The Department of Defense Cyber Crime Center (DC3) is designated as a Federal Cyber Center by National Security

Presidential Directive In the United States, a presidential directive, or executive action, is a written or oral instruction or declaration issued by the president of the United States, which may draw upon the powers vested in the president by the Constitution of the Uni ...

54/Homeland Security

23, as a

Department of Defense The United States Department of Defense (DoD, USDOD, or DOD) is an executive department of the U.S. federal government charged with coordinating and supervising the six U.S. armed services: the Army, Navy, Marines, Air Force, Space Force, ...

(DoD) Center Of Excellence for Digital and Multimedia (D/MM) forensics by DoD Directive 5505.13E, and serves as the operational focal point for the Defense Industrial Base (DIB)

Cybersecurity Computer security (also cybersecurity, digital security, or information technology (IT) security) is a subdiscipline within the field of information security. It consists of the protection of computer software, systems and networks from thr ...

program. DC3 operates as a

Field Operating Agency This is a list of Field Operating Agencies (FOA) in the United States Air Force that are active. FOAs report directly to a functional manager in either the Office of the Secretary of the Air Force or the Air Staff. FOAs perform field activities ...

(FOA) under the

Inspector General of the Department of the Air Force The inspector general of the Department of the Air Force is responsible for conducting investigations and inspections as directed by the secretary of the Air Force, Chief of Staff of the United States Air Force, chief of staff of the Air Force, a ...

Mission

The mission of the Department of Defense Cyber Crime Center (DC3) includes adding layers to enhance security of dotmil domains by identifying

vulnerabilities Vulnerability refers to "the quality or state of being exposed to the possibility of being attacked or harmed, either physically or emotionally." The understanding of social and environmental vulnerability, as a methodological approach, involves ...

computer system A computer is a machine that can be programmed to automatically carry out sequences of arithmetic or logical operations (''computation''). Modern digital electronic computers can perform generic sets of operations known as ''programs'', wh ...

servers which could lead to the unauthorized disclosure of

information Information is an Abstraction, abstract concept that refers to something which has the power Communication, to inform. At the most fundamental level, it pertains to the Interpretation (philosophy), interpretation (perhaps Interpretation (log ...

. DC3 provides resources such

computer crime Cybercrime encompasses a wide range of criminal activities that are carried out using digital devices and/or networks. It has been variously defined as "a crime committed on a computer network, especially the Internet"; Cybercriminals may exp ...

investigations, cyber technical training,

penetration testing A penetration test, colloquially known as a pentest, is an authorized simulated cyberattack on a computer system, performed to evaluate the security of the system; this is not to be confused with a vulnerability assessment. The test is performed ...

, technical solutions development, and cyber analysis within the following DoD mission areas:

cybersecurity Computer security (also cybersecurity, digital security, or information technology (IT) security) is a subdiscipline within the field of information security. It consists of the protection of computer software, systems and networks from thr ...

and

critical infrastructure protection In the U.S., critical infrastructure protection (CIP) is a concept that relates to the preparedness and response to serious incidents that involve the critical infrastructure of a region or the nation. The American Presidential directive PDD-63 o ...

law enforcement Law enforcement is the activity of some members of the government or other social institutions who act in an organized manner to enforce the law by investigating, deterring, rehabilitating, or punishing people who violate the rules and norms gove ...

and

counterintelligence Counterintelligence (counter-intelligence) or counterespionage (counter-espionage) is any activity aimed at protecting an agency's Intelligence agency, intelligence program from an opposition's intelligence service. It includes gathering informati ...

, document and media exploitation, and

counterterrorism Counterterrorism (alternatively spelled: counter-terrorism), also known as anti-terrorism, relates to the practices, military tactics, techniques, and strategies that governments, law enforcement, businesses, and Intelligence agency, intelligence ...

Cyber Forensics Laboratory

The Cyber Forensics Laboratory performs Digital and Multimedia (D/MM) forensic examinations, repairs damaged devices and extracts otherwise inaccessible data from them, and provides expert testimony in legal proceedings for DC3 customers. The lab's robust intrusion and malware analysis capability supports law enforcement, counterintelligence, and Defense Industrial Base activities and operations. The CFL also works with the Defense Cyber Operations Panel (which consists of Defense Criminal Investigative Organizations and Military Department Counterintelligence Organizations) to develop requirements and set standards for digital investigations as new technologies emerge and evolve. The CFL is an accredited lab under ISO 17025 by the ANSI National Accreditation Board, and its operations are subject to strict quality control and peer review. The CFL produces results which are valid and reliable, based on conditions and methods which are repeatable. * Digital and Multimedia (D/MM) forensic examinations * Device Repair * Data Extraction * Expert Testimony for DC3 Customers

Cyber Training Academy

The DoD Cyber Crime Center – Cyber Training Academy has been active since 1998, providing cyber training for Department of Defense (DoD) personnel. Over the years, the academy has played a role in training various defense entities, including Defense Criminal Investigative Organizations (DCIOs), Military Department Counterintelligence Organizations, Cyber Mission Forces (CMFs), Cyber Protection Teams (CPTs), Mission Defense Teams (MDTs), and others within the broader DoD enterprise. "The CTA offers more than 30 unique courses of classroom, online, and Instructor-Led Virtual (ILV) cyber training to both individuals and organizations within the DoD charged with protecting defense information systems from unauthorized use, criminal and fraudulent activities, and foreign intelligence/counterintelligence efforts." —CTA

Technical Solutions Development

Technical Solutions Development (TSD) tailors software to the requirements of digital forensic examiners and cyber intrusion analysts. TSD validates digital forensic tools from commercial off-the-shelf, government off-the-shelf, and open-source domains to ensure relevancy and reproducibility as to expected use. In coordination with its cooperative partners, TSD: * Leads the way by proactively identifying, researching and evaluating relevant new technologies, techniques and tools * Actively participates in the development of industry standards, including Structured Threat Information eXpression (STIX) and Cyber-investigation Analysis Standard Expression (CASE) * Shares in-house-developed tools with federal, state, and local law enforcement partners * Maintains the Counterintelligence Tool Repository (CITR), a warehouse of classified and unclassified tools that support digital forensics and counterintelligence needs.

DIB Cybersecurity

DoD-Defense Industrial Base Collaborative Information Sharing Environment (DCISE)—DCISE is the operational hub of the Defense Industrial Base (DIB) Cybersecurity Program of the Department of Defense, focused on protecting intellectual property and safeguarding DoD content residing on, or transiting through, contractor unclassified networks. The public-private cybersecurity partnership provides a collaborative environment for crowd-sourced threat sharing at both unclassified and classified levels. DCISE provides cyber resilience analyses for Cleared Defense Contractor (CDC) companies and offers unmatched Cybersecurity-as-a-Service capabilities. DCISE performs cyber threat analysis and diagnostics, offers mitigation and remediation strategies, provides best practices, and conducts analyst-to-analyst exchanges with DIB participants ranging in size from small to enterprise-sized companies.

Operations Enablement

Operations Enablement Directorate (OED) The mission and principal focus of the OED is to amplify the effects of DoD-wide law enforcement and counterintelligence (LE/CI) investigations and operations, and by extension, the effects of the U.S. Intelligence Community at large. That charge encompasses: # Conducting expert technical and all-source analysis (resulting in more than 493 products released in FY21) focused on countering foreign intelligence threats to DoD and the U.S. government as a whole # Integrating disparate and emerging technologies to enhance collaboration, interoperability, and the collective capabilities of DoD and Federal LE/CI, cybersecurity, and acquisition communities # Providing focused oversight and integration with the LE/CI and intelligence communities through liaison officers and embeds with: #* Air Force Life Cycle Management Center (AFLCMC) #* Army Military Intelligence #* U.S. Cyber Command #* Defense Counterintelligence and Security Agency (DCSA) #* FBI #* National Cyber Investigative Task Force (NCIJTF)

Vulnerability Disclosure

The mission of the DoD VDP is to function as the single focal point for receiving vulnerability reports and interacting with crowd-sourced cybersecurity researchers supporting the DoDIN.1 This improves network defenses and enhances mission assurance by embracing a previously overlooked, yet indispensable, resource: private-sector white hat researchers. In January 2021, the DoD VDP scope was officially expanded from public-facing websites to all publicly accessible information systems throughout the DoD. This broadens the protection for the DoD attack surface and offers a safe harbor for researchers while providing more asset and technology security. The success of the program relies solely on the expertise and support of the security researcher community, and the program's success contributes to the overall security of the DoD.

References

* {{authority control Information Systems Agency United States Air Force Office of Special Investigations Naval Criminal Investigative Service Cybercrime Computer security organizations Universities and colleges accredited by the Council on Occupational Education