Investigator Methodology | Strategic & Tactical Vs. a Hopeful Change - ShadowDragon.io

Investigator Methodology | Strategic & Tactical Vs. a Hopeful Change

wolf

If the world has a plethora of investigators and the success of prosecutors is hovering around 90% success rate  — why do we struggle with an increase in more complex crime, a rise in international terrorist capability and what seems to be a more brittle and hostile world?

There are probably a million different perspectives and answers to the barrage of these shotgun questions but I want to argue the problem might be how the game is played.  The tension lies between two schools of thought and practice.

 

  1. Hope & Change
  2. Strategic & Tactical

Both approaches will produce good points for the ego, but one will rarely move the needle to produce a game changing outcome.  The jaded, high minded whack-a-mole hope and change perspective is the same as a catch and release program.  It was fun, but doesn’t really change anything nor did one party truly lose.  The pursuit, catch, and release sure felt good though.

Hope And Change

The classic hope and change perspective hinges not only on a once used great marketing slogan, but it is also mixed with a moralistic perspective and practice.  Pushing forward in an investigation will produce results, you will catch bad guys, they will get arrested and the prosecutor’s office will prosecute.  The investigator in this role feels good, he feels justified and many times will be approaching the problem set with a very moralistic black and white perspective.  Black and white moralism isn’t wrong, but I want to argue that the world is a full spectrum color.  Bad guys are master chameleons and discernment is needed not only for capture, but for a 4 dimensional chess game.

Operating in a catch and release mode fueled by hope and change has nearly zero effect on the master adversary you are up against.

 

Rarely does hope affect change, but it feels good saying or believing that hope will affect and produce any change to the larger ecosystem.  If there is no strategic mindset the game will not change.  Whack-a-mole investigations will feed your ego, jade your perspective and plant the seeds and experience that this is the best you can do.

In the movie Sicario, this was illustrated greatly by Emily Blunt playing the character Kate.  Kate was an FBI agent moving through the tactical motions but lacking the game changing strategy needed to affect meaningful change.

Strategic & Tactical

Being strategic and tactical requires you to think about how you want to get home court advantage and how you want to tip the game in your favor for a greater outcome; something that will wound the adversary so they don’t think twice about their next move but react in a manner you can control.

I have been stewing on this issue for a long time in the information security world.

Many people will reference attribution or humbly brag about a “take-down,” but have most take-downs been true game changers?  I’ve always been an outsider on the value of whack-a-mole or take-downs, it may because I had thrown my hat into long term investigations seeing and concluding that the only way to win depends on being laser focused on a strategic outcome.  That outcome will be the strategic outcome that gives more opportunity for exploitation in a very tactical manner.

If you are an investigator, question the outcome.  Remember you being in the game may be another player purposely putting you in as a pawn.  Misguided moralism may blind you to other opportunities and risk.  The game of whack-a-mole is the same as a catch and release program while the tide continues to rise.

Die to your ego for short term successes so you can play a long term strategic win.

Will you move to a target-centric approach in your research with the hope to apply a deeper level of volition into the moves you want to make?

You can’t have the success that will be truly needed if you don’t first map out the outcomes desired. Desired outcomes should be as disruptive as possible or change the game enough so home court advantage can be gained.  When you control the game your success and disruption will skyrocket.  If you are to play the game of whack-a-mole, add some flavor to the outcomes.  Think of how you can control the target physiologically with fear, uncertainty, and doubt further disrupting the trust they have in the ecosystem where they harvest their ill gotten gains.

Destroy the return on investment and the problem will become much more manageable.

 

Disruptive Patterns For Good

Some disruptive patterns that may be considered include:

  • Identify key elements in the target criminal enterprise which may be fundamental building blocks in their success.  Try to remove these pieces from the equation making their normal livelihood difficult. 
  • Call the adversary (or their parents), kindly ask them to stop.  Never underestimate the value of an overly creative imagination.
  • Create an intelligence sharing consortium within your industry, inform the adversary they should stop or else.  Enlighten the adversary with dossier/report.  Once actions move to another industry member share a threat report with that member.  Rinse and repeat.
  • Kindly ask them to stop.

Getting arrests in many of the cases I have worked did not have the goal of an arrest.  Most specifically identified this as a negative outcome, while gravitating more towards a strategic, disruption plan once enough attribution had been gained to take the next steps.

DanielImage

Daniel Clemens

Daniel Clemens is the founder and CEO of both ShadowDragon and Packet Ninjas, a niche cyber security consulting and services company.

With extensive experience in defensive and offensive security, Daniel has been a quiet trailblazer in digital intel gathering long before cyber intelligence became a discipline. More than a decade ago he was inventing and applying his own intelligence tools in support of companies and governments around the world facing urgent threats. Using this deep understanding of web technologies and the behaviors of cybercriminals, he has enhanced, updated and packaged these tools under ShadowDragon.

Daniel is a member of the Odonata Holdings, Inc.
Scroll to Top