Investigator Spotlight: Frank Perhacs of the Ohio HIDTA

In this month’s edition of our monthly Investigative Q&A series, we sat down with Frank Perhacs, an investigative support center manager with the Ohio HIDTA, about the future of investigations and how digital evidence is changing the law enforcement landscape. This month’s edition explores Perhacs’s most helpful tip for using PenLink in investigations, how digital evidence is changing the way investigators are looking at cases, and why digital evidence is no longer a luxury item.  

Q: How has the investigative process changed over the last three to five years?

A: Over the past three to five years, the use of digital evidence items in narcotics investigations has advanced from a luxury item to an absolute necessity. Five years ago, our law enforcement partners and prosecutors were just beginning to embrace and appreciate the value of digital evidence analysis and the corresponding benefit to their cases. After years of successfully utilizing digital evidence to secure convictions, our partners now seek it out earlier in the process to help uncover new leads and move their investigations forward. Five years ago, analysis of things like social media search-warrant returns, phone extractions, and cell tower location information was encountered more in our major conspiracy investigations. Now, we see at least one of these items being requested with almost every case-support request our unit processes.

 

Q: What impact does digital evidence have on clearing your cases?

A: The ability to identify, obtain, and analyze digital evidence is now an essential component to the life cycle of our narcotics investigations. Having the ability to quickly and easily review social media search-warrant returns and phone extractions by utilizing PenLink’s interface has allowed us to provide investigative leads to our law enforcement partners in the field with a quicker turnaround time. The mountain of raw information that is furnished with these digital evidence returns is often seen as overwhelming to our law enforcement partners who don’t have access to systems like PenLink. We’re able to educate them on the value of the key intelligence pieces that may be hidden inside of that information. We leverage PenLink’s industry-leading capabilities to translate that raw information into processed intelligence reports that are easy for our enforcement and prosecution partners to understand and utilize to secure convictions in their cases. This analysis ranges widely to meet the needs of the customer in the field. In the most simplistic form, we can utilize PenLink to upload the phone extraction of a victim of a fatal drug poisoning and leverage the analysis capabilities to identify potential suspects for our investigators. In more complex investigations, we may utilize multiple digital evidence items. For example, we may use PenLink to analyze a Facebook search-warrant return to identify addresses of interest in our investigations. We’re then able to map out cell tower location information and other enhanced location records within PenLink to identify whether the target phone was in the area during the time the crime was committed. Being able to perform all these tasks within one software system saves our analytical unit hours of time that we can use to support additional investigations.

 

Q: Research shows that investigators believe digital evidence is more important than DNA evidence. How would you say this applies to your jurisdiction?

A: In my experience, the importance of the digital footprint linking our targets to the crime is viewed as having similar importance to other established scientific standards such as DNA evidence.  Both are extremely important, but when combined they paint an important picture that further connects our suspects to the crimes they are accused of committing. Having one aspect (DNA or digital evidence) is helpful, but having both is viewed as superior. Even in our overdose investigations, where DNA evidence may already be present, our law enforcement and prosecution partners want to further establish the relationship between suspect and victim by utilizing communication and location analysis. We accomplish this by using PenLink to display the content of text messages that were exchanged between the suspect and victim arranging the sale of narcotics, as well as any phone calls that may have occurred between the two. We then map the movements of the suspect and victim’s phones based on these communication events to see if they did appear to meet up.

 

Q: Has PenLink made your team more efficient?

A: PenLink has proven to be an essential software system within our analytical unit. The ability to upload files of multiple types into one standard interface has allowed us to turn mountains of raw information quickly and efficiently into processed intelligence.  Because PenLink is designed to handle everything from basic call-detail records (CDRs) to live phone location pings and even wire intercepts, we are able to effortlessly blend these data sources into one view and streamline our intelligence process. We frequently speak with analysts and investigators in the field who don’t have access to the same types of capabilities in their current software, and hear the stories of how long and drawn-out the analysis process is when dealing with these digital evidence items. By constantly updating their product to match the evolving structure of these evidence returns, PenLink has saved our analytical unit countless hours of manual-processing work. In turn, our analysts can spend their time writing more detailed documents to explain the data, which helps us secure more convictions with our investigations.

 

Q: What’s your favorite investigative tip?

A: I’d encourage any PenLink users who currently only use the system for things like the analysis of basic CDRs to expand their horizons and leverage the system’s full analytical capabilities. Because PenLink is built to ingest so many types of data, you have the unique ability to upload CDRs, cell tower information, pings, GPS information, phone extractions, social media returns, and so much more into one easy-to-understand format. You are then able to analyze the communications quickly and easily for things like hot number lists, common call lists, call pattern analysis and other helpful pre-programmed report types. Also, don’t forget to customize your own reports and interactive grids to save you time in the future. PenLink makes it simple and easy to set up your analysis reports just the way you need them, so the next time you get a request of a similar nature it will take you a matter of seconds to produce a report for your target audience. In short, don’t find yourself getting lost on one specific aspect of your investigation—use PenLink to better understand the full scope of your investigations, so you can be the true expert on all aspects of your ongoing cases.

 

Q: How are the expectations for investigations evolving, and how are you preparing for those changes?

A: As more agencies become aware of the benefit of analyzing these digital evidence items, we are seeing a corresponding surge in the number of case requests that include a request for these services. As an analytical unit, we need to make sure that we have the necessary storage space to intake and store copies of these digital evidence items, which can often be several hundred gigabytes in size. We also need to be sure that our team is up to date on any recent changes to the landscape of what is available from the providers. That has involved our identifying ongoing training opportunities specific to each of the major providers to ensure that our team is aware of what is available, how to request the data, and what information is important inside of each return. By staying up to date on these new changes, our unit can act as an advisor to any of our local law enforcement partners who have questions on what is available and how they are able to obtain and analyze that information. Finally, the analysis of these digital evidence items is still a large undertaking, even with the time-saving benefits of software like PenLink. We’re constantly evaluating the need to hire new analytical personnel who are focused on providing these basic services, to make sure that the needs of our law enforcement customers are adequately met.

Thank you to the Ohio HIDTA, and to Frank Perhacs for his willingness to share his experiences and opinions—as well as their commitment as a team to keeping their community safe.

If you would like to take part in our Q&A series, please reach out to [email protected]. To learn more about PenLink and to access resources, please visit  www.penlink.com.Join us as we discuss the ever-changing cyber landscape and spotlight modern advancements in live communications collection. Internet communications expert, Scott Tuma, will highlight how top investigators across the nation are executing live social media intercepts to enhance investigations and identify larger criminal networks faster. Hear how live intel from social media providers can be crucial to solving cases, plus best practices for effective intercepts with real case examples.

Featured Topics:

• Current trends in live collection and analysis
• How today’s savvy investigators are using social media intercepts
• Myths about modern live collection
• Advantages and best practices for live social media intercepts

Don’t miss the opportunity to see how to navigate social media organizations, collect and analyze new data types, and master the tools of the trade.

This webinar was previously hosted by Police1.