Kyung-schick Choi, a MET professor of the practice, created Metropolitan College’s Cybercrime Investigation & Cybersecurity programs.

Cybersecurity

This MET Cyber Sleuth Helped Find the Man Who Stole His Identity

Kyung-shick Choi is helping the Justice Department train the next generation of cyber investigators

As a courtesy to students, professors being profiled by BU Today typically introduce writers when they sit in on a class. But when you’re a former cop who nabbed the thief who stole your own identity, knowing someone’s name barely scratches the surface of your talents. Hence the loquaciousness of Kyung-shick Choi about the visiting writer at the start of Applied Digital Forensic Investigation.

“I know a lot about him already,” he whispers conspiratorially to the class. “Your birthday is—I want to say just the month: March. He just turned 63. And also, you live in Belmont. You used to live in Cambridge, though, right? It’s a nice house; I’ve already seen your house.” Choi rattles off the writer’s college and years of attendance. And “you majored in history.”

The sensation of being stalked is offset by the knowledge that Choi (MET’02) is one of the good guys. He’s merely foreshadowing the point of his lecture: publicly available online information is a goldmine for inquiring minds. Called OSINT, for Open-Source INTelligence, it’s all the tech-rage from think tanks to law enforcement, and the topic du jour for Choi, architect of Metropolitan College’s Cybercrime Investigation & Cybersecurity programs. The programs confer graduate certificates and master’s degrees on students who are police officers, computer science personnel in business, and others. He also teaches Cyberterrorism and Cyber Defense.

“I know everything,” the (actually unboastful) Choi joked before class about his cyber sleuthing. His lecture this raw spring evening surveys publicly accessible resources such as familytreenow.com, where he asks students to enter their names. Even a veteran investigator like Paul Mahoney, who spent 32 years as a cop before his current job as a Boston University Police Department lieutenant, sits up when the site spits out details about his brother.

“That’s pretty creepy,” he says.

Choi, a MET professor of the practice, is working with the US Department of Justice on several projects, including an $881,000 grant to train the next generation of cyber sleuths. “This curriculum will be kind of standard for law enforcement” when completed in two years, he says, as it’s developing guidelines for cyber-investigation education for federal law enforcement and intelligence officers. “That’s why we work with many cyber experts from different universities and local, state, and federal agencies.” 

The curriculum-in-progress reflects MET’s commitment to law enforcement professionals among its adult-learner and graduate student community, says Lou Chitkushev, the college’s senior associate dean for academic affairs and an associate professor of computer science.

“When you investigate a crime scene,” Chitkushev says, “you have to collect digital devices, like cell phones. That’s the first thing. But just collecting is not enough. You have to be able to use them in a court system. So you have to train the workforce—policemen, officers, FBI—so that when they collect devices, they don’t damage the data when they copy it. To make sure, in the legal system, you will be able to say, Yes, this is exactly the picture that was taken, and it has not been modified, and that is the guy who took the picture.”

Chitkushev calls Choi “a top expert in cybersecurity… He directs the program. He attracts students. He’s a creator of this new curriculum, and MET is all about top-quality professional education.” Choi has also been a guest speaker of the United Nations and Interpol at international conferences. 

President Biden has warned businesses to brace for retaliatory Russian cyberattacks for sanctions imposed after the Ukraine invasion. The United States says it recently thwarted such an attack, detecting and removing malware from global computer systems. More than a fifth of the way into the 21st century, shouldn’t the good guys already have a state-of-the-art cyber curriculum?

“We have well-educated investigators at the federal level,” Choi says, “but we see the exponential number of cybercrimes we experience. That’s why this grant really is focusing on pretty much local and state…lack of knowledge in processing evidence. They don’t have a kind of fundamental education for cyber investigation.”

Mahoney seconds that. He worked many cyber cases before joining the BUPD. Yet “as you observed by my reaction in our class discussion to my information being readily available, the field of cyber investigations requires an ever-evolving skill set and learning,” he says. “In every class, we learn new investigative techniques that are truly eye-opening to identify bad actors.”

With cyberthefts a recurring problem for BU students and staff, Mahoney adds, “I look forward to using the skills I am developing from Doctor Choi’s classes and the other courses that make up the Cybercrime/Cybersecurity graduate program. His class came highly recommended by several of my law enforcement associates from the local and federal level. Doctor Choi has earned his reputation as leader in the field.” 

Choi has seen cybercrime as both victim and investigator. In his native South Korea, he spent one semester in college, studying economics with an eye toward running his father’s business, but “I couldn’t feel the passion about it,” he says. Then his father died, and Choi, pursuing his true passion, became a police officer. He found his way to Boston to finish his undergraduate study, in criminal justice, at Northeastern, staying to work as a research assistant.

Then, in 1999, the Korean National Police called.

He was suspected, they said, of having gained South Korean citizens’ confidence online, then scamming them out of more than $50,000, claiming to be a student who couldn’t afford his college bills. “Five victims paid their tuition,” Choi recalls. He told the Korean police: “‘I was a police officer back home, and that’s not me.’” Volunteering his tech-savvy to help clear himself, he sniffed around. He was one of the few people in his circle then with a personal website, and he acknowledges that he “was not nearly well-educated at that time” in the need for online caution. He’d posted his CV and lots of personal information. A friend saw it and thought it cool enough to recommend that her husband take a look.

He allegedly pilfered Choi’s identity, citing Choi’s respectable law enforcement and academic background to scam his Korean victims. It wasn’t hard tracing the crime to the real scammer in those days, Choi says: “I could easily track an IP, because it [was] a dial-up… He used all the money, according to him, just for their honeymoon.” His friend’s father reimbursed the victims, but that dissuaded them from the hassle of coming to the United States to press charges against the thief. Meanwhile, “the damage is already done to me,” Choi says.

“Because—think about that—it’s a one-year process, and my professor kind of gives me a suspicious look whenever I go to class, because they thought I did it. I’m the only Asian student in the entire program, so very noticeable. They know I do technology. So it was extremely uncomfortable, just continuing studying at Northeastern. [That] one year was a horrible year for me. I couldn’t really sleep.” As a result of the incident, he says, he cut off contact with his friend and her spouse.

But for that nightmare, Choi might not be at MET today. “I envisioned myself working the field more, and not scholarly kind of work.” He’d enjoyed a job before the identity theft with the Cambridge, Mass., police department’s CSI unit, he says. But after his searing experience, he searched for graduate study in criminal justice, which led him to the Charles River Campus. “It changed my life,” he says. He earned a master’s degree, and with the encouragement of a mentor, pursued a doctorate from Indiana University of Pennsylvania.

In a field probing topics both complex (forensic science) and depressing (crime), Choi tries to add a little upbeat, human connection. He begins his class on OSINT by asking what students did on their recent weekend. Not much, replies Michael Ross (MET’23), who’d just spent his downtime reading a book.

“My book?” Choi asks archly. (He’s actually written several on cybersecurity.) Not missing a beat, Ross replies, “I’m always reading your book.”

After class, Ross, who majored in psychology before enrolling at MET for a master’s in criminal justice, says that “learning from someone who is as renowned in the field as Doctor Choi is truly one of the coolest things to have come of my time at the University. Being able to go to class every week to learn from, and talk to, someone who I know I’ll be quoting in academic pieces on cybercrime for years to come is an experience like no other in my academic career.”