CFET 2007: Paul Stephens: Abstract

Cybercrime Training versus Computer Forensics Education

Paul Stephens
Department of Computing
Canterbury Christ Church University

In 2002 under the European Commission (EC) funded Falcone Programme an expert group comprising law enforcement officials and academics from across the European Union held several meetings to identify areas for improvement in training for high tech crime investigators. Having examined the training programmes available in several member states the group concluded that a European approach to cybercrime training and education was required. The panel of experts recommended that university accredited training in computer forensics be provided to law enforcement officers that is consistent throughout the member states. Provision should be made for sharing of training materials and the development of new resources in an attempt to minimise workload and promote best practice [O Ciardhuain, S., Patel, A., and Gillen, P. 2003].

The following year several members of the Falcone Programme expert group secured funding from the EC to carry out these recommendations. The funding was made available through the AGIS Programme [AGIS 2003] under the title "Cybercrime Investigation – developing an international training programme for the future". As a direct result of this project Canterbury Christ Church University, along with several other higher education institutions, was invited to explore the possibility of working with the National Policing Improvement Agency (NPIA) [NPIA 2007] High Tech Crime Training Centre to extend and enhance their training provision to a Master's level qualification. The MSc in Cybercrime Forensics had its first intake in September 2004 [CCCU 2005] for which the author is a course leader for three of the modules.

In addition to the MSc, the author has been involved with the development and delivery of a number of computer forensics training and education courses. The Department of Crime and Policing Studies runs an ICT and Forensic Investigation module as part of its BSc in Forensic Investigation which the author taught on for the first time this academic year. The author helped to develop and was part of the training team for the AGIS 2006 pilot training course Linux as a Forensic Tool. CCCU's Department of Computing is also in the final stages of validating a BSc in Forensic Computing [CCCU 2006] for which the author is the Programme Director Designate and a major contributor to several of the modules.

This paper will discuss the major similarities and differences between the training provided by the NPIA and AGIS Programmes and the education provided by CCCU from the particular experience of the author as both a trainer and as a lecturer.


[AGIS 2003] European Union AGIS Programme 2003-2007 to help legal practitioners, law enforcement officials and representatives of victim assistance services from the EU Member States and Candidate Countries to set up Europe-wide networks, exchange information and best practices|

[CCCU 2005] "Canterbury Christ Church joins forces with central police training and development authority to deliver masters degree in cybercrime forensics", Canterbury Christ Church University website, 24th June 2005,|

[CCCU 2006] "New degree in Forensic Computing", Canterbury Christ Church University website, 4th October 2006,|

[NPIA 2007] National Policing Improvement Agency,|

[O Ciardhuain, S., Patel, A., and Gillen, P. 2003] "Training: Cyber Crime Investigation", International Federation for Information Processing (IFIP) website, 29th March 2007,|