Exploring Cybercrime Capabilities: Variations Among Cybercrime Investigative Units

• Published date: 01 August 2024
• DOI: http://doi.org/10.1177/08874034241265106
• Author: Kevin F. Steinmetz,Brian P. Schaefer,Adrienne L. McCarthy,Christopher G. Brewer,Don L. Kurtz
• Date: 01 August 2024

https://doi.org/10.1177/08874034241265106

Criminal Justice Policy Review

2024, Vol. 35(4) 194 –215

© The Author(s) 2024

Article reuse guidelines:

sagepub.com/journals-permissions

DOI: 10.1177/08874034241265106

journals.sagepub.com/home/cjp

Article

Exploring Cybercrime

Capabilities: Variations

Among Cybercrime

Investigative Units

Kevin F. Steinmetz1, Brian P. Schaefer2,

Adrienne L. McCarthy1, Christopher G. Brewer3,

and Don L. Kurtz1

Abstract

The current analysis utilizes semi-structured qualitative interviews with sworn

cybercrime detectives, civilian digital forensics analysts, and unit administrators to

consider variations between cybercrime units which bear significant implications for

cybercrime investigative policy and practice. The first variation observed in this study

concerns differences in the structure of digital forensics assignments. Such duties

may be assigned to sworn officers, civilians, sworn officers and civilian, outsourced

to other departments, or a dedicated forensic lab. Second, variations between units

were noted in resource availability (tools, training, and finances). These variations

among cybercrime units may have implications for personnel recruitment and

retention, the sophistication of cases considered by investigators, and case success.

Keywords

cybercrime investigations, policing, cybercrime, inter-unit differences

In recent decades, police departments have steadily adopted specialized personnel and

units to grapple with technology-mediated crimes including what are commonly

1Kansas State University, Manhattan, USA

2University of Louisville, KY, USA

3Illinois State University, Normal, USA

Corresponding Author:

Kevin F. Steinmetz, Department of Sociology, Anthropology and Social Work, Kansas State University,

204 Waters Hall, 1603 Old Claflin Place, Manhattan, KS 66506, USA.

Email: kfsteinmetz@ksu.edu

1265106CJPXXX10.1177/08874034241265106Criminal Justice Policy ReviewSteinmetz et al.

research-article2024

Steinmetz et al. 195

known as “cybercrimes.” According to the United States Bureau of Justice Statistics,

in 2016 approximately 2,500 of the 12,261 U.S. police departments had personnel

dedicated to cybercrime investigations (20%) while 480 have specialized cybercrime

units (4%) (Hyland & Davis, 2019).1 Among the 313 departments serving over 100,000

residents, 78% had specialized personnel and 46% had specialized cybercrime units.2

The Office of Juvenile Justice and Delinquency Prevention’s (OJJDP) Internet Crimes

Against Children (ICAC) Task Force Program, one of the largest cybercrime task

force programs in the United States, claims that their task forces involve over 5,400

U.S. law enforcement agencies at federal, state, and local levels.3 These figures indi-

cate that a significant proportion of U.S. law enforcement agencies are developing

cybercrime investigative capabilities of one kind or another.

Amid these hundreds of units and thousands of personnel, there is no one-size-fits-

all approach to unit organization and operation. Despite recent strides in cybercrime

policing scholarship, few studies have scrutinized variations between cybercrime

units. Just as there can be significant variations between police departments regarding

characteristics like culture, operational approaches, political circumstances, and

financing (e.g., Hassell et al., 2003; Maguire & King, 2020; Paoline, 2003), there also

exist important distinctions between specialized units—distinctions which may impact

staffing, available expertise, resourcing, strategies employed, clearance rates, and

other factors related to investigative operations and administration (e.g., Crank &

Langworthy, 1992; Maguire, 1997). Since cybercrime investigations will only become

more central for law enforcement agencies in the coming years, there is a need to

highlight potentially significant points of difference between units and how these vari-

ations may impact unit development, management, recruitment, and retention.

Identification of such variations is necessary to inform future research on cybercrime

policing.

The current analysis utilizes semi-structured qualitative interviews with sworn

cybercrime detectives, civilian digital forensics analysts, and unit administrators gath-

ered as part of a National Science Foundation-funded study of cybercrime units

(Award No. 1916284) to consider potentially significant variations among cybercrime

units. The results of this analysis constitute a story told in two parts. First, this study

considers the assignment of digital forensics responsibilities within units which

appears to be a significant determinant of unit organization and operations. This study

traces five general models for the organization of digital forensics responsibilities

among cybercrime units and their potential correlations with agency size and invest-

ments in cybercrime capabilities. The implications of these models for recruitment and

retention, caseloads, case success, and sunk costs are considered. Second, this analysis

considers the role of resource inequities evinced among studied cybercrime units.

These include perceived deficits in access to tools (hardware or software), cybercrime

investigative or digital forensics trainings, and—at the root of these deficits—financial

resources. Before describing the results of this analysis, however, a review of the

cybercrime investigations literature is provided. A description of the data gathering

and analytic methods used in this study is as follows.