Detective David Roach

1
Cooperative Investigations Internal Audit and
University Police
Detective David Roach University of Virginia
Police Department Brian Daniels, CISA, GCFA IT
Audit Manager
2
Internal Audit

• 17 professional Faculty and Staff
• Health System Team
• University Team
• IT Team
• Operational Audits
• UVA Policy and Procedure Violations
• State and Departmental Hotline Calls

3
UVA Police Department

• The average daily population served is 40,000
  including students, faculty, staff, and visitors.
  
• Its statutory arrest jurisdiction included the
  property of the University as well as streets and
  sidewalks adjacent to the property.
• Participates in a mutual aid agreement with the
  city of Charlottesville which gives jurisdiction
  in much of the city area surrounding the
  University.

4
UVA Police Department

• The UVa. Police Department consists of over 130
  employees including sworn Police Officers,
  Community Service Officers, and Administrative
  Personnel.
• 70 Sworn Officers
• 4 detectives

5
Wireless Laptop Recovery

• Using University Network Registration System to
  track down a stolen laptop
• All computers at UVA and UVA Health System must
  be registered to access the Internet or the
  network.
• Registration is based on unique MAC address from
  network card, and is then assigned to a user.
• When UVA PD gets a report of a stolen laptop, it
  is logged into PD reporting system, along with
  the user ID and name and computer description.

6
Wireless Laptop Recovery

• Once we are notified by UVA PD, we are able to
  look up the machine in the system based on the
  user id, whether they are student or employee or
  guest.
• Do run in to some trouble occasionally when the
  machines stolen have been registered by Tech
  Support Personnel. Adds an extra step to track
  them down.
• Also with multiple registrations, contact usually
  needs to be made with the individuals to
  determine which machine was stolen. Sometimes the
  users will have had several Black Dell Laptops
  in the system over the years.

7
Wireless Laptop Recovery

• If the machine that is reported stolen is showing
  up as active in the system, then we are on to
  something.
• In one case, we found a machine that regularly
  showed up in the system.
• We watched it for a couple of days, and then a
  couple of weeks due to its regular return to the
  network. We were able to chart the access and it
  ended up looking an awful lot like a class
  schedule.hmmmm.

8
Wireless Laptop Recovery

• We were able to identify which Wireless Access
  Point was being hit based upon system
  descriptions.
• We were able to find exactly one student whos
  class schedule matched the pattern set forth by
  the wireless access. This level of access was
  approved by General Counsel as legitimate use of
  FERPA information.
• Once this information was known, Detective Roach
  was able to obtain a photo from the DMV of the
  individual.

9
Wireless Laptop Recovery

• Detective Roach met with us to formulate a plan
  for recovery of the device.
• He went over in the middle of one of the blocks
  of time to the room that was identified in the
  system as having an AP nearby.
• Sure enough, the individual he had the picture
  for also had a laptop matching the description in
  the system.
• He brought it back to the office for a review by
  us to match up the MAC Address. It of course
  did, and we had ourselves a recovery.

10
Wireless Laptop Recovery

• And then there was court
• Proof positive that anything goes in the court
  room.
• First of all, Detective Roach and the Prosecutor
  requested that I testify in court for the
  prosecution as to the process by which we
  recovered the machine.
• I testified at the preliminary hearing that was
  to decide whether or not the case had enough to
  go to trial.

11
Wireless Laptop Recovery

• At the actual criminal trial
• Sequestered
• Called to the stand
• Prosecution moved to certify me as an expert
  witness in Virginia Circuit Court
• Judge asked for opposition from defense, there
  was none
• Then I testified about how we recovered the
  machine

12
Wireless Laptop Recovery

• Details from testimony
• The defendant was found with the machine.
• Defense was that the machine was purchased from
  some guy in a stairwell somewhere.
• Also, character witnesses testified that the
  defendant stated a need to purchase a computer.
• And

13
Wireless Laptop Recovery

• The Jury returned a unanimous decision that of
  course the defendant did not steal it.
• This underscores the fact that even when you do
  everything right from a procedural perspective,
  there is a lot of wiggle room in the context of
  reasonable doubt and the human element of a
  jury is very powerful.
• Detective Roach, Thoughts?

14
Serving a Search Warrant

• A domestic complaint led to the fact that there
  may be a number of University Resources that
  walked off with a tech support employee charged
  with repairing PCs.
• Specifics of the report led to Audit being
  involved along with UVA PD and outside
  jurisdictions for serving a search warrant and
  any potential recovery.
• Audit was involved because of the ability to
  again identify devices registered in the system
  in case they were not UVA equipment.

15
Serving a Search Warrant

• So Audit and UVA PD and another couple of police
  departments coordinated the search and seizure.
  There ended up being a number of computers as
  well as boxes of peripherals such as mice,
  keyboards, cables, toner, etc.
• Dave, Thoughts?

16
Tracking down stolen machines outside the
University

• Have worked with municipalities and school
  districts locally, but successfully with another
  to track down a stolen laptop through ours and
  their network registration system.
• We simply went through the process of identifying
  the MAC Address of the stolen device and supplied
  it to Detective Roach

17
Tracking down stolen machines outside the
University

• Detective Roach then did.

18
Further Discussion on the Process

• UVA PD can rely on Internal Audits forensic
  expertise in some areas rather than relying on
  the State Police due to the time required to
  process evidence through the State. The volume
  they have is obviously very large.
• Sometimes it works, sometimes there are no
  helpful results, but coordination among the
  departments has significantly helped the
  University run more efficiently.

19
Questions???

• Detective David Roach, UVA PD -
  dlr4d_at_virginia.edu
• Brian Daniels, IT Audit Manager
  bdaniels_at_virginia.edu