Action Item 3. Create a dedicated intelligence unit to identify new and emerging cybercrime threats. Links to operational framework: P1; O1; O2; O3; E3; E4; E5 Sucess Indicators - Collect and analyze data sources on cybercrime threats and trends to identify vulnerabilities and enforcement opportunities for investigators. - Produce cybercrime intelligence to identify leads and operational priorities for enforcement action. Planned Timeline Ramp-up: 2015-17. Full implementation: 2017 and ongoing. Description: The RCMP requires dedicated resources to analyze more data sources and foster a strategic, national intelligence picture of cybercrime, and to better identify major cybercrimes for enforcement action. To address this requirement, the RCMP will establish a dedicated cybercrime intelligence unit within the RCMP National Intelligence Coordination Centre (NICC). The NICC will gather and analyze cybercrime intelligence from domestic and international sources where suspected cybercrime activity has been identified and reported to the RCMP. The dedicated cybercrime intelligence unit will enhance the RCMP’s ability to analyze cybercrime threats in an operational capacity and direct resources to target Canada’s most serious and prolific cybercriminals. The NICC will also improve the RCMP’s ability to link cybercrime threats to criminal activity in other domains, such as financial crime or serious and organized crime. 4. Improve digital evidence capabilities for cybercrime investigations. Links to operational framework: P3; O7; O8; E2 - Provide digital forensic support to cybercrime investigations, including those led by the cybercrime investigative team. - Acquire new operational tools to analyze digital evidence more effectively. Ramp-up: 2015-2020. Full implementation: 2020 and ongoing. Description: Cybercrime investigations differ significantly from traditional criminal investigations. They have a greater requirement for operating in online environments through open source analysis and covert means, and obtaining and analyzing data (potential digital evidence) to drive investigations. The new cybercrime investigative team is expected to handle large and complex volumes of digital evidence, such as potential evidence from lawfully seized digital devices and servers. To address this requirement, the RCMP will devote new personnel and acquire new operational tools to directly support digital evidence requirements for cybercrime investigations, including those led by the new cybercrime investigative team. These digital forensic resources will ensure that state-of-the-art technological tools and capabilities are in place to support priority cybercrime investigations. In addition, the RCMP will examine capacity and capability requirements to push digital forensic skills and tools to the frontline of policing. Royal Canadian Mounted Police Cybercrime Strategy 13