The New Detectives

Several days a week, computer science majors Lila Masand and Max Sonderegger take time out from their coursework and their social lives to help solve crimes. Masand and Sonderegger aren’t secret private eyes. They’re interns working as digital forensics examiners with the Massachusetts Attorney General Office’s Digital Evidence Lab (DEL). 

The Digital Evidence Lab internship is an innovative collaboration of the UMass Cybersecurity Institute at UMass Amherst’s Manning College of Information and Computer Sciences, the Massachusetts Office of the Attorney General (AGO), and the Office of the Northwestern District Attorney (DA). This unusual on-campus internship with an external organization is one of only a few programs of its sort in the country. 

The DEL is part of an AGO statewide unit that assists with digital forensics: the collection and analysis of electronics, primarily cell phones, computers, and videos. Their work has become crucial in recent years. “Digital evidence is the most important evidence we’ve ever seen in criminal investigations, because every single case has some digital component,” explains Christopher Kelly, the lab’s director. While DNA is powerful evidence, it is only available in a small number of cases, and it only really tells investigators who may have been involved. 

“Digital evidence gives us the who, what, why, where, when, how,” says Kelly. “And very importantly, it also gives us who’s responsible, and who isn’t responsible. It has an equal opportunity to exonerate people, so our ability to do this right is a justice issue.” 

Given the ubiquity of digital evidence, the demand for talented forensic investigators is extremely high, but thanks to COVID-19 and retirements, the DEL has a shortage of these specialists. Internships have been a key strategy for building the lab’s team of investigators, allowing them to train new staff while they are still students. According to Kelly, it takes two to three years for a new hire to become an excellent forensic investigator. When they bring in interns, they can start training them early, and if hired into a full-time position, they progress much more quickly. 

"They’re brilliant. They’re well trained, they’re passionate, they work hard. They really seem to love what they’re doing. They ask questions, they want to make sure that they’re getting it right.” —Andrew Covington 

Building a Public Service Pipeline 

UMass undergraduate and graduate students selected for the Cybersecurity Institute’s CyberCorps Scholarship for Service (SFS) program receive up to three years of tuition, fees, and additional financial support as they prepare for careers in cybersecurity. Now in its eighth year at UMass Amherst, the program is funded by the National Science Foundation (NSF) to build a strong cohort of experts in federal agencies who can help protect the country’s computing networks and infrastructure. 

In addition to financial support, the students benefit from a rigorous curriculum, personalized professional development, interdisciplinary enrichment, and unique research opportunities. During summers, SFS students intern at federal agencies. Once they complete their degrees, they work in cybersecurity roles in the federal government for a length of time equivalent to the length of their scholarship. Recent graduates have accepted permanent or internship positions at the Air Force at Hanscom, the National Security Agency, MITRE, the Institute for Defense Analyses, and Los Alamos National Laboratory, among other federal agencies. 

Bringing the Digital Evidence Lab to UMass Amherst 

The DEL has had a successful internship program, but Kelly hadn’t been able to draw on the talented pool of UMass computer science students studying forensics, security, and privacy because the distance from Amherst to Boston prevented long-term commitments. His solution: work with Cybersecurity Institute director Brian Levine to create a lab on the UMass Amherst campus, allowing students to intern throughout the academic year. 

The AGO has had a long working relationship with Levine and the Cybersecurity Institute, which prioritizes projects and courses that help society by increasing privacy, protecting personal information, thwarting exploitation of the vulnerable, and increasing access to the internet. Levine’s research and teaching, in particular, focus on security in the context of the internet and mobile systems, addressing child rescue, privacy, blockchains, cellular networks, and peer-to-peer networking. Investigators using tools developed by Levine’s team have rescued hundreds of children from sexually abusive situations and their searchable website, the App Danger Project, helps parents determine the safety of particular social media apps. 

The internship Kelly and Levine developed together is a true win-win-win project, expanding the pool of digital investigators, giving law enforcement agencies in the western part of the state better access to forensic resources, and giving students career-making opportunities. Further, as Levine notes, it expands the public service efforts of the Cybersecurity Institute. “This gives them experience before they graduate of working towards a better society. And that may influence what they do after graduation, whether they work in federal or state government or with a nonprofit.” 

The first group of UMass Amherst interns began at the DEL in September of 2022. In addition to Masand and Sonderegger, they include Jeremy Dunn, Elyse Dotsie, Alyssa Lanter, Ethan Ritchie, Itir Sayar, and Gregory Turnberg. All are computer science majors, with the exception of Dotsie, who is majoring in electrical and computer engineering. They work eight to ten hours a week and the positions are paid. Working with the interns is Sahil Sharma ’21MS, a research fellow who serves in a supervisory position. 

Masand, a recent graduate from Wayland, MA, decided to pursue the internship to broaden her knowledge in the field. “I’ve mainly been interested in software development, but there is a gap in my knowledge of hardware in cybersecurity that I’ve wanted to round out because I just love computer science. I was shocked that something like that was being offered—an on-campus internship,” she says. 

Sonderegger, a senior from Boston, has had a long-standing commitment to public service. “I saw this opportunity to use my skills as a computer scientist for public good and I jumped at the chance,” he explains. “I have thoroughly enjoyed every day being able to go in and know that the work I’m doing is actually making a difference.” Sonderegger is also part of the CICS CyberCorps Scholarship for Service (SFS) program, which provides financial support to students preparing for careers in cybersecurity (see sidebar). 

Comprehensive Training and In-Depth Forensic Experience 

The DEL interns receive extensive training before beginning their work. They are certified in the practices of the lab, learning the technical skills they’ll need to examine evidence. They also receive comprehensive legal training, so they understand the law of search and seizure of digital evidence, as well as the criminal justice case process. In the lab, interns are supervised by law enforcement analysts, who are ultimately responsible for their work, including Kelly and Andrew Covington, an assistant DA with the Northwestern District Attorney’s Office, who serves as their liaison with the lab. 

The interns work on criminal cases, including drug trafficking, breaking and entering, armed robberies, and homicides. On a day-to-day basis, this involves looking through phones and computers and properly acquiring evidence from them, which may be photos, emails, texts, video, social media posts, etc. “When we first get a phone, we have to read the search warrant to make sure we know what we’re allowed to search for—just like when police are searching a house, they have to know what they’re allowed to take,” Masand explains. “After that, we are using forensic software to look through the contents of the phone and mark or tag anything that has been listed in the search warrant.” Sonderegger adds that they’ve been trained to collect evidence in a way that preserves what’s on the device without disrupting anything. 

The AGO and DA staff working with the interns have been thrilled with their work. “They’re brilliant. They really seem to love what they’re doing. They ask questions, they want to make sure that they’re getting it right,” Covington affirms. “They’ve been absolute assets to the digital evidence lab, and they’re helping solve very complicated, difficult cases.” 

A Game Changer for Students and for the Commonwealth 

It’s already clear to Levine and the students that their work will give them a significant advantage in the job market when they graduate. “Having this much experience on your resume really sets you apart.” Sonderegger agreed— employers he has spoken with were impressed with his knowledge and skills and surprised at how much experience he’s already had as an undergraduate. 

The benefits of this internship to the participating agencies and the commonwealth as a whole are also significant. As Kelly anticipated, the internship has expanded the DEL’s capacity to examine evidence, shortening the time victims have to wait for justice, and accused perpetrators have to wait for a trial or for exoneration. 

Less than a year into the program, its success is clear to everyone involved. “I’m just absolutely thrilled. It’s a game changer for the Northwest District Attorney’s Office. Our entire office is ecstatic about the program and the progression of it in just a few short months,” says Covington. Kelly agrees: “We’re really doing something unique within this space. It’s been a little bit of a risk, but it’s paid off significantly in a very short time.” 

Looking ahead 

Going forward, if they are able to secure enough funding for the long term, the internship’s organizers hope to expand the number of students, eventually having 20 interns at any given time. “We’re looking to create a tiered system where you have students who have been doing it for a semester or two helping to mentor students who have just joined. Ideally, this would really be a two year process,” explains Levine. 

Kelly is hopeful that the success of the internship model will also lead to further collaborations and that they’ll have more opportunities to draw on the talents of UMass students. “It’s been a great experiment. We’re looking forward to all of the future opportunities we’re going to have with UMass and other stakeholders to try to solve this big problem.” 

Dean Laura Haas, Professor Brian Levine, and interns host Massachusetts Attorney General Andrea Campbell for a discussion and tour of the Digital Evidence Lab on March 6.