CHAPTER 400 - INVESTIGATIONS

**(400)-370** **[Strategic Enforcement Division]{.underline}**

370.1 [Overview.]{.underline}

This Section includes the following information regarding TIGTA Office
of Investigations (OI), Strategic Enforcement Division (SED):

**SED-Cincinnati**

-   [SED-Cincinnati Mission](#SEDCincinnatiMission)

-   [UNAX Violations](#UNAXViolations)

-   [Proactive UNAX Development: Security Audit and Analysis
    System](#ProactiveUNAXDevelopmentSAAS)

-   [Collateral Services from SED-Cincinnati](#CollateralServices)

-   [Requests for SED-Cincinnati
    Assistance](#RequestForSEDConcinnatiAssistance)

**Computer Investigative Support Program**

-   [Computer Investigative Support Program Mission](#CISProgramMission)

-   [CIS Program Structure](#CISProgramStructure)

-   [CIS Program Special Agent Duties](#CISProgramSADuties)

-   [Requesting CIS Program Support](#RequestingCISProgramSupport)

-   [Submitting Items for CIS Examination](#SubmittingItemsCISExam)

-   [Computer Related Investigations](#ComputerRelatedInvestigations)

-   [External Agency Assistance](#ExternalAgencyAssistance)

**System Intrusion Network Attack Response Team**

-   [System Intrusion Network Attack Response Team
    Mission](#SINARTMission)

-   [SINART Structure and Services](#SINARTStructure)

-   [Requesting SINART Assistance](#RequestingSINARTAssistance)

370.1.1 [Acronyms
Table.](http://web.tigta.treas.gov/IMDS/chapter400-inv/acronyms-table/acronyms-table.doc#AcronymsTable)

370.2 []{#SEDCincinnatiMission .anchor}[SED-Cincinnati
Mission.]{.underline}

SED-Cincinnati, located in Cincinnati, Ohio, is a coordinated effort
between forensic data analysts, SAs and computer programmers who provide
pro-active investigative referrals to TIGTA divisions and assistance to
SAs in their investigations. SED-Cincinnati uses computer technology,
forensic data analysis, and other techniques to identify potential
criminal violations.

SED-Cincinnati is assigned the responsibility to detect and investigate
suspected unauthorized accesses (UNAX) to, and/or misuse of taxpayer
data. In order to fulfill this mission, SED-Cincinnati develops
proactive programs designed to detect fraud and misuse of Internal
Revenue Service (IRS) computer data, systems, and operations.

In addition to forensic database analysis, SED-Cincinnati is also
responsible for the following:

-   Providing testimony/evidentiary guidance and advice during criminal
    and

> administrative proceedings;

-   Advising Assistant U.S. Attorneys (AUSA) on the evidentiary
    significance of database analysis results;

-   Maintaining liaison with other law enforcement agencies and
    professional forensic organizations in order to stay current on the
    latest technological advances and methodologies in computer database
    analysis and reporting;

-   Initiating proactive investigative initiatives from information
    developed during successful investigations or UNAX analysis;

-   Maintaining unassigned fictitious identities/entity social security
    numbers;

-   Preparing TIGTA's annual report to the Treasury Data Integrity Board
    concerning TIGTA's matching activities; and

-   Providing SAs with investigative support concerning the retrieval
    and manipulation of IRS computerized data.

370.3 []{#UNAXViolations .anchor}[UNAX Violations.]{.underline}

The following statutes criminalize the unauthorized access to Federal
Government records and information:

[26 U.S.C. §
7213A](http://assembler.law.cornell.edu/uscode/html/uscode26/usc_sec_26_00007213---A000-.html)
prohibits any Federal, State or other employee or persons from
[willfully]{.underline} inspecting any tax return or return information
without authorization.

[18 U.S.C. §
1030(a)(2)(B)](http://assembler.law.cornell.edu/uscode/html/uscode18/usc_sec_18_00001030----000-.html)
prohibits the [intentional]{.underline} access to a computer without
authorization or exceeds authorized access and obtains information from
a Federal Government department or agency.

370.3.1 [Reporting Potential UNAX Violations.]{.underline} UNAX
allegations involving the following employees, regardless of their
source, must be reported as follows:

  --------------------------------- -------------------------------------
  If\...                            Then\...

  A TIGTA employee.                 Report UNAX allegation directly to
                                    the Special Agent-in-Charge
                                    (SAC)-Special Inquiries and
                                    Intelligence Division (SIID).

  A GS-15 or above IRS employee.    Report UNAX allegation directly to
                                    the SAC-SIID.

  An IRS employee in the            Report UNAX allegation directly to
  International (U.S. Competent     the SAC-SIID.
  Authority) function and is        
  located in Washington, DC or U.S. 
  embassies abroad.                 

  An IRS employee in the            Report UNAX allegation to the
  International (U.S. Competent     SAC-Atlanta Field Division.
  Authority) function and is        
  located in Puerto Rico or the     
  U.S. Virgin Islands.              

  An IRS employee in the            Report UNAX allegation to the SAC-San
  International (U.S. Competent     Francisco Field Division.
  Authority) function and is        
  located in Guam or the American   
  Samoa Islands.                    
  --------------------------------- -------------------------------------

UNAX allegations involving all other IRS employees will be reported
directly to the SAC-Field Division responsible for servicing the duty
station of the subject of the allegation.

370.3.2 []{#InvestigatingPotentialUNAXViolations .anchor}[Investigating
Potential UNAX Violations.]{.underline} For UNAX allegations within the
jurisdiction of SAC-SIID, the SAC-SIID makes a determination whether to
conduct the investigation in SIID or to send the information to the
appropriate SAC-Field Division for investigation.

For UNAX allegations within the jurisdiction of a SAC-Field Division,
the SAC-Field Division will determine if the information warrants
initiation of an investigation. If the UNAX allegation **does** warrant
initiating an investigation, the Assistant Special Agent-in-Charge
(ASAC) will ensure the assigned SA accomplishes the following, at a
minimum:

-   Initiates an investigation using the appropriate UNAX violation
    code;

-   Conducts a preliminary audit trail review utilizing the Data Center
    Warehouse;

-   If necessary, prepares a SED-Cincinnati Request for Assistance (Form
    OI 7550) using the procedures in
    [370.6](#RequestForSEDConcinnatiAssistance) of this section and
    forwards the form to SED-Cincinnati via email. SED-Cincinnati will
    conduct a preliminary review to determine if a full UNAX analysis is
    warranted. After initial analysis, SED-Cincinnati will advise the
    division as follows:

-   If an indication of UNAX is established, SED-Cincinnati will conduct
    the appropriate record checks, and refer any credible allegations on
    a Memorandum of Interview or Activity (Form OI 2028-M) via the
    Performance and Results Information System (PARIS) Lead Screen to
    the requesting SAC for further investigation.

-   If no indication of UNAX is found, SED-Cincinnati will refer the
    allegation back to the requesting SAC for further investigation by
    an SA. If subsequent investigative steps reveal an indication of
    UNAX, SED-Cincinnati will complete a full UNAX analysis as described
    above.

-   Reviews pertinent data obtained from SED-Cincinnati analysis;

-   Interviews UNAX victims and suspected UNAX victims;

-   Reviews any Taxpayer Data Access forms (IRS Form 11377), completed
    by the subject of the investigation, for investigative leads;

-   Interviews the subject's supervisor;

-   Completes all other investigative leads on current and former
    employees, witnesses, and third parties, prior to referral to the
    AUSA for a prosecutive determination or use of a Blanket Declination
    Agreement;

-   Ensures that all of the above leads are timely documented on the
    Chronological Case Worksheet (Form OI 6501);

-   Timely forwards the final Report of Investigation (ROI) involving
    IRS employees to the appropriate IRS office as listed in [Section
    250.12.1](../../400-250/chapter400-250.doc#ReferralOfInvestigationsToIRS).
    Obtains concurrence from the U.S. Attorney's (USA) office to forward
    an ROI pending criminal action;

-   Ensures that PARIS timely and accurately reflects the UNAX source
    codes, UNAX violation codes, and the resulting criminal and/or
    administrative disposition codes;

-   If the investigation results in an indictment or information
    involving a violation of 18 U.S.C. § 1030(a)(2)(B), 26 U.S.C. §
    7213, or 26 U.S.C. § 7213A, provides the SAC-Operations with the
    following information:

```{=html}
<!-- -->
```
-   A copy of the indictment or information;

-   Address of the clerk of court where the indictment or information is
    filed; and

-   Name, SSN, and last known address of the affected taxpayer.

The SAC-Operations will provide the information to the IRS Office of
Privacy, which will notify the affected taxpayer(s) pursuant to the
notification provision in 26 U.S.C. § 7431(e).

See [Section
290.7.1](../../../../../../../../I:/chapter400-inv/400-290/chapter400-290.doc#Section7431Notifications)
for information on this reporting requirement.

370.4 []{#ProactiveUNAXDevelopmentSAAS .anchor}[Proactive UNAX
Development: Security Audit and Analysis System.]{.underline}

SED-Cincinnati receives data from the Security Audit and Analysis System
(SAAS), which identifies employees who have made possible unauthorized
accesses to taxpayer data.

Potential UNAX violations identified through SED-Cincinnati analysis of
SAAS data will be referred, via the PARIS Lead Screen, to the SAC of the
Field Division responsible for servicing the duty station of the subject
of the allegation. The Lead Screen will contain an associated electronic
file (Form OI 2028-M) that details the results of SED-Cincinnati's
analysis.

The receiving office is responsible for the following:

-   Initiating the appropriate investigation by bridging the lead from
    the Lead Screen to the Investigation Screen in PARIS within 15 days
    of receipt;

-   Conducting an investigation in accordance with the guidelines in
    [370.3.2](#InvestigatingPotentialUNAXViolations) of this section;
    and

-   Coordinating directly with the SED-Cincinnati analyst regarding any
    additional analysis or clarification relating to the referred lead.

370.5 []{#CollateralServices .anchor}[Collateral Services from
SED-Cincinnati.]{.underline}

SED-Cincinnati maintains access to electronic data files that enhance
UNAX and fraud detection and/or support field investigative efforts.
Electronic files and records that are available through SED-Cincinnati
are in [Exhibit (400)-370.1](../../400-exhibits/exhibit400-370-1.doc).

All data file requests should be submitted in accordance with the
guidelines in [Section 370.6](#RequestForSEDConcinnatiAssistance).

370.6 []{#RequestForSEDConcinnatiAssistance .anchor}[Requests for
SED-Cincinnati Assistance.\
]{.underline}Most requests for SED-Cincinnati Assistance must be
documented on a Form OI 7550 that includes the case or complaint number,
and are approved by the requesting SA's ASAC or SAC. Use the Form OI
7550 to request assistance for UNAX analysis and data extracts and
analysis. Exceptions to using Form OI 7550 are as follows:

-   CAF extract - SAC approved memorandum required. See [Section
    140.11](../../../../../../../../I:/chapter400-inv/400-140/chapter400-140.doc#CAF);

-   Consumer Credit Report - Signed consent form required. See [Section
    150.7](../../../../../../../../I:/chapter400-inv/400-150/chapter400-150.doc#ConsumerAgencyReports);
    and

-   Entity SSN - SAC approval required. See Section 180.8.2.

After approval, send the Form OI 7550 and any attachments to
SED-Cincinnati at **\*TIGTA SED Cincinnati Assistance**.

If SED-Cincinnati determines that the request does not involve an UNAX
issue, does not require SED-Cincinnati analysis, or could be completed
by the requestor, SED-Cincinnati will provide the requestor guidance on
completing the task.

370.7 []{#CISProgramMission .anchor}[Computer Investigative Support
Program Mission.]{.underline}

The primary mission of the Computer Investigative Support (CIS) Program
is to provide SAs with technical support through forensic analysis of
digital evidence. The CIS Program also advises SAs concerning the impact
of technology on their investigations. CIS program support includes the
following:

-   Forensic imaging, analysis, and reporting of digital evidence
    examinations;

-   Preparation of search warrants and subpoenas for search and seizure,
    and production of electronic evidence, equipment, and related media;

-   On-site participation during execution of search warrants and
    seizures;

-   Participation in subject, witness, and third-party interviews;

-   Testimony concerning the content of digital evidence at judicial and
    administrative proceedings;

-   Consultation with SAs concerning all aspects of digital evidence;

-   Open-source and Internet-related research to support TIGTA
    investigations; and

-   Providing technical training to SAs, upon request.

See the CIS Forensic Guide for more information on CIS program
procedures.

370.8 []{#CISProgramStructure .anchor}[CIS Program
Structure.]{.underline}

The CIS Program is comprised of an ASAC; SAs assigned to SED, who are
engaged in CIS duties full-time; and SAs and Information Technology
Specialists assigned to SED, who are engaged in CIS duties part-time.

Each CIS SA will maintain a computer laboratory at his/her post of duty
that contains a locked evidence storage area. A national CIS computer
laboratory will be maintained at the Washington, DC post of duty and
will include unique equipment available to CIS Program personnel on an
as-needed basis. The CIS ASAC maintains a current inventory of all
equipment assigned to CIS SAs .

CIS SAs serve as technical advisors to the OI offices located in their
areas of responsibility.

See the CIS Forensic Guide, Section 2, for more information on CIS
quality control, including training and testing of CIS personnel, and
selection and use of hardware and software.

370.9 []{#CISProgramSADuties .anchor}[CIS Program SA
Duties.]{.underline}

A CIS SA is responsible for performing a timely analysis of electronic
evidence submitted to his/her laboratory. Prior to the examination, the
CIS SA and the case SA should have a comprehensive discussion concerning
the overall investigation and the role of the digital evidence
examination. Recognizing that each digital evidence examination is
unique, the following are some possible discussion topics:

-   Range of examination capabilities;

-   Establishment of examination purpose, scope, and specific goals;

-   Development of keyword search list;

-   Known skill-set of computer user, including countermeasures,
    encryption, and passwords;

-   Overall priority of the examination, including investigative or
    judicial deadlines;

-   Grand Jury information; and

-   Review of search warrant, when appropriate.

If it is known that the digital evidence examination will encounter
Grand Jury material, the case SA should have the CIS SA placed on the
appropriate Grand Jury 6(e) Order.

At the conclusion of the examination, the CIS SA will discuss the
findings with the case SA and determine if there are any additional
leads or evidence items to review. The CIS SA will prepare and submit a
Computer Investigative Support Program Forensic Examination Report (Form
OI 7570) of the findings to the CIS ASAC for review and approval. The
approved Form OI 7570 will be provided to and discussed with the case
SA.

Digital forensic examinations are tracked using the submitting
division's case number, and are to be documented by the submitting
division in PARIS, Section S12 - Interview and Investigative Techniques;
Specialized Techniques/Equipment, Code 13 -- Analysis - CIS Involvement.
Proper PARIS documentation supports accurate accounting of CIS program
activity.

See the CIS Forensic Guide, Sections 3, 6, and 7, for more information
on pre and post digital forensic examination procedures and required
documentation.

370.10 []{#RequestingCISProgramSupport .anchor}[Requesting CIS Program
Support.]{.underline}

An SA assigned an investigation involving electronic media, computers,
hand-held computing devices (PDA), fax machines, cellular telephones,
etc., should consult a CIS SA early in the investigation to discuss CIS
assistance. Early CIS involvement will ensure the following:

-   A proper legal basis for any subsequent seizure;

-   The proper seizure of electronic media; and

-   The proper processing/documentation of original evidence.

To request CIS program assistance, the case SA should complete a
Computer Investigative Support Program Request for Assistance (Form OI
7560). The Form OI 7560 should be approved by the SA's ASAC or SAC and
forwarded to **\*TIGTA Inv SED SINART- CIS Assistance**. All emergency
requests must be followed up with a Form OI 7560 and forwarded to the
email box above within one business day. The CIS ASAC will assign the
request to the appropriate CIS SA.

Once the request for CIS assistance has been assigned, the CIS SA is
available to assist with the following aspects of the investigation:

-   Development of the investigative plan by providing input that may
    impact legal issues, decisions to seize or copy evidence, and the
    acquisition of additional support, equipment and supplies;

-   Coordination of equipment and resources needed to conduct a search
    warrant. The equipment and resources needed will be based on the
    following:

```{=html}
<!-- -->
```
-   Number of computers involved;

-   Types of computers involved;

-   Location of the computers within the overall search site;

-   Type, topology and operating system of any computer network
    involved;

-   Size and nature of date storage media, and the existence of any
    \"back-up\" media;

-   Level of cooperation expected from the computer owner and their
    degree of sophistication;

-   Remote connectivity issues;

-   Type of software involved;

-   Nature of any computer security, passwords or encryption utilized;
    and

```{=html}
<!-- -->
```
-   Discussion of the computer aspects of the search warrant with the
    AUSA.

See the guidance documents in the CIS Library for additional information
on searching and seizing computers.

370.11 []{#SubmittingItemsCISExam .anchor}[Submitting Items for CIS
Examination.]{.underline}

After a CIS SA has been assigned a forensic examination, the case SA
should submit those items to be examined directly to the assigned CIS
SA. Digital evidence is fragile and can be unintentionally altered,
damaged, or destroyed by improper handling. Items submitted for
examination should be shipped using an authorized overnight courier
(e.g., UPS or FedEx). Each package should contain appropriate packing
materials to minimize the possibility of damage, and appropriate
documents, such as an Evidence Custody Document (Form OI 5397) with the
chain of custody completed.

Evidence provided to a CIS SA will be maintained in accordance with the
policy and procedures in [Section
190](../../400-190/chapter400-190.doc#Evidence2) of this chapter. If the
forensic examination contains media that is not from the IRS, the case
SA is responsible for providing the CIS SA with documents that establish
the legal authority for the examination (e.g., search warrant, subpoena,
court order, consent).

370.12 []{#ComputerRelatedInvestigations .anchor}[Computer Related
Investigations.]{.underline}

The case SA should be familiar with conducting computer related
investigations and should note the following when investigating a
computer incident:

-   The success of any data recovery/analysis and resulting potential
    prosecution is dependent on the actions of the individual who
    initially discovers a computer incident;

-   The ideal situation when confronted with a computer incident is to
    isolate the suspect computer from additional use or possible
    tampering. The entire workstation or office is a potential crime
    scene, not just the computer itself. All computer equipment should
    be handled with care;

-   In the event of a suspected computer incident, care must be taken to
    preserve evidence in its original state. Merely opening a file on a
    computer/system changes it. Once the file is changed, it is not
    original evidence, and may be inadmissible in any subsequent
    proceedings. Opening a file also alters the computer generated time
    and date showing when the file was last accessed/created, and could
    make it more difficult to determine who committed the violation or
    when it occurred;

-   Computer disks, CD-ROMs, tape storage media, and additional hard
    drives found in the area of the suspect computer need to be
    protected and isolated. Do not allow anyone access to the storage
    media or the computer involved as individuals with extensive
    computer knowledge can develop programs that, with a few keystrokes,
    will destroy all magnetic data on a hard drive;

-   The initial responder may be called to testify concerning measures
    that were taken during the initial computer/system shutdown or
    isolation. The SA should take detailed notes, photographs, sketches,
    and video recordings during the scene processing. This will also
    help ensure the appropriate evidentiary chain of custody;

-   The initial responder to a computer incident should secure the scene
    and immediately contact a CIS SA for further guidance and
    assistance; and

-   Initial interviews of potential witnesses and/or suspects may be
    enhanced by consultation with a CIS SA.

When a TIGTA office becomes aware of electronic harassment or
Internet-related threats directed at the IRS or an IRS employee, SED
assistance should be requested as soon as possible. Once notified, the
CIS ASAC will assign a CIS SA as a technical advisor to assist during
the investigation.

See the guidance documents in the CIS Library for additional information
on computer investigations and electronic evidence.

370.13 []{#ExternalAgencyAssistance .anchor}[External Agency
Assistance.]{.underline}

Resources allowing, the CIS program will assist other law enforcement
organizations, including members of the Inspector General community,
with seizure and examination of digital evidence. Any digital evidence
examination conducted for an external organization will comply with the
CIS Forensic Guide and the TIGTA Operations Manual. Requests for CIS
program assistance must be on agency letterhead and submitted to the
AIGI (Field Operations).

370.14 []{#SINARTMission .anchor}[System Intrusion Network Attack
Response Team Mission.]{.underline}

The System Intrusion Network Attack Response Team (SINART) ensures
effective computer incident prevention and response capability for all
IRS and TIGTA information systems, hardware, telecommunications,
networks, Internet sites, and vendor-supplied software products. SINART
is a cooperative initiative between the IRS and TIGTA. Working closely
with the IRS Computer Security Incident Response Center (CSIRC),
SINART's mission is to promote the security and integrity of all IRS
computer systems by providing technical support and conducting criminal
and administrative investigations.

370.15 []{#SINARTStructure .anchor}[SINART Structure and
Services.]{.underline}

The SINART is comprised of an ASAC, SAs, and Information Technology
Specialists assigned to SED, who are engaged in SINART duties full-time.
Primary services provided by SINART include the following:

-   Network incident response analysis, and investigation;

-   Identifying and mitigating external threats to electronic tax
    administration;

-   Assisting AUSA and case SAs with prosecution of complex network
    investigations;

-   Preserving electronic evidence "chain of custody;"

-   Providing technical advice on obtaining court orders, search
    warrants and subpoenas associated with network investigations;

-   Supporting a joint operation with IRS CSIRC that contains a central
    point for reporting and analysis, sharing response efforts, and
    providing investigative support, as appropriate;

-   Conducting and assisting with interviews relative to network related
    investigations;

-   Network vulnerability identification and assessments;

-   Recommending preventive, recovery, or mitigation strategies for
    internal or external vulnerabilities or attacks;

-   Electronic intelligence collection concerning network vulnerability;

-   Research and development; and

-   Recommending improvements and system enhancements.

370.16 []{#RequestingSINARTAssistance .anchor}[Requesting SINART
Assistance.]{.underline}

SAs are encouraged to contact SINART as soon as possible to discuss
computer network related investigations. If substantive SINART
assistance is required, the case SA must complete a Form OI 7560. The
request must be approved by the case SA's ASAC or SAC and forwarded to
**\*TIGTA Inv SED SINART-CIS Assistance**. See [Section
370.10](#RequestingCISProgramSupport) for additional information on
submission of Form OI 7560.

All computer security or intrusion incidents should be reported to
SINART as soon as possible. SINART has a duty SA assigned each day of
the week on a 24 hour basis, and a reporting process to ensure that
assistance and support are provided in a timely and effective manner. To
report an incident or event to SINART, or to contact a SINART SA
immediately regarding a possible computer security or intrusion
incident, call the SINART duty telephone number at **202-316-8496** and
provide your contact number.