Digital Forensics and the Military - Interview with Andrew Lister

i'm joshua james with d first science we have andrew lister with the tego global and i'm really excited to talk to him today specifically about his career path and how he actually got into forensics and what he's working on now so yeah no great thanks joshua and as i mentioned my name's andy i have a background in the military here in the uk and joined the royal marine commandos at 18 and graduated through to our reconnaissance junior commanders senior commanders and then graduated up from that to our special forces selection for sas sbs i guess how long you talked about your military experience how long were you in the military and what kinds of work did you do specifically in the military what kinds of work did you do related to forensics let's say um through the military but i think now it's the modern world you know gone are the days of the um regular soldiers and even the special operations teams like the teams i was running with and not having some kind of digital capability the ability to push forward and extract data and intelligence and indeed in a lot of cases evidence from the devices you find you know and it used to be we'd go into uh new sort of special operations units that maybe aren't as as far forward as um luckily some of the key western groups that we'd work with and instantly you know they've got a million skill sets already and they're asking questions well why do i need to do that you know this digital side and you're going well you consider yourself a professional operator in this damn world is there anywhere you've deployed in the world where you do not come across computers phones thumb sticks macbooks hard drives and what do you do do you ignore them do you gather that really important quick j2 intelligence that is on target on scene do you wait for it to go back to a lab to get lost in the melee or does that come forward so all these things and kind of evolve through the military and i was lucky enough to hit the ground running coming from a reconnaissance troop in the royal marines and then into our special operations and then four years in a cell that did the uh the covert and over exploitation so that's everything from the ability to be able to um work with people that are giving us information potentially force protection so looking after our own staff you maybe operate in a location where you're you're working away from everybody else and you have local nationals that are to some degree trusted but there's always an element of distrust there potentially can you quickly look across their digital devices just to see potentially is there you know do they do they are are they searching for a lot of the uh local terrorist organizations are they looking at information around your camp in more detail than they should be so it's not always just what you think in regards to going out facing down the enemy quickly pulling data getting the results back it can quite often be just protecting yourselves as a small group it can be on the covert side so um using tradecraft to enter hotels houses whatever it is uh in these permissive and non-permissive environments really uh to gain that intelligence or evidence so again there is a big crossover now between what the military do in these certain circles and what the police do so for that that four year period i've ran a cell called the uh joint effect cell the the jet or the exploitation side of it that's mpe material people and equipment exploitation and that that is that encompasses everything so wet forensics uh digital forensics cyber all these kind of pieces the problem being of course military already have a million skill sets it's not in most cases your day job so you're then getting pushed in to go okay we need to give these guys and in some cases girls that go to some of these locations the ability to do something that very quickly very easily without that training burden how do we do that and the answer was go and get all the experts so we went to gchq we went to cheltenham we went to all the main agencies that do these kind of things scotland yard gthq and so15 which is the count of terror police all these different pieces and we said look we know you've spent decades honing your skills getting all this experience and i know it's going to be painful but we need you just to give us the golden nuggets right now give us all the best pieces that you've learned to give us best effect forward and that's where it started so this all kind of started at that initial forward phase originally it was bag and tag and so maybe some of your viewers are familiar with that old school going in you may be on a location there's a lot of digital evidence there and it's getting swept in a bag you know those those days in many ways have gone because the information you can gain rapidly in a lot of cases now it is just so effective for us okay um again just because i think the military aspect is so different than maybe criminal or civil investigation you you mentioned a lot of different skills you mentioned on scene or applying it to intelligence counterintelligence local protection all of these different things can you just break it down kind of as easy as possible what would a a relatively standard digital investigation for the military look like it's a bag of dolly mixtures and that's that's part of the magic really of the way that um the military has grabbed the best of both so it's it's gone to all these agencies and groups it's gone to companies like ourselves and said look we can't individually learn these 10 tools to give us 100 of what we want we don't have the time the cognitive ability we don't have the resources can you condense that and give us at least 80 of everything we require but the training burden and skill fade is is massively reduced and you know clearly i now work for a commercial company i use this technology down range not just at the the front line but at a kind of fusion cell kind of piece so that that lab kind of affects a massive vested interest in uh in making sure the technology does what it needs to do too many devices too much data not enough experts out there and so we're trying to bring something to the table that can assist that in regards to a standard military it depends on the group so you might have more elite troops who are going in and maybe let's let's theoretically use ukraine at the moment you know and some of the fighters there might have downed an individual come across them that individual has a mobile on them has a thumb stick on them has a camera from doing surveillance and has an sd card in that or a drone you know at that point at that instant that intelligence is just mind-blowingly critical how it would have been done 10 years ago is all that would get bagged up it might even be left in some cases and then it would eventually get sent back somebody would go what do we do with this it goes off to one agency he passes it to another they find some key critical data ah awesome well done guys but that gets lost in the you know the chinese whispers the communication chain takes ages so we're trying to work out organic ways that organizations could have the technology and skills up front but still feed all of the greater agencies that are smes subject matter experts specifically in those fields so you you managing to cover off both sides so at that point you might have someone going forward and pulling that critical data off the phone or a device lifetime at the front end you might be on another job and we have for about four years held a contract for discrete us agency they have all their tradecraft weighed off they everything is legal covert method of entry all these kind of pieces against them bad actors across the globe really and they add the technology to that so that's being able to extract data and using the technology skills blended with their tradecraft in order to leave everything in situ how it was so it doesn't ever look touched from a physical point of view or from a data digital point of view but still pulling back the the critical information so there is no there is no there is no standard you can go down pretty much every kind of avenue the critical thing is and rest assured that the vast majority of organizations now are grabbing this they're realizing that um when i first came into this in the military we were blessed in the organization i was with you sat at the top of the tree and if you requested something you generally got it and but even in that field now you're finding there's so much stress on anything related to cyber digital it's massive so organizations three letter agencies whatever it is that maybe supported you regularly can't because they're influx doing their primary task even though yours is a high value target and then you find well hang on what do we need well we need some answers ourselves so again going back to that having an organic capability in a bag that can be usable for for the operators okay so if i can if i can kind of summarize this um coming from the criminal investigation perspective it almost sounds like um you had support labs they were taking a long time to process the data and this is you know critical intelligence that you're trying to process so you might find something let's say on scene or in the field and then that would need to be sent back and processed by your lab but then that can take too long because it's potentially actionable intelligence what i would call first responders you know 90 80 90 of of the way and then given them tools that way they can actually respond in the field and start to collect and analyze data immediately is that essentially what i'm hearing okay abs absolutely but going a step further than that we have it with what's called like a let's call it a level one two and three level one would be that first responder that incident responder that that goes there be it police albeit military in whatever fashion is and this is where the technology blends we're currently working with likes of op atom in the home office here for police officers to do similar to what sf did in the sf special forces in the manner that i was just describing there but into homes managing serious sexual offenders so it might have been where an officer goes in to manage a previous serious sexual offender and and thinks you know that investigating for 20 years the hair on the back of the neck goes up something is not right here but i'm not a digital expert and i'm not seeing anything else so i'll report back to the lab i'll ask for justification to seize the 24 devices in the home the lab is already backlogged by six months sadly because it's just it's just overwhelmed which is a common air piece across all the world and the and the the user the front line police officer then you know can't really do anything at that point so we've started now adding that triage blending the best of both the quick intelligence investigation piece but making it evidential and having clear easy steps in some case patented technology from us for those officers to be able to do that get quick identification yes there is illicit material great well not great clearly but great in the sense that we can bring justice they can then remove those devices to the lab for further exploitation and again we've had we've had so many uh we were terror borders we work with a lot of the icat community internet crimes against children see salmon and so on and everybody's loved that frontline rapid response adding common sense with great digital technology and and and the boffins that sit in the cave doing all the development they are awesome and but putting all that together they loved on that front line and then we started getting maybe five years ago a big ass to say well can't you do more on the lab side use the same ethos and mentality because the digital tide is against us as we said too many devices too much data not enough individuals being able to process this can you do these profiles can you do this so we blended all that into the lab side and now we've got some exciting lab technology and that basically enables you to put job cues of 20 30 different digital high level forensic examination techniques in a row press a button and the technology the complex under the hood that is relatively easy on the front side cartridge experience but also freeze up the examiner to do the let's call it the more difficult stuff that you you can't i assume that the tools that you're talking about i mean all this development is actually taking place in the teego is that correct yeah oh okay well i'm i'm here with the teego but as detego we play really good we like to think we're the good player in the market you know we play nice in the playpen with other technologies we import many of our competitors into our technology so so that if a user already has multiple different tools they can utilize some of our um analytics that maybe other tools don't have they can do link analysis source all this great stuff but of course yeah i mean detego is is pioneering the way for this mainly because it's been lucky enough to have that blend what i call the best of both it's had the blue and it's had the black it's had the police and it's had the special ops and it's kind of mashed them all together and taken the best bits from each gone what can we learn for the for the greater good of each of those groups and as a fallout that works for borders it works for a corporate and you know it just depends how you want to utilize the technology of course there's multiple other tools out there and it's quite flattering copying similar kind of methodologies and pieces from that and and in the real world of course not one tool is going to do everything for you clearly and those of you that are experienced out there know that those are your arm there's no there's no sort of golden fleece that's going to cure everything for you but what it can do is a significant amount to get you a massive head start and across that i think the americans actually taught me that yeah one is none and two is one um can you can you expand you've talked a little bit about you know the products now and and how they apply to industry but can you talk about your role in uh deteco and specifically how your military experience transfers to a private company you touched on it a little bit i think but um you know as somebody in digital forensics if they're starting from a military background like where do they go how do they actually transfer those skills to another part of digital forensics uh sector or maybe even another industry altogether yeah i think i was specifically lucky really because it's you know the government spends millions on the special operators globally in all the different units you know wherever they are so you do kind of have a very different career path to other individuals when you come out and again it just the stars aligned so i've been using the technology i'd actually been probably a great pain in the obvious for the teego constantly hitting them up asking for changes in technology coming up with issues that we were finding forward i keep my security clearances so you're talking semi-veiled speech to try and go oh if i had this kind of problem could you solve it without giving the game away completely they were really good at it so when i came out i got approached and there was an individual working for a discrete government aid or previous government agency and then working for the company approached me and said would you like to join and i came in under special projects and sales and then over time just built up the history in the company helped with the development helped intrinsically with the developers themselves although i can't code all the way through to the trainers and then the market inside and it just it just exploded from there really and then became the um director for sales and about five months ago the managing director and obviously we just rebranded and stuff as we sort of push our team forward so and did you have to i mean did your military experience like let you like did you already have kind of uh knowledge about how all those all those aspects of the job worked through the military or is this like constant learning like how did you how did you get those skills to be able to do all of these different things it's constant learning but the the key piece is and this is a difficult one there's a big veteran push out there in the uk and and of course in the us and globally in pieces like this and one of the biggest barriers to that for um for some individuals is not understanding that correlation between what you do in the military versus how that comes across in the private sector it is extremely similar just changing words so you know it's like changing your suit you go from a green suit or a black suit jumping through windows airplanes whatever it is to a shirt and tie or you know a polo top or whatever it happens to be it's that same kind of piece and the skills that our individuals have from the miller because we're talking specifically about the military here it's the same with police and other agencies and industries that they can bring across with just their communication friendships being able to utilize i mean let's not forget it's people people are key you know if you have great developers great marketing great trainers great sales individuals all these different pieces they're going to fall down if they work in their own compartmented areas and don't gel well and there is this great bond and piece through the military that i do think comes across and when we come into that private sector and of course you're very used to working with massive organizations with multiple sensitive kind of commercial and government relationships built into that so um yeah i think it's i think it's the best of both to be honest um it'd just be brilliant for any veterans out there just take a bit of time find a mentor sit with someone regardless of whether it's digital forensics cyber whatever it is find someone most people are willing to help a little bit and just get a bit of a teaching on how change your mind or not always change your mind but pull across to how is everything that i did on that military side transferable and where are the areas where it's not that is also important as well great but it's been a great journey for me so far yeah i mean i think not just military anyone looking to get into digital forensics or switch switch what they're doing should be looking to get a mentor anyway so i think that's a really excellent point um you talked a little bit about um branding and advertising and i noticed i checked your website this morning and i saw the the new ditigo global um logo like usually whenever there's a logo update or like the site looks different there's some reason behind it is this just something you wanted to do is there a reason like what what what is that about can you tell us a little bit i think the teego has been around for well over a decade and producing cutting-edge technology and initially we were this boutique british company and that was working in the sensitive gray areas with special operations and others and it that kind of worked for us as a group because back then this technology was much more kind of hush-hush but now everybody knows there's abilities to break encryption albeit hard in some cases there's abilities to scan devices you can pull back deleted data all these different things are known so that that's no longer regarded as sensitive it's when you blend that and blend that with other pieces so um that's kind of where we ended up with with detego coming across that so yeah you've been talking about tools a little bit and and applications to different areas especially military but what um i guess what is teego working on what can we expect from you guys uh this year or coming up in the future so 100 i mean along with the the rebranding that we've just gone through i mean clearly that that was driven by bud and the marketing team so a big shout out to the team that they've done a fantastic job because we have now pushed from like i say that that discreet little bubble and that we were into a global powerhouse multi-million pound contracts with government agencies but are sticking with that ethos where if you are the single loan investigator in the small little force that is out wherever in whatever police department we are answering the phone we are taking in your concerns and and we are working like that as well so the company is staying flexible agile and really trying to do the right thing if i'm honest if you look across everything that detego does now it's got things like offline translation photo dna ai object detection for weapons cars nudity indecent images jihadis symbology right-wing symbology there's link analysis super fast rapid imaging nearly all of those things have come from client requests as opposed to just organically driven by us as a as a company so we are driving forward like that what we have noticed is that there's a there's a large need within the forensic commercial community for these kind of technologies that face the same problems the police and the military have so we've started pushing a lot of our technology across to the civil and corporate investigators of course there's still some covert and sensitive sides that are not required but on top of that we've got a case management system so that's quite new and that's still evolving so that again across police forces lining up the management of your forensic incidents your workflows having all your exhibits tracked and other parts that come into your investigations automatic alerts and to really streamline that and in fact police forces have had that for a long time in different ways what we're trying to do is make it easier more flexible and built into the kind of the tego workflow if you like whereas the military haven't done that quite so much so we're actually bringing that part of the technology across to the military from um from the law enforcement side which is great on top of that we've got endpoint monitoring so that can be from again a commercial point of view wanting to make sure that you're employing the right people that there's um no commercial espionage going on pieces like this maybe someone's leaving it's in point as as a person not in point as in like a networked server somewhere correct well endpoint as in a digital device okay but that enables you obviously to monitor individuals and also overtly or cover so including we're trying to help other countries that maybe are not as far forward in digital forensics and areas like and sadly in a lot of these countries and areas there is a higher rate of corruption etcetera probably an argumentative fact there but uh and so also some of the clients that we have in these regions want some kind of security round and being able to monitor to some degree what they do of course is it's a choice and sensitive uh piece of technology just because of the way that it can obviously be utilized even remote acquisition now so uh we did a great demo around sweden with magnus of uh high two consulting and we've been working over there for maybe eight years we've never lost the client never lost a client we've always expanded over there or they've renewed our technology which is great but we were able to access a computer back in the uk remotely acquire that and bring the evidence over at lifetime whilst in a in a short live in-person demonstration was that for internal investigations you're talking or it's like a lot of these things it depends how people want to use the technology and this specific piece was for internal investing so again you're in a company you put it out on your multiple um machines that are spread across the globe and rather than traveling to do all those pieces or having to have individually trained experts in the regions you can remote in and and do hopefully the vast majority of what you need to do without the need to to physically take that time and to go there okay so you have you have basically a product suite for not only military law enforcement you're also expanding out to um uh basically corporate investigations internal audits things like that and then also bringing lessons learned from each of those back to like you said military um that's super interesting okay um and then again your your experience in the military is going to inform a lot of that where you know i've been out in the field i know what these guys are gonna need um uh that's great okay so um we're we're kind of short on time so i'm gonna ask another question um specifically related to your um uh work experience what advice would you give students considering getting into information security and digital investigations well i'd say round peg round hole so you know make sure is what you want to be doing make sure and there's not been some weird veil pulled over your eyes that you're going to be a jack bauer running around with something the size of a cigarette packet that can image i don't know if they know i don't know if students know what jack bauer is so um well let's go let's go with james bond everybody knows james bond right and so i'd say just make sure that you know what it is you're getting into and and that you definitely have you've got to love it find the passion not the job and the rest will come and that's definitely what i found and within the military and then sadly obviously got injured and lost my career there but was blessed enough to fall into something i've been doing for a couple of years and finding that the passion is still completely there you know i find it funny eight years on in detego and i'm away at some show like technical security and i'm talking to a police officer about their investigations and before you know it 20 minutes has gone and i'm you know beaming and i'm talking about our patented technology and rapid imaging and they're like wow you still love this stuff and i'm like absolutely the the moment that goes you've got to start questioning everything but going back to your other point a mentor having someone in there that can put a you know put an arm over you direct you into a location and help you learn what you need to learn and just be a bit brave reach out you know don't wait for it to come to you don't assume that you're not up for the task don't have that fear of failure um or habit but be brave still step in um you know imposter syndrome comes up a lot i think for for individuals get in there and get it cracked but the biggest thing i notice in in my particular work environment that's changed uh over my tenure really is is trying to help people with their initiative trying to give them the tools to find the answers or at least when they hit a roadblock not just sit there and go oh yeah i've hit a roadblock okay maybe don't take the next step but think about it and come with a couple of koa's courses of action for well this is option one and two in my mind what do you think you know and that makes such a huge difference in an organization be it digital or just um you know just commercial okay um so just to kind of summarize um first off let's see if you love it which kind of implies you know test out some things um see what's online maybe look at the look at the materials and if you're enjoying what you're studying then keep with it get a mentor and then that'll help you to actually find resources that you need and then get support in the direction to go so we actually have a question from chat um and it is uh andrew do you ever get burned out from doing continuous learning and working with so many data tools devices if so how do you deal with it that is an awesome question and um yeah so when when we first started this in my last organization so in the in the special operations we had a couple of smes subject matter experts that were put in and you were putting in called a subject matter expert and you didn't have a clue what you were doing you were then built up to being that subject matter expert over over a period of time and the first time we tried this we did it the wrong way around you've got it's all a learning curve so we went out and we got all the open source tools we bought all the cots tools commercial off the shelf technology we had access to all the government tools and we tried to learn them all we tried to do it all and we became what's called combat and effective exactly as you were kind of asking there the cognitive overload the ability for the organization to operate was just extremely limited so we had to tune it down and go okay we want now just the best of breed rather than having the technology there that let's just for argument's sake say you could do 100 of everything it's not possible for the human and for the organization to actually manage that because you'd have to know consistently how to use these 12 15 tools so what we wanted to do was was take the the mass amount of data and problems and solve those and then have a few specialists that could do the j tab the chick off the chip off that all the other like minutiae kind of niche areas that everybody talks about and loves but actually really in most cases are a smaller part of your investigation overalls when you hit that wall on your your biggest stream kind of pieces in regards so that helped us a lot with that kind of um stress factors there but for me personally um yeah it can be a problem but again it's it's going back we have a thing in the military where you go on an operational sort of orm and it's like taking pots off the boil so right now if i'm super interested and i know there's a lot coming up that might be involving one type of technology you get yourself fully up to speed on that whilst keeping the others just on the bubble so they're good and all of a sudden boom something comes in on drones you're out well i haven't touched a drone in six months well great where's the manual where's the help videos where's those bits where's the sme can i quickly tap them up for a bit and pull that one back to the front get that one heated up and push it and that's that's a military technique it's probably across the board when you're hit with so many things it's almost by default you can't really do it many other ways because there's only so much you can do as any individual uh we have a couple more questions um andrew do you have paid one-to-one coaching i don't know what i don't know what for just coaching mentoring coaching is fantastic um so i i i have coaching and but generally the coaching is by my colleagues and friends fact my partner actually she works for the national health service as a learning development coach so again sometimes i i do this all the time i use people as a um sort of like a check board to go am i am i miles off here and that can even be on personal relationships with members of staff you know obviously bearing in the sensitivities of things but going you know am i reading this completely wrong or am i wrong in doing this or how does this come across sometimes in those cases i'll put stuff to the side and then go back to it re-read it and funnily enough you look at it and go yeah no that needs that means changing so i think i think they're asking for coaching from you not whether you receive coaching no i'm afraid not we is a company at train and i i am occasionally one of the trainers depending on the the style of opera or the style of the way our technology is going to be used i keep all my clearances and stuff but paid one to one afraid not it's just not enough hours in the day i would love to and but i definitely feel i can give you much more benefit helping my whole team work and giving them what they need to to sort of take that forward but we have all sorts of training courses from your basic digital forensics all the way through to and utilizing our our patented technology and pieces like that um thanks for the shout that's really kind we have uh we have one more question so um can you tell us how you started your way in forensic cybersecurity world i think we kind of covered that with military but is there any kind of last last thing you'd like to say about um going through the military first to begin um in cyber security or digital forensics any final words for that lucky lucky okay it was awesome you know i joined the round round hole round peg so i joined the military because that's what i wanted to do and i loved it i joined the marines because i loved being in the uk called the thinking soldier it's the longest training in the western world i liked the reconnaissance aspect so i went into that and then special forces and that just opens a whole plethora of different skill sets there with different agencies so really lucky going that way there are a lot of groups now within the military the royal military police military police in general are utilizing a lot this kind of technology the specific intelligence battalions are utilizing a lot of this technology obviously and special operations and pieces like that so it is a great place to go in if you already love and want to do all those pieces and once you've started that road you can start veering off down these kind of speciality pieces having a pension having a great laugh traveling the world obviously occasionally it has its downsides but that's the same with anything certainly in the world i've come from it wasn't like a screamy shouty kind of go do this do that very much a professional quiet operators uh wayforward which which was just just amazing so really lucky i'm really blessed okay great so thank you so much that's really all we have time for everyone uh we have a quiz detigo kindly offered to provide some prizes so if you fill out a little quiz about detego uh about the tools and like when you can use them in different forensic situations then they will provide these prize packs so that quiz is going to be open until this friday so if you're looking at it now i will post the quiz link in the chat now and andrew thank you so much for talking about us it's super interesting hearing the military perspective and specifically um how you got the skills in the military and how those are transferring over to the private sector so really interesting um it was a pleasure to talk to you thank you so much for joining us now thanks very much joshua thanks very much for everyone out there you