9.4.11 Investigative Services

Manual Transmittal

May 05, 2022

Purpose

(1) This transmits revised IRM 9.4.11, Investigative Services.

Material Changes

(1) In a Criminal Investigation 2021 reorganizing and restructuring of program areas, the following updates to IRM 9.4.11 were initiated:

Responsible Program Areas

Subsection 9.4.11.1 thru 9.4.11.3.5.1, revisions, deletions and additions were made to responsible program areas:

  • Electronic Crimes, revised to, "Digital Forensics."

  • Operations, Policy and Support, revised to, "Cyber and Forensic Service."

  • Reference of NFL "teams" revised to, "units."

  • Symbols CI:OPS:F updated to, "SE:CI:CFS:NFL"

    Titles

    Subsections 9.4.11.2 thru 9.4.11.3 revisions, deletions and additions were made to previous titles.

  • Digital Information and Analysis Team, revised to, "Multimedia and Deception Detection Unit."

  • New DNA Collection subsection added to 9.4.11, and numbered under 9.4.11.2.1.4

  • Questioned Document and Chemistry "Team" revised to, "Examination."

  • Polygraph Team, revised to, "Polygraph Examination."

  • Electronic Crimes, revised to, "Digital Forensics" .

  • Evidence Control, updated to specify: Evidence Control at "National Forensic Laboratory" 9.4.11.2.1.9

    Procedural Directives

    Subsection 9.4.11.2 thru 9.4.11.3.5.1 revisions, deletions and additions, were made to procedural directives:

  • Acronym table updated to concur with revisions.

  • Deleted location of Trial Graphics and Design, and the Data Processing Center teams, stating they are each headquartered in Florence, Kentucky.

  • Added NFL Headquarters are located in Chicago, Illinois.

  • Table inserted to display the different types of services provided by NFL Organizations.

  • Table inserted to display the Advance Support Services provided by Digital Forensic Team.

  • Forensics reference material is now located on NFL's SharePoint site via CI Connections.

  • Form 13437, IRS National Forensic Laboratory Request for Services, should be submitted a minimum of; updated 45/60 days, to "30 days."

  • Document Manager updated to, "Unified Checklist" .

  • Digital Forensics subsections added to reflect services and procedures.

    Renumbered Subsection

    Subsections 9.4.11.2.1.4 thru 9.4.11.2.1.9, renumbering made within the IRM as needed.

  • Polygraph Examination subsections renumbered as subsection 9.4.11.2.1.2.

  • Suitability of a Polygraph Examination renumbered as subsection 9.4.11.2.1.3

  • Legal Admissibility of the Results of a Polygraph renumbered as subsection 9.4.11.2.1.3.1

  • Previously titled Polygraph Team, updated to DNA Collection, subsection 9.4.11.2.1.4

  • Torn/Shredded Paper subsection renumbered as subsection 9.4.11.2.1.5

  • Latent Print Unit subsection renumbered as subsection 9.4.11.2.1.6

  • Questioned Document and Chemistry Examiners renumbered as subsection 9.4.11.2.1.7

  • Types of Exemplars renumbered as subsection 9.4.11.2.1.7.1

  • Requesting Exemplars (Known Writing Exemplars) renumbered as subsection 9.4.11.2.1.7.1.1

  • Collected Exemplars renumbered as subsection 9.4.11.2.1.7.1.2

  • Comparisons of Handwriting, Printing and Numeral Exemplars subsection renumbered as subsection 9.4.11.2.1.7.2

  • Mechanical Impression Comparisons subsection renumbered as subsection 9.4.11.2.1.7.2.1

  • Typewriter Exemplars subsection renumbered as subsection 9.4.11.2.1.7.2.2

  • Printer Exemplars subsection renumbered as subsection 9.4.11.2.1.7.2.3

  • Rubber Stamp Exemplars subsection renumbered as subsection 9.4.11.2.1.7.2.4

  • Charred Documents subsection renumbered as subsection 9.4.11.2.1.7.3

  • Trial and Design Services renumbered as subsection 9.4.11.2.1.8

  • Evidence Control subsection renumbered as subsection 9.4.11.2.1.9

(2) Additional grammatical changes were made throughout sections, which may/may not have resulted in substantive changes but contributed to the procedural clarity of the subject matter.

Effect on Other Documents

This IRM supersedes IRM 9.4.11, dated December 18, 2018.

Audience

CI

Effective Date

(05-05-2022)

James D. Robnett for
James C. Lee
Chief, Criminal Investigation

Program Scope and Objectives

  1. This section relates to the investigative services available within Criminal Investigation (CI) to provide special agents assistance in conducting criminal investigations and associated litigation activities. The sources providing investigative services include the following:

    1. National Forensic Laboratory

    2. Digital Forensics

    3. Field Office Resources, including: Investigative Analyst; Tax Fraud Investigative Assistant; and Compliance Support Assistant

    4. Lead Development Centers

Authority

  1. See IRM 9.1.2, Authority for the delegated authority relating to 9.4.11, Investigative Services.

Acronyms

  1. The table lists commonly used acronyms and their definitions:

    Acronyms Definition
    ASAC Assistant Special Agent In Charge
    AVI Audio, Video, and Image
    BCERT Basic Computer Evidence Recovery Training
    CFS Cyber and Forensic Services
    CIFA Computer Investigative Forensic Analysts
    CIS Computer Investigative Specialist
    CPE Continuing Professional Education
    CSA Compliance Support Assistant
    DF Digital Forensics
    DFFS Digital Forensics Field Services
    DFL Digital Forensics Lab
    FBI Federal Bureau of Investigation
    IA Investigative Analyst
    NCIC National Crime Information Center
    NFL National Forensic Laboratory
    ORI Originating Agency Identifying
    RDFL Regional Digital Forensics Lab
    SAC Special Agent In Charge
    SSA Supervisory Special Agent

National Forensic Laboratory

  1. The NFL commonly known as the "Forensic Lab" is a section under the office of Cyber and Forensic Services Criminal Investigation. The NFL is comprised of separate and distinct units, each of which offers services relating to evidence gathered in the course of an investigation.

  2. The NFL is headquartered in Chicago, Illinois, with additional examiners located in a few other cities across the nation.

  3. Each of these groups offers distinct services relating to evidence gathered in the course of an investigation. The NFL maintains up-to-date contact information and forensic reference material on CI Connections. The NFL's SharePoint site via CI Connections should be reviewed for additional information that may be utilized during investigations. The following subsections will briefly describe the individual units within the NFL and the services provided by each team. The subsections also detail how to request and obtain services provided by the NFL.

National Forensic Laboratory Teams

  1. The NFL is divided in to two sections, Trial and Design Services and Scientific Services. Units in each section deliver specific services. There is useful information on the NFL's SharePoint site via CI Connections that should be reviewed early on in an investigation to determine if the NFL may be useful. The NFL is organized as follows:

    NFL Organization NFL Services
    Trial and Design Services
    • Trial Support

    • Special Projects

    Scientific Services Pattern Interpretation and Chemistry Unit
    • Questioned Document Examination

    • Chemistry Examination

    • Latent Print Examination

    • DNA Collection

    Multimedia and Deception Detection Unit
    • Audio, Video, and Image Analysis

    • Polygraph Examination

Multimedia and Deception Detection Unit
  1. The Multimedia and Deception Detection Unit provides Audio, Video, and Image (AVI) analysis, as well as, deception detection services through polygraph examinations.

  2. Using forensic software, examiners are able to apply non-destructive techniques to better hear and/or see events as they occurred. Examiners aim to clarify recordings and to preserve speech quality and recording authenticity. They also aim to clarify photographs or shot footage while preserving the integrity of the original image or video.

Polygraph Examination
  1. Polygraph Examiners conduct examinations to test credibility issues which may arise before, during, or after the completion of an investigation.

  2. Polygraph Examiners also evaluate examinations conducted by operators outside the IRS.

Suitability of a Polygraph Examination
  1. A polygraph examination may be used to determine the reliability of information provided by informants, subjects, witnesses, and cooperating defendants. A polygraph examination may also be conducted pursuant to a plea agreement in order to determine if the defendant is cooperating fully with the government.

  2. A polygraph examination should be used selectively as an investigative tool. A qualified polygraph examiner should be directly consulted by the special agent whenever a polygraph is being considered. A qualified examiner is trained to evaluate the suitability of the polygraph technique as requested by the special agent.

Legal Admissibility of the Results of a Polygraph
  1. The legal admissibility of the results of a test (deception indicated, no deception indicated, inconclusive, or no opinion) varies by jurisdiction. However, statements, admissions, and confessions, obtained during the examination process are generally admissible in court

DNA Collection
  1. Examiners at the NFL can attempt to collect DNA from items of evidence.

  2. Requests for DNA Collection may be made via the IRS National Forensic Laboratory Request for Services Form (13437).

  3. Collection of DNA samples does not necessarily require analysis of the sample. Suitability for subsequent DNA analysis will be determined on a case by case basis with the evaluation of the evidence in conjunction with documented communication with the submitter.

Torn/Shredded Paper
  1. Torn/shredded paper evidence should not be taped or glued together prior to submission to the laboratory. The examiner will evaluate the characteristics of the torn/shredded edges to reconstruct the documents. If the torn/shredded documents are found in the garbage or a shredder, the special agent should attempt to maintain the integrity of the torn/shredded documents by handling them as little as possible.

Latent Print Unit
  1. Latent Print Examiners process evidence and compare latent finger and palm prints found on evidence to fingerprint and palm print cards of known subjects. The use of new techniques has enabled the development of previously undetectable prints. Latent Print Examiners can search unidentified latent prints through computerized fingerprint and palm print databases throughout the country. Review NFL SharePoint site via CI Connections for additional technical information.

  2. When a subject is required to provide handwriting exemplars and/or to be photographed, special agents should also obtain fingerprints and palm prints of the subject, and submit them with the evidence to be examined.

    1. A full set of known prints consists of clearly and completely recorded fingerprints and palm prints, including the area referred to as the "writer’s palm." The writer’s palm is that area on the side of the palm which normally rests on the paper when writing.

    2. Fingerprints should be recorded on Form FD-249, Federal Bureau of Investigation. Form FD-249, with the Field Office’s Originating Agency Identifying (ORI) Number, may be obtained directly from the FBI.

    3. Fingerprints and palm prints are also taken by a method called live-scan or direct electronic fingerprinting/palm printing. This method records prints digitally into a computer database after fingerprints/palm prints are rolled/recorded on a piece of glass of a computer-driven scanner.

    4. If an agent is unable to roll/record the subject’s prints, fingerprints and palm prints may be obtained from the FBI Identification Division, which contains civilian and criminal records. The FBI number of an individual with a criminal history may be found in the NCIC. This number is necessary for ordering purposes. When using the services of the NFL to obtain a set of prints, special agents must provide the person’s FBI number.

    5. Although a set of recorded fingerprints/palm prints might be considered classifiable, that does not mean they are fully comparable or identifiable to latent fingerprints/palm prints.

    6. The utmost care must be utilized to ensure that subjects do not handle any original documents relating to the investigation during interviews, etc. This would negate any subsequent examination for latent prints on those documents. If it is appropriate to preserve the evidence for examination, the evidence should be placed in document protectors before it is shown to the subjects.

Questioned Document and Chemistry Examiners
  1. The Questioned Document and Chemistry Examiners conduct analysis and comparisons of questioned and known documentary evidence. This includes handwriting, hand printing, numerals, mechanical impressions, and ink and paper. Examiners also decipher obliterations and alterations, and develops indented writing on documents. Burned or torn/shredded documents may be submitted; however, special agents should contact the laboratory for specific instructions and guidance before handling and/or submitting burned of torn/shredded documents.

    Note:

    It is very important not to add any indentations to the questioned documents during their collection, handling, or shipping. The documents should be put in plastic sleeves or document protectors for handling. Never place other papers on top of the evidence and then write on them. The transmittal envelope should be addressed before the documents are placed inside.

  2. Exemplars should be obtained whenever special agents become aware that the authenticity or origin of a document may be questioned. It is critical that special agents obtain original known exemplars before submitting a request. The results of the examinations performed by the NFL depend largely on the quality of the known writing that is submitted for comparison.

Types of Exemplars
  1. There are two types of exemplars: requested and collected. Whenever possible, both types should be submitted.

Requested Exemplars (Known Writing Exemplars)
  1. Requested exemplars contain repetitions of all of the letters and letter combinations that are present in the text of the questioned documents.

  2. Requested exemplars are gathered during the course of an investigation as a result of a request, summons, or subpoena of the suspected writer.

  3. A summons or a subpoena may be issued to a subject for the purpose of providing handwriting exemplars. Compulsion of handwriting exemplars is neither a search nor seizure subject to Fourth Amendment protections, nor testimonial evidence protected by the Fifth Amendment privilege against self-incrimination. Serving a summons on a subject for the purpose of taking exemplars is within the authority of 26 USC 7602. This action does not violate the Fifth Amendment rights of a subject, or policies established by Congress because handwriting exemplars are deemed identifying physical characteristics. The NFL SharePoint site via CI Connections has more information, or contact examiners at the NFL on requesting known writing exemplars.

Collected Exemplars
  1. Collected exemplars consist of normal course-of-business records such as personal papers, canceled checks, rent applications, receipts, school documents, etc. Collected exemplars are naturally written (no disguise) and they are an excellent source of known writing when comparing writings.

Comparisons of Handwriting, Printing and Numeral Exemplars
  1. Special agents should contact Questioned Document and Chemistry Examiners at the NFL prior to obtaining exemplars. Special agents should use the following guidelines when obtaining exemplars:

    1. Exemplars should be original documents known to have been written by the person suspected of writing the questioned document.

    2. Exemplars should contain repetitions of all of the letters and letter combinations that are present in the text of the questioned documents.

    3. Exemplars should approximate the questioned writing conditions (i.e., if handwritten, get known handwriting; if upper-case hand printed, get known upper-case hand printing, etc.).

    4. Exemplars should be made with a similar writing instrument, on similar paper, and should include, as nearly as possible, the full text of the questioned document.

  2. In addition to getting exemplars containing comparable repetitions of the questioned text, special agents should use Form 6540 (EN-SP), (see Unified Checklist or the Media and Publication Services catalog page) to obtain a general sample of an individual’s writing.

Mechanical Impression Comparisons
  1. Examinations and comparisons of mechanical impressions, including typewriter impressions and rubber stamp impressions can be conducted. Identifications are based on individual defects usually caused by wear or damage.

Typewriter Exemplars
  1. If a known typewriter is located, Questioned Document and Chemistry Examiners at the NFL should be contacted to determine if the typewriter should be submitted to the laboratory or if exemplars should be taken from it.

    1. If the machine is equipped with a readable carbon ribbon, the ribbon should be removed, protected, and submitted. The team has the capability of transcribing the text found on readable carbon ribbons.

Printer Exemplars
  1. If a printer is located, Questioned Document and Chemistry Examiners at the NFL should be contacted before submitting it or exemplars from it to the laboratory.

Rubber Stamp Exemplars
  1. If available, the known rubber stamp should be submitted along with the questioned documents bearing rubber stamp impressions. The document examiner will examine the rubber stamp before producing exemplars. No attempt should be made to clean the rubber stamp before submitting it to the laboratory.

Charred Documents
  1. Charred or burned documents may be examined and imaged with the aid of various light sources. Many times what is not visible under ordinary light may be deciphered and recorded using specialized light sources. Charred or burned documents should be placed in protective packaging and submitted, as soon as possible to the laboratory. Special agents should contact the laboratory for specific instructions and guidance before handling charred or burned paper evidence.

Trial and Design Services
  1. Visual Information Specialists design presentations based on supporting evidence and statistical information provided by the trial team during consultation. Designers collaborate with CI counterparts to create branded print and digital marketing material. All products are provided to customers after multiple phases of design comprehensives. Ongoing communications and support is provided throughout the trial and product development.

  2. Summarized graphics are prepared and designed based on supporting evidence and various statistical information provided to the Visual Information Specialist. Methods used in the design of graphics include consultations and correspondence, review of evidence and charges. The types of graphic vary from basic graphs such as bar charts, line, pie maps, and timeliness. Other graphics include link analysis, computations and element of the offense charts.

  3. Form 13437, IRS National Forensic Laboratory Request for Services, should be submitted a minimum of 30 days before to allow for consultation and to provide sufficient time to discuss the evidence and documentation that will assist in the preparation of the graphics. Form 13437, IRS National Forensic Laboratory Request for Services, can be located on the CI Connections page under Cyber and Forensic Services, on the NFL's SharePoint site.

Evidence Control at National Forensic Laboratory
  1. Evidence Control receives all requests for the NFL and tracks these requests as they move through the NFL between services. Evidence Control is responsible for ensuring the integrity of the evidence when it comes in and leaves the laboratory.

How to Request Services of the National Forensic Laboratory

  1. Special agents should initiate requests for any service offered by the NFL using Form 13437, National Forensic Laboratory Request for Services (see Unified Checklist or the Media and Publication Services catalog page). Information required on the form includes the investigation name and number, type of request, type of investigation, investigation synopsis, description of the submitted evidence, and the submitter’s contact information.

  2. Whenever possible, original evidence should be submitted for examination. If copies are the only available evidence they can be submitted; however, the examination may be limited. Special agents should keep copies of the original evidence submitted to the NFL.

  3. Form 13437, National Forensic Laboratory Request for Services, includes instructions on how to fill out the form and how to package, seal and ship the evidence. If an expedited examination is needed, the special agent should indicate the reason and/or pending court or grand jury date. Special agents should call and advise the team in advance of an exigent request.

    Note:

    All evidence should be secured from the time the evidence is obtained through the course of the investigation. Before submitting evidence to the laboratory, it is recommended that special agents call the laboratory and/or review the CASE web page under Forensic Lab/Evidence Control.

  4. Requests for services and evidence for any of the NFL teams should be sent to the following address:

    Evidence Control, National Forensic Laboratory
    SE:CI:CFS:NFL
    Internal Revenue Service
    Criminal Investigation Division
    525 W. Van Buren St., Suite 400
    Chicago, Illinois 60607

  5. Special agents should submit the request for services and the evidence, as soon as they realize their investigation may benefit from the services offered by the NFL.

Use of a Non-IRS Laboratory
  1. In situations where the use of a non-IRS laboratory is being considered, the SAC of the requesting field office may contact the NFL Director, SE:CI:CFS:NFL for recommendations and guidance based on services needed and/or turn-around-time.

Role of the Examiners

  1. Examiners prepare reports based on their examinations and conclusions. They are available to testify in court or other judicial proceedings regarding their conclusions.

Travel by the Examiners
  1. In situations where it is necessary for examiners to travel to a field office to perform on-site examinations and/or consultations, travel must be coordinated with the specific examiner and NFL management. The examiners are also available to travel to the field offices for CPE presentations.

  2. Requests for travel by NFL examiners to perform on-site examinations should be submitted on Form 13437 as specified (see subsection 9.4.11.2.2). Requests for examiners to participate in CPE presentations should be made in writing (either memorandum or e-mail) by the SAC to the Laboratory Director, SE:CI:CFS:NFL.

  3. The cost of the services provided by the NFL is not charged to the requesting field office as the cost is paid using the NFL’s budget. The cost of NFL services may be charged to the defendant if the judge orders the defendant to pay court costs.

Evaluation of Services

  1. At the completion of a case, special agents will receive and are asked to complete Form 13436, IRS National Forensic Laboratory Evaluation of Services. The evaluation will enable the NFL to meet laboratory accreditation requirements, while maintaining quality services and keep apprised of the field offices’ needs.

Digital Forensics

  1. Digital Forensics (DF), formerly known as Electronic Crimes, is a section within Cyber and Forensic Services (CFS), Forensic Services. Digital Forensics is comprised of two units:

    1. Digital Forensics Field Services, and

    2. Digital Forensics Lab

  2. DF is led by a Director, Digital Forensics

Digital Forensics Field Services

  1. DFFS is led by an Associate Director(s), Digital Forensics Field Services.

  2. Each DFFS group is comprised of one SSA, CIS and a mix of 1811 CISs, and non-1811 CIFAs and contract employees.

  3. Each DFFS group is located in RDFL or in a smaller remote lab throughout the country.

  4. DFFS personnel are trained in digital forensics methodology to ensure digital evidence is acquired, authenticated, analyzed, and reported in a forensically sound manner according to established forensic best practices.

    1. Each CIS and CIFA successfully completes BCERT a six-week course that provides baseline digital forensics training, and Basic Mobile Forensics, a two-week course that provides baseline mobile forensics training.

    2. Each CIS and CIFA attends annual advanced training courses to maintain a high level of proficiency and develop additional skills.

    3. Each CIS and CIFA is required to obtain and maintain various digital forensics certifications to ensure their skills meet industry standards.

  5. DFFS provides vital services to support criminal investigations:

    1. Assist case agents with affidavit writing and review.

    2. Provide technical digital forensics services at search warrants, for subpoena/summons responses, and during consent evidence production.

    3. Ensure digital evidence is obtained, validated, and maintained in a forensically sound manner.

    4. Conduct analysis on digital evidence to locate and properly interpret potential evidence.

    5. Report to case agent on results of analysis.

    6. Assist with discovery production by providing validated copies of digital evidence obtained throughout the investigation.

    7. Assist case agents with seizure of cryptocurrencies.

    8. Other digital forensics tasks as required.

  6. It is vital to request DFFS services as early as possible in the investigation when digital evidence is anticipated. Affidavit review must occur prior to final approval to ensure legal requirements are met, all investigative needs are addressed, and no undue restrictions are present. Digital forensics requires extensive planning, research, and resources prior to enforcement actions.

Digital Forensics Lab

  1. DFL is led by an Associate Director, Digital Forensics Lab.

  2. Each DFL group is comprised of one SSA and a mix of 1811 Senior Analysts and non-1811 CIFAs.

  3. The DFL is headquartered in Woodbridge, Virginia. Some DFL personnel are located in a RDFL or in a smaller remote lab throughout the country.

  4. DFL personnel are trained in digital forensics methodology to ensure digital evidence is acquired, authenticated, analyzed, and reported in a forensically sound manner according to forensic best practices.

    1. Each Senior Analyst and CIFA successfully completes BCERT, a six-week course that provides baseline digital forensics training, and Basic Mobile Forensics, a two-week course that provides baseline mobile forensics training.

    2. Each Senior Analyst and CIFA attends annual advanced training courses to maintain a high level of proficiency and develop additional skills.

    3. Each Senior Analyst and CIFA is required to obtain and maintain various digital forensics certifications to ensure their skills meet industry standards.

  5. DFL assists DFFS as needed to provide support in criminal investigations.

    1. Provide technical digital forensics services at search warrants, for subpoena/summons responses, and during consent evidence production.

    2. Ensure digital evidence is obtained, validated, and maintained in a forensically sound manner.

    3. Conduct analysis on digital evidence to locate and properly interpret potential evidence.

    4. Assist case agents with seizure of cryptocurrencies.

    5. Advanced support through DFL Teams as needed.

    6. Other digital forensics tasks as required.

  6. DFL provides advanced support to DFFS through the following DFL Teams.

    DFL Team Advanced Support
    Cyber Team
    • Cryptocurrency seizures

    • Cloud investigations

    • Network intrusions

    • Pent/Trap orders

    • Title III Intercepts

    • Dark Web investigations

    • Website captures

    Data Recovery Team
    • Hard drive recovery

    • Encryption

    • Password cracking

    • Specialized imaging

    Hardware Team
    • Selection and purchase of DF forensic equipment

    • Testing and validation of equipment

    • Maintain inventory records

    Mac Team
    • Mac Imaging

    • Apple specific tools

    • Apple cloud analysis

    Mobile Team
    • Mobile forensics tools

    • Advanced mobile device extraction

    • Cloud analysis

    Programming/Databases
    • Databases

    • Linux based forensics

    • DF created forensic programs

    Software
    • RAM captures

    • Windows forensics

    • Selection and maintenance of DF forensic software

    • Testing and validation of software

    Systems
    • Network forensics

    • Server forensics

    • Virtualization

  7. In addition to the DFL teams above, DF has several DFL Teams which support the infrastructure of DF.

    DFL Teams DF Infrastructure Support
    Training and Education
    • Coordinate DF basic and advanced DF training

    • Develop basic and advanced DF training curricula

    • Certification maintenance and renewal

    Quality Assurance
    • Creation and maintenance of DF Standard Operating Procedures (SOP)

    • Ensure established procedures conform with industry practices for accreditation

    • Create and maintain methodologies for DF proficiency testing

    • Create and maintain protocols for DF technical reviews

    • Monitor DF training and certification compliance

    Electronic Crimes Environment
    • Technical lead for ECE

    • Lead Area CIS cadre lead

    • Develop and deploy ECE training

    • Monitor resources

Evidence Control at Digital Forensics

  1. DF employees will maintain proper Chain of Custody for all items in DF custody as per DF Standard Operating Procedures.

  2. DF employees will maintain custody of digital devices as needed during the acquisition phase. Once acquisition is complete, custody will be transferred to the case agent. Any exception will be approved by the SSA-CIS and recorded in the case file.

How to Request Services of Digital Forensics Field Services

  1. Case agents should initiate requests for service using Form 10908, Computer Investigative Specialist Request for Assistance.

  2. Case agents should initiate requests as soon as practicable upon determining a search warrant will be executed, a consent involving digital evidence will be scheduled, a cryptocurrency seizure is likely, or a search warrant or subpoena for digital evidence will be issued.

  3. Form will be submitted through SSA to SSA-CIS for assignment

  4. It is vital to request services as early as possible in the investigation when digital evidence is anticipated. Digital forensics requires planning, research, and resources prior to enforcement actions.

How to Request Services of Digital Forensics Lab

  1. If a DF employee is assigned to an investigation, no additional form is required. If not, case agents should initiate requests for DFL service using Form 10908, Computer Investigative Specialist Request for Assistance through the SSA-CIS.

  2. DFFS will initiate requests for DFL assistance through internal request processes. DFL SSA or Associate Director, DFL will assign an appropriate Team and DFL personnel to assist on the case.

How to Request Digital Forensics Services for Cryptocurrency Seizures
  1. Case agents should follow procedures set forth in 9.7.12.4. DF has set up a Cryptocurrency shared mailbox specifically for cryptocurrency seizures.

Investigative Analyst

  1. The IA assists in the identification of noncompliance with tax laws and supports ongoing criminal investigations by researching, collecting, analyzing, and evaluating raw data. The IA is available to support any investigation in the field office. For additional information pertaining to IA assistance go to CI Connections-CASE-Communities of Practice (CoPs)-Investigative Assistance for SAs.

Tax Fraud Investigative Assistant

  1. A TFIA provides technical support to special agents. The TFIA regularly operates various types of communications equipment and serves as the central communications point for the field office and subordinate offices. For additional information pertaining to TFIA assistance go to CI Connections-CASE-Communities of Practice (CoPs)-Specialized Responsibilities-IA/TFIA.

Compliance Support Assistant

  1. The CSA provides clerical and program assistance, to a work group of special agents in a CI field office.

Group Resource

  1. The CSAs may be centrally managed by the SAC or an ASAC, or may be assigned to a specific work group in a field office. Each CSA provides support to more than one group.

  2. The CSA duties and support are normally limited to the office environment. A CSA is not authorized to perform field investigation work typically performed by TFIAs.

When to Request

  1. Special agents may request the assistance of a CSA anytime during an investigation or when help is needed. Special agents should consider requesting the services of a CSA whenever the services will result in more efficient use of CI's resources.

Services Provided by a Compliance Support Assistant

  1. A CSA provides a variety of services. The list of possible services performed by a CSA includes, but is not limited to, the following functions:

    1. Performs complex research in support of ongoing investigations and gathers, extracts, and compiles information from a variety of sources. These sources include internal and external investigative databases and the internet.

    2. Assists as directed in verifying accounting records; extracting information from books and records; interviewing informants or witnesses; administering handwriting and handprinting exemplars; preparing related reports, correspondence, and other documents; and serves as corroborator/witness during interviews with principals or third parties.

    3. Selects and uses small computer applications for presentation of word processing, database, and spreadsheet tools to meet users' needs.

    4. Assembles investigation files and reports into prescribed formats, ensuring that all required or related materials have been included.

    5. Inputs CIMIS updates; assists in the maintenance of Criminal Investigation Equipment Control System (CIECS); requisitions tax returns using IDRS; maintains the tax return inventory; and oversees the maintenance of office files.

Request for Compliance Support Assistant Assistance

  1. To request the services of a CSA, special agents should coordinate the assistance of the CSA through their CSA’s immediate supervisor.