February 14, 2024 

1:00pm – 4:00pm ET

#FISSEA | nist.gov/fissea

Federal Information Security Educators 

(FISSEA) 

Winter Forum
#FISSEA

Please Note...

This webinar and the engagement tools will be recorded.

An archive will be available on the event website. 
#FISSEA

Welcome and Opening Remarks

Brooke Crisp

FISSEA Co-Chair

Marian Merritt

Deputy Director of NICE/FISSEA Lead

National Institute of Standards and Technology
#FISSEA

Get Involved

Subscribe to the FISSEA Mailing List 

FISSEAUpdates@list.nist.gov

Volunteer for the Planning Committee

https://www.nist.gov/itl/applied-cybersecurity/fissea/meet-fisseaplanning-committee

Serve on the Contest or Award Committees

Email fissea@list.nist.gov

Submit a presentation proposal for a future FISSEA Forum 

https://www.surveymonkey.com/r/fisseacallforpresentations
Previous FISSEA Award Winners include: 

• Best blog

• Best newsletter

• Best website

• Best podcast

• Best poster

• Best innovative solution and 

more
#FISSEA

Lesley Fair

Senior Attorney

Federal Trade Commission

They Give Love a Bad Name: How the FTC Educates Consumers 

to Spot, Stop, and Report Romance Scams

Opening Keynote
How romance scammers 

give love a bad name –

and what the FTC is doing 

to educate consumers 

about the risks

Lesley Fair

Senior Attorney

Federal Trade Commission

lfair@ftc.gov

February 14, 2024
Federal

Trade

Commission
For

The

Consumer

it’s likely to 

mislead 

consumers

acting 

reasonably 

under the 

circumstances

and it would 

be material to 

their decision 

to buy the 

product

AN ACT OR PRACTICE

IS DECEPTIVE IF:
it causes 

substantial 

consumer 

injury – financial, 

physical, etc. 

not 

reasonably 

avoidable by 

consumers 

themselves

and not 

outweighed 

by benefits to 

consumers of 

competition 

AN ACT OR PRACTICE

IS UNFAIR IF:
FTC DATA SECURITY CASES
How does the FTC

collect data

about romance scams?
register.consumersentinel.gov 
How does the FTC

report the data it collects?

AGE AND FRAUD LOSS IN GENERAL

20-29 157

30-39

40-49

50-59

60-69

70-79

80+

FRAUD LOSS REPORTS

PER 100,000 POPULATION

183

170

137

149

158

87

MEDIAN REPORTED 

DOLLAR LOSS

$480

$460

$450

$470

$500

$803

$1,450
What have the reports

taught us about

romance scams?
2019 ROMANCE SCAM DATA

$2,600

Median losses to 

romance scams

About 7 times 

higher than other 

forms of fraud 

reported to the FTC

40-69

Age range of 

those who 

reported losing 

money to 

romance scams 

at highest rate

70+

Age range of 

those who 

reported the 

highest 

individual 

median losses: 

$10,000

2019

First year that 

romance 

scams first 

ranked #1 in 

total reported 

fraud losses 
 2021: Total financial 

losses to romance scams 

were six times what they 

were in 2017.

 2021: Total number of 

romance scams reports 

were three times what 

they were in 2017. 
2022

MOST 

COMMON

TOLD

BY ROMANCE
“I (or someone close to me) is hurt, sick, or in jail.”

“I can teach you how to invest – and make big money.”

“I’m in the military far away.”

I need help with an important delivery.”

“We’ve never met, but let’s talk about marriage.”

“I’ve come into money or gold and need help getting it.”

“I’m on an oil rig or a ship.”

“You can trust me with your private pictures.”

24%

18%

18%

18%

12%

7%

6%

3%
Cryptocurrency

34%

Bank Wire Transfer

27%

Gift Card

7%

App

3%

Other

28%

Cryptocurrency

19%

Bank Wire

Transfer

14%

Gift Card

24%

App

15%

Other

27%

2022: Payment methods for romance scams 

by total reports

2022: Payment methods for romance scams 

by dollar loss amount
What does the

2023 Data Book

tell us about romance scams?
COMPARING ROMANCE SCAM DATA

NUMBER OF REPORTS

WITH DOLLAR LOSSES

TOTAL DOLLAR LOSSES

IN MILLIONS

39,875

28,399

$959

$483M

54,213

35,900

$1,300

$722M

79,696

48,495

$1,870

$1,294M

69,583

42,115

$2,000

$1,339M

MEDIAN

DOLLAR LOSSES

64,003

39,680

$2,000

$1,140M

NUMBER OF

FRAUD REPORTS

2019 2020 2021 2022 2023
COMPARING IMPOSTER SCAM REPORTS – 2023

BUSINESS IMPOSTERS 474,731

GOVERNMENT IMPOSTERS 228,282

ROMANCE SCAMS 64,003

FAMILY EMERGENCY SCAMS 33,479

TECH SUPPORT SCAMS 91,196
Of the $2.21 billion imposter 

“industry,” which imposters

are inflicting the most

reported financial harm?
FAMILY 

EMERGENCY 

SCAMS

GOVERNMENT

IMPOSTERS

TECH 

SUPPORT 

SCAMS

BUSINESS

IMPOSTERS

5 4 3 2

$89 

million

$242 

million

$617 

million

$752 

million

IMPOSTER SCAM DATA BY REPORTED $$ LOSS
FAMILY 

EMERGENCY 

SCAMS

GOVERNMENT

IMPOSTERS

TECH 

SUPPORT 

SCAMS

BUSINESS

IMPOSTERS

5 4 3 2

$89 

million

$242 

million

$617 

million

$752 

million

IMPOSTER SCAM DATA BY REPORTED $$ LOSS

ROMANCE

SCAMS

1

$1.14 

billion
So why is it so difficult to

go after romance scammers?

What can we do to shatter

the stigma of romance scams?
Rethink the

vocabulary

1
Encourage 

reporting

2

Empower 

through education

3
MULTIMEDIA EDUCATION

Articles on 

consumer.ftc.gov

Videos on 

ftc.gov, YouTube, 

and other 

platforms

Articles and blog 

posts directed to 

consumers and 

businesspeople

Strategic 

partnerships

Social media 

content with 

sharable 

graphics

Articles for 

specific audiences 

(college students, 

military, older 

consumers)

Data spotlights 

for news media

and others

“Carpe

podium!”


THE MESSAGES

LET FAMILY & FRIENDS KNOW YOU’RE LOOKING ONLINE 

AND PAIR UP WITH A PEER TO COMPARE NOTES.

DO REVERSE IMAGE SEARCHES FOR PHOTOS AND LOOK 

FOR TEXT ON SEARCH ENGINES.

A REQUEST FOR MONEY IS A NO. 

AN “INVESTMENT OFFER” IS A NO. 

A REQUEST FOR EXPLICIT PHOTOS IS A NO. 

HELP OTHERS BY REPORTING SCAMS TO THE FTC AND 

TO THE PLATFORMS. 

1

2

3

4

5

6
Sign up to get FTC Business 

Blog and Consumer Alerts 

at ftc.gov/subscribe.

lfair@ftc.gov
#FISSEA

Are There Any Questions?

Q&A
#FISSEA

Katie Shuck

Lead Cyber Intelligence Analyst

South Dakota Fusion Center

Using OSINT Model to Identify Threats to Critical Infrastructure
Using OSINT Model to Identify 

Threats to Critical Infrastructure

FISSEA Winter Forum

14 February 2024

Mission: Keeping South Dakota a Safe Place to Live, Work, Visit and Raise a Family
Open-Source Intelligence 

(OSINT)

The collection and analysis of publicly available information for 

an intended audience.

• Public Records

• News Articles

• Social Media

• Data Breaches

• Vulnerability Information

• ...and More

The Internet maximizes the availability OSINT...

and its use by cyber and physical threat actors.
OSINT Physical Threat: 

Doxing

Revealing and possibly publicizing the personal information of 

an individual, which was previously private or difficult to 

obtain, often for the purpose of online shaming, extortion, 

stalking, harassment/intimidation, and/or vigilante activities.

Including, but not limited to:

Full Name

Address

Phone Number(s)

Email Address(es)

Family Member Information

Social Media Account(s)

Intimate images
OSINT Cyber Threat: 

The Possibilities are Endless

Phishing

Impersonation

Domain Information

Vulnerabilities

Vulnerable Devices

Credential Leaks

Open Ports

Data Breach Information

Ransomware Victims

Fraud/Scams

And more...
OSINT Techniques

• Google – and non-Google – “Dorking”

• Public Records

• Social Media and Online Communities

• People Search Sites

• Mapping Services

• Email Searches

• Phone Number Searches

• Data Breach Information

• Image Searching

• Vulnerability Posts and Searches

• Dark Web Searching
Google “Dorking”

The most popular search engine – Google works by using web crawlers to 

generate and index its search results

• Advanced search techniques/queries make searching more effective and 

efficient – and provide better ways to identify hard-to-find information

• Some search strings are Google-specific – some can be used on other 

browsers and in other search techniques (e.g., searching Facebook)

Advanced Search String Examples Result

Taylor Swift The words “Taylor” AND “Swift”

“Taylor Swift” The exact phrase “Taylor Swift”

“Taylor Swift” –music The phrase “Taylor Swift” but NOT 

the word “music”

site:[URL] Restrict search to one website or 

domain

Visit googleguide.com for more search techniques
Google “Dorking”: Linking Searches

Search parameters, when linked together, can greatly improve search results so 

that you only see what you really want to see

Example:
Public Records

• Public records can provide vast amounts of freely available information 

and are often available online

• While some records can be requested to be made public, this is 

dependent on the location of the records

Examples of Public Records:

 Property Records

 Court/Criminal Records

 Birth/Death Records

 Voter Records

 Business Filings

 Government Open Records
Social Media and Mobile Apps

Facebook

Twitter/X

Instagram

LinkedIn

SnapChat

Tik Tok

Telegram

CashApp

Venmo

And Many More...

Can provide access to exponential information to identify home, 

family, friends, patterns of life, background...

Username Display Name Birthday

Connections Images/Video Phone Numbers

Email Employment Schools Attended

Visibility of accounts is often dependent on privacy settings
Online Communities

• Similar to social media, but usually created for a specific service or lifestyle

• Many online communities won’t show up on Google searches because 

Google doesn’t index them – or doesn’t index them well.

Some online communities can be searched with a Google site: search but many 

cannot

• Online communities can include chat forums, blogs, dating and meetup 

sites, chat applications, eCommerce sites, and more

• Examples:

Reddit 4Chan Discord

Slack Craigslist Amazon

eBay Match Meetup

Roblox Tinder OnlyFans
People Search Sites

People search sites will have opt out pages or contacts to have information deleted from 

their site – but this isn’t always easy and information may repopulate over time
Mapping Services
Phone Searches

Once identified, they can be verified with search techniques, including:

• “Forgot My Password” searching

• Payment application searches

• Adding to device contacts and searching

• Caller ID Databases

• Craigslist may post phone numbers
Email Searches

Can search for similar to phone searches

• “Forgot My Password” searching

• Payment application searching

• Adding to Contacts and searching
Image Searching
Paste Sites
Vulnerability Searches
Questions?

Katie Shuck

Lead Cyber Intelligence Analyst

South Dakota Fusion Center

katie.shuck@state.sd.us

fusion.sd.gov
#FISSEA

We want to hear from you!

Select ”Polling” in the 

bottom left of your screen

Complete the 

poll and click 

“Submit”
BREAK

The Forum will resume at 2:30pm ET

#FISSEA | nist.gov/fissea

Federal Information Security Educators (FISSEA) 

Winter Forum
#FISSEA

Welcome Back!

Maureen Premo

Cyber Defense Education and Training (CDET)

Cybersecurity and Infrastructure Security Agency 
#FISSEA

Susan Hansche 

CISA/CSD Training and Development 

Department of Homeland Security

Featured Panel: NIST SP 800-50

Marian Merritt

Deputy Director of NICE/FISSEA Lead

National Institute of Standards and Technology

Kevin Sanchez-Cherry 

Cybersecurity Policy, Architecture 

and Training Lead

U.S. Department of Transportation

Office of the Chief Information Officer

Don Walden

Senior Privacy Analyst 

Internal Revenue Service 
NIST SP 

800-50 

update

Panel: 

Susan Hansche, CISA

Marian Merritt, NIST

Kevin Sanchez-Cherry, DOT

Don Walden, IRS

Additional NIST Special Publication 800-50 Authors:

Brenda Ellis, NASA

Julie Snyder, MITRE
NIST SP 800-50 rev 1

• Building an Information Technology Security Awareness & Training Program - 2003 

(20 years ago)

• Revision draft made public August 28, 2023

• Comments through October 27, 2023

• Co-authoring team from several Federal agencies

• Goals:

• Leverage NIST guidance

• Develop consistent language

• Reflect research from FISSEA community

• Address challenges such as measuring impact
NIST SP 800-50 rev 1, cont.

• The learning program is a cyclical, iterative model

• Consolidates 800-16, incorporates NICE Framework

• Intended to be collaborative, flexible, scalable
Adding Privacy

• Background to the Privacy Act of 1974

• Requirements of OMB Circular A-130

• Leverage and reference the NIST Privacy Framework
Poll 1

In your current job, do you have privacy-related responsibilities?

 Yes

 No

 Don’t know/aren’t sure
Poll 2

Do you have responsibility for including privacy topics in an 

awareness or training program?

 Yes

 No

 Don’t know/aren’t sure
Poll 3

In your current job, do you participate in or are required to take 

privacy training?

 Yes

 No

 Don’t know/aren’t sure
What SP 800-50 r1 is:

• “Building a Cybersecurity and Privacy Learning Program” 

• Enterprise-wide awareness, training, and education program -

Cybersecurity and Privacy Learning Program (CPLP)

• The learning program supports a culture of respect for employees 

• Everyone plays some type of role in managing the organization’s 

cybersecurity and privacy risk
The Learning Program is...

• a cyclical, iterative model that 

adapts to each agency’s needs 

and situation

• Intended to be collaborative, 

flexible, scalable

• A way to encourage crossfunctional cooperation with 

senior leadership
Senior Leadership

• 800-50 r1 recommends forming a Senior Leadership committee or 

advisory board

• CIO, CPO, etc

• Human Resources

• Communications

• Strategy and Budget Planning

• Regular Program review and discussion

• Program support and participation
What SP 800-50 r1 is NOT

• Details on designing or developing new training elements 

• How to create a change management or cultural program

• An enterprise-wide human risk management program

• Who should do what work in the organization

• How to create an enterprise-wide metrics program

• How to identify employees in your workforce according to the NIST 

SP 800-181 work roles
What comes next...

•Final editing to incorporate comments

•Internal NIST editorial review

•Publish to the public-facing NIST website
Q&A
Thank you!
#FISSEA

Are There Any Questions?

Q&A
#FISSEA

Rachel Yurkovich

Management and Program Analyst

Federal Bureau of Investigation 

Wes Quigley

Unit Chief 

Federal Bureau of Investigation

How IC3.gov Works
Internet Crime Complaint Center
Internet Crime Complaint Center

The mission of the Internet Crime Complaint 

Center is to provide the public with a reliable 

and convenient reporting mechanism to 

submit information to the Federal Bureau of 

Investigation concerning suspected Internetfacilitated criminal activity and to develop 

effective alliances with law enforcement and 

industry partners. Information is analyzed 

and disseminated for investigative and 

intelligence purposes to law enforcement 

and for public awareness. 
National Threat Operations Center (NTOC)

1-800-CALL-FBI 

www.tips.fbi.gov

Receives and processes phone calls and e-Tips reporting:

Threats to Life

Suspected Terrorism

Internet Crime Complaint Center (IC3)

www.ic3.gov

Receives and processes online complaints reporting:

Frauds, scams

Elder Fraud

Intrusions

Ransomware

IC3 - or -NTOC 
Cyber Division

18 U.S Code § 1030 

Fraud and Related Activity in 

Connection with Computers

Ransomware

Computer Intrusion

Malware

Criminal Investigative

18 U.S Code § 1341, 1343, 1349 

Frauds and Swindles

Mail Fraud

Wire Fraud

Frauds and Scams

Cryptocurrency

Elder Fraud

Recovery Asset Team

18 U.S Code § 1349

Wire Fraud

Business Email Compromise

Domestic Financial Fraud Kill Chain
IC3 Complaints –Past Five Years

$10.3 Billion

$6.9 Billion

$4.2 Billion

$3.5 Billion

$2.7 Billion

800,944

847,376

791,790

467,361

351,937

2022

2021

2020

2019

2018

Complaints and Losses over the Last Five Years*

Complaints Losses
Cryptocurrency
IC3 Support

SUPPORT 2023 2022

Case Enhancements 310 190

Search Requests 103 284

Data Disseminations 3,825 4,754

Guardians 5,347 4,023

Cases Opened 398 441

Product Publications

Public Service 

Announcements

Cyber Security Advisories

Annual Reports

Major Initiatives

Ransomware, Intrusions

Call Center Fraud

Crypto Investment

Elder Fraud

Kill Chain

Complaint Aggregation

Case Support

Trending

Outreach / Presentation

Presentations

Webinars

Podcasts

Media Inquiries

Interviews
Recovery Asset Team (RAT)

Functions as a liaison between law enforcement 

and financial institutions supporting statistical 

and investigative analysis

$157.32

Million

$433.30

Million

Remaining Losses Frozen Funds

2022 Successes

73% Success Rate

2,838 Incidents

$590.62 Million Losses

$433.30 Million Frozen

$246,116,570 

$383,833,904 

$464,624,659 

$450,377,914 

$590,623,479 

$638,325,811 

$190,746,546 

$304,440,474 

$381,596,592 

$337,192,872 

$435,421,931 

$458,756,295 

$0

$100,000,000

$200,000,000

$300,000,000

$400,000,000

$500,000,000

$600,000,000

$700,000,000

CY18 CY19 CY20 CY21 CY22 CY23

Loss Frozen
IC3 Remote Access

• Access to the IC3 database, via remote 

query, is automatically granted to sworn 

law enforcement and FBI employees

• All other LEEP users are evaluated on a 

case-by-case basis

• Email LE-SearchAssist@ic3.gov for search 

requests or with questions.
IC3 Remote Query

258,524

378,716

620,778

338,570

112,385 127,641

227,007 224,093

2022 2023 as of 11/25/2023

FBI Searches FBI Downloads Non-FBI Searches Non-FBI Downloads
Our Partners

• 56 FBI Field Offices and 63 LEGATS

• Foreign Law Enforcement

• GAEN, GASA, International Threat Group (NFIB, RCMP, CoLP, CAFC)

• Government Agencies

• Secret Service, Homeland Security, Federal Trade Commission, State and Local Law 

Enforcement

• Private Sector

• National Cyber-Forensics and TrainingAlliance

• Financial Institutions, Cryptocurrency Exchanges
Success Stories

FFKC

• Between January 2014 – December 2022, internationally over $731 million dollars frozen for possible recovery.

• Between February 2018 – December 2022, domestically over $1.6 billion dollars frozen for possible recovery.

Case Support

• Tech Support (Knoxville): Five individuals, including one subject from India charged with being the Owner/Director of the 

call center in India. Three individuals in Iowa and one individual in Maryland are accused of facilitating payments on 

behalf of the Indian call center. ~15,000 victims; ~$15 million losses. 

• Call Center Fraud; FY23 - FBI enabled 26 arrests through 13 joint operations with Indian authorities.
Questions?

UC SSA L. Wes Quigley

LE-SearchAssist@IC3.gov
#FISSEA

Lisa Plaggemier

Executive Director

National Cybersecurity Alliance

What’s New, and What’s Ahead, at the National Cybersecurity 

Alliance
What’s New, and What’s Ahead, at 

the National Cybersecurity Alliance

Lisa Plaggemier

Executive Director, National Cybersecurity Alliance

20 January 2022

February 14, 2024
We empower a more secure, 

interconnected world. 

Our alliance stands for the safe and secure use of all technology. 

We encourage everyone to do their part to prevent digital wrongdoing 

of any kind. 

We build strong partnerships, educate and inspire all to take action to 

protect ourselves, our families, organizations and nations. 

Only together can we realize a more secure, interconnected world.

About Us

HBCU

Career

Program
Cybersecurity Awareness Month

2023 Results

• 4,080 Champions from 93 countries and all 50 states

• 765 people tuned into our 20th Cybersecurity Awareness Month 

Virtual Kick-off event

• 40% increase from 2022's virtual events

• 43,274 individuals posted about the campaign in 136,646 posts 

across social media platforms

• Resulted in 651,263 engagements and 1.8b impressions
Cybersecurity Awareness Month

Speaking

Engagements

• 9,500 individuals from 135

organizations attended an NCA talk 

or virtual game show in 2023

• https://staysafeonline.org/programs/

request-a-speaker/
101

Secure Our World 

Secure Our World • Evergreen awareness campaign

• Tip sheets, infographics, social media posts & 

graphics, sample press release, virtual 

backgrounds

• PSAs

101
Security Behaviors

1. Password hygiene: password creation, password management, etc

2. Using Multi-Factor Authentication (MFA)

3. Installing the latest updates

4. Checking emails for signs of phishing

5. Backing up data
2024 NCA Events & Campaigns Timeline

CONVENE 1

DATA PRIVACY WEEK

ROMANCE 

SCAMS

RSA 

CONFERENCE

& EXECUTIVE 

LUNCHEON

CYBER 

SURVIVAL GUIDE

CAM TOOLKIT 

LAUNCH

CONVENE 

CAM & NASDAQ 

CYBERSECURITY 

SUMMIT

ONLINE HOLIDAY 

SHOPPING

Jan. Feb. May Aug. Nov.

Jan. May June Oct.
104
Opportunity

Motivation

Capability

Behavior
Oh Behave 2023 

● Launched Oct 3, 2023

● 1,965 downloads to date

o 65% increase compared to same period in 2022

● Coverage:

o Fortune (UVM: 19M)

o Beta News (UVM: 1M)

o Dark Reading (UVM: 405K)

o CyberWire (UVM: 32K)

Q. What is your preferred method of remembering multiple

passwords?

a. I write them down in a notebook 31%

b. I write them down in a document on my computer 5%

c. I store them in my phone 11%

d. I store them in my email 5%

e. I just remember them (without writing them down) 24%

f. I save passwords in the browser 9%

g. I use a password manager application 12%

h. Reset at each log in 3%

Password Management Strategies
• 89% consider online safety a priority

o 39% feel frustrated by work it takes

• 46% of Millennials say parents rely on them to stay safe online

• 83% of Baby Boomers feel that staying safe online is a priority

o 52% of Gen Zers, 57% of Millennials agree

• 50% report they are better at spotting phishing attempts after 

cybersecurity training

o 94% report adopting at least one new cybersecurity behavior

Oh Behave 2023 Results

https://kubikleseries.com/







Stay safe online. Website

StaySafeOnline.org

Twitter

@staysafeonline

Facebook

/staysafeonline

LinkedIn

/national-cyber-security-alliance

Email

info@staysafeonline.org 
#FISSEA

Are There Any Questions?

Q&A
#FISSEA

Closing Remarks

Maureen Premo

Cyber Defense Education and Training (CDET)

Cybersecurity and Infrastructure Security Agency 
#FISSEA

Get Involved

Subscribe to the FISSEA Mailing List 

FISSEAUpdates@list.nist.gov

Volunteer for the Planning Committee

https://www.nist.gov/itl/applied-cybersecurity/fissea/meet-fisseaplanning-committee

Serve on the Contest or Award Committees

Email fissea@list.nist.gov

Submit a presentation proposal for a future FISSEA Forum 

https://www.surveymonkey.com/r/fisseacallforpresentations
Federal Information Security Educators 

(FISSEA) Conference

May 14-15, 2024

#FISSEA | nist.gov/fissea

SAVE THE DATE

Rockville, MD
THANK YOU

https://www.surveymonkey.com/r/2024FISSEAWinterForum

We look forward to receiving your feedback via the post-event survey!

#FISSEA | nist.gov/fissea