Cyber Corps program trains spies for the digital age

TULSA, Okla. — Jim Thavisay is secretly stalking one of his classmates. And one of them is spying on him.

“I have an idea who it is, but I’m not 100% sure yet,” said Thavisay, a 25-year-old former casino blackjack dealer.

Stalking is part of the curriculum in the Cyber Corps, an unusual two-year program at the University of Tulsa that teaches students how to spy in cyberspace, the latest frontier in espionage.

Students learn not only how to rifle through trash, sneak a tracking device on cars and plant false information on Facebook. They also are taught to write computer viruses, hack digital networks, crack passwords, plant listening devices and mine data from broken cellphones and flash drives.

It may sound like a Jason Bourne movie, but the little-known program has funneled most of its graduates to the CIA and the Pentagon’s National Security Agency, which conducts America’s digital spying. Other graduates have taken positions with the FBI, NASA and the Department of Homeland Security.

The need for stronger cyber-defense — and offense — was highlighted when Defense Secretary Leon E. Panetta warned in an Oct. 11 speech that a “a cyber-terrorist attack could paralyze the nation,” and that America needs experts to tackle the growing threat.

“An aggressor nation or extremist group could gain control of critical switches and derail passenger trains, or trains loaded with lethal chemicals,” Panetta said. “They could contaminate the water supply in major cities, or shut down the power grid across large parts of the country.”

Panetta said the Pentagon spends more than $3 billion annually for cyber-security. “Our most important investment is in skilled cyber-warriors needed to conduct operations in cyberspace,” he said.

That’s music to the ears of Sujeet Shenoi, a naturalized citizen from India who founded the cyber program in 1998. He says 85% of the 260 graduates since 2003 have gone to the NSA, which students call “the fraternity,” or the CIA, which they call “the sorority.”

Shenoi subjects his students to both classroom theory and practical field work. Each student is assigned to a Tulsa police crime lab on campus and uses digital skills to help uncover evidence — most commonly child pornography images — from seized devices. Several students have posed as children online to lure predators. In 2003, students helped solve a triple homicide by cracking an email account linking the perpetrator to his victims.

“I throw them into the deep end,” Shenoi said. “And they become fearless.”

The Secret Service has also tapped the Cyber Corps. Working from a facility on campus, students help agents remove evidence from damaged cellphones, GPS units and other devices.

“Working alongside U.S. Secret Service agents, Tulsa Cyber Corps students have developed techniques for extracting evidence from burned or shattered cellphones,” Hugh Dunleavy, who heads the Secret Service criminal division, said in a written statement. More than 5,000 devices have been examined at the facility, he added.

In 2007, California’s secretary of state, Debra Bowen, hired the University of California to test the security of three electronic voting systems used in the state, and Shenoi and several students joined one of the “red” teams assigned to try to hack the voting machines. They succeeded. One of the students, who now works at the NSA, showed that someone could use an off-the-shelf device with Bluetooth connectivity to change all the votes in a given machine, Shenoi said.

“All our results were provided to the companies so they could fix the machines to the extent possible,” Shenoi said.

In May, the NSA named Tulsa as one of four national centers of academic excellence in cyber-operations. The others were Northeastern University in Boston, Naval Postgraduate School in Monterey, Calif., and Dakota State University in Madison, S.D.

“Tulsa students show up to NSA with a lot of highly relevant hands-on experience,” said Neal Ziring, a senior NSA official who visited the school recently to consult about the curriculum and to interview students for jobs and internships. “There are very few schools that are like Tulsa in terms of having participation with law enforcement, with industry, with government.”

Shenoi’s students have ranged in age from 17 to 63. Many are retired from the military, or otherwise starting second careers. They are usually working toward degrees in computer science, engineering, law or business. About two-thirds get a cyber-operations certification on their diplomas, or what Shenoi calls a “cyber-ninja” designation “because they have to be super techie.”

To be accepted into the corps, applicants must be U.S. citizens with the ability to obtain a security clearance of “top secret” or higher. But not all of them spend their careers in government.

One former student, Philip McAllister, worked after graduation at the Naval Research Laboratory, which does scientific research and development for the Navy and Marines. He later moved to San Francisco and worked at several startup companies before he joined Instagram, which developed a photo-sharing mobile application, early this year. Facebook purchased Instagram, which had only 13 employees, for $1 billion three months later.

“Sujeet gets incredibly talented people,” said Richard “Dickie” George, who retired last year after a three-decade career at the NSA.

Shenoi speaks proudly of students who pushed the boundaries or broke the rules.

One, who now works at the NSA, hacked the school’s computer system and created a fake university ID to impersonate his cyber-stalking target, for example. Another spoofed a professor’s email account to fool his target into spilling details. As part of a vulnerability study, one student sneaked into a Tulsa water system facility and stole blueprints that a more malign attacker could use to wreak havoc.

A few years ago, Shenoi says, a group of students rummaged through trash bins outside offices on campus and obtained confidential information about football recruits, professors’ salaries, and major financial donors.

“We are now banned from Dumpster diving on campus,” he said with a smile.

ken.dilanian@latimes.com