The modern crime scene is no longer confined to obvious, physical evidence like broken glass or shell casings. In the age of the “smart home,” seemingly innocuous devices that are networked, mounted on a wall or strapped on a wrist can play a key role in solving — and committing — crimes.
As the number of connected devices worldwide is projected to exceed 40 billion by 2034, The University of Texas at San Antonio is leading a national initiative to ensure law enforcement can keep pace. Through the Internet of Things (IoT) National Training and Technical Assistance Program, cybersecurity experts are bridging a critical gap in digital forensics, providing investigators with the skills to extract evidence from everything from Ring doorbells to robotic vacuums.
“The integration of IoT devices into our daily life has accelerated at a pace that law enforcement training infrastructure has not matched,” said Raymond Choo, the project’s principal investigator and associate dean for graduate studies in the College of AI, Cyber and Computing. Choo also holds the Cloud Technology Endowed Professorship in the Department of Information Systems and Cybersecurity.
“A decade ago, these devices would not have appeared on an investigator’s evidence checklist. Today, they are everywhere,” Choo added.
Jean Costello, one of the lead trainers in the courses, noted that IoT evidence was “first used in a 2014 Canadian legal case.” Police investigating a murder noticed an Amazon Echo in the home and subpoenaed Amazon for its audio and transcript data. “Another IoT device was used in a 2015 murder case in Arkansas,” she added. This opened the doors to a new subset of digital forensics.
Examples of modern IoT devices that can store vital evidence include smart watches, Apple AirTags, smart glasses and VR headsets, which could help with building a chronological timeline and geolocating a crime.
Securing a sector on the rise
The training program was born from a simple observation: while criminals were exploiting new technologies, the investigators tasked with stopping them lacked a roadmap. This need is compounded by the explosive growth of the sector; a recent market forecast valued the global IoT industry at over $514 billion, with projections reaching nearly $840 billion by 2032.
“In a nutshell, we were trying to solve the issue of a knowledge gap, and one that would be increasingly critical in the near future,” Choo said. “Our team saw a particular need to tackle the lack of accessible, hands-on training for law enforcement. We wanted to provide them with the foundational knowledge and practical skills required to navigate the complexities of IoT forensics.”
Specialized training for a new frontier
UT San Antonio launched the program in partnership with the Cybercrime Investigation and Cybersecurity (CIC) Graduate Program at Metropolitan College, Boston University (BU) and external consultant Jean Costello, supported by a grant from the Bureau of Justice Assistance. The curriculum consists of four specialized courses that guide trainees through the lifecycle of a modern investigation:
- IoT Overview and Basic Devices: Identifying smart home and wearable evidence at a scene.
- Additional Home, Wearable Devices and Cloud Extracts: Navigating the data stored by smart watches, smart glasses, fitness trackers, smart thermostats and home hubs.
- Video Display Devices: Extracting evidence from smart cameras, smart TVs, VR headsets, gaming devices and others with visual interfaces.
- IoT Devices Used as Robots: Analyzing autonomous systems and mobile robotics.
The program even ventures into the cutting edge of technology through a partnership with Boston Dynamics. In the robotics course, investigators learned how to handle data from autonomous systems that are increasingly found in industrial and residential settings.
Strategic partnerships and real-world tools
To ensure the training is both practical and accessible, the team collaborated with specialists from MOBILedit to provide trainees with industry-standard tools for mobile and IoT device analysis. The team also used free and open-source tools within the curriculum so that agencies with limited budgets could immediately apply the skills they learned.
Other experts supporting the initiative were Kyung-Shick Choi and Lou Chitkushev, who served as co-principal investigators from BU, Oren Upton, another lead trainer in the courses, Erin Stephens, who provided administrative and logistical support throughout the project, and WestEd, through its Justice and Prevention Research Center, which provided evaluation and critical feedback on the design and delivery of the courses to improve future trainings. This cross-institutional collaboration allowed the team to deliver training through a hybrid model, combining in-person intensives with online webinars to reach investigators across the country.
“Working with our BU colleagues, external partners and law enforcement was a rewarding experience,” Choo said. “We learned how different agencies operate and the unique challenges they face. The collaboration also allowed us to refine our curriculum to be as relevant and impactful as possible, particularly as malicious cyber activities targeting global critical information infrastructure are becoming increasingly frequent.”
Measurable impact on public safety
The impact of the program has been immediate. To date, the initiative has trained over 300 professionals, including digital forensic examiners and investigators from local, county, state and federal jurisdictions.
Quantitative analysis showed that average pre-test scores, which ranged from 45% to 75%, rose to post-test scores between 73% and 98% following the training. This represents a significant leap in the technical readiness of the nation’s frontline investigators.
“The feedback indicated that participants gained practical skills they intended to apply directly to their work,” Choo said. “For example, some learned how to identify previously overlooked IoT evidence at crime scenes that could be the key to solving a case.”
Securing the digital future
This effort comes at a time of heightened awareness regarding cybersecurity. Recent high-profile incidents, such as the cyberattack on educational technology giant Instructure, highlight how digital breaches can disrupt essential services. By training law enforcement to secure and analyze IoT data, UT San Antonio is helping to fortify the nation’s investigative capabilities against an increasingly complex array of threats.
As UT San Antonio continues to grow as a Tier One research institution, programs like the IoT National Training initiative showcase the university’s role as a leader in national security and economic development. By empowering the next generation of digital investigators, the university is ensuring that as the world becomes more connected, it also becomes more secure and resilient.
Republished courtesy of UT San Antonio