Computer Crime Problems Research Center

Natalia Akhtyrskaja, Ph.D.


The organized crime in sphere of information technologies 


Organizational features of disclosing and investigation of the crimes prepared and made by criminal groups, as well as investigation of illegal penal acts of separate persons, are defined, first of all, by the contents of criminal acts.

 At the same time, fulfillment of group crimes, their organization, stability have an influence on process of criminal case investigation, and in some cases become the dominating factor in criminal actions disclosing and investigation. For example, the organization of the armed gangs by several persons with the purpose of an attack on state or other enterprises, establishments, the organizations or on separate citizens, and participation in such gangs and attacks forms independent structure of a crime - gangsterism - and demands the special tactics of  investigation.

Sources of criminal groups' concept are connected to a criminal - legal category of criminal complicity, i.e. deliberate joint participation of two or more persons in commission of a crime.

The judicial statistics testifies that group crimes are enough widespread form of criminal activity. The majority of such crimes are committed in the form of simple accompliceship, and only 3 % - with division of their participants to functional attributes.

For a designation of concept "accompliceship" the criminal law uses various terms: « group of persons », « a criminal grouping », "gang", etc. The General for all these concepts is privity of several persons to the crimes. It is the major attribute of the organized criminal groups. The quantity of accomplices in such groups changes from two till many hundreds.

Criminal groups, in view of features of their occurrence and the organization, are divided into four types: casual; companies; organized; the criminal organizations or communities.

Casual groups will consist of the persons united for a crime commission without preliminary criminal collusion, situationally. As a rule, in these cases accomplices unite the familiar people related by a residence, study, job, leisure, interests for usual dialogue, and participate in a crime with feeling of solidarity, under influence of momentary impulses. Such criminal groups perpetrate hooligan actions, disabling, destruction or damage of property and other similar acts which are not demanding preliminary planning and the harmonious organization.

Criminal groups such as the companies, more often created   from casual groups, are more rallied and have already settled structure with the expressed antisocial orientation. Criminal activity starts to take the important place in their life though also has no precise plans. The psychological and functional structure of group continues to develop. In the company usually there is no leader, but there is a supervising center, which consists of the most active and authoritative members.

The organized criminal group is the steady criminal community having stable structure. Inside group there is a special discipline and the norms of behavior, antisocial valuable orientation dominates. Infringers of rules quite often are exposed to prosecutions and even punishments.

All activity of the organized criminal group is directed on a perpetration of a crime for reception of the criminal income. In process of formation of such antisocial communities, severity of perpetrated crimes increases.

Structurally organized criminal group is headed by the leader, the head to whom the most active, authoritative members of criminal community and rank-and-file members conducted by them adjoin.

In process of stabilization of the organized criminal group, so-called oppositionist, who aspires to the statement of the leading position, can appear and consequently he becomes a contender of the leader.

In such groups division of their members on functional applicability is widely distributed. One participate in preparation of crimes, carrying out a reconnaissance, developing the plan («the brain center»), working as suppliers on purchase of the weapon and crime instruments, others directly perpetrate crimes, the third provide transportation, storage and realization of the got values.

In some organized groups relations between their members have a latent character. Redistribution of incomes occurs according to a position in a criminal community, and special monetary funds are created for maintenance of community’s activity. Leaders of these criminal associations manage such funds.

Among different criminal groupings the most dangerous ones are criminal organizations or communities. In essence, these are also organized criminal groups but with higher degree of cohesiveness. They differ by branching, order of criminal activity, accountability and stability.

Criminal communities commit the most serious crimes and can exist for a long time since they consist of separate blocks or parts. It implies that disclosure of one or several criminal groups that included in a criminal organization does not result in its liquidation.

Blocks or parts of criminal communities have a relative autonomy, they are headed by the leaders, and thus rank-and-file members do not know all system and features of the organization of criminal association.

The criminal community is headed by the strong leader. As a rule it is the person, subordinated to itself the heads of blocks and parts. There are strict norms of behavior and the rigid discipline supported by threat of inevitable punishment of infringers and persons, leaving of obedience. For maintenance of successful criminal activity in the criminal organizations the special groups are created. They engaged in counterprospecting job, protection of the revealed participants of community, legal covering of crimes' accomplices.

Quantitatively criminal communities can expand to large criminal formations (for example so-called "corporation SCN" disclosed in Kharkov, Ukraine). Presence of various kinds of criminal groups shows that we have active process of qualitative transformation of the underworld with an establishment of relations with the international criminal and official enterprise activities.

Especially it is necessary to note professional crime. Criminal professionalism is a parameter of criminal skills and also shows the role of criminal activity in a criminal communities’ life.

Special criminal knowledge, skills (i.e. the qualification) are necessary for transformation of criminal activity into a professional work. The acquisition of this "skill" is connected to transfer of criminal knowledge to junior criminals by more skilled criminals, during original training. Sometimes criminal training has particular character and results in development of experts in any one field of criminal activity.


Forensic - investigatory practice and criminal statistics allow to define three basic directions of criminal activity of such groups. These are mercenary-violent or general crimes; economic crimes and politized crimes. So, at first, the Russian legislation made answerable the American special services. Russian center of public relations   informed about initiating of criminal case against the agent of FBI the Michael Shuler. The agent is accused of the non-authorized access to the computer information. This story is connected to scandal with the Russian programmers Vasily Gorshkov and Aleksey Ivanov from Chelyabinsk. They have been arrested in the USA on November, 10, 2000. They are incriminated a penetration into payment system Pay Pal (Russian hackers have got 56 thousand numbers of credit cards from this system), and also the breaking of the famous system Western Union in September, 2001. Besides the Chelyabinsk hackers cracked systems of American companies' protection and blackmailed their head.  As a result they paid money to hackers, and sometimes employed them as security advisers.  FBI has founded false firm Invita for arrest criminals. Russians were offered to arrive in the USA and to crack protection system with a guarantee of payment for such services. All keystrokes were fixed by the special program. So experts of FBI could get the remote access to hackers' computers located in Chelyabinsk, and could to receive numerous proofs of their criminal activity.

Ivanov's and Gorshkov's lawyers tried to prove to court, that accesses to criminals' computers which are on the territory of foreign state are illegal action. But the court has not heeded these arguments. The Russian special services joined to case. Chelyabinsk inspector Igor Tkach initiated criminal case and has directed official order to the USA Ministry of Justice. If the Russian hackers will condemn on the basis of the proofs extracted by Americans in the illegal way, it will mean, that special services of USA could use illegal methods for gathering information  both in Russia, and in other countries in further.


It is possible to illustrate the variety of criminal acts of the organized criminal formations by hackers' actions directed to site of the USA Government in October, 2002. Contents of a site, with the information about the USA, have been replaced with a set of obscene words. This act can be considered as a preparatory or educational hacker course for perpetration of further acts of economic- or cyberterrorism.

The technique of such crimes' investigation is characterized by the following features:

- The organization of investigatory activity at reception of the primary information

- Typification of investigatory situations

- Definition of the circumstances subjected to substantiation

- Development of investigation programs

- The organization of inspectors' precautionary activity

- Tactics of investigatory and other actions.

Primary information shares on two parts in accordance with its sources

1) Information arisen as a result of the committed crime having attributes of criminal activity of organized criminal group in the field of computer technologies

2) Information testifying to criminal lifestyle of the person or group of persons; their former criminal activity; about relations in the criminal sphere; participation in creation, storage, selling of the software; antisocial intentions; presence of dirty money.

There are the most important factors influencing on character of investigatory situations at the initial stage of investigation:

- A direction or "branch" of criminal activity

- The contents of criminal acts

- Character of the information on a crime;

- Consequences of a crime;

- Results of previous job on check of the primary information

- The data confirming a commission of a crime by organized criminal group, involved computer systems.

The listed factors and their combinations form the following investigative situations, which are the most typical for an initial stage of crime investigations:

1. There is an active preparation of members of the organized criminal group with purchase of computers, software, involving of experts to a commission of crime.

2. There is a realization of continuing criminal action by members of criminal groups connected to breaking of computer information protection.

3. There is a fact of already finished serious crime committed by criminal group with use of information technologies.

Hypothetical idea, called versions, cannot arise groundlessly with reference to judicial-investigatory activity. The base for their formation is circumstances of a real life and some factors concerning a crime. The variety and complexity of criminal situations creates conditions for the solution of the numerous cogitative tasks, some of them carries not algorithmic, but creative character.


Fragmentary character of the numerous situations is expressed in separate traces, testimony, material evidences. At the same time, the complex of the data on a crime is quite often complicated by staging of crime conditions, falsification of traces, creation of the false information, not allowing to come to correct conclusions and assumptions by the analysis of the available information. The break of real causal-investigatory connections often directs investigation on a false way, results to loss of the evidentiary information. All listed testifies to complex cogitative activity of the inspector, the public prosecutor, the judge.  It is possible to define the following tasks in accordance with the rate of difficulties:


1) Problems in detection of the evidentiary information

2) Tasks according to proofs and the operative information

3) Tasks in development versions of a various orientation

4) Problems in realization of legal decisions.


All listed tasks are connected among themselves by event of a crime and have the purpose of its disclosing. In this plan cogitative tasks can be divided into groups: 1) problems-algorithms, the course of the decision is typical and beforehand known, determined by norm of the law or remedial procedure; 2) heuristic or creative tasks, arising in connection with a problem situation and not having beforehand given course of decisions. A significant part of the cogitative tasks concerning to investigation of computer crimes, committed by the organized criminal groups, are creative, i.e. they demand the search of such ways of the decision which fall outside the limits elementary reasoning. Not always tasks in view can be solved just on the basis of available initial information.

The cogitative analysis of set of factors results in formation of versions. Version is the proved assumption concerning criminal event as a whole or its separate parts. The reference to classification of any objects, properties, situations promotes more precise definition of their kinds and their functions. Classifications in various fields of knowledge have not only theoretical value (finding-out of objects' characteristics), but also a practical value, allowing to define appointment of each class, its role in realization of practical activities. Problems of classification take place in separate sections of criminalistics tactics, namely there is a certain set of investigatory actions, tactical method, the recommendations directed on optimization of investigatory activity.

At investigation of crimes in sphere of computer technologies it is possible to develop some specific versions, in which theory attempts of classification have been undertaken. One of authors shared versions into two groups, the general and individual versions. So, the version is an assumption of a crime in researched event, its character, elements of the crime, separate circumstances and their value, and also about guilty persons, forms of fault, motives and the purposes of a crime [1].

The gradation of versions is detailed, allowing to distribute those concerning concrete items of definition. However, other authors do not divide so wide gradation, specifying that the investigatory version is «the basic, most essential circumstances which form structure of a crime» [2].

The level of the version is defined by set of initial data, and limits of set are defined by a level of data constructed on these initial assumptions. The general set determining significant number of the data, will concern to the general version, smaller set - to a level of individual versions. Thus, the first classification basis is set of the initial data, or volume of concepts.  So versions are divided on the general and individual. The basis for classification of versions is subjects of versions promotion. They are persons connected to investigation of crimes. As a result versions are divided on search, investigative, expert, judicial. As for degree of definiteness, versions are to be divided on typical and concrete [3].



Inherently versions are retrospective and directed on knowledge of the criminal event having place in the past. However, the essence of perspective version is an ascertainment of the criminal and prospective place of his presence, migration, the subsequent criminal acts (preparation, committing and concealment).


Thus, the analysis of elements of criminalistics characteristics of cyber crimes allows to draw a conclusion on a priority of perspective investigative and operative versions of prognostic character, concerning such crimes («the typical center»); on spheres of an encroachment (financial stock exchanges, branch information systems); on a motivated orientation of encroachment (political, economic, hooligan); on a level of preparation and tendencies to perfection of "criminal skill»; on a level of organization,  criminal, intellectual, territorial dynamics and dynamics on spheres. Taking into account the basic prognostic characteristics of the given kind of crimes can play a main role at development of investigation strategy and in a course of operational - search activity.


1.    A.Vasiljev  Base of investigatory tactics M., 1960. page 15.

2. V.Terebilov To a question on investigative versions and planning  // Criminalistics on service of investigation. Ì., 1955. - part 6. - page 109.

3. R.Belkin Course of criminalistics. - Ò.3. page 372.

Home | What's New | Articles | Links
Library | Staff | Contact Us

Copyright © Computer Crime Research Center, 2001-2002 All Rights Reserved.
Contact the CCRC Office at 380-612-735-907

Rambler's Top100 Rambler's Top100