ITI to Develop Ambitious New Digital Forensics Curriculum

ITI faculty have received a grant from the National Science Foundation that will support development of a new undergraduate educational curriculum in digital forensics, in order to address a national shortage of trained cyber-security professionals.

Forensics is the use of scientific methods to obtain information with legal significance, and digital forensics is a type of forensics that deals with recovery and investigation of data in digital devices. Digital crime, and the need to use digital evidence in investigations, are both growing dramatically in today's technology-dependent world. Consequently, digital forensics is now a major part of many criminal investigations, and its tools are frequently and increasingly being used by law enforcement agencies. According to one estimate, the number of jobs related to digital forensics will increase by over 20% from 2010 to 2018.

Unfortunately, the skilled workers needed for those jobs don't exist. The strongly multidisciplinary nature of digital forensics has been a significant barrier to entry into the field. Expertise in computer science is not enough; forensics practitioners must also have a solid understanding of legal procedures, laws of evidence, and investigative techniques. Most computer scientists don't have enough legal understanding even to present facts appropriately in court, and many don't realize how easily they might commit crimes themselves while taking action to address possible malicious activity.

You want to have a chain of legal custody associated with digital information, and that requires you to treat the gathering of information in a manner that's not typical of the way computer scientists deal with it, explains Roy H. Campbell, the leader of the new ITI effort. You really have to consider, are you tampering with the evidence in some way? Are you destroying its content? Are you invalidating the logical chain of evidence by doing something to the computer? It's also bringing in the notion of weighing of evidence: what is likely to have occurred, what is not likely to have occurred. Nowadays that can be quite interesting and difficult technically.

Dr. Masooda Bashir, who is the managing director and a co-principal investigator of the new program, explains the need for a new curriculum. While several academic programs on digital forensics have already been developed, the field and its curriculum standards are still evolving. Therefore, without a standard curriculum, there may be great inconsistency among the university programs being offered. The aim of our project is to develop and implement a model curriculum in digital forensics that balances the various necessary multidisciplinary components, and to work for acceptance of that model as a standard for education in digital forensics.

To address the challenge of teaching such a complex topic, the ITI development team includes not just faculty in computer science and computer engineering, but also experts in criminal justice, law, sociology, and educational assessment.

One of the things we're guilty of in computer science and computer engineering is being very focused, very ‘siloed,' Campbell observes. The problem is that computer science is stretched out now into social networking, into business and accounting, into relationships between people. And there are all sorts of aspects of human behavior interacting with computers that are not addressed in a computer science program, not addressed in a sociology program, and so on. For data forensics, you really want to have a body of professionals that understand all the needs.

The curriculum resources to be created will be usable as the basis for future academic programs, distance learning, and multidisciplinary, multi-institutional programs that meet evolving standards. Specialized curricula will be developed to meet the needs of both universities and two-year colleges, and a K-12 outreach program will translate the educational materials and program to levels suitable for a wider audience. Much of the material, including a virtual laboratory and class notes, will be provided on-line and shared with other institutions.

Campbell reflects that the new digital forensics effort may broaden ITI's perspective on trust. We have established the Information Trust Institute as one of the premier research institutes in computer security, power grid security, infrastructure security, and so on, but we what we need to do very much is think about the interaction of computers with society and with policymaking. And I think that the forensics project will push us in the direction of considering trust in a broader sense. Computer forensics can be applied to all the things ITI does; it's another step in the way ITI is maturing. ITI not only has great depth in particular areas, but is now extending its knowledge into the relationships of technology, society, and the legal system.

Campbell is a professor of Computer Science and the director of the NSA Center for Information Assurance Education and Research in ITI, and Bashir is ITI's assistant director of social trust initiatives. Other members of the development team include Jay P. Kesan of the College of Law; David M. Nicol, the director of ITI and a professor of Electrical & Computer Engineering; Anna-Maria Marshall of the Department of Sociology; Susan Hinrichs of the Department of Computer Science; Lizanne DeStefano of the College of Education (serving as evaluation team leader); and Jana Sebestik of the College of Education (serving as K-12 outreach coordinator). Also participating will be personnel from the University of Illinois College of Business and from Parkland Community College, a two-year college in Champaign, Illinois that has an established set of associate's degree courses in digital forensics.

The NSF awarded the new grant under its CyberCorps: Scholarship for Service program, which was created to bolster the nation's workforce of trained cyber-security professionals, and thus promote America's economic prosperity and national security.