---

Welcoming Remarks and Top Ten Challenges

Tuesday, November 17, 2026

8:45-9:00 AM	Welcoming Remarks Tatiana Lucas, ISS World Program Director, TeleStrategies
9:00-9:30 AM	Top Ten Challenges Facing Law Enforcement and the Government Intelligence Community and Who at ISS World North America has Solutions Dr. Jerry Lucas, President, TeleStrategies

---

Track 1: Training Sessions Presented by Sworn Law

Enforcement Officers and Ph.D Computer Scientists

Note: Sessions in this track are only open to all attendees unless marked otherwise

Tuesday, November 17, 2026

Seminar #1
9:35 AM - 5:00 PM

Online Social Media and Internet Investigations　

Presented by: Charles Cohen, Vice President at NW3C, the National White Collar Crime Center, Professor in Practice Criminal Justice, Indiana University and Retired Captain, Indiana State Police

This Seminar is open to all attendees but designed for practitioners who are actively collecting evidence and criminal intelligence, identifying unlawful online activity, and mitigating threats.  

While Tor is the most common Darknet Service, it is not the only one.  And, while Tor Hidden Service servers are the most well-known portion of the Darknet, there are other areas accessible through other tools.  The first two sessions will give practitioners the foundation that they need to understand these tools and communities—both how they function and how they are exploited by criminals.

Mobile devices collect, store, and transmit an ever-increasing amount of information that includes handset geolocation information collected from a combination of GPS, Wi-Fi, cellular trilateration, BLE beacons, and ultra-wideband sensors. The afternoon sessions will take a deep dive into information being collected by mobile handsets, operating system developers, and social media companies.

9:35-10:20 AM
Proxies, VPNs, and Dark Web: Identity Concealment and Location Obfuscation

10:25-11:10 AM
Tor, onion routers, Deepnet, and Darknet: An Investigator's Operational Perspective

1:30-2:15 PM
How Criminals exploit Darknet Services and Dark Markets: A Deep Dive for Criminal Investigators

2:20-3:05 PM
Tor, onion routers, Deepnet, and Darknet: Investigative Strategies & Case Studies

3:35-4:20 PM
Device Geolocation through GPS, Wi-Fi Triangulation, Cell site Trilateration, BLE Beacons, and Ultra-Wideband: What Investigators Need to Know

4:25-5:00 PM
Collecting Evidence from Online Communication: Building a Cyber-OSINT Toolbox

Seminar #2
10:25-11:10 AM

Understanding 5G/5GA/6G LI for Investigators
Matthew Lucas (Ph.D., Computer Science, VP, TeleStrategies

Seminar #3
1:30-2:15 PM

AI Basics and LEA Use Cases
Matthew Lucas (Ph.D, Computer Science), TeleStrategies

This session gives LEA, intelligence, and other practitioners a primer on AI technologies. Topics covered include how AI technology is being leveraged in our industry (e.g., image recognition, classifying unstructured data, natural language processing, document summarization, and more); traditional AI approaches (heuristics, indicators); basics of machine-learning systems; generative AI capability overview; and how the LEA/IA/ISS vendor communities can (and are) leveraging AI to increase the efficiency and accuracy of their investigation tools.

Seminar # 4
2:20-3:05 PM

Agentic AI – LEA and Criminal Use Cases
Presented by: Matthew Lucas (Ph.D., Computer Science, TeleStrategies

This session covers Agentic-AI platforms. Part 1 will address the basics of Agentic AI systems: what they are good at; how industry is using them; how they can be used by LEAs to drive operational efficiency within their organization.  Part 2 will cover criminal use cases: including cyber, automating fraud/scams, CSAM/fake news and extortion scams; as well the challenges LEAs/IAs have with respect to investigating and/or preventing agentic AI-based criminal use/misuse.

Seminar #5
3:35-4:20 PM

AI Implementing Challenges for LEAs/Investigators
Presented by: Matthew Lucas (Ph.D., Computer Science,  TeleStrategies

Generative and Agentic AI technology is a gamechanger. This session will look at the challenges facing LEAs/IAs looking to incorporate Generative and Agentic AI capabilities into their operations. Topics covered include small/local model options versus LLMs; the strengths and weaknesses of AI models; hosting platform options; operational costs; implementation requirements; security; regulatory considerations; aligning / fine-tuning models; optimizing agentic AI platforms for ISS workflows; and ongoing development advances to watch.

Wednesday, November 18, 2026

Seminar #6
8:30 AM- 4:15 PM

(THIS SEMINAR IS ONLY OPEN TO LEA AND GOVERNMENT ATTENDEES)
A Real World Look at Dark Web Investigations
Presented by: Todd G. Shipley, CEO, Dark Intel, and CoAuthor of, Investigating Internet Crimes: An Introduction to Solving Crimes in Cyberspace and retired investigator, Reno NV, Police Department

This intensive one-day training introduces law enforcement investigators to the knowledge, tradecraft, and operational safeguards required to navigate and analyze the Dark Web. Participants will progress from foundational understanding to advanced investigative techniques, including covert access, digital currency usage, and deanonymization strategies. Delivered with tactical clarity and real-world examples, this seminar empowers professionals to engage hidden environments safely, interpret technological artifacts, and build actionable intelligence. This is a Law Enforcement–Only training: investigative methodology, covert tactics, and operational tradecraft will be discussed in detail throughout.

8:30-9:15 AM
Unmasking the Dark Web: Myth vs Reality
Explore what the Dark Web really is and the media myths. Dispel common myths about anonymity and illicit trade, understand the layered internet (Surface, Deep, Dark), and learn why Dark Web familiarity matters for investigators.

9:20-10:05 AM
Inside TOR: Tracing the Onion
Examine the TOR network’s architecture, access methods, and Tor’s role in obfuscating criminals’ identities. Learn forensic artifacts generated during TOR usage, how exit nodes behave, and what investigators can observe, log, and preserve legally.

11:15-12:00 PM
Bitcoin & Beyond: How Digital Money Powers Hidden Markets
Understand how cryptocurrency operates within Dark Web marketplaces—beyond tracing transactions. Learn about payment mechanics, vendor trust systems, wallet practices, and common misconceptions about anonymity.

1:00-1:45 PM
Fieldcraft in the Shadows: Safely Engaging the Dark Web
Learn secure, covert engagement techniques for accessing the Dark Web, its forums and markets. Topics include persona development, OPSEC protocols, and other best practices.

2:00-2:45 PM
Web Bugs & Covert Tech: Tracing the Invisible
Dive into investigative technologies including web bugs, tracking pixels, browser fingerprinting, and covert probes. Learn how these tools can be used ethically to reveal suspect behavior, location, and activity across hidden platforms. *

2:50-3:25 PM
Piercing the Veil: Identifying Anonymous Actors
Learn how covert actors slip up on the Dark Web and are uncovered using real-world investigative techniques. See how investigations have exposed hidden actors across encrypted channels and from fragments of digital behavior.

Seminar #7
1:00-1:45 PM

Unmasking Hidden Evidence: Metadata & EXIF for Digital Investigators (1 Classroom hour)
Presented by:Charles Cohen, Vice President at NW3C, the National White Collar Crime Center, Professor in Practice Criminal Justice, Indiana University and Retired Captain, Indiana State Police

Seminar #8
2:00-2:45 PM

Push Tokens in Criminal Investigations: Tracing Digital Footprints & Uncovering Evidence
Presented by: Charles Cohen, Vice President at NW3C, the National White Collar Crime Center, Professor in Practice Criminal Justice, Indiana University and Retired Captain, Indiana State Police

Seminar #9
2:50-3:25 PM

Understanding the Implications of Online Social Media for OSINT During Critical Incidents
Presented by: Charles Cohen, Vice President at NW3C, the National White Collar Crime Center, Professor in Practice Criminal Justice, Indiana University and Retired Captain, Indiana State Police

---

Track 2: Lawful Interception, Digital Forensics and

Mobile Signal Intercept Training Sessions

Note: Sessions in this track are only open to Law Enforcement, Public Safety and Government Intelligence Community Attendees.

Tuesday, November 17, 2026

9:35-10:20 AM
Vulnerability Research Tooling for the Agentic AI Era
Presented by Zealot Labs

10:25-11:10 AM
Mission Intelligence: Transforming Investigations with Multi-Agent AI
Today's investigations demand more than faster searches—they require a smarter way to transform overwhelming volumes of digital evidence into actionable intelligence. Join Penlink for a first look at CoAnalyst360, an AI-powered mission intelligence platform that orchestrates specialized AI agents to analyze evidence, uncover hidden connections, automate investigative workflows, and generate continuously evolving intelligence reports. See how investigators and analysts can move from a single investigative question to decision-ready intelligence with greater speed, consistency, and confidence.
Stephen Lerner, Penlink

1:30-2:15 PM
The AI-Enhanced 5G Monitoring Centre: Integrating Lawful Interception, Communication Metadata, and Investigative Analytics
Presented by AREA

2:20-3:05 PM Session A
Amplified Intelligence: Merging OSINT with Evidentiary Data for more Efficient Investigations
In today's digital age, solving complex cases requires a multifaceted approach that combines Open-Source Intelligence (OSINT) and evidentiary data. This presentation delves into the critical importance of integrating both these sources to achieve an understanding of cases, making it clear that one cannot stand alone. We explore the value of gathering OSINT, including social media information. Plus, see how that can save your agency time and money in helping you discover what data to move forward with and to obtain through search warrants.
Scott Tuma, Penlink

2:20-3:05 PM Session B
How to Fight Disinformation

Turning an Asymmetric War into a Fair Fight

Disinformation is considered one of the world's greatest short-term risks. Unlike many other threats, it is an active front for most countries, yet effective mitigation remains limited, leaving malicious actors largely free to operate with little resistance.

In this session, we will explore practical, effective ways governments can move beyond monitoring and analysis to actively combat disinformation, protect their communities, and turn this asymmetric war into a more balanced fight.
Presented by Brinker

3:35-4:20 PM Session A
Time-Critical Digital Forensics: Finding the Evidence That Matters Before It’s Too Late
In today’s investigations and intelligence operations, the challenge is no longer collecting data, it is identifying the evidence that matters before it is too late to act.
Join us to explore how Detego’s patented rapid triage, selective extraction capabilities, intelligent workflow automation and AI-driven analytics enable investigators to identify and act on critical evidence across thousands of devices and apps in record time.
Designed for users of any experience level, Detego’s intuitive platform enables fast, forensically sound investigations with minimal training requirements. The session will also highlight covert investigation capabilities and flexible deployment options including field kits, kiosks, lab environments and digivans, demonstrating how Detego technology can be deployed in the most challenging conditions to deliver fast, forensically sound results.
Andy Lister, Global Director, Detego

3:35-4:20 PM Session B
AI-Assisted Electronic Surveillance: Connecting Field Operations, Tracking Technologies, and Intelligence Platforms
Presented by AREA

3:35-4:20 PM Session C
Intercepted but Not Understood: Solving the Challenge of Low-Resource Languages and Spoken Dialects
Live demonstration: from raw intercepted audio to traceable, analyst-ready intelligence.
Presented by Mehu.ai

4:25-5:00 PM Session A
Following the Actor: From a Single Selector to a Cybercrime Ecosystem
What can a single fraud-actor selector reveal? Potentially, an entire criminal enterprise. This presentation follows an actor-centric cybercrime investigation as it expands from one identifying clue into a multidimensional map of aliases, digital identities, victims, infrastructure, financial activity, and interconnected fraud schemes. Rather than examining incidents in isolation, the investigation reveals how criminals acquire and operationalize identities, construct believable personas, exploit institutions across sectors, obscure their true location, and move proceeds through multiple channels. The result is a compelling view of fraud not as a series of disconnected events, but as an organized ecosystem held together by repeatable behaviors and shared operational infrastructure.

Attendees will see how seemingly minor artifacts can become powerful investigative pivots when correlated at scale. Reused credentials, account relationships, device characteristics, geographic inconsistencies, persona patterns, marketplace activity, and monetization pathways combine to expose an actor’s tactics, techniques, and procedures -- and ultimately support attribution. The session will explore how SpyCloud intelligence can help investigators move beyond identifying compromised data to understanding the people behind the activity, connecting previously siloed cases, prioritizing victims and investigative leads, and transforming fragmented digital evidence into a defensible picture of who is operating, how the operation works, and where it can be disrupted.
Duncan Edwards, Senior Investigator, SpyCloud

4:25-5:00 PM Session B
Collaboration Station:  how real-time indicator collaboration shortens time to adversary disruption
I will cover some of the recent, published wins of scam center takedowns with commercial and government teams were made possible through not only our data collection and analysis, but more importantly, indicators with relevant temporal details. I will highlight how this is currently one of the best ways to avoid playing whack-a-mole and instead destroying the moles' den.
Presented by Silent Push

4:25-5:00 PM Session C
Online Biological Threats - Emerging Challenges for Law Enforcement
Cheong Ju Kim, Criminal Intelligence Officer, INTERPOL Bioterrorism Prevention Unit (BTPU)

Wednesday, November 18, 2026

8:30-9:15 AM Session A
From Data to Investigative Insight: AI-Assisted Processing and Analytics Across Integrated Intelligence Platforms
Presented by AREA

8:30-9:15 AM Session B
One Shared Number, One Thousand Identities: Investigating Fraud at Scale
Government benefit programs -- Medicaid, unemployment insurance, and federal disaster relief -- lose billions annually to fraud that hides behind legitimate-looking credentials and shifting shell entities. This session presents a replicable investigative methodology that fuses claims/billing analytics, shared-infrastructure network analysis, and breach/identity intelligence into a single pipeline -- taking analysts from a raw anomaly flag to a referral-ready case package. Using real casework, presenters will walk through how automated billing-pattern detection narrows millions of records to a prioritized target list; how shared phone numbers, addresses, and controlling officials expose coordinated fraud rings; and how leaked-credential and OSINT data attributes anonymous online infrastructure to real-world identities. Attendees will leave with a practical framework for scoring risk, mapping fraud networks, and building attribution bundles suitable for law enforcement and program-integrity referral -- applicable across Medicaid, unemployment insurance, SBA relief programs, and beyond.
What attendees will learn:

• How multi-signal billing analytics (peer, specialty, geographic, and ML-based benchmarks) surface fraud that name-matching alone misses
• How shared-infrastructure analysis turns individual anomalies into evidence of coordinated fraud rings
• How breach and OSINT data close the gap between digital infrastructure and real-world identity for referral-ready attribution
• A repeatable workflow -- detect, prioritize, identify, connect, attribute, bundle, refer -- adaptable to any benefit program

Note: This session will include TLP:RED case material. Attendance is restricted to law enforcement, intelligence community, and government personnel; attendees may be asked to verify affiliation.

Tom Harper, Senior Investigator, SpyCloud

9:20-10:05 AM
A Holistic Approach to Deepfake Forensics
Learn about a multifaceted approach to determining image and media authenticity.
Digital imagery is one of the most prevalent and sought-after forms of evidence in all criminal investigations. The proliferation of Generative AI and Diffusion Models has fundamentally challenged the traditional "presumption of authenticity" in digital images and video. This presentation will examine a multifaceted approach to more accurately determine multimedia authenticity and bridge the gap between current deepfake detection research and the evidence admissibility standards of the courts. 
Presented by Amped Software

THIS SESSION IS OPEN TO ALL ATTENDEES
11:15 AM-12:00 PM Session A
Staying Ahead of Privacy and Regulatory Changes With Location Intelligence
2026 has been a pivotal year for privacy regulation. This session breaks down the year's key legislative developments, from shifts in GDPR enforcement to expanding state Data Broker Registries and California's new Data Broker Registry and Deletion Mechanism (DROP). We'll put these changes in context, comparing them to prior regulatory waves and looking ahead to where the landscape is likely headed next. Attendees will get a firsthand look at how Venntel is evolving its products in response, with practical examples of how we're staying compliant with GDPR, DROP, and the next generation of privacy law.
Jason Sarfati, Chief Privacy Officer & VP Legal, Venntel

11:15 AM-12:00 PM Session B
The Queen’s Gambit: How Chess.com Blew an Investigation Wide Open
Join us for a behind-the-scenes look that takes you directly into the mind of the investigator. In this session, we’ll walk through a real case where a single email address in a murder investigation opened the door to an unexpected chess.com profile, revealing a suspect’s alias and unlocking a trail of intelligence.
This is a true “look over the shoulder” experience, showing how small digital breadcrumbs can cascade into major investigative breakthroughs. You’ll see how analysts use Penlink's Tangles in real time to pivot, expand, and connect disparate data points into a clear, actionable picture.
Stephen Lerner, Penlink

1:00-1:45 PM
One Investigation, Multiple Sources: AI-Assisted Correlation of Network, Surveillance, Communication and Field Data Across Integrated Intelligence Platforms
Presented by AREA

---

Track 3: Social Media, DarkNet and Cyber Security

Monitoring Training Sessions

Note: Sessions in this track are only open to Law Enforcement, Public Safety and Government Intelligence Community Attendees.

Tuesday, November 17, 2026

9:35-10:20 AM Session A
From Open Source to Actionable Intelligence — Integrating OSINT, AI, and Investigative Workflows
Presented by Carahsoft

9:35-10:20 AM Session B
How Threat Actors Used AI to Hack 90,000 Organizations
This session explores how threat actors are leveraging artificial intelligence to scale cyberattacks, automate malicious operations, and target organizations at an unprecedented level. Through a real-world case involving 90,000 organizations, we will examine how AI is changing the cyber threat landscape and how threat intelligence can help uncover attacker tactics, infrastructure, and activities. Attendees will gain valuable insights into how law enforcement and government agencies can identify AI-driven threats, investigate malicious operations, and turn cyber threat intelligence into actionable investigative leads.
Presented by SOCRadar

10:25-11:10 AM Session A
DarkOwl DarkMark - Darknet Marketplaces - Enhancing intelligence for Law Enforcement and National Security Investigations
Presented by DarkOwl

10:25-11:10 AM Session B
Finding the Threat Before the Attack: Turning Terrorist and Violent Extremist Online Activity into Actionable Intelligence
Presented by Site Intelligence Group

1:30-2:15 PM Session A
Following the Digital Breadcrumbs — Disrupting Criminal Networks Across Social, Dark Web, and Crypto
Presented by Carahsoft

1:30-2:15 PM Session B
Leveraging OSINT 0-days to investigate a person of interest
Sylvain HAJRI, Epieos

2:20-3:05 PM
Leveraging OSINT Tools for Cross-Border Narcotics Investigations
This session explores how Open-Source Intelligence (OSINT) tools can be used to trace complex transnational narcotics supply chains from precursor chemical sourcing through processing and manufacturing hubs to distribution networks. Attendees will examine investigative methodologies for tracking shipments, identifying key facilitators, and correlating logistical, commercial, and digital indicators across multiple jurisdictions. Through practical examples and real-world investigative workflows, participants will gain insights into leveraging Publicly Available Information (PAI) and Commercially Available Information (CAI) to uncover illicit networks and support cross-border narcotics investigations.
Presented by OSINT Combine

3:35-4:20 PM
Title TBA
Presented by 10XNationalSecurity

4:25-5:00 PM
Iran: The Most Transparent Country in the World
How artificial intelligence is turning fragmented, hard-to-access data into actionable reports that reveal the people, organizations, and hidden networks behind Iran’s military and strategic infrastructure.
Presented by Geonosys

Wednesday, November 18, 2026

8:30-9:15
From Fragments to Findings: AI-Assisted Subject Development Across the Dark Web, Deep Web and Open Source
The subjects behind today's most serious investigations leave scattered traces: an alias on a dark-web forum, a reused handle, a wallet address, a leaked credential. Individually, these fragments say little. Correlated at speed, they become actionable leads. This session shows how Cyble Hawk, an AI-native operational-intelligence platform built for government agencies, fuses these signals into structured subject profiles.
Amit Lokhande, Associate Director, Research, Intelligence and Hawk, Cyble

9:20-10:05 AM Session A
From Tip to Takedown: Unifying OSINT, Case Management, and Multi-Agency Data Sharing in One Investigative Platform
Presented by Kaseware

9:20-10:05 AM Session B
Early Warning in the Digital Domain — Identifying Threats Before They Become Incidents
Presented by Carahsoft

11:15 AM-12:00 PM
How to Expose Threat Actors Using OSINT, Dark Web, and Threat Intelligence
This session shows how investigators can combine open-source intelligence, dark web monitoring, and cyber threat intelligence to unmask the people and infrastructure behind cyberattacks. Using real-world investigation examples, we'll walk through how threat actor personas, forum activity, leaked data, and technical indicators can be correlated to build a clear picture of who is behind an operation. Attendees from law enforcement and government agencies will leave with practical techniques for turning scattered online traces into actionable investigative leads.
Presented by SOCRadar