Phishing, Wiping, and the XO's Request
The executive officer (XO) of a destroyer squadron forwards you an email he received from a 'defense contractor' asking him to review an attached invoice. He clicked the link, entered his Navy credentials on a lookalike page, and realized the mistake an hour later. Three hours after that, the network security team reports a login to his account from an IP address in another country. The XO asks you to 'keep this quiet' and let the IT department wipe his laptop and reset his account, arguing that an investigation will embarrass the command before an upcoming inspection. A chief petty officer in the IT shop has already imaged the laptop without asking you, and says he can 'make the logs disappear' to avoid a report.
1. What immediate actions should you take to preserve digital evidence and secure the account, and what should happen to the laptop and logs?
Read the worked answer
Preserve first; do not wipe.
- Stop the wipe. Instruct IT in writing not to reimage or reset the laptop until a forensic image is made. The chief's existing image should be documented, hashed, and preserved; a second image may be needed.
- Preserve logs for the account, VPN, email, and network security systems. Logs may be the best evidence of unauthorized access.
- Secure the account by resetting credentials, revoking sessions, and enabling or rechecking multifactor authentication. This is containment, not destruction of evidence.
- Document the phishing email and preserve headers, URLs, and attachments.
The chief's offer to 'make the logs disappear' is a serious integrity issue. The agent should document the statement and report it through the proper channel; intentional deletion of evidence could constitute obstruction. The XO's embarrassment concern does not override evidence-preservation duties.
2. How do you respond to the XO's request to keep the incident quiet, considering professional integrity and command climate?
Read the worked answer
Decline the request clearly and professionally.
- Explain that a credential compromise with a foreign login may be a reportable cyber incident and potential federal crime, not merely an internal embarrassment. Keeping it quiet could jeopardize the command, the network, and the investigation.
- Frame the response around readiness and protection: prompt reporting limits damage, preserves the command's ability to inspect, and protects the XO from later allegations of concealment.
- Do not promise confidentiality you cannot provide. Offer to coordinate the notification through the appropriate chain and to keep operational details need-to-know.
- Document the XO's request and your response.
Professional integrity requires following reporting rules even when a senior officer asks otherwise. The agent should be respectful but not ambiguous.
3. What legal and administrative notifications may be required, and what investigative steps follow?
Read the worked answer
Notifications may include the command, NCIS leadership, the staff judge advocate, network-security or cyber authorities, and possibly federal prosecutors or the FBI if the intrusion meets thresholds for unauthorized access or espionage-related risk. Privacy Act and classified-network rules affect how information is shared.
Investigative steps:
- Interview the XO about the email, link, credentials entered, and any data he accessed after the compromise.
- Interview the IT chief about the imaging and the log-deletion comment; preserve the image and verify its hash.
- Obtain email and network logs through proper legal process.
- Determine whether the attacker accessed email, attachments, or command data, and whether other accounts were targeted.
- Consider whether the phishing email is part of a broader campaign against the command.
The investigation should proceed on two tracks: cyber containment and possible criminal or administrative accountability. The agent should not let the command's inspection timeline dictate the evidence-handling decisions.