Topic Library — Hackers (Year 1 Foundations)

School: Minister Destiny Testimony Schools Track: Law Enforcement Class: Topic Library — Year 1 (Foundations) Presented by: Minister Destiny Marie Morgan, Muslim Ordained Minister

A note on what this school is: this is community-designed training — Minister Destiny's program, built from lived experience in the neighborhoods being policed. It is not agency policy and does not replace your department's training, general orders, or the law. Where this program proposes new approaches, they are taught and labeled as proposals. Nothing here is legal advice.

Before you start

• This school never collects your name. Your progress is saved only in your own browser on this device — the school collects and keeps nothing. If you pass this unit's quiz (80% or higher, retakes allowed), you earn a downloadable certificate with a blank line — you write your own name on it after you save it. Quiz answers are not shown; if you miss a question, re-read the lesson and try again.
• This unit is defensive and civic in framing. It explains who hackers are, the attack patterns your victims and your own agency will meet — described at the level public alerts use, for recognition and protection only — why targets are chosen, the law in general terms, and the defender careers that stand opposite the criminal ones. It contains no intrusion techniques or tools. It makes you fluent in the landscape, calm in the first hour of an incident, and precise in handing cases to specialists.

The lesson

Part 1. What a Hacker Is — and Is Not

Strip the word down to its working parts. A hacker, in the technical sense, is a person deeply skilled at how computer systems behave and where their limits lie. Skill is neutral. Two figures stand on opposite sides of the only line that matters:

The criminal hacker accesses systems, accounts, or data without authorization — to steal, spy, disrupt, or extort. Meet this offender with clear eyes about structure: much of today's criminal hacking is organized like an industry, with specialists who obtain access, others who move money, others who run the phishing and call-center scripts, and marketplaces where stolen data changes hands. The lone figure in a dark room exists, but your district's victims are overwhelmingly harmed by the industry — patient, scripted, and scaled.

The security researcher, or ethical hacker, applies the same skills with authorization: testing an owner's defenses under agreed rules, or discovering flaws and reporting them to the maker through established channels so they can be repaired. These are your allies and, increasingly, your colleagues — in agencies and in firms that serve your community's institutions.

Why the distinction belongs in a patrol curriculum: you will meet both figures. You will take reports from researchers whose findings upset an employer; you will interview young people whose real talent is being recruited by the wrong side of the line; you will work scenes where the difference between "our IT consultant" and "an intruder" is paperwork you must ask for. In every case, the dispositive question is the same one the law asks: was there authorization — whose system, whose permission, what scope? Officers who sort by appearance, age, or confidence will sort them wrong.

Part 2. Common Attack Patterns, in Plain Words

The patterns below are described from the victim's side, as public alerts describe them — recognition knowledge for first response:

• Phishing and impersonation. Fake messages and calls — bank, agency, employer, "IT support," police — harvesting passwords and verification codes or delivering harmful software. The dominant entry method against households, businesses, and governments alike. Your interview should always establish whether a message, call, or code disclosure preceded the loss.
• Credential reuse. Breach-stolen passwords tried automatically against other services. The victim's bank login "hacked" may involve no attack on the bank at all. Establish the victim's password reuse honestly — it shapes containment (every account sharing that password is in scope) more than any other fact.
• Malware and ransomware. Harmful software that steals, spies, or seizes control; ransomware encrypts systems and demands payment. Your scene priorities for a ransomware victim are: do not let well-meaning hands make it worse, preserve the ransom note and system state as your procedures and specialists direct, get the victim to ic3.gov reporting immediately, and connect them to the resources CISA publishes for exactly this event. Negotiation and payment decisions belong to the victim with professional guidance — authorities warn payment guarantees nothing.
• Unpatched flaws. Known weaknesses in un-updated software are worked at industrial pace. In interviews and business outreach, "when did you last update, and what can't be updated?" is a diagnostic question, not small talk.
• Insider and social routes. A coerced, bribed, or deceived employee; a help desk talked past its checks. Trust fails before technology does.

Notice, again, the absence of magic. Scale, patience, and unpatched, reused, or persuaded openings — which means the first officer's calm documentation of which opening was used is often the most valuable evidence in the file.

Part 3. Why Homes, Businesses, and Public Systems Get Targeted

Offenders select for return on effort, in a few currencies your victims should hear named plainly, because "why us?" is the question every victim asks:

• Direct money — account access, payment and payroll diversion, ransom.
• Data — personal, health, and financial records stolen for resale and identity crime. A two-dentist practice's records and a hospital's obey the same market; the practice is softer.
• Access as a bridge — a home device conscripted to attack others, a small vendor's credentials opening a large client, a resident's email resetting everything.
• Pressure through public need — hospitals, schools, utilities, municipalities, and public-safety agencies themselves are targeted because downtime is intolerable and public. Understand this about your own house: your agency's systems, and officers' personal accounts and families, sit inside the threat picture, not above it. The Awareness unit's habits are professional obligations now, not lifestyle tips.
• Advantage and espionage — the sophisticated, sometimes state-backed tier, aimed at research, infrastructure, and government. Local officers meet this tier mainly as its outer ripple: the vendor, the contractor, the utility in your jurisdiction. Your role there is recognition that something looks beyond ordinary crime, prompt escalation, and disciplined preservation — not solo pursuit.

Give victims the arithmetic honestly: selection is usually automated and opportunistic; being small is not armor and being chosen is not a verdict on their worth. Being patched, backed up, uniquely credentialed, and verification-minded is armor — and an officer who installs that understanding has done prevention work with a half-life of years.

Part 4. Warning Signs an Account or Device Has Been Touched

Teach residents and businesses the tells, and use the same list to structure your intake:

• Account signs: credentials or recovery details changed without the owner; sign-in alerts from unrecognized places; messages sent that the owner didn't write; contacts reporting strange requests; unexplained money movement or settings.
• Device signs: new programs or extensions never installed; security settings altered; persistent pop-ups; marked slowness or heat while idle.
• Silence signs: expected alerts and statements stop arriving; the owner is locked out of accounts they didn't change — the attacker has seized the notification channels to buy time.

On scene, convert these signs into a timeline before devices are wiped, "fixed" by a helpful nephew, or discarded: what was noticed, when, in what order; what the victim then did; who else had legitimate access. Direct victims to preserve messages, ransom notes, logs, and records as your procedures specify, and to route technical examination to your department's specialists or outside professionals the victim chooses — never to a "support" number that arrived with the attack, because post-incident "recovery" callers are the same industry returning for a second harvest.

For your own agency's incidents, the doctrine is identical and not yours to improvise: follow department and IT-security procedures exactly, escalate immediately, and document contemporaneously. The officer who clicked is a witness the investigation needs honest, not a defendant in the hallway court of colleagues — because agencies that shame the clicker get silence next time, and silence is how intrusions mature.

Part 5. The Law in General and Careers in Defense

The law, in general terms. Unauthorized access to computers and data is criminal under federal law and the laws of the states, and the conduct surrounding it — fraud, identity theft, extortion — adds its own offenses. Outcomes turn on the acts, the damage, and the offender's history, and can include substantial imprisonment and restitution. This unit states no specifics — they vary and change — because your field needs are the durable ones: authorization is the line the law polices; "the security was weak" and "I took nothing" are not defenses you will see succeed; and jurisdiction is often layered — local, state, and federal interests in a single incident — which is why early consultation with detectives and prosecutors, and meticulous ic3.gov reporting, matter so much in cyber cases.

Careers in defense — know this landscape because you will steer people toward it, including young people you meet on the wrong doorstep of it. The field employs analysts who watch for intrusions, administrators who build systems correctly, authorized testers, incident responders, digital investigators, and awareness educators. Entry runs through degrees, community colleges, certifications, military service, and agency training. When you encounter a teenager whose skills are real and whose authorization sense is not yet, the most consequential sentence of your shift may be the one that names the lawful market for exactly their talent — and the local doors into it, if you have done the small homework of learning them. Departments that build those bridges are doing crime prevention at the recruitment stage of the opposing industry.

Part 6. Protecting Yourself and Helping After an Incident

Consolidate the unit into field practice:

1. Hold your own line. Unique passphrases, two-factor authentication everywhere, prompt updates, verified backups, unexpected authentication prompts treated as attacks and reported per policy — at work and at home, because your family is inside the same threat picture as your agency.
2. Run the first hour well. For a victim: safety and calm; establish the entry pattern (message? code? reuse?) and the timeline; contain in the Awareness order — accounts secured from the real services, email first, money protected through the bank's real number; preserve artifacts as procedures direct; escalate early.
3. Report on every track. Your report, written for the specialists who inherit it; the victim's ic3.gov filing, assisted where needed; ftc.gov for fraud and identity theft; CISA's published guidance handed to institutional victims. Explain each track's purpose honestly.
4. Warn the circle. A compromised account is a weapon aimed at its contacts. Help the victim notify theirs; issue method-level public warnings when a pattern is working your area.
5. Treat the victim as the industry's survivor, not its fool. The operations that took their money test their scripts on millions. Respect in the first interview buys the early call next time.

The civic frame to carry out of this unit: every community now lives behind digital doors, and the contest between the two figures of Part 1 is decided by which side recruits better, patches faster, and teaches its people more honestly. An officer fluent in this landscape is doing for the digital street what good patrol does for the physical one.

Words to know — Hackers

• Hacker — a person deeply skilled with computer systems; the word says nothing about legality — permission decides that.
• Criminal hacker — a person who accesses systems or data without authorization, to steal, spy, disrupt, or extort.
• Security researcher — a skilled specialist who, with authorization or through reporting channels, finds weaknesses so owners can fix them.
• Malware — harmful software designed to steal information, spy, or seize control of a device.
• Ransomware — malware that locks victims out of their files and demands payment for their return.
• Vulnerability — a weakness in software, hardware, or practice an attacker could use to gain access.
• Patch — a maker's fix for a vulnerability, delivered as an update; unpatched systems stay open.
• Data breach — an incident in which stored information is stolen or exposed.
• Digital evidence — records and artifacts of a digital incident — messages, logs, notes — preserved under proper procedure.
• Incident response — the organized steps taken when an intrusion is discovered: contain, preserve, escalate, report, recover.

Myths vs facts — Hackers

• Myth: Cyber cases aren't local police work — there's nothing for a patrol officer to do. Fact: The first hour belongs to you: entry pattern established, timeline preserved, containment started, specialists engaged early. Cases live or die on that hour.
• Myth: You can tell a criminal hacker from a researcher by how they look and act. Fact: The line is authorization — whose system, whose permission, what scope. Appearance tells you nothing.
• Myth: A ransomware victim should just pay quietly and move on. Fact: Authorities warn payment guarantees no recovery and funds the industry. Reporting to ic3.gov and qualified guidance come first.
• Myth: Our agency is too small to be a target. Fact: Public-safety and municipal systems are selected for their public necessity. Small is a targeting feature, not a shield.

Think it through — Hackers

At 2 a.m. you're dispatched to a small medical billing office — a burglar alarm, you assume, until the owner meets you in the parking lot, pale, holding a printed page: a ransom note. Screens inside show a locked-message. An employee mentions she "clicked something from the courier" yesterday, then goes quiet, watching the owner's face. The owner hisses, "Nobody calls anyone — we'll handle this Monday with our computer guy." Walk the scene.

Walk it through: (1) Recognize the incident class from Part 2: ransomware, with a probable phishing entry — the courier click the employee just disclosed. That disclosure is gold and it is fragile: your next sentences decide whether this office tells the truth or buries it. Protect the discloser visibly — early honesty about errors is what incident response runs on, per Part 4's culture rule. (2) Stabilize and preserve: nothing gets wiped, "fixed," or negotiated tonight. Screens, the note, and system state are documented and held as your procedures and specialists direct; employees preserve the courier message rather than deleting it in shame. (3) Answer the owner's secrecy plan with Part 5's reality: this incident involves other people's health and personal data, layered legal duties, and an extortion in progress; quiet delay spends the only hours in which containment and reporting do the most good — and authorities warn that private payment, the usual sequel of secrecy, guarantees nothing. (4) Escalate on every track now: your chain and cyber specialists per policy, the victim's ic3.gov report filed immediately, CISA's published ransomware resources in the owner's hands. (5) Build the timeline while it's warm: the click, the first strange signs, the lock-out, who had access, what systems hold what data — Part 4's intake, taken tonight, becomes the specialists' map. (6) Leave the owner with the Part 3 truth to replace the shame: this industry selected her office by softness and data value — and the offices that survive it reputationally are the ones that responded openly and fast.

Try this — Hackers

• ☐ I can state the dispositive question in any hacker encounter: whose system, whose permission, what scope?
• ☐ My incident intake establishes entry pattern, timeline, and password reuse — before anything is wiped or "fixed."
• ☐ I protect early disclosers of mistakes; my scenes reward the truth that incident response runs on.
• ☐ I route ransomware victims to ic3.gov reporting and CISA guidance immediately, and I never advise quiet payment.
• ☐ My own accounts, devices, and family practice the Awareness habits, and I treat unexpected authentication prompts as reportable attacks.

Resources to keep — Hackers

• 911 — if an incident involves threats to safety or an extortion in progress.
• FBI Internet Crime Complaint Center — ic3.gov — the reporting track for intrusions and ransomware; assist victims to file.
• Cybersecurity & Infrastructure Security Agency — cisa.gov — ransomware response guidance and the Secure Our World program.
• Federal Trade Commission — ftc.gov — fraud and identity-theft reporting.
• National Cybersecurity Alliance — staysafeonline.org — teaching material for community talks.
• mass.gov — Massachusetts consumer information.
• 988 Suicide & Crisis Lifeline — call or text 988 — when an incident becomes a personal crisis.

What you earned / what's next — Hackers

✅ Topic Library — Hackers complete (quiz score 80% or higher): You can sort hacker encounters by authorization, describe the attack patterns from the victim's side, explain target selection without shame, run a first hour that preserves evidence and engages specialists, and steer talent toward the defended side of the consent line.

Your certificate

Minister Destiny Testimony Schools Certificate of Completion — Topic Library: Hackers

This certificate is presented by Muslim Ordained Minister Destiny Marie Morgan

Awarded to: ______________________________ (write your name here after you download — your name is never collected or stored by this school)

Date completed: ______________

Congratulations. You stand on the consent line with your eyes open — fluent in the patterns, calm in the first hour. That steadiness is the defense. — Minister Destiny Marie Morgan

This is a certificate of educational completion from Minister Destiny Testimony Schools. It is not a state license, a government certification, or legal training for representing anyone. School rank and completion are school achievements only — not a law-enforcement rank, title, or credential.

What's next: You have completed the Law Enforcement side of the Fraud & Digital Safety cluster — carry its habits into every call: verify, preserve, report.

Sources

• ic3.gov — FBI Internet Crime Complaint Center, annual Internet Crime Reports and alerts
• cisa.gov — Cybersecurity & Infrastructure Security Agency, "StopRansomware Guide"
• ftc.gov — Federal Trade Commission, "How to Recognize and Avoid Phishing Scams"

Minister Destiny Testimony Schools — Law Enforcement. Educational information only, not legal advice. Help lines: 911 in an emergency · 988 Suicide & Crisis Lifeline (call/text 988).