CHAPTER 400 - INVESTIGATIONS

**(400)-370** **[Strategic Enforcement Division]{.underline}**

370.1 [Overview.]{.underline}

This section includes the following information regarding SED:

**SED-Cincinnati**

-   Mission

-   UNAX

-   ATLAS

-   Collateral Services

-   Requests for Assistance

**Computer Investigative Support** **Program**

-   Mission

-   Structure

-   CIS Laboratories

-   CIS Duties

-   Computer Related Investigations

-   Requests for Assistance

**System Intrusion Network Attack Response Team**

-   Mission

-   Structure

-   Responsibilities

370.1.1 [Acronyms
Table.](../../acronyms-table/acronyms-table.doc#AcronymsTable)

370.2 [SED-Cincinnati Mission.]{.underline}

SED-Cincinnati located in Cincinnati, Ohio, is a coordinated effort
between auditors, S/A\'s and computer programmers. SED-Cincinnati uses
computer technology, forensic data analysis, and computer matching to
identify potential criminal violations. In addition to forensic database
analysis, SED-Cincinnati also:

-   Provides testimony/evidentiary guidance and advice during
    criminal/administrative proceedings.

-   Advises AUSA's on the evidentiary significance of database analysis
    results.

-   Maintains liaison with other law enforcement agencies and
    professional forensic organizations in order to stay current on the
    latest technological advances and methodologies in computer database
    analysis and reporting.

SED-Cincinnati is assigned the primary responsibility to detect and
investigate suspected unauthorized accesses to, and/or misuse of
taxpayer data. In order to fulfill this mission, SED-Cincinnati develops
proactive programs designed to detect fraud and misuse of IRS computer
data, systems, and operations.

SED-Cincinnati works with other Headquarters' and divisional components
by applying advanced computer analysis techniques to assist
investigative and audit personnel in their assigned duties.

370.3 [UNAX Violations.]{.underline}

A UNAX violation is generally defined as the willful unauthorized access
or inspection of taxpayer records.

26 U.S.C. § 7213A prohibits any federal or state employee from willfully
inspecting any tax return or return information.

18 U.S.C. § 1030(a)(2)(B) prohibits the intentional unauthorized or
exceeding authorized access to any information stored on a
government-owned computer.

Potential UNAX violations are identified through a variety of both
internal, IRS, and external sources. TIGTA personnel may receive reports
of potential UNAX violations from:

-   Internal automated detection systems

-   IRS management

-   IRS employees

-   Taxpayers

-   Tax practitioners

-   Other outside sources.

S/A's and auditors may also develop UNAX allegations during the course
of assigned investigations or audits.

370.3.1 [Reporting Potential]{.underline} [UNAX Violations.]{.underline}
UNAX allegations involving the following employees, regardless of their
source, must be reported as follows:

  --------------------------------- -------------------------------------
  If\...                            Then\...

  A TIGTA employee.                 Report UNAX allegation directly to
                                    the SAC-SIID.

  A GS-15 or above IRS employee.    Report UNAX allegation directly to
                                    the SAC-SIID.

  An IRS employee in the            Report UNAX allegation directly to
  International (US Competent       the SAC-SIID.
  Authority) function and is        
  located in Washington, DC or US   
  embassies abroad.                 

  An IRS employee in the            Report UNAX allegation to the
  International (US Competent       SAC-Jacksonville Field Division.
  Authority) function and is        
  located in Puerto Rico or the US  
  Virgin Islands.                   

  An IRS employee in the            Report UNAX allegation to the SAC-San
  International (US Competent       Francisco Field Division.
  Authority) function and is        
  located in Guam or the American   
  Samoa Islands.                    
  --------------------------------- -------------------------------------

UNAX allegations involving all other IRS employees will be reported
directly to the SAC-Field Division responsible for servicing the duty
station of the subject of the allegation. The SAC-Field Division should
address any jurisdiction questions on a complaint.

370.3.2 [Investigating Potential UNAX Violations.]{.underline} UNAX
allegations within the jurisdiction of SAC-SIID, the SAC-SIID makes a
determination whether to conduct the investigation in SIID or to send
the information to the appropriate SAC-Field Division for investigation.

UNAX allegations within the jurisdiction of a SAC-Field Division, the
SAC-Field Division will determine if the information warrants initiation
of an investigation.

If the UNAX allegation **does** warrant initiating an investigation, the
ASAC will ensure the assigned S/A will, at a minimum:

-   Initiate an investigation using the appropriate UNAX violation code.

-   Prepare a Form OI 7550 using procedures set forth in text [370.6
    of](#RequestForSEDConcinnatiAssistance) this Section and forward the
    form to the DSAC-SED-Cincinnati. SED-Cincinnati will initiate a
    preliminary investigation, conduct the appropriate record checks,
    and refer any credible allegations to the SAC-SIID or SAC-Field
    Division, as appropriate, for further investigation. See
    [Exhibit(400)-370.1](../../400-exhibits/exhibit400-370-1.doc) for a
    sample Form OI 7550.

-   Review pertinent data obtained from SED-Cincinnati analysis.

-   Interview all apparent UNAX victims.

-   Review any IRS Forms 11377 completed by the subject of the
    investigation for investigative leads.

-   Complete all other investigative leads on current as well as former
    employees, witnesses and third parties prior to referral to the AUSA
    for a prosecutive determination even if a "Blanket Declination" is
    available.

-   Ensure that all of the above leads are timely documented on Form OI
    6501.

-   Timely forward the final ROI involving current IRS employees to the
    appropriate IRS office as listed in [Section
    250.12.1](../../400-250/chapter400-250.doc#ReferralOfInvestigationsToIRS)
    of this Chapter. Obtain concurrence from the USA's office to forward
    ROI on investigations pending criminal action.

-   Ensure PARIS timely and accurately reflects the UNAX source codes,
    UNAX violation codes, and the resulting criminal and/or
    administrative disposition codes.

-   If the investigation results in an indictment or information
    involving a violation of Title 18 U.S.C. § 1030(a)(2)(B), Title 26
    U.S.C. § 7213, or Title 26 U.S.C. § 7213A, provide the
    SAC-Operations with the following information:

```{=html}
<!-- -->
```
-   A copy of the indictment or information.

-   Name and address of the clerk of court where the indictment or
    information is filed.

-   Name, SSN, and last known address of the affected taxpayer.

```{=html}
<!-- -->
```
-   SAC-Operations will notify IRS Office of Security and Privacy
    Oversight. As required by law, IRS will notify the affected
    taxpayers of the indictment or information.

If the UNAX allegation **does not** warrant initiating an investigation,
the SAC-SIID or SAC-Field Division will forward the information via
electronic mail to DSAC-SED-Cincinnati, using Form OI 7550.
DSAC-SED-Cincinnati will conduct the appropriate analysis and determine
if the individual's tax information was electronically accessed, and if
the access appears to be for an official business reason. If
SED-Cincinnati's analysis/research **does not** identify an electronic
access and SED determines no further action is required by TIGTA-OI, SED
will document this in the SED-MIS. See [Exhibit(400)
-370.1](../../400-exhibits/exhibit400-370-1.doc) for sample Form OI
7550.

If SED-Cincinnati database analysis/research **does** identify possible
UNAX violations, or other potential violations, SED-Cincinnati will
document this information on a Form OI 2028-M. The Form OI 2028-M will
be forwarded to the S/A who initiated the Form OI 7550. The S/A, with
the concurrence of the ASAC, will initiate an investigation in
accordance with the guidelines listed in this Section.

370.4 [Audit Trail Lead Analysis System.]{.underline}

SED-Cincinnati receives data from ATLAS, which identifies employees who
have made possible unauthorized accesses to taxpayer data.

Potential UNAX violations identified through SED-Cincinnati analysis of
ATLAS data will be referred, via electronic mail, to the SAC-Field
Division responsible for servicing the duty station of the subject of
the allegation. These referrals will contain a Form OI 2028-M that
details the results of SED-Cincinnati's analysis.

The receiving office will:

-   Initiate the appropriate investigation using the appropriate UNAX
    violation code.

-   Conduct an investigation in accordance with the guidelines
    delineated in text [370.3.2](#InvestigatingPotentialUNAXViolations)
    of this Section.

-   Provide the SED-Cincinnati analyst with the case number within 15
    days of receipt.

-   Coordinate directly with the SED-Cincinnati analyst regarding any
    additional analysis or clarification relating to the referral.

370.5 [Collateral Services.]{.underline}

SED-Cincinnati continues to obtain access to electronic data files that
enhance UNAX and fraud detection and/or support field investigative
efforts. The five most frequently requested files available through
SED-Cincinnati include:

-   **Auto Track** -- A database compiled from public records that
    includes name, data of birth, social security number, current
    address, previous addresses, driver's license information, liens,
    judgments, bankruptcies, property ownership, corporate affiliations,
    UCC filings, telephone listings, relatives, associates, and
    neighbors.

-   **BART** -- A GSA application that provides access to AT&T invoice
    data. BART contains data only for calls that generate a charge to
    IRS, such as long distance or government credit card calls. BART
    does not provide data on local calls to 800 numbers, incoming calls,
    or calls charged to an employee's personal calling card.

-   **CAF** -- The CAF contains information regarding the type of
    authorization that taxpayers have given representatives for various
    and specific tax periods. The CAF can be used to determine whether
    an individual claiming to be a representative of a taxpayer is
    authorized to represent or act on the taxpayer's behalf, or to
    receive requested information. CAF requests should be submitted in
    accordance with the guidelines delineated in [Section
    140.11](../../400-140/chapter400-140.doc#CAF) of this Chapter.

-   **Consumer Credit Reports** -- SED-Cincinnati utilizes a third party
    source to obtain consumer reports from Equifax. The request for a
    consumer credit report must be accompanied by a completed Form OI
    2760 that includes the signature of the subject of the report.
    Consumer credit report requests should be submitted in accordance
    with the guidelines delineated in [Section
    60.3](../../400-60/chapter400-60.doc#RestrictionsObtainingConsumerAgencyRepor)
    of this Chapter.

-   **PIF** -- The PIF contains information regarding the listed
    preparer of a taxpayer's individual and/or business tax return. The
    Individual Master file information includes processing year,
    district office, taxpayer TIN, tax return data and some tax return
    dollar amount fields. The Business Master file information includes
    everything in the Individual Master file with the exception of the
    dollar amount fields.

Additional electronic files and records that are available through
SED-Cincinnati are outlined in
[Exhibit(400)-370.2](../../400-exhibits/exhibit400-370-2.doc).

All file requests should be submitted following the guidelines listed in
text [370.6](#RequestForSEDConcinnatiAssistance) of this Section.

370.6 []{#RequestForSEDConcinnatiAssistance .anchor}[Requests for
SED-Cincinnati Assistance.]{.underline}

Use Form OI 7550 to request assistance for:

-   UNAX analysis

-   Refer UNAX leads

-   Data extracts and analysis

S/A's should send Form OI 7550 and any attachments to SED-Cincinnati via
electronic mail communication at
<*tigtasedcintiassistance@tigta.treas.gov>.

If SED-Cincinnati determines that the request does not involve an UNAX
issue, does not require SED-Cincinnati analysis, or could be completed
by the requestor, SED-Cincinnati personnel will work with the requestor
to ensure that they are able to complete the task.

370.7 [Computer Investigative Support Program Mission.]{.underline}

CIS Program includes CIS agents and other professional positions in
TIGTA and the Computer Laboratory. CIS agents are presently located in
Lanham, Maryland, Dallas, Texas, Nashville, Tennessee, and Los Angeles,
California.

The CIS Program is tasked with providing computer investigative support
and advice involving the search/seizure of computers and computer
related media; the processing of seized media; assistance on Internet
related crimes and investigations; and any other computer related issues
deemed appropriate. The CIS Program also:

-   Maintains an investigative computer research and reference facility
    to enhance technical expertise in the investigative use of
    computers.

-   Formulates and conducts computer investigative training for TIGTA
    employees.

The CIS Program provides technical assistance to TIGTA-OI personnel
during investigations. This assistance includes, but is not limited to:

-   Assisting in the development/preparation of search warrants and
    subpoenas regarding the search and seizure of computers, computer
    media and related equipment.

-   Providing on-site support during the execution of any warrants or
    seizures, and during any related subject/witness/third party
    interviews.

-   Providing computer analysis.

-   Testifying on the evidentiary content of seized items as
    needed/necessary.

-   Conducting Internet research.

-   Providing technical assistance and support to TIGTA-OI personnel on
    all investigative matters relating to TIGTA's investigative mission.

370.8 [CIS Program Structure.]{.underline}

The CIS Program is comprised of a DSAC who is located in Lanham,
Maryland, and GS-1811, CIS agents and/or GS-1801, general investigators.
The CIS Group is under the direction of the SAC-SED. Presently, there
are CIS agents assigned to offices in Dallas, Texas, Los Angeles,
California, Lanham, Maryland, and Nashville, Tennessee.

Each CIS agent is provided equipment to be used within their respective
computer laboratories. The SAC-SED maintains a current inventory of all
equipment assigned to that CIS agent.

Evidence provided to a CIS agent or CIS laboratory will be maintained in
accordance with the rules and regulations concerning the maintenance of
evidence as described in Section 190.2 of this Chapter. S/A's should be
familiar with encountering and obtaining electronic evidence. In
addition to consultation with a CIS agent, an S/A can obtain additional
guidance on conducting computer investigations, to include DOJ
guidelines for searching and seizing computers, at
[www.cybercrime.gov](http://www.cybercrime.gov/).

In addition, each CIS agent is required to maintain a record of all
evidence that is brought into his or her laboratory. A record will
contain:

-   A unique 14 character tracking number, identified as follows:

```{=html}
<!-- -->
```
-   The first character will be an alpha character designating the
    location of the specific laboratory: D -- Dallas L - Los Angeles N
    -- Nashville W - Lanham

-   The next 9 characters will be numeric characters, and will reflect
    the case number associated with the evidence submitted for analysis.

-   The last four characters are numeric characters that are numbered
    sequentially by fiscal year for each piece of evidence. For example:

> D xxxxxxxxx 0001
>
> D -- Dallas
>
> xxxxxxxxx -- 9 digit case number
>
> 0001 -- 4 digit sequential number

370.9 [CIS Laboratories.]{.underline}

A national CIS computer laboratory will be maintained in the Washington,
DC area and is presently located in the New Carrollton Federal Building
in Lanham, Maryland. This laboratory will include unique equipment
available to CIS Program personnel on an as-needed basis.

Each CIS agent will maintain a laboratory within his or her POD. Current
technology will determine the equipment needs of each office. Each
laboratory will contain a locked evidence storage area.

370.10 [CIS Agent Duties.]{.underline}

Each CIS agent is responsible for assisting investigative personnel
with:

-   Developing probable cause to seize computer equipment and related
    media

-   Drafting affidavits in support of search warrants

-   Developing intelligence on the computers anticipated to be on-site
    during any such seizures/warrants

-   Briefing the search team on technical and other issues regarding the
    computer to be seized

-   Assisting in related subject and third party interviews

-   Participating in the search warrant

-   Seizing and preserving evidence, computer equipment and media, as
    specified in the search warrant.

-   Providing relevant training to agents in his or her field divisions.

-   Each CIS agent is responsible for following the guidelines of
    forensic examination of electronic evidence.

Each CIS agent is responsible for performing or arranging for the timely
analysis of electronic media brought into their individual laboratories.
The CIS agent performs analysis and at the conclusion of the analysis,
the CIS agent provides a Form OI 7570 to the SAC/DSAC of SED for
review/approval. The approved report will be distributed to the assigned
case agent. See
[Exhibit(400)-370.4](../../400-exhibits/exhibit400-370-4.doc) for a
sample Form OI 7570.

Each CIS agent may conduct Internet related research for on-going
investigations for TIGTA personnel. The CIS agent will prepare a Form OI
2028-M regarding any research conducted.

When a TIGTA office becomes aware of electronic harassment or Internet
related threats directed against the IRS or one of its employees, SED
assistance should be requested as soon as possible. Once SED is
notified, the SAC or DSAC-SED will assign a CIS agent to act as a
technical advisor to assist the assigned TIGTA office during an
investigation.

Each CIS agent serves as a technical computer advisor to the TIGTA-OI
offices located within their area of responsibility. Currently, CIS
agent locations and areas of responsibility are:

CIS S/A in Los Angeles

> Los Angeles Field Division
>
> San Francisco Field Division

CIS S/A in Nashville

> Atlanta Field Division
>
> Cincinnati Field Division
>
> Jacksonville Field Division

CIS S/A in Dallas

> Dallas Field Division
>
> Denver Field Division
>
> Chicago Field Division

CIS S/A in Washington DC

> Boston Field Division
>
> New York Field Division
>
> Philadelphia Field Division
>
> Washington Field Division

370.11 [Computer Related Investigations.]{.underline}

The CIS Program provides support and assistance as follows:

-   Computer seizures

-   Computer analysis

-   Computer harassment/threat cases

-   Internet research

In any investigation involving a computer, the CIS agent should be
consulted early in the investigation to discuss possible computer
related issues and available assistance.

It is important to note that:

-   The success of any data recovery/analysis and resulting potential
    prosecution is dependent on the actions of the individual who
    initially discovers a computer incident.

-   The ideal situation when confronted with such a circumstance is to
    isolate the suspect computer from additional use or possible
    tampering. The entire workstation or office is a potential crime
    scene, not just the computer itself. All computer equipment should
    be handled with care.

-   In the event of a suspected computer incident, care must be taken to
    preserve evidence in its original state. Merely opening a file on a
    computer/system changes it. Once the file is changed, it is not
    original evidence, and may be inadmissible in any subsequent
    proceedings. Opening a file also alters the computer generated time
    and date showing when the file was last accessed/created, and could
    make it more difficult to determine who committed the violation or
    even when it occurred.

-   Computer disks, CD-ROMs, tape storage media, and additional hard
    drives found in the area of the suspect computer need to be
    protected and isolated. Do not allow anyone access to the storage
    media or the computer involved as individuals with extensive
    computer knowledge can develop programs that, with a few keystrokes,
    will destroy all magnetic data on a hard drive.

-   The initial responder may be called to testify concerning measures
    that were taken during the initial computer/system shutdown or
    isolation. The S/A should take detailed notes, photographs,
    sketches, and video recordings during the scene processing. This
    will also help to ensure the appropriate evidentiary chain of
    custody.

-   The initial responder to a situation should secure the scene and
    immediately contact a CIS agent for further guidance and assistance.

-   Initial interviews of potential witnesses and/or suspects may be
    enhanced by consultation with a CIS agent.

370.12 [Procedures for Requesting CIS Program Support.]{.underline}

Use Form OI 7560 to request CIS Program assistance. Requests should be
forwarded via electronic mail communications to [\*TIGTA Inv SED
SINART-CIS
Assistance@tigta.treas.gov](mailto:*TIGTA INV SED SINART-CIS Assistance?subject=Request for CIS Assistance).
The SAC or DSAC-SED will coordinate the assignment of each request to
the appropriate CIS agent. See
[Exhibit(400)-370.3](../../400-exhibits/exhibit400-370-3.doc) for sample
Form OI 7560.

An S/A who is assigned an investigation relative to electronic media,
computers, hand-held computing devices (PDA's), fax machines, wizards,
etc., should request CIS assistance as soon as possible. Early CIS
involvement will:

-   Ensure a proper legal basis for any subsequent seizure.

-   Ensure the proper seizure of electronic media.

-   Ensure the proper processing/documentation of original evidence.

All emergency contacts and requests should be followed-up with a Form OI
7560 along with all pertinent documentation to the [\*TIGTA Inv SED
SINART-CIS
Assistance](mailto:*TIGTA INV SED SINART-CIS Assistance?subject=Request for CIS Assistance)
mailbox within 24 hours. The assigned S/A should prepare the Form OI
7560. The Form should include, at a minimum:

-   The date the Form OI 7560 is submitted.

-   The name of the assigned S/A's SAC or ASAC, his/her telephone
    number.

-   The assigned S/A's name, office telephone number, cellular or pager
    number and office location.

-   The case title and the complaint or case number.

-   Describe the type of investigation or any other pertinent
    information

-   Describe any evidence/items submitted for forensic examination.

-   Describe the type of support or assistance requested.

-   Describe the goal/intent of the request.

-   Indicate the anticipated date of a search warrant or the date a
    forensic examination is needed.

-   

-   

-   

Once the request for CIS assistance has been approved, the assigned S/A
should ensure that the CIS agent is part of the investigation \"team\"
as it relates to:

-   Providing critical information to the development of an
    investigative plan. The CIS agent provides input that may impact
    legal issues, decisions to seize or copy evidence, and the
    acquisition of additional support, equipment and supplies.

-   Determining, in coordination with the SAC or DSAC-SED and the
    assigned S/A, the equipment and the number of additional CIS agents
    needed to conduct the search warrant. The decision as to the
    equipment and number of S/A's will be based upon:

```{=html}
<!-- -->
```
-   The number of computers involved.

-   The type of computers involved.

-   The location of the computers within the overall search site.

-   The type, topology and operating system of any computer network
    involved.

-   The size and nature of date storage media, and the existence of any
    \"back-up\" media.

-   The level of cooperation expected from the computer owner and their
    degree of sophistication.

-   Any remote connectivity issues.

-   The type of software involved.

-   The nature of any computer security, passwords or encryption in
    place.

```{=html}
<!-- -->
```
-   The CIS agent should be available to the AUSA to discuss the
    computer aspects of the search warrant.

During the course of a computer examination, the CIS agent will be in
contact with the assigned S/A to discuss the findings and determine if
there are any additional leads or evidence requiring attention.

If there are no additional requests concerning the examination, the CIS
agent will prepare and submit a report of findings utilizing Form OI
7570 to the SAC or DSAC SED for review. The approved report will be
forwarded to the assigned S/A, through his/her SAC or ASAC. See
[Exhibit(400)-370.4](../../400-exhibits/exhibit400-370-4.doc) for a
sample Form OI 7570.

13. [SINART Mission]{.underline}

SINART was formed to ensure an effective computer incidence prevention
and response capability for all IRS and TIGTA information systems,
hardware, telecommunications, networks, Internet sites, and
vendor-supplied software products. SINART is a co-operative initiative
between the IRS and the TIGTA. Working closely with IRS Computer
Security Incident Response Center (CSIRC), SINART's mission is to
promote the security and integrity of all IRS computer systems by
providing technical support and conducting criminal investigations.
Mission essentials include:

-   Adding to the capability within the IRS to monitor systems without
    interfering with operations to identify vulnerabilities.

-   Reporting, documenting and tracking all suspected incident
    investigations.

-   Assist with the identification of appropriate response strategies.

-   Supporting a joint operation with IRS that acts as a central point
    for reporting and analysis, sharing response efforts, and providing
    investigative support, as appropriate.

    13. [SINART Structure.]{.underline}

The SINART is comprised of a DSAC who is located in Lanham, Maryland,
and GS-1811, Special Agents and GS-334, Computer Specialist. The SINART
group is under the direction of the SAC-SED.

1.  [SINART Services.]{.underline}

Primary services provided by SINART include:

-   Network incident response and incident analysis.

-   Assist AUSA/case agents with prosecution of complex network
    investigations.

-   Preserve electronic evidence "chain of custody".

-   Provide technical advice regarding obtaining Court Orders, Search
    Warrants and Subpoenas associated with network investigations.

-   Conduct/assist with interviews relative to network related
    investigations.

-   Education and training

-   Electronic intelligence collection concerning network vulnerability.

-   Vulnerability identification.

-   Research and development.

-   Recommendations for improvements and system enhancements.

    13. [IRS CSIRC Responsibilities.]{.underline}

The CSIRC is responsible for initiating and leading the first response
to suspicious incidents. They determine and deploy the appropriate
safeguards for the IRS Enterprise network. They monitor the security
over internal and external system connections and report all incidents
and /or suspected attacks to the SINART.

14. [SINART Responsibilities.]{.underline}

The SINART is responsible for the identification and investigation of
all incidents or alleged incidents of attacks or intrusions against the
IRS computer network. The SINART recommends preventive, recovery, or
mitigation strategies for internal or external vulnerabilities or
attacks. The SINART also provides expert advise for network security
issues and for proposed network security procurements.

17. [Requesting SINART Assistance]{.underline}.

In order to meet SINART's mission of promoting the security and
integrity of all IRS and TIGTA computer systems, all incidents or
alleged incidents should be reported to the SINART as soon as possible
so appropriate action can be taken. SED has implemented a duty agent
schedule and a reporting process to insure that assistance and support
are provided in a timely and effective manner. This process is to be
utilized by all internal and external sources of referrals.

1.  [Request emergency assistance.]{.underline}

To report an incident or an event to the SINART or to contact an agent
immediately regarding a possible computer event or intrusion call the
SINART duty pager: **877-749-7204** and leave a number where you can be
contacted.

All emergency contacts and requests should be followed-up with a Form OI
7560 along with all pertinent documentation to the [\*TIGTA Inv SED
SINART-CIS
Assistance](mailto:*TIGTA INV SED SINART-CIS Assistance?subject=Request for SINART Assistance)
mailbox within 24 hours.

2.  [Request non-emergency assistance or support.]{.underline}

To request non-emergency SINART support you should e-mail a completed
Form OI 7560 to the [\*TIGTA Inv SED SINART-CIS
Assistance](mailto:*TIGTA INV SED SINART-CIS Assistance?subject=Request for SINART Assistance)
mailbox. Please provide, as much information as you can, including any
pertinent documents, as this will help determine an appropriate level of
action needed to be taken by the SINART.

> Exhibit(400)-370.1 [TIGTA Form 7550 UNAX Referral/Request for Database
> Analysis/Assistance](../../400-exhibits/exhibit400-370-1.doc)
>
> Exhibit(400)-370.2 [Investigative Data Sources Available through
> SED](../../400-exhibits/exhibit400-370-2.doc)
>
> Exhibit(400)-370.3 [TIGTA Form 7560, Request for CIS/SINART
> Support](../../400-exhibits/exhibit400-370-3.doc)

Exhibit(400)-370.4 [TIGTA Form 7570, Computer Evidence Recovery
Report](../../400-exhibits/exhibit400-370-4.doc)