FBI needs better data on cyber crime victims

The FBI is tasked with notifying cyber crime victims and ensuring they understand their rights with regard to cooperation with ongoing investigations. But that duty is complicated by poor data and other flaws in the Cyber Guardian system the FBI uses to track victim information, according to a watchdog report.

A redacted report from the Justice Department Office of Inspector General found data issues ranging from typos to problems obtaining notifications for victims in cases that are restricted for security reasons. Data was entered differently or inconsistently by agents and investigators, contributing to the poor data quality, it said.

The errors and inconsistencies, the report said, made it extremely hard to tell if all the victims of cyber intrusions were being notified. That is particularly important, according to the IG, because many victims of cyber intrusions are unaware their systems have been infiltrated by criminals.

The FBI's partner agency in Cyber Guardian, the Department of Homeland Security, contributed to the problem, according to the IG. DHS "was not entering information into the system as required."

The Cyber Guardian system is due to be replaced in 2019, and according to auditors there aspects of the new system -- dubbed CyNERGY -- that represent an improvement. However, some flaws appear to persist in the new system, including a lack of automation and problems accessing restricted data.

More generally, the auditors observed that notification standards and data collection varied across field offices, even within FBI's Cyber Division operations. The IG is recommending that the FBI create a new minimum standard for information that is collected when investigating a cyber crime in order to facilitate subsequent notifications by agents.

The report contained 12 recommendations for the FBI and one for DOJ. The FBI concurred with all the recommendations, which focused on structuring data fields in its systems, improving timeliness of notifications and adding clarity to certain definitions, including what entity or person can be considered a victim of cyber crime.

DOJ did not entirely concur with a recommendation that it update witness assistance guidelines because it objected to language used by auditors as "imprecise or unclear," according to Associate Deputy Attorney General Bradley Weinsheimer. However the DOJ indicated that it will consider updating those guidelines to take into consideration "the nuances of identifying cyber victims."