The FBI Citizen's Academy: Outreach Experience

The FBI Citizen's Academy: Outreach Experience

Speakers: Beck (blither), CISO

Conference: BSides NYC

YouTube: https://www.youtube.com/watch?v=oh7d0FR5Bkw

Overview

In "The FBI Citizen's Academy: Outreach Experience," Beck (blither), a seasoned CISO, offers a unique and deeply personal account of her participation in the FBI Citizen's Academy. This talk transcends typical technical conference presentations by delving into the rarely seen intersection of the cybersecurity community and federal law enforcement. Beck shares her journey through the 12-week program, which aims to foster greater understanding and collaboration between the FBI and the public it serves. Far from a dry recruitment pitch, the academy exposes participants to the diverse operations, challenges, and human element behind the federal agency, often shattering preconceived notions.

The talk is a compelling narrative that highlights the critical importance of bridging the historical divide between "hackers" and "feds." Beck argues that in an increasingly complex threat landscape, mutual suspicion is a luxury neither side can afford. Her experience underscores the FBI's genuine efforts to engage with various professional communities, including cybersecurity, to build trust and facilitate information sharing. For security professionals, this presentation offers invaluable insights into the operational realities, investigative capabilities, and often unseen threats that federal agents confront daily, urging a shift from an adversarial mindset to one of partnership in protecting critical infrastructure and society at large.

Background

▶ Watch: Introduction to FBI Citizen's Academy and vetting process (0:00)

The FBI Citizen's Academy is a community outreach program designed to provide business, religious, civic, and community leaders with an inside look at the FBI. Its primary goal is to demystify the agency's operations, build stronger relationships with the public, and foster a better understanding of the challenges law enforcement faces. Historically, a significant perception gap, often fueled by popular culture and a "spy versus spy" mentality, has existed between the cybersecurity community and federal agencies like the FBI. Many within the hacking space, even ethical hackers, have viewed law enforcement with a degree of suspicion or apprehension, while agencies have sometimes struggled to understand the nuances of cyber culture.

Beck's motivation to join the academy stemmed from an invitation by former FBI agents she worked with at a startup. With over 15 years in cyber, having achieved a CISO role, she sought a new, eye-opening experience that could provide a different perspective on the world of security and threat actors. The application process itself involved a background check and a "pee test," though Beck notes it was "not super thorough," suggesting a balance between vetting and accessibility for community engagement. Her journey through the academy serves as a testament to the program's success in exposing civilians to the breadth of the FBI's work, from counter-terrorism and cybercrime to human trafficking and domestic extremism, thereby providing context for why such outreach is crucial for national security. This initiative aims to cultivate a network of informed citizens who can act as ambassadors, dispelling myths and promoting a more collaborative environment for addressing shared security concerns.

Key Findings

▶ Watch: FBI's outreach goals and diverse modern image (2:00)

Beck's participation in the FBI Citizen's Academy yielded several profound insights, challenging her own preconceptions and offering a nuanced view of federal law enforcement. One of the most significant findings was the unexpected diversity within the FBI. Contrary to the outdated stereotype of "white guy, suit, tie," Beck was "relieved and surprised" to see a fair amount of women and people of color among the agents, reflecting a more modern and representative agency. This diversity extends beyond demographics to the wide array of specialized roles and personalities within the organization, from the "perky, upbeat, happy" bomb squad technicians to the highly trained tactical teams.

Another key takeaway was the dual nature of the program itself: "they're watching you as much as you are watching them." While presented as an outreach effort, there's an inherent vetting process, suggesting the FBI uses these interactions to identify potential allies, community leaders, or even individuals whose profiles might warrant further, albeit benign, observation. Beck's revelation that having an "FBI marker" on her profile now doubles the time for background checks for future jobs underscores this point.

The academy provided an unprecedented look into critical operational capabilities and real-world threats. Participants were exposed to the workings of the Regional Computer Forensics Lab (RCFL), weapons of mass destruction (WMDs) like ricin and radioactive glass, and the complexities of crisis negotiation using the "More PIES" method (Minimal encouragers, Open-ended questions, Reflecting, Emotional labeling, Paraphrasing, Effective pauses, Summary). Beck also gained sobering insights into domestic threats, including Sovereign Citizens who operate "off-grid" and reject governmental authority, and the disturbing realities of human trafficking and modern slavery within the United States. The emotional impact of learning about high-profile cases like the Gabby Petito murder, where the FBI utilized cell phone triangulation to track the suspect, underscored the gravity of their investigative work. These findings collectively paint a picture of an agency dealing with a vast, often grim, spectrum of threats, and an urgent need for public understanding and cooperation.

Technical Deep Dive

▶ Watch: Citizen's Academy isn't recruitment; agent lifestyle (3:30)

While the FBI Citizen's Academy is not a technical deep dive in the traditional cybersecurity sense, Beck's talk provides a unique lens into the operational technologies and methodologies employed by the FBI, as experienced by a civilian participant. This section interprets "technical" as the capabilities and tools used by federal agents in their daily work, offering insights relevant to security professionals who might interact with law enforcement.

One of the most striking technical exposures was to the Bomb Squad's equipment. Beck describes interacting with real bomb disposal robots, which she found "adorable" despite their serious purpose. While not detailing their internal mechanics, her account highlights the advanced robotics and remote operation capabilities crucial for safely disarming explosive devices. These robots represent a sophisticated application of engineering for hazardous environments, demonstrating the FBI's investment in protecting personnel while neutralizing threats.

The visit to the Regional Computer Forensics Lab (RCFL) in Colorado offered a glimpse into digital evidence analysis. Beck described the lab as a massive facility "filled with I.T equipment and black box stuff," indicating a sophisticated infrastructure for handling and processing digital evidence. Although specific tools or forensic techniques were not detailed, the very existence and scale of such a lab underscore the FBI's robust capabilities in digital forensics. This includes data acquisition from various devices, analysis of compromised systems, recovery of deleted information, and attribution efforts—all critical components in investigating cybercrimes, intellectual property theft, and other digitally-enabled offenses. For cybersecurity professionals, understanding the existence and capabilities of RCFLs is vital for proper evidence handling during an incident response, ensuring that digital artifacts are preserved in a forensically sound manner for potential law enforcement involvement.

Beck also touched upon the FBI's understanding and handling of Weapons of Mass Destruction (WMDs). She learned that substances like ricin, a potent biological toxin, grow "native to Colorado" and are "everywhere," yet largely unknown to the public. Furthermore, the academy highlighted the danger of radioactive glass from antique shops, which can be acquired and used for malicious purposes. This segment reveals the FBI's expertise in identifying, managing, and neutralizing chemical, biological, radiological, and nuclear (CBRN) threats. This technical knowledge is critical for first responders and specialized units, involving an understanding of material science, toxicology, and containment protocols.

In the context of criminal investigations, Beck mentioned the use of cell phone triangulation in the Gabby Petito murder case. This technique involves using the signal strength from a suspect's mobile phone to multiple cell towers to estimate their geographical location. While a common investigative method, its application in a high-profile case demonstrates its practical utility in tracking individuals and building timelines. This capability, alongside other forms of digital surveillance and data analysis, forms a cornerstone of modern criminal investigations, relying on telecommunications infrastructure and advanced data processing.

Finally, the discussion of ballistics analysis provided a visceral understanding of forensic science. Beck described seeing "glossy photo[s]... no bodies but blood and ballistics everywhere" from crime scenes, illustrating the detailed examination of firearms, ammunition, and bullet trajectories. This involves highly specialized equipment and expertise to match bullets to specific weapons, determine angles of fire, and reconstruct events, demonstrating a deep technical understanding of projectile dynamics and material science.

These elements, while presented from an observational standpoint, collectively illustrate the FBI's broad spectrum of technical capabilities, extending from advanced robotics and digital forensics to CBRN threat analysis and traditional forensic science. For the cybersecurity community, this provides a vital perspective on the operational realities and investigative prowess of the federal agency, fostering a greater appreciation for their role in national security.

Demo / Proof of Concept

▶ Watch: Hands-on experience: touching bomb robots, learning about bombs (5:55)

The FBI Citizen's Academy, as described by Beck, featured several compelling demonstrations of operational procedures and capabilities, which served as practical "proofs of concept" for the agency's training and readiness. These demonstrations were crucial in conveying the realities of law enforcement work to civilian participants.

One of the most engaging demonstrations was the Firearms Training and Security/Safety (FATS) training. Participants used weighted, non-real weapons that "felt like" actual guns in a video game-like scenario. This immersive experience required them to make split-second decisions on when and whom to shoot in various simulated threat situations. Beck found this "pretty cool," and it served as a practical illustration of the intense decision-making and training required of agents in high-stress environments. It wasn't about marksmanship per se, but about understanding the psychological and tactical demands of armed encounters. Later, participants also had the opportunity to visit a firing range, where Beck discovered her unexpected aptitude with a shotgun, and they got to fire "old Tech" retired guns that kept jamming, providing a hands-on experience with actual firearms.

A highlight of the academy was a SWAT team demonstration involving a simulated house raid. Beck described watching from a catwalk above a demonstration room as the SWAT team used live rounds to execute a "typical house raid" scenario. This demonstration was not merely theatrical; it showcased the precision, coordination, and rapid response capabilities of highly trained tactical units. The use of flash bombs (flash grenades) to disorient suspects, the methodical clearing of rooms, and the communication protocols were all on display. The scenario included a hostage situation, illustrating how the team would "get in there, kill the bad guy, get the good guy out." This live demonstration offered an unparalleled look into the tactics and operational excellence required for high-risk interventions.

Beyond these major events, the academy included several smaller, practical demonstrations focused on forensic techniques. Participants were divided into teams to observe how agents lift tire prints, footprints, and fingerprints. These sessions provided hands-on insight into the meticulous process of collecting physical evidence from crime scenes. Another demonstration focused on identifying and safely handling corrosive and toxic chemicals, showcasing the protocols for hazardous material response. Finally, the ballistics demonstration, though emotionally challenging for Beck due to personal connections to a shooting incident, was a critical component. It involved detailed analysis of crime scene photos showing blood and bullet patterns, demonstrating how forensic experts reconstruct events based on physical evidence.

These demonstrations collectively served to demystify the FBI's operational methods, showcasing their training rigor, technological applications, and forensic expertise. They provided participants with a tangible understanding of the agency's capabilities, moving beyond abstract concepts to concrete, observable actions.

Defensive Implications

▶ Watch: Tour of the Regional Computer Forensics Lab (RCFL) (6:30)

Beck's experience in the FBI Citizen's Academy, while not directly focused on cyber defense tools or exploits, carries profound defensive implications for the cybersecurity community. Understanding the FBI's operational capabilities, threat landscape perceptions, and investigative methods can significantly inform and enhance defensive strategies for organizations and individuals.

Firstly, gaining insight into the FBI's forensic capabilities, particularly through the mention of the Regional Computer Forensics Lab (RCFL), underscores the importance of proper digital evidence preservation during a cyber incident. When organizations suffer a breach, their ability to work effectively with law enforcement hinges on maintaining the integrity of logs, disk images, and network captures. Knowing that the FBI possesses advanced capabilities to analyze such evidence should prompt security teams to integrate forensic readiness into their incident response plans, ensuring that potential evidence is not inadvertently destroyed or corrupted.

Secondly, the exposure to the FBI's understanding of Weapons of Mass Destruction (WMDs) and domestic threats like Sovereign Citizens or organized "angry youth" movements broadens the scope of threat intelligence for security professionals. While cyber threats often dominate discussions, physical security and the potential for real-world violence linked to extremist ideologies remain critical. Organizations, especially those in critical infrastructure (where Beck now works), must consider holistic security strategies that integrate cyber, physical, and human intelligence to counter a wider array of threat actors, not just state-sponsored hackers or financially motivated cybercriminals. Beck's emotional account of the Aurora theater shooting and the Boulder King Soopers shooting highlights the pervasive nature of real-world violence and the need for preparedness beyond digital perimeters.

Thirdly, the speaker's emphasis on the need to move past the "spy versus spy" mentality and foster better partnership between the hacker community and federal agencies is a direct call to action for defenders. Enhanced communication and trust can facilitate vital information sharing, allowing the private sector to report significant incidents to law enforcement more readily, and enabling agencies to provide actionable intelligence back to industry. This symbiotic relationship is crucial for collective defense against sophisticated adversaries. The challenges faced by the InfraGard program, as described by Beck (being reactive, lacking symbiosis, and experiencing a breach), underscore the ongoing need for more effective collaboration models.

Finally, the talk implicitly reinforces the importance of human element in security. The crisis negotiation techniques ("More PIES") learned by Beck, though aimed at hostage situations, are applicable in various professional contexts for de-escalating conflicts or improving communication. For security leaders, understanding human psychology and communication can be invaluable in managing teams, dealing with difficult stakeholders, or even engaging with adversaries in certain scenarios. Moreover, Beck's personal vulnerability and the emotional toll of dealing with real-world crime scenes highlight the mental health challenges faced by those on the front lines, whether in law enforcement or cybersecurity. Defenders must recognize the human cost of their work and prioritize resilience and support systems.

In essence, Beck's talk serves as a reminder that effective defense in the modern era requires a comprehensive approach that extends beyond technical controls, embracing collaboration with law enforcement, understanding a broader threat landscape, and acknowledging the critical human factors involved.

Key Takeaways

• Bridging the Divide: The FBI Citizen's Academy is a crucial program for fostering mutual understanding and trust between the public, particularly the cybersecurity community, and federal law enforcement, moving beyond historical "spy versus spy" perceptions.
• Diverse Operations & Personnel: The FBI is a highly diverse organization, both demographically and in its operational scope, covering everything from advanced digital forensics and bomb disposal to WMD response, crisis negotiation, and countering domestic extremism and human trafficking.
• Operational Realities: Participants gain firsthand exposure to the intense training (e.g., FATS, SWAT demonstrations) and investigative methodologies (e.g., cell phone triangulation, ballistics analysis) employed by agents, offering a sobering look into real-world threats.
• Broader Threat Landscape: The academy highlights significant non-cyber threats, such as Sovereign Citizens, the availability of WMD components (ricin, radioactive glass), and the pervasive issue of human trafficking, emphasizing the need for a holistic security perspective.
• Importance of Collaboration: Effective national security and critical infrastructure protection require active partnership and information sharing between the private sector (including hackers) and federal agencies, rather than suspicion.
• Personal Transformation: The experience can be profoundly impactful, leading to a deeper appreciation for the sacrifices of law enforcement and a challenge to personal biases, even for seasoned security professionals.

About the Speaker(s)

Beck (blither) is a CISO with over 15 years of experience in the cybersecurity field. She has a background working at startups, where she quickly rose to a CISO role after developing security programs for a year and a half. Currently, she works in critical infrastructure, a sector she emphasizes needs robust protection. Beyond her professional life, Beck describes herself as a "car guy," with hobbies including racing go-karts and flying planes, reflecting a passion for dynamics and machinery. Her personal journey through the FBI Citizen's Academy demonstrates her commitment to understanding the broader security landscape and fostering collaboration between different communities involved in protection. Beck is also active in the security conference circuit, planning to attend Defcon and Black Hat, and speaking at other events like Day of Security. She encourages others to connect with her on LinkedIn to discuss the academy or security topics.