the perpetu- transition is that we have likely seen the low wa- al partisan thunder. Already political fatigue is set- termark of the Trump Administration's manage- ting in, and a "Spring Break" is needed to unwind ment of national security issues. No doubt there from the election and to focus on other less politi- will be periodic snafus on specific issues, but the cized national and international issues. Unfortu- longer arc of government will become better orga- nately, it is hard to see this resetting this spring. nized and focused as the pragmatists take charge at the NSC, State, Defense and the Intelligence Community. As anticipated, the internal struggle Reinstate Moscow Rules between the ideologues and pragmatists will con- The recent political storm about the Trump team's tinue for months to come, but the early departure alleged collusion with the Russians in the U.S. po- of NSC Director Flynn has put the wind at the litical process, and the countervailing accusation pragmatists' back. Also, as Trump's team gets its that Obama tapped the Trump campaign for politi- sea-legs and begins to line up with the career pro- cal reasons, will produce in the end goose eggs on fessionals within the respective departments and both sides. With more smoke than fire on these agencies, the White House will become more alleged conspiracies, and no prosecutions or last- grounded on the key national security issues. Also, ing political benefits flowing from them, the public through the inevitable osmosis process of continu- will be left scratching its head and asking why so ous briefings, Trump will become more knowledge- much time was wasted on these issues, instead of able and less prone to substantive slip-ups. This is a process that all presidents experience, whether they like it or not. Continued next page

15 Spring 2017 Forecast Jack Devine, CII

Despite the many global problems confronting the South Korea may be one way that China can be Administration, there are relatively limited param- brought around to support us on this existential eters within which it will be able to work. This will threat. But, it will take more President Xi visits to be particularly true in our dealings with Russian Mar-a-Lago and Secretary of State Tillerson trips aggression in Ukraine and Crimea, Chinese military to Beijing to do it. expansion in the South China Sea and ISIS-driven terrorism. For the most part, the policy will likely reflect a continuation of the post-WWII Iran Heading Toward Treacherous Waters "containment strategy" which was designed pri- Running nip and tuck for the top thorny issue for marily to keep in check our adversaries. Whether it Trump on national security will be the nuclear deal is robust or soft containment remains to be seen, with Iran. Trump and the Republicans will try to but it is a good bet that on many issues Trump's modify the agreement, and in the process apply foreign policy will retain the same general outline more sanctions. Iranian internal politics will not as his predecessors. It will be hard to embark on a allow a rewrite of the deal or significantly in- genuine game-changing strategy, with the excep- creased sanctions. It is very likely they will feel tion of Iran and North Korea, where the Admin- compelled to tear up the agreement and press istration may be forced to act boldly despite an ahead with the development of nuclear weapons. inclination not to do so. The big question: Now what? We certainly can increase sanctions on Iran and squeeze its economy hard, but this won't lead to a regime change or a North Korea Will Remain Intractable step back in its nuclear policy. The Europeans will North Korea may be the toughest national security strongly resist an increase in sanctions, but it's a issue that the Trump administration will have to 50-50 bet that in the end they may sign up in soli- face this year. The nuclear genie is out of the bot- darity, and to avoid triggering negative economic tle in North Korea, and it will be extraordinarily dif- consequences for themselves. Hanging in the bal- ficult to get Chairman Kim Jong-un to cease and ance is the reelection bid of "moderate" President desist from exploiting it to the fullest. The Hassan Rouhani in Iran's May election, which is "strategic patience" strategy we have pursued over staked in large part on economic benefits from the the past several years has had no impact. North nuclear deal. If Trump follows through on further Korea already has over 20 nuclear weapons in its sanctions and challenging the agreement, realisti- arsenal, and is fairly quickly developing a ballistic cally we are back to the drawing board with covert missile capability to deliver these weapons against action programs and war planning as our only op- our allies, particularly South Korean and Japan. tions. Not a good place to be. And, in the next five years, if not stopped, these missiles will be able to reach the continental U.S. Going It Alone on Trade

Notwithstanding these national security issues, ar- Many policymakers and Asia experts believe China guably the biggest Trump international initiative to is the best pressure point on North Korea. While watch in the months ahead is the coming policy that may be true in the abstract, we definitely changes on trade, which will not only have major should not count on China, especially in light of its consequences on the economy, but also on our in- response to the March 5, 2017 firing of four mis- ternational relationships. The two hottest points of siles into the Sea of Japan. Instead of showing out- friction will be Mexico and China. While the NAFTA rage and calling North Korea on the carpet, the agreement won't be abrogated, it will be revised Chinese Government lashed out at the U.S. and enough to sour the relationship with Mexico and South Korea. It blatantly criticized the U.S. deci- uncap nationalistic sentiments which would be eco- sion to move forward with installing the anti- nomically unhealthy and unproductive for both ballistic missile defense system (THAAD) in South sides of the Rio Grande. It certainly will compel all Korea and has put increased economic pressure on of Mexico's likely presidential candidates in 2018 to South Korea to reject THAAD. Even if China weighs run on an outspoken nationalistic platform with in to help, the U.S. needs to keep hardening our anti-American undertones. Look out for the poten- military position in the region, working existing tial rise of leftist leader Andrés Manuel Lopez Obra- diplomatic channels, maximizing economic sanc- dor as a consequence. It will take great diplomatic tions on North Korea, acting covertly to undermine and political finesse by all to avoid this problem. North Korea's nuclear program and even consider positioning tactical nuclear weapons in South Ko- Continued next page rea. The threat of tactical nuclear weapons in

16 Spring 2017 Forecast Jack Devine, CII

Much like Mexico, future trade policies will rankle the Chinese, put a chill on the overall relationship and nudge Chinese nationalism upward. Now that the United States has officially pulled out of the Trans Pacific Partnership (TPP), China already has increased its efforts to lead on trade initiatives and negotiate multilateral agreements that leave the U.S. out. This will be especially tricky considering that China's economy is contracting more than admitted publicly. As with Mexico, great diplomacy and art- ful maneuvering will be required to keep the relationship on a positive track. Hold on tight to your seat on trade issues. Health Care, Oil and ISIS Democrats are still reeling and not coming to terms with the long-range implications of their defeat last November. However, the Republican plan to reform Obamacare gives the Democrats a good whipping boy to keep the fight fair. Many a politician has broken his/her pick on health care, and House Speaker Paul Ryan and President Trump won't be an exception. It's hard to see how the Republicans can craft a plan which doesn't cost them part of their constituency. The struggle over health care also will likely push tax reform and infrastructure spending further down the road on the congressional agenda. And, at least in the short term, it will give the Democrats a powerful issue to stake out a clear position and possibly refocus itself in the process. It will also reveal more clearly Trump's relationship with Congress going forward, which is muddled at this point. Aches and pain lie ahead for the Republicans on this issue.

Keep an eye on oil prices. It is unlikely prices will move much above $55 for the foreseeable future due to the dramatic improvement in recent years in U.S. energy capabilities and technology, and because of China's shrinking economy over the long run. Recent suggestions that the Chinese economy is improving will be short-lived. On the geopolitical front, low oil prices will have a particularly significant political and economic impact on Saudi Arabia and Russia. They both need oil prices above $50/barrel to meet their budget minimum requirements and to keep a lid on political dissent. If the prices fall below $50 a barrel for a protracted period, you can count on internal tensions in Russia and Saudi Arabia. Continued low prices will also have a worsening impact on Venezuela's instability. Venezuela is already in deep economic and political turmoil and this could become an even more urgent crisis for the hemisphere.

ISIS will continue to weaken in the months ahead. But, remain alert for a terrorist event at home or in Europe designed in desperation to attract new recruits to the ISIS cause.

If you or your firm would like individualized consultation or information, please contact Jack Devine at The Arkin Group.

Don’t be left out of “PANAMANIA” 2017 Click here to register today 2017 AGM Registration Form

Panama_Hotel_registration_63rd_AGM

Provisional Schedule

17 Feature Article Cyber Warfare Gains New Weapons Against Vulnerable Data: Spear Phishing and Social Engineering

By Lauren Sowers of Colley Intelligence

We all know what the spies of the past looked like. The classic “gumshoe” depiction- the trench coat clad spy, whose hat casts a recognizable shadow as he goes about solving the unsolvable. The typical spies of today and to- morrow, however, will cast a different sort of shadow. And it will be a little less glamorous, but perhaps more dam- aging in scope: a person, face to face with the gleam of a laptop, who can, in mere moments, wreak havoc on the civilized world. We’re of course talking about cyber espionage, a growing concern as more companies and organizations are identified as compromised.

THAT WAS THEN…. THIS IS NOW.

Photo: Wikipedia This is a poster for Gumshoe. The poster art copyright Less shadowy trenchcoat, more laptop and WIFI: International espio- is believed to belong to the distributor of the film, Columbia Pictures, nage today looks a lot more like this. the publisher of the film or the graphic artist.

In 2016, a massive cyber espionage operation, now known as “Operation Cloud Hopper” began, which targeted Managed IT Service Providers, and gave the perpetrators known as APT10 (a group believed to be based in China) access to an incredible amount of intellectual property and sensitive data. These attackers are becoming increasingly sophisticated, ever improving their malware, and adding new custom tools to their arsenal. The most recent attacks believed to be traceable to APT10 were reminiscent of the 2013 event that compromised U.S. megastore Target. And here’s the kicker- the damage is done by gaining legitimate accessto the information. Data is extracted and com- pressed, and then moved back to the Managed Service Provider network. It is then continued next page

18 Cyber Warfare Gains New Weapons Against Vulnerable Data: Spear Phishing and Social Engineering

By Lauren Sowers of Colley Intelligence exfiltrated from the MSP. “social engineering” technique within the cyber security world.) The recipient then clicks the link to PlugX, CheChes, EvilGrab, and RedLeaves are “reset a password” or “confirm account ownership” among the payloads (computer viruses) successfully or similar, and they are guided to a page wherein used to infiltrate large organizations. By now, we all they’ll unwittingly download malware. This shows know what “phishing” is- when the attacker’s mes- another startling difference between regular phish- sage appears to come from a trusted outside source ing and spear phishing: in a spear phishing attack, (i.e., a slightly varied version of a familiar email ad- the attacker has already been within the system dress, like Paypal or Google. In the MSP attacks, how- and gathered information about the intended tar- ever, the attacker’s initial move is often “spear get. The attack is personalized, and therefore more phishing,” in which messages appear to be sent from convincing and likely to be successful. The attacker a source within the recipient’s own company, gener- has already gained access to some sensitive data, but ally someone in a position of authority, or someone spear phishing ensures they’ll gain access to all the known personally by the recipient. The sender and sensitive data, and export it at their convenience. All the links contained in the email may appear legiti- it takes is a single employee to fall victim to the mate to the recipient, and there is usually infor- attacker’s methods, and an entire organization’s data mation within the email that appears to validate the security vanishes. sender’s identity. Additionally, requests within the message will seem logical to the recipient. In a recent incident I researched for a client, the email was sent by a slight variation of the company For instance, an individual might receive an email president’s email address. The recipient’s email soft- from her boss, with maybe a letter or two off in the ware doesn’t show e-mail addresses by default, only email address. Such minor differences in the appar- the names of senders. The email referenced bank ent sender often go unnoticed by a recipient, espe- accounts, and a location of a current project. No cially as more email programs feature sender’s wonder the recipient clicked on the link and compro- names as opposed to their email addresses. The mised their entire operation. They were able to stop sender will often reference a piece of proprietary an illegal wire transfer in it’s tracks, but had to com- information that an outside source would be pre- pletely relocate assets and redesign their communi- sumed not to have. This validates the sender’s re- cations, as well as their in-office policies about quest in the eyes of the recipient. (This is known as a emails. Continued next page DEFINITIONS

Social Engineering Spear Phishing

Social engineering is an attack vector that relies heavily on human Spear phishing is an email-spoofing attack that targets a interaction and often involves tricking people into breaking normal specific organization or individual, seeking unauthorized security procedures. access to sensitive information. Spear-phishing attempts are not typically initiated by random hackers, but are

more likely to be conducted by perpetrators out for fi- nancial gain, trade secrets or military information.

19 Cyber Warfare Gains New Weapons Against Vulnerable Data: Spear Phishing and Social Engineering

By Lauren Sowers of Colley Intelligence

All organizations utilizing managed services/ cloud services/ enterprise services are considered extremely at-risk for these sorts of attacks. Known successful attacks of this kind have been completed on several continents and many countries, including the U.S., India, Australia, South Africa, France, Finland, Sweden, Norway, Switzerland, Can- ada, Brazil, Thailand, Japan, and the U.K.

What does all this mean for us as investigators? As these attackers increase in sophistication, we must become more vigilant protecting our data, and the data of our clients. Cyber security is not a corner of the business to ignore, nor an area of the business in which to try to keep a lean budget. It may also be our professional responsibility to counsel our clients on their own information security. One OSINT expert recently noted on Twitter that today’s “snake oil” is “cybersecurity software without training employees on basic security standards and practices.” Why? Because as successful spear phishing attacks have shown, the most top-notch software is useless if you’ve got even one individual who isn’t trained on keeping systems secure. The biggest tip to avoid a phishing scandal? When in doubt, pick up the phone! If you (or your client) receive a strange email, contact the sender (not via email) and if they didn’t send it, treat your information systems as if they’ve already been infiltrated and compromised, because they probably have. A recent report by PWC notes the following sectors have been the main targets: Engineering and Construction Retail and Consumer Public Sector Pharmaceuticals and Life Sciences Energy and Mining Technology Industrial Manufacturing Metals Business and Professional Services

FOR YOUR INFORMATION: Other AKAs for APT10 CVNX Stone Panda MenuPass POTASSIUM

A complete report issued on the matter can be found here: https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf

20 Resource of the Month WEB CONTENT PRESERVATION: PROVIDING SOCIAL MEDIA

EVIDENCE THAT PASSES THE AUTHENTICATION TEST By Lauren Sowers, Colley Intelligence

I’ve noticed lately some new companies are popping up, offering services to the investigative and legal communi- ties for evidence preservation of social media content. Why? Because in some places, a screenshot (though time stamped by a computer, something one should reasonably be able to authenticate) isn’t admissible as evidence. Some courts in the U.S., for instance, have ruled that there’s no way to authenticate a screenshot without “personal witness,” or unless the screenshot is obtained by another service, such as The Wayback Machine. As investigators, our work needs to be admissible. So the first item on our checklist if to ensure that you’re aware of the legal protocols for electronic discovery in your geographical location. Don’t waste your time with screenshots if you need to produce a bigger electronic evidence chain!

So first, let’s talk about the WAYBACK MACHINE https://archive.org/web/. This is a go-to for whenever you’re dealing with a defunct website or a deleted profile. If the target dismantled their web presence just in time for your research to begin, your first stop should be the internet archives. Wayback Machine takes images of websites and places them in a cache for safe keeping. The uses for this as an investigative tool are endless. The Wayback Machine boasts 286 billion pages preserved to date. For fun, I put in our website, ColleyPI.com. Turns out that the oldest preserved image of that site was from 1998. The page has been archived 198 times in the history of the site. Lois Colley likely won’t appreciate me bringing this fancy looking site back from the dead, but here’s what I found:

Continued next page

21 WEB CONTENT PRESERVATION: PROVIDING SOCIAL MEDIA

EVIDENCE THAT PASSES THE AUTHENTICATION TEST By Lauren Sowers, Colley Intelligence

The archive’s snapshots are neatly presented in a calendar format, so that if you have a time frame for what you’re seeking, you can easily find it by clicking on the date:

I’m also rather excited about Wayback Machine’s Beta version which includes site search! You can enter search terms related to a site’s homepage. This could be a good source of leads. WAYBACK MACHINE BETA https://web-beta.archive.org/ Similar to Wayback Machine, but less searchable is the Google Cache. Their definition of their cache is as follows. Never overlook that little cached beside the website you want to visit!

During disputes, or for any controversial issue that may arise in a pre-hire situation or similar, our best bet is always to preserve items in their entirety. Facebook currently lacks a tool that allows you to auto-expand all comments, so we frequently may find ourselves hitting the space bar and expanding comments the old fashioned way, which is both time consuming and annoying. This free OSINT Bookmarklet tool isn’t perfect, but it’s good. It isn’t lightning fast, but at least you can make a phone

Google Cache is nothing but a snapshot or a copy of a page stored by Google as a back-up. Google usually takes a snapshot of each page it examines and caches or stores that version as a back-up. The cached version is what Google uses to judge if a page is a good match for our query. Oct 7, 2010

call or grab a cup of coffee and give yourself a break from the mind-numbing space bar or endlessly scrolling mouse for a minute. To learn about it, visit the link below. If you wish to install it, you can just drag the link right into the bookmark bar, and click on it whenever you’ve visited a page you need to expand. Continued next page 22 WEB CONTENT PRESERVATION: PROVIDING SOCIAL MEDIA

EVIDENCE THAT PASSES THE AUTHENTICATION TEST By Lauren Sowers, Colley Intelligence

(Please note that it won’t do thousands of comments on an individual post. It works best on your average personal Facebook user’s profile, not for massive organizations or celebrities who receive thousands of comments per post. It also will work differently on different browsers, so make sure the one you’re using appears to be compatible with the tool. I use Google Chrome.)

The joy of this tool is that you can come back and do keyword searches, and/or preserve the page in its entirety. EXPAND COMMENTS ON FACEBOOK http://com.hemiola.com/2015/08/29/expand-all/ Another frequent issue in evidence preservation is downloading videos in their entirety. Every few months, the free tools I use for this go down and another one pops up. I prefer to use browser-based services that don’t re- quire a software download, potentially compromising the security of my system. Currently, I use the following site for downloads- you simply place the URL of the video you wish to preserve in the box. It’s important to recognize that the URL of the video as it exists in a target’s timeline will not suffice- you need to open the video in its own window within the person’s profile by clicking on the post itself. That will provide you with the right URL to copy and paste into the site below. FACEBOOK VIDEO DOWNLOADS www.downfacebook.com

PRESERVING THE WHOLE PROFILE Once you’ve successfully got the user’s entire profile page in view (clicking“ older posts” until you can’t anymore, and perhaps expediting using the Expand Comments Bookmarklet), I find the easiest and most foolproof method of preservation is simply to click File> Print> Save as PDF. I find that the format is best preserved (photos, comments etc.) and looks most like the original profile if preserved in this way. There are downloadable tools and some rather incomplete outside scripts that claim to do this as well. But as I said above, I prefer not to compromise my machine with sketchy downloaded items. There isn’t much incentive for people to build “scraper” tools that will expand comments and preserve a whole profile instantaneously, because anytime Facebook makes even a mi- nor change, the scraper program would break and need to be reworked for the changes.

Lauren Sowers has been an important contributor to the Councilor, volunteering as Associate Editor and over the past few years, submitting numerous articles on some of the latest techniques in utilizing social media for investigative purposes. Her Fea- ture of the Month essays are always appreciated. Lauren is the daughter of Lois Col- ley and works with Lois, and Ryan Colley in the highly regarded firm, Colley Intelli- gence based in Ohio and Washington DC.