In a vehicle bay on the FBI’s campus in Huntsville, Alabama, students lean into an open car, peeling back plastic and upholstery, tracing wires deep into the vehicle’s interior. One by one, they work to extract the electronic control unit—the car’s digital brain.
In a real investigation, the information it contains could help reconstruct where a vehicle has been, how it was used, and who may have been behind the wheel.
For now, it’s an exercise.
“This is about as real as it’s going to get before people go out in the field,” said Dave Beachboard, who manages the FBI’s Kinetic Cyber Range.
The exercise, conducted in early April, reflects a broader shift in how the Bureau prepares agents, analysts, and forensic specialists for investigations that increasingly hinge on digital evidence. For years, much of that training took place in classrooms, where students learned tools and techniques at their desks before applying them later in the field.
“In the past, you never left the classroom,” Beachboard said. “Everything was presented to you at your desk. You would process a cell phone or a piece of loose media, learn about servers. Everything was kind of theory-based, along with a little bit of hands-on.”
At the FBI’s North Campus on Redstone Arsenal in Huntsville, that model has been turned inside out.
The Kinetic Cyber Range—a 22,000-square-foot training environment operated by the Bureau’s Operational Technology Division—resembles a small town built for investigations. There are houses and hotel rooms, a power company, a hospital, and a gas station. Each space is wired with functioning systems, networks, and devices designed to behave as they would in the real world.
Since opening in February 2025, the facility has trained more than 1,400 students, including FBI personnel and partners from other agencies.
But the point isn’t just scale. It’s realism.
“The systems that we have running in these facilities are just as real as the facade on the outside,” Beachboard said. “When they start diving into the network, they’re going to see Active Directory, email, firewalls—everything that’s typical of that venue.”
In one scenario, students move through a home filled with internet-connected devices and decide what to seize and what to leave behind. In another, they serve a search warrant at a business and work with system administrators to access data buried inside a corporate network.
Elsewhere, inside a data center, the training becomes more physical.
“I have a data center that has over 200 servers running in it,” Beachboard said. “Some are running Windows, some are running Linux. So, a student gets to encounter what it’s like working in a data center.”
The conditions are deliberate.
“They’re cold, they’re cramped, they’re noisy, they’re dark, they’re miserable,” he said. “Again, recreating what it’s like working in a data center.”
The range is also where different parts of the FBI’s mission converge.
The Operational Technology Division, which focuses on digital forensics, trains alongside the Cyber Division, which investigates computer intrusions—cases that often unfold across continents and rarely involve physical evidence.
“The success of our investigations and operations require the various job roles that make up a cyber squad working together,” said Stephanie Cassioppi, who leads the unit running cyber training in Huntsville.
For cyber investigators, the work is less about seizing devices and more about following activity across networks.
“For us, our threat actors are overseas,” Cassioppi said. “The odds are I’m never going to get my hands on their computer or their phone.”
Instead, they learn to trace the origins of an intrusion, identify how malware spreads, and follow digital breadcrumbs—sometimes across multiple systems and jurisdictions.
Inside the range, those challenges are recreated through scenarios that unfold in real time.
Students conduct interviews with role players acting as business owners, executives, and legal teams and practice how to explain what they are doing and why.
“Interviews are conducted ensuring the company understands what we are collecting, but, more importantly, what we are not collecting,” Cassioppi said.
In other exercises, the pace accelerates. A simulated ransomware attack locks down a hospital network. Alarms sound. Role players respond as if patients’ care is at risk, forcing trainees to navigate both the technical problem and the human one.
The pressure is intentional.
The goal is not only to teach technical skills but to prepare investigators for the moments when those skills must be applied under stress—when communication, judgment, and restraint matter just as much as expertise.
“Cyber is not just technical,” Cassioppi said. “It’s also practicing those soft skills, the dealing with people.”
The range also offers something that has historically been harder to replicate: the chance to make mistakes.
“We try to keep the scenarios as real as possible,” Beachboard said. “Everything’s based off of past case studies.”
“We want them to make the mistakes in the Kinetic Cyber Range,” Cassioppi added. “That’s when we can slap their hands and kind of say, ‘Hey, this is a learning opportunity. This is what you don’t want to do when you get out into the real world.'”
As technology evolves, so does the training. Scenarios are updated regularly to reflect emerging threats—from connected devices to new forms of cybercrime—so that what students encounter here does not lag behind what they will face outside.
“If we see gaps in training, we will adjust,” Beachboard said, “making sure that students are encountering the latest software, the latest Internet of Things, the latest drones, the latest vehicle forensics—all of that to keep us cutting edge.”
Back in the vehicle bay, the students finish extracting data from the car’s systems. What began as a tangle of wires and panels has been translated into something usable—information that could, in another setting, become evidence.
Read the original announcement here.
