2024 Canada Cyber Investigation Summit

Our dates have now been confirmed for October 1-3, 2024.

Located in the heart of downtown in the Hull sector, the Gatineau Convention Center is in Canada's National Capital Region.
*closest airport is Ottawa International Airport (YOW)

Venue:

Palais des congrés de Gatineau
50, boul. Maisonneuve
3rd floor
Gatineau QC
J8X 4H4

The HTCIA Canada Cyber Investigation Summit (CCIS) 2024 is the event for investigators at all levels to attend. The event will allow you to see, to learn and to evaluate the best that the industry has to offer.

The High Technology Crime Investigation Association (HTCIA) was created in the 1980’s with a goal of providing it members training and networking opportunities in the field of investigating high tech crimes. While a lot has changed over 40 years, the principle of HTCIA has not - Training for Investigators by Investigators.

The CCIS, in its 5th year, focuses on the rapid changes we are seeing in technology and the need for agility and adaptability, when conducting high tech crime investigations, by delivering invaluable content through hands-on training, leading-edge insights and extensive opportunities to exchange ideas with other event attendees – from investigators to case managers to lawyers. The event will focus on relevant and practical information, inclusive of case simulations, to support an investigator’s inherent desires to succeed at work while encouraging growth in their careers.

HTCIA has strong partnerships with organizations and a membership with affiliating international chapters.

Speakers and Agenda

Sponsor CCIS!

Pricing for CCIS 2024

Early Bird

(by Sept 1, 2024)

Regular

Existing HTCIA Member pricing:

CCIS registration and includes a one year membership extension

$750

$850

Non-Members (incl membership):

CCIS registration and includes a one year membership

$850

$950

Discount Codes available *

10%
10%
15%
20%
20%
20%

Public Sector (Public sector includes municipal to federal)
Group (5+)
Group (10+)
Group (25+)
Currently enrolled Student in a recognized institution
Fully Retired

* Cannot be combined with other group codes

Please email CCIS2024@htcia.org for the specific discount codes

Please email CCIS2024@htcia.org for the Hotel Registration code to
the FOUR POINTS by Sheraton Hotel & Conference Centre Gatineau-Ottawa

Agenda

Agenda will be updated on an ongoing basis

Click Here for the AGENDA

Tuesday. October 1

Tuesday, Pre-Conference Training

8:00 am - 5:00 pm - Vendor Trainings

Transforming DFIR Workflows with Detego Global's Groundbreaking Solutions

Detego Global is excited to announce a full-day training session that will revolutionize your approach to on-scene and lab-based investigations. Led by US Special Operations veteran Javis Olson, this certified training will provide you with an in-depth understanding of Detego Global's award-winning digital forensics and incident response technologies, enabling you to fast-track every aspect of your investigations - from data extraction and analysis to reporting.

Experience Ballistic Imager, the world's fastest forensic imaging tool, which can extract 1TB in under 8 minutes and significantly reduce data acquisition times. Learn to swiftly identify devices containing investigation-critical data using Field Triage, and gain expertise in Media Acquisition, a powerful tool that automates data capture and analysis from multiple devices. The training will also cover Detego Analyse AI+, featuring advanced AI-powered capabilities such as semantic search, AI facial recognition, real-time transcription and translation, advanced steganography detection, and intelligent automation.

This session is tailored for professionals across various fields, including the military, law enforcement, corporate security, e-discovery, and legal and investigative experts from federal, state, or government organizations. Attendees will gain invaluable insights and practical experience to eliminate data siloes, speed up investigations, and minimize backlogs. Every attendee will also receive a 60-day license to Detego Suite Pro, enabling the immediate application of the knowledge acquired.

* To ensure a seamless learning experience, all participants must bring a laptop with a pre-installed version of Detego (v 4.15), an SSD, and a thumb drive.

For your Detego license and any additional information, please email:
Javis Olson, at javis.olson@detegoglobal.com or
CJ Hamidi at cj.hamidi@detegoglobal.com

Blockchain Intelligence Group

“Blockchain Analytics for Law Enforcement" was designed to equip law enforcement personnel with the necessary skills and knowledge to tackle crimes in the digital age. Throughout the day, participants will be introduced to the fundamentals of blockchain technology, emphasizing its role in various high-tech crimes, including cryptocurrency fraud, money laundering, and cyber extortion. The training covers the use of advanced blockchain analytics tools to track, trace and analyze transactions on the blockchain, enabling officers to identify illicit activities. Experts in the field will share real-life case studies, demonstrating how blockchain analytics have been pivotal in solving complex investigations. Interactive workshops will allow participants to apply what they learn in practical scenarios, fostering a hands-on understanding of how to leverage technology in law enforcement efforts. This comprehensive training underscored the importance of staying ahead of technological advancements to effectively combat high-tech crimes. Certification of attendance will be provided for CPE credits.

Cellebrite

The Cellebrite Reader training is a one (1) day entry-level course designed to familiarize the non-technical investigator and legal professional with the simple and free Reader tool. Cellebrite Reader enables investigators to receive Universal Forensic Extraction Device (UFED) extraction reports from a forensic lab so they may complete their own searches, tag and highlight evidentiary items, and generate reports for their cases.

Course Learning Objectives

Upon completion of this course, students will be able to:

Explain the Digital Forensic Process and how Cellebrite’s solutions provide the mechanism to conduct end-to-end digital investigations.
Identify Cellebrite Reader’s features and benefits for evidence viewing and reporting.
Use Cellebrite Reader to view and analyze reports received by forensic labs.
Generate final Reader reports based on evidentiary findings from the user’s own specific needs.

Level: Entry
Length: One-Day (7 hours)
BYOD: *Attendees must provide their own device

Wednesday, October 2

Wednesday, Session Descriptions

9:00 am - 9:15 am

Welcome/State of the Association - Denis Roussel, HTCIA International President

9:15 am - 10:15 am

Keynote Session - State of the Union on Cybersecurity in Canada and Globally (Imran Ahmad, Partner and Head of Technology, Co-Chair Cybersecurity & Data Privacy at Norton Rose Fulbright Norton Rose Fulbright)

As criminal groups and foreign state actors leverage cyber-attacks for financial gain or to achieve geo-political goals, Canada has become a prime target. Our businesses, institutions and citizens are consistently being targeted by malicious actors. This session will discuss the current state of play when it comes to cybersecurity in Canada and where we're situated compared to our peers and allies. We will discuss specific techniques being employed by these groups and what law enforcement, national security, and governments can do to counter them. Specifically, we will look at how the use of artificial intelligence by these malicious actors will lead to an increase in attacks due in part to scalability. Similarly, how law enforcement is using AI to counter these threats.

10:45 am - 4:45 pm

CTF

10:45 am - 1:45 am - Part 1

Forensic OSINT (Ritu Gill)

https://www.forensicosint.com
A walkthrough of an OSINT investigations and what is the standard of evidence when going to court

How Compromised Records Can Enhance Your Investigations and Expose Cyber Risk (Matteo Tomasini)

Cryptocurrency Invesitgations - Seizure & Recovery (Arran McWhirter)

A case study format focusing on seizure and recovery in law enforcement operations

Criminal Intelligence: organized crime ab/using laws, AI, cryptocurrencies, and more (Bruce WATSON /Neal KUSHWAHA)

11:45 am - 12:45 pm - Lunch Break

12:45 pm - 1:45 pm - Part 2 Continues

Forensic OSINT (Ritu Gill)

https://www.forensicosint.com
A walkthrough of an OSINT investigations and what is the standard of evidence when going to court

How Compromised Records Can Enhance Your Investigations and Expose Cyber Risk (Matteo Tomasini)

Cryptocurrency Investigations (TBD)

Management Presentations (TBD)

2:15 pm - 3:15 pm - Part 1

Low Code/ No Code Options for Automating OSINT Processes (Chris Pierre)

In this practical lab attendees will be taught theory and practical steps to create no-code and low code ways to automate OSINT processes.

Utilizing Cloud Architecture for On-Device Collection (Richard Perillo)

Cryptocurrency Invesitgations - Seizure & Recovery (Arran McWhirter)

A case study format focusing on seizure and recovery in law enforcement operations.

CAT Labs (Arran McWhirther)

3:45 pm - 4:45 pm - Part 2

Low Code/ No Code Options for Automating OSINT Processes (Chris Pierre)

In this practical lab attendees will be taught theory and practical steps to create no-code and low code ways to automate OSINT processes.

Utilizing Cloud Architecture for On-Device Collection (Richard Perillo)

Cryptocurrency Invesitgations - Seizure & Recovery (Arran McWhirter)

A case study format focusing on seizure and recovery in law enforcement operations.

Management Presentations (TBD)

Thursday October 3

Thursday Session Descriptions

9:00 am - 10:30 am - Part 1

Modern Memory Forensics with Volatility 3 [4 hours] (Andrew Case)

Memory forensics—the analysis of volatile memory (RAM)—is an extremely powerful technique for detecting and triaging modern malware. Memory forensics is often a critical component of modern incident response due to the frequent use of memory-only payloads and rootkits that bypass EDRs, hide from live analysis tools, and often leave no file system artifacts. In this workshop, a mix of lectures and hands-on labs provides students with memory forensics knowledge and experience that can be utilized during real-world incident response. A few of the topics that will be covered during this workshop includes detection and triage of credential dumping, lateral movement, and stealthy code injection techniques. By having documentation of these techniques in the slides and gaining hands-on experience analyzing them during the labs, attendees will leave with knowledge that is immediately applicable in real investigations. This workshop is focused on Volatility 3, which is set to become the industry standard memory analysis framework in Fall 2024.

Building OSINT for Operators (William Rahal)

Attendees will conduct 3 exercises of 10 minutes each. Each
exercise will involve attendees accessing the internet with their own devices and
submitting their findings en masse

10:30 am - 11:30 am

12:30 pm - 1:30 pm

Modern Memory Forensics with Volatility 3 [continued] (Andrew Case)

Darkweb Investigations (Brock Lupton)

Investigating dark web markets safely, anonymously and securely using a managed attribution solution and Hunchly.

Cloud Forensics / eDiscovery (TBD)

Building OSINT Teams (William Rahal)

Attendees will discuss how OSINT team structures affect their capabilities, with an
exercise on building different teams for different OSINT needs and requests.

2:00 pm - 3:00 pm - Continued

Modern Memory Forensics with Volatility 3 [continued] (Andrew Case)

Darkweb Investigations (Brock Lupton)

Investigating dark web markets safely, anonymously and securely using a managed attribution solution and Hunchly.

Cloud Forensics / eDiscovery (TBD)

Building OSINT Teams (William Rahal)

Attendees will discuss how OSINT team structures affect their capabilities, with an
exercise on building different teams for different OSINT needs and requests.

3:00 pm - 3:30 pm

Conference Closing (Denis Roussel, HTCIA International President)

Keynote Speakers

Imran Ahmad (Oct 2)

Partner, Canadian Head of Technology, Canadian Co-Head of Cybersecurity and Data Privacy
Norton Rose Fulbright Canada LLP

Mark Spencer (Oct 3)

President
Arsenal Consulting

Bio

Imran Ahmad is a senior partner and the Canadian head of technology and Canadian co-head of cybersecurity and data privacy. He is based in our Toronto and Montreal offices and is recognized as a leading cybersecurity
and privacy lawyer by several legal directories.

Imran advises clients across all industries on a wide array of technology-related matters, including outsourcing, cloud computing, SaaS, strategic alliances, technology development, system procurement and implementation, technology licensing and transfer, distribution, open source software, and electronic commerce.

As part of his cybersecurity practice, Imran works with clients to develop and implement strategies related to cyber threats. He advises on legal risk assessments, compliance, due diligence, security, and data breach incident preparedness and response.

Imran often acts as "breach counsel" in the event of a cybersecurity incident, and has extensive experience in managing complex cross-border security incidents. He also provides representation in the event of an investigation, enforcement action or litigation.

Imran is the author of Canada's first legal incident preparation and response handbook titled Cybersecurity in Canada: A Guide to Best Practices, Planning, and Management, 2nd Edition (LexisNexis, March 2021). In his privacy law practice, he advises clients on compliance with all Canadian federal and provincial privacy and data management laws. He has a particular focus on cross-border data transfer issues and enterprise-wide governance programs related to privacy and information governance. Imran is the former chair of the Privacy and Access to Information Section of the Ontario Bar Association.

Imran is an adjunct professor at the University of Toronto's Faculty of Law, where he teaches cybersecurity and privacy law.

Bio

Mark Spencer is President of Arsenal Consulting, where he leads engagements involving digital forensics for law firms, corporations, and government agencies. Mark is also President of Arsenal Recon, where he guides development of digital forensics tools. He has more than 25 years of law-enforcement and private-sector digital forensics experience. He has led the Arsenal team on many high-profile and high-stakes cases, from allegations of intellectual-property theft and evidence spoliation to support of terrorist organizations and military coup plotting. Mark has testified in cases which include United States v. Mehanna and United States v. Tsarnaev.

Speakers

Speakers will be added as they are confirmed.

Andrew Case

Director of Research
Volexity

Chris Pierre

CISSP, CFE, Managing Dir.
The KeyNorth Group

Ritu Gill

Co-Founder
Forensic OSINT

William Rahal

Founder
PROSINT

Bio

Andrew Case is the Director of Research at Volexity and has significant experience in incident response handling and malware analysis. He has conducted numerous large-scale investigations that span enterprises and industries. Case is a core developer of the Volatility memory analysis framework, and a co-author of the highly popular and technical forensics analysis book “The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory.”

Bio

Ritu Gill is an Intelligence Analyst with over 17 years of experience working with Canadian law enforcement, 12 of those years were with the Royal Canadian Mounted Police (RCMP). During her tenure with the RCMP, she specialized in open source intelligence, and worked on high profile investigations. As part of RCMP’s international capacity building program, Ritu trained law enforcement in Bangladesh and India in the use of the internet as an investigative tool. In 2016 Ritu set up a consulting business providing OSINT training and research to law enforcement and related entities across North America. Ritu holds a Bachelor’s Degree in Criminology from Kwantlen Polytechnic University, and is actively involved in the OSINT community.

Bio

Bill's passion for research and the internet make him a natural OSINT specialist with a wealth of experience in developing capabilities, training, and new methodologies for OSINT.
Starting fast in 2021 by leading a 27-person proof-of-concept detachment, he spent the last few years pushing the envelope of what OSINT can become in the Canadian Armed Forces, receiving a commendation for his work.
His qualifications include a Bachelor of Computer Science from the University of Guelph (with areas of application in Computer Engineering and Data Simulation & Modelling) and a range of industry training in OSINT, Geomatics, and Organizational Leadership.

Brock Lupton

VP - Product & Innovation
Sapper Labs Groups

Erin Monahan

Law Enforcement Solutions Specialist
Ntrepid

Matteo Tomasini

Cyber Practice Lead
of Prescient

Joe Caruso

CEO/CTO
Global Digital
Forensics

Bio

Brock is proud to lead the amazing team building and supporting Hunchly. WIth 10+ years of experience in open source intelligence and cybersecurity and an extensive background in operational support, he brings a dynamic approach to meet every new challenge. Previously, he led the OSINT team at Sapper, providing tailored intelligence support to commercial and government clients, and focusing on projects investigating the Wagner Group and Russian cognitive warfare activities in Africa. Prior to joining Sapper Labs, Brock served in a variety of roles in the Canadian Armed Forces.

Bio

With over 20 years of active in-the-field experience, Joseph Caruso is a recognized industry leader in the fields of cyber security, computer forensics and eDiscovery. His experience and exposure in the industry is unrivaled and dates as far back 1980 where he developed databases and real-time systems with the capability of processing millions of transactions on a daily basis. Mr. Caruso is a seasoned technology expert who has led incident response teams for Fortune 500 companies and is a highly regarded expert, including serving in an advisory capacity for national cyber security councils for two US Presidents.

Neal Kushwaha

Chair, NSCOESN
(Canada)

Arran McWhirter

Director - Client Solutions
CATLabs

Tom Armstrong

Compliance Advisor
TRM

Javis Olson

N.A. Solutions Provider
Detego Global

Bio

Neal Kushwaha is a recipient of the Royal Humane Silver Medal of Bravery and commendation from the Governor General of Canada, an international bilingual speaker, a guest lecturer at Stellenbosch University, and a motivational speaker. He operates an Ottawa based consulting company, IMPENDO Inc. (member of the Paris Call) serving governments and international agencies as clients. His research and consulting fall within the cross-section of cyberspace, security, law, policy, and politics.

Bio

Arran McWhirter joined CAT Labs in May 2024 where he specializes in delivering tools and training programs that enable governments to effectively seize crypto assets from criminal organizations and adversarial nation states. His work addresses the growing use of cryptocurrency for laundering illicit proceeds. Prior to CAT Labs, Arran was a Supervisory Special Agent with the U.S. Department of Homeland Security, Homeland Security Investigations (HSI) where he led investigative and forensic teams that focused on transnational criminal organizations and threat actors that use emerging technology to promote their criminal enterprises. He began his career with the U.S. Department of State, Diplomatic Security Service (DSS) working domestic assignments in Washington, DC and North Carolina where he conducted fraud investigations and led protective security details for the U.S. Secretary of State and visiting foreign dignitaries. He also served internationally as a Regional Security Officer in the U.S. Embassies in Buenos Aires, Argentina and Lima, Peru.
He is ACAMS certified and holds multiple certifications in blockchain analytics and crypto asset recovery.
Arran holds a MA of Forensic Psychology from John Jay College of Criminal Justice, City University of New York and a BA in Psychology from James Madison University. He has two children in college in New York and in his spare time can be found somewhere hiking in Colorado, where he lives with his spouse Nicole and their two Kooikerhondjes.

Bio

Tom Armstrong currently serves as TRM's Compliance Advisor where he provides expert guidance and advisory support to traditional financial institutions, emerging crypto businesses, tax authorities and regulators on industry best practices for the detection and prevention of money laundering, tax evasion and financial crime within digital assets. Prior to joining TRM, Tom spent over nine years at Goldman Sachs leading various investigative teams. He served as the Head of Financial Crime Compliance Digital Assets at Goldman Sachs, leading the strategic efforts to build the bank’s first dedicated financial crime compliance team covering digital assets. He also served as the Global Head of the Forensics Group, Head of the Financial Intelligence Unit, and Transaction Surveillance Group.

Bio

Prior to joining Detego Global, Javis was employed by SOCOM Digital Forensics trainer based in Fort Liberty, NC. In addition to his role at Detego Global, Javis serves in the US Army Reserves currently. During his 18 years of service in the military, he has been deployed to Afghanistan and Africa on multiple combat tours.
Javis has also been deployed with various tier-one assets to enable support with electronic device forensics. He also ran an EAC lab in Nigeria, showcasing his expertise in this field.

Garrick Apollon

Lawyer-Filmmaker and CFE
Founder, CPE Studios

TBD

Bio

Garrick Apollon is a lawyer-filmmaker and owner of CPE Studios, a company specializing in the production of documentary films for continuing professional development (CPD) for legal and accounting professionals. An alumnus of the University of Pennsylvania Carey Law School (Penn Law), Garrick was trained in visual legal advocacy Penn Program on Documentaries & the Law. Garrick has almost 20 years of experience as a corporate lawyer with a focus on training and professional development. Garrick has taught and trained thousands of university students and professionals in Canada and internationally. A part-time professor at the University of Ottawa’s Telfer School of Management since 2005, Garrick teaches Corporate Governance and Ethics at the Executive MBA program, among other subjects. He has authored ten peer-reviewed articles in American law journals. Garrick is a strong advocate for social justice and pro bono legal services, earning him several awards.

He was called to the Law Society of Ontario in 2004 and holds degrees in civil law (LL.B.) from Université Laval and a Juris Doctor (J.D.) from the University of Ottawa. He also holds a Master of Law in International Business Law (LL.M.) from Université Laval, a Master of Comparative Law (LLCM) from Penn Law and is a Certified Fraud Examiner (CFE) with the Association of Certified Fraud Examiners (ACFE).Garrick Apollon, JD, LLB, LLM, LLCM, CFE

Bio

Plan Your Trip Today!

Ottawa

Visit Ottawa and Gatineau

Come experience the best of Canada's capital city. You will be near attractions like Parliament Hill, and many museums.

Gatineau

Tourism

Museums

Tourism

Organizing Committee

Denis Roussel

IEC President

Gilles Racine

IEC Executive Member
Organizing Committee

ccis2024[at]htcia.org

Anthony Martin

Chair
Organizing Committee

chair.ccis[at]htcia.org

Roxanne Bronsard

Co-Chair & Secretary
Organizing Committee

David Ehrlich

HTCIA Office
Organizing Committee

Jeanette Foster

HTCIA Office
Organizing Committee

Corey Forman

Stream Coordinator
Capture The Flag (CTF)

Bio

Alexandre Bruce

Stream Coordinator
Open source intelligence (OSINT)

Bio

Title: Senior Program Officer - National Fisheries Intelligence Service

Alexandre Bruce has been actively practicing Open-Source Intelligence for over 15 years. He currently
leads the Open Source Information Collection Program (OSIC) for the National Fisheries Intelligence
Service at the Department of Fisheries and Oceans. Prior to leading the national OSIC Program, he
worked for the Royal Canadian Mounted Police and in a private sector financial institution in Anti-
Money Laundering and fraud investigations.

Thomas Yohannan

Stream Coordinator
Cloud Investigations

Bio

Thomas thrives at the intersection of technology, business, and law. As a former attorney turned sales and technical partnerships expert, he specializes in security, data forensics, and law, with a dash of cyberinsurance for good measure. His passion lies in bringing products and services to market by leveraging lateral thinking, research, analysis, and a deep understanding of risk and regulatory frameworks.
Throughout his career, Thomas has crafted messages and grown bottom lines for a diverse range of companies, from early-stage tech firms like Cvent to international leaders such as Cisco and Aon, and even industry giants like UBS and Goldman Sachs