Dane County Sheriff’s Office Badge (Credit: danesheriff.com)

When law enforcement officers are investigating complex cases, finding connections among people, places, and events is critical. “You start to see who has mutual connections,” explains Detective Timothy Blanke of the Dane County (Wisconsin) Sheriff’s Office, Field Services Division. “Eventually you get that big, spoked wheel of different people, and usually one or two are usually the main hub of those wheels. Then you can start looking at all of the different spokes in the wheel and see who they move with and who they’re friends with – and work either in or out from there towards your main suspects.”

Detective Timothy Blanke of the Dane County Sheriff’s Office, Field Services Division (Credit: danesheriff.com)

Two key challenges get in the way of creating these “spoked wheels.” One is the proliferation of mobile devices in criminal activity, and with them, massive storehouses of data. The other challenge, Blanke says, is the need to collaborate with fellow law enforcement agencies. “Because we have clusters of different departments, it’s not hard for a suspect to walk across the street and all of a sudden be in a completely different city and in a completely different jurisdiction,” he says. “You need to be in constant communication with your other agencies as to who’s working on what because it’s not tough to have two burglaries right across the street from each other but in two different towns.” The Dane County Sheriff’s Office is a good example of a law enforcement agency that can benefit from inter-agency collaboration. The office is located in the city of Madison, which has its own police force; but the sheriff’s office is also responsible for highway and trail enforcement activities in the rural reaches of Dane County. And since Madison is the state’s capital city, the sheriff’s office also oversees law enforcement for events occurring in the capital region.
“Criminals are becoming more sophisticated, and we need to be sophisticated as well because criminals don’t respect the lines that we have to respect.” 
The crisscrossing law enforcement responsibilities around the county’s 1,200 square miles make collaboration among agencies essential. For the Dane County Sheriff’s Office, that collaboration has been strengthened by technology – specifically, Investigative Analytics, which investigators, analysts, and prosecutors use to share Digital Intelligence, collaborate on cases, surface leads, and build out the “spoked wheels” that help solve cases and bring criminals to justice. (Digital Intelligence is the data collected and preserved from digital sources and data types – such as smartphones, computers, and the cloud – and the process by which agencies collect, review, analyze, manage, and obtain insights from this data to run their investigations more efficiently.) Finding Ways to Work Smarter It’s not just the proliferation of cell phones that steers departments like the Dane County Sheriff’s Office toward Digital Intelligence solutions to fight crimes like car theft rings. It’s also the changing tactics of policing, some of which are driven by community pressure. For instance, highly visible, high-speed chases – the staple of many police procedural movies and TV shows – aren’t acceptable to local citizens, especially when they result in road accidents.
“It [Cellebrite Pathfinder] really revolutionized our collaboration.” 
“We might find violent offenders and arrest the bad guys that way, but people won’t tolerate the dangers that come with that for property crimes,” Blanke says. “We could also use road spikes so that the car’s tires would go flat. That leaves us returning a damaged vehicle to our victim. We had to find a way to work smarter, and use the clues that we can find to solve crimes without putting the general public at risk.”

Dane County Sheriff’s Office uses Cellebrite Pathfinder to help improve cross-agency crime-solving by automating digital analysis across complex networks of crime rings (Credit: Cellebrite)

To step up on cross-agency crime-solving, the sheriff’s office adopted Cellebrite Pathfinder. “It really revolutionized our collaboration,” Blanke says. By automating digital analysis, even for large amounts of data and complex networks of personas in crime rings, Cellebrite Pathfinder helps the sheriff’s office share what officers know with neighboring law enforcement agencies. Officers also get the benefit of applying artificial intelligence to case resolution. “Criminals are becoming more sophisticated, and we need to be sophisticated as well because criminals don’t respect the lines that we have to respect,’” Blanke says. Cracking a Car Theft Ring The power of collaboration and analysis solutions became crystal clear when the Dane County Sheriff’s Office had to find and arrest the perpetrators of a broad car theft ring. It’s a common practice in the Madison suburbs for commuters to warm up their cars in their driveways on frigid winter mornings – often leaving the keys in the ignition. The thieves would drive around neighborhoods in a single-vehicle, jump out, check car doors to locate keys in running cars, then take off with the stolen vehicles.
“When we were able to demonstrate that it would benefit everyone to work together, agencies started contributing, regardless of jurisdictional lines.” 
“Then the thieves started getting even bolder and going into houses,” Blanke explains. “They would look for doors that were unlocked, go inside, and take the car keys. If they saw a purse or a wallet, they’d likely grab any cards out of that, and then grab the cars out of the garage.” These amped-up car and house thefts were even more worrisome, he adds, because of concerns that homeowners and thieves might end up in armed encounters. Through traditional shoe-leather policing, Blanke and his fellow officers discovered that the thieves were parking many of the stolen cars at a local mall parking lot. “When they needed a car, they’d go grab one,” Blanke says. But catching the thieves in action still eluded the officers. An auto-theft team of five deputies tried to guess exactly when and where the thieves would strike – for example, by deploying surveillance airplanes from the state’s police force. This turned out to be a hit-or-miss tactic: No one could be sure when the thieves were out, and if the weather wasn’t clear, no one could see the ground. “It’s very cost-intensive to have that many people sitting around in the middle of the night and a plane in the sky, hoping somebody does something,” Blanke says. Digital Evidence Provides the Big Picture The Dane County Sheriff’s Office is now using a complete Digital Intelligence Platform to solve cases, which includes UFED 4PC and Cellebrite Physical Analyzer to collect and review data, and Cellebrite Pathfinder to handle investigative analytics. With these tools in place, the timing was right to attack the car theft problem anew, since, at the beginning of the COVID-19 pandemic, the thefts started to pick up. At the same time, members of the Madison city police force, who knew some of the suspected players in the car theft ring, started tracking the suspects’ movements on social media to obtain more names and places. And members of the sheriff’s office car theft team were working with other law enforcement agencies in the county to gather information about car thefts.

The Dane County Sheriff’s Office uses a complete digital intelligence platform to find and arrest the perpetrators of a broad car theft ring. Tools such as UFED 4PC, Cellebrite Physical Analyzer, and Cellebrite Pathfinder have proven to be critical in collecting and reviewing data and handling investigative analytics. (Credit: Shutterstock)

“I started noticing that more phones were coming to me,” Blanke said. “When we recover a car that’s stolen, we’ll frequently find mobile devices left behind. We realized that the suspects’ phones are their lives. We could probably find even more data about who these people are, rather than just hope we catch them in the act next time. I thought, why not put everything into Cellebrite Pathfinder and see what we can learn?”
“We’re keeping all the files in Cellebrite Pathfinder, ready to go. When the next round of car thefts occurs, we can feed in new data and see if it’s the same guys at work, or if we have new players.”
Officers began feeding any possible information on the theft ring into Cellebrite Pathfinder – such as social media data, data from phones found in stolen autos, and iVe data from Berla, the vehicle forensics tool. Information from Berla, such as data from a vehicle’s several dozen electronic control units, can be converted into the Cellebrite data format and viewed through Cellebrite Pathfinder. “From the navigation data, sometimes we’d see vehicles going to similar locations,” Blanke says. “That way, we’d know the places they might be dumping them or places they’re taking the cars for other activities.” As officers from various agencies tracked suspects’ social media activity, the Dane County Sheriff’s Office obtained warrants for the relevant social media data, then entered that data into Cellebrite Physical Analyzer and eventually Cellebrite Pathfinder. The result was the “big, spoked wheel” of suspects and their connections to the car thefts, such as videos of suspects in the cars that they had stolen. “We played the long game,” Blanke says. “As soon as we had files on given cars and suspects, we’d send over a set of charges.” Eventually, about 70 charges were filed against suspects, although the investigations are ongoing. “We’re keeping all the files in Cellebrite Pathfinder, ready to go,” he says. “When the next round of car thefts occurs, we can feed in new data and see if it’s the same guys at work, or if we have new players.” Digging Deeper Into Phone Data The analytic approach to digital evidence has since served the Dane County Sheriff’s Office well in other situations. In a recent case involving child pornography, a suspect had already confessed to possession of images, and his phone was obtained via warrant. The digital evidence in the phone, processed by an outside agency using Project VIC hash values, appeared to only have images of children that were not illicit per se. “In Wisconsin, we would have never been able to charge the suspect using those images,” Blanke explains, despite the suspect’s confession.

Dane County Sheriff’s Office’s analytic approach to digital evidence has helped Detective Blanke and his colleagues to solve complicated and cross-agency crimes. (Credit: danesheriff.com)

Using Cellebrite Pathfinder, Blanke and his colleagues examined the phone data again, using Pathfinder’s image classification function. This time, the digital forensics team found about 30 self-manufactured images that were created by the suspect as he was FaceTiming with children.
“We need to find ways to put bad guys in jail safely and efficiently.”
“Not only did we have the screenshots, but we had the suspect’s face in the corner since it’s a FaceTime image,” Blanke says. “The suspect couldn’t argue that he didn’t know the image was there, and he couldn’t argue that he didn’t create the image.” The Project VIC technology likely didn’t catch the images because the FaceTime screen grabs didn’t have known hashes. As of mid-2021, the suspect has been charged with about 30 counts of possessing and manufacturing child pornography images; the case is still ongoing. Working Together to Solve Broad Problems The success of the sheriff’s office’s use of technology to study digital evidence is inspiring more such applications to many cases. “We need to find ways to put bad guys in jail safely and efficiently,” Blanke says. And wherever possible, he adds, that analysis will involve agencies that can benefit from the power of shared evidence – as in the case of the car-theft ring. “When we were able to demonstrate that it would benefit everyone to work together, agencies started contributing, regardless of jurisdictional lines,” Blanke says. “Somebody would give me a call from one of the other jurisdictions and say, ‘I’ve just dumped a phone on UFED and I’ll send you the UFDR. Let’s put it in and see what we find.’ “So they might crack their own cases,” Blanke continues, “but they were also willing to share and help us help everyone resolve multiple cases throughout the county.”