Peculiarities of search tactics during investigation of computer crimes
Date: October 15, 2003Source: Computer Crime Research Center
By:
The tactics of inquiry activity (as a complex of more expedient ways of its implementation) is characterized by not only the elements, which determine general order and ways of taking investigatory actions, but also the peculiarities of carrying out them in difficult , unfavorable situations when the concerned persons impede the investigation process.
Under such circumstances the tactics serves as a means of overcoming counteraction since the fulfillment of inquiry targets is practically impossible without active actions and tactics methods, which ensure their offensive character.
The suddenness consisting in such an organization of the inquiry work, which makes the content and character of the investigator’s actions unforeseen for the counteracting side, is one of these means.
The suddenness can be considered, first, as a principle, which defines and reflects the offensive and operative nature of inquiry activities while overcoming the investigation counteraction rendered by concerned persons. In such situations the suddenness has a capacity of the fundamental basis, obligatory rule of activities, since the other approach (refusal to apply active means of overcoming counteraction) would mean the disarmament of inquiry bodies in the face of the counteracting side. Secondly, the suddenness is a tactical scheme of collecting factual data in conformity with concrete circumstances of the investigation. Thirdly, it is expressed by realizing the unexpectedness factor in the conditions of definite investigatory situation. However some statements on the illegality of using the suddenness in the investigatory activity can be met in the juridical literature. It is based on the assertion that the investigation dispute can be solved by mutual agreement. So, I.F.Panteleev thinks that the
affirmation concerning the presence of disputes in the inquiry activity “is at variance with the essence and main principles of the criminal trial”. “This idea, - he points out, - favors the emergence of some methods which are not peculiar to the criminal trial and directed at “misinforming”, “confusing”, “surprising”, “embarassing” the interrogated person and “rousing a conflict” among the accomplices [1].
While performing investigatory actions the suddenness can be achieved by different factors – time, place, character and mode of measures implemented by the investigator. The interrogation of convicted persons showed that in 71% of cases they were surprised by the place and time of carrying out the investigatory action; in 46,5% of cases the unexpectedness was achieved by the factor itself of realizing the investigatory action, circle of persons drawn in it and character of used evidences.
Time factor. In the temporal aspect taking actions in that moment when the corresponding persons do not suppose and expect it attains the suddenness.
The main ways of realizing it are:
1) a forestalling character of implemented measures;
2) a delay of carrying out necessary actions;
3) a repeated realization of investigatory actions.
The choice and opportunities of using these ways are stipulated by the stage of investigation, peculiarities of the concrete investigatory situation.
The forestalling nature of the investigatory actions assumes that they must be taken before the suspected person, who counteracts the investigation, obtains information on the possibility of carrying out them. If the concerned person has such an information, the investigatory action should be implemented at the time excluding the possibility of taking steps which impede the achievement of a result planned by the inspector.
The most favorable situation for using the given way is usually formed on the initial stage of the investigation when the suddenness, as a rule, is connected with the quickness and urgency of inquiry actions, as well as their simultaneous realization (search) in respect of some persons. So, 78,4% of the interrogated inspectors noted that the realization of suddenness depended on stages of the investigation. According to the analysis of criminal cases, searching on the day of instituting proceeding was effective in 82% of cases, then the effectiveness of the given investigatory action dropped abruptly: during three days – till 25%, during ten days – till 15%.
The possibilities of using tactical methods of unexpectedness considerably widen while bringing an action on evidences collected by the inquiry agency in the process of implementing operation-and-search measures. In such cases there forms a situation when an inspector and operating official can learn the available information beforehand and determine time, order and sequence of using it to attain a desired result. Their actions take a purposeful and planned character when the persons concerned in counteracting the investigation do not expect them. It allows to arrest all the suspected persons at the same time and prevent them from coordinating their actions, search simultaneously all the persons who are expected to oppose the investigation.
The inspectors often come across the necessity of examining computers and information contained in them and on separate carriers (floppies, laser disks).
During the investigatory action the computing equipment and computer information can be considered as:
1) an object of traditional crimes (for example: larcenies). More often in such cases the examination of computer hardware and information carriers is a variety of the investigatory inspection of objects and does not have any tactical features;
2) an instrument of both traditional crimes and those in the field of computer information. In such cases the other computers are “victims of the computer attack” (e.g. as a result of viruses such as “Trojan horse” which allow to take possession of information and use it with a mercenary motive) and so should be examined;
3) an object with information which bears or can bear a relation to the investigated crime. The fact is that now enterprise and industrial accounting is kept on the computing base; data reflected in that way can also be an object of offences or of interest to the investigation;
4) persons, who have computers at their private or official disposal, often use them as a diary, telephone directory or for holding talks through e-mail in Internet. This information is of a great interest to the investigation as well. The tactics of inspecting computers is quite specific for three last varieties of their use in all respects, which are of interest to the investigator.
The realization of the suddenness factor is characterized by the peculiar regularity consisting in that the effectiveness of suddenness is limited by the time, which is needed for a person to reorder his actions and intentions, as well as choice of means and ways of opposing the suddenness. After that the suddenness ceases acting. The inspector’s loss of time leads to the suspected or other concerned person’s gain in it. It gives them an opportunity to analyze the formed situation, choose a new line of conduct and co-ordinate their actions with the accomplices, relatives and other concerned persons.
A.F.Cony wrote in conformity with the given situation : The more sudden is an impression exciting a strong emotion the more it seizes attention and the quicker feelings overshadow the external circumstances… The danger suddenly arisen causes unintentional exaggeration of its sizes and forms" [2].
On the next sages of investigation the concerned persons have available to definite extent information on actions of the inspection and officials from law enforcement bodies. It allows them to forecast the possible actions on the part of the law enforcement body officers. Therefore the use of tactical methods of providing suddenness (by time) can be achieved, first of all by a delay of implementing and repeatedly performing the investigatory actions.
Many persons take the delay of implementing the inquiry action as the inspector’s inactivity, which is caused by the lack of appropriate information or necessity and opportunity to carry out it. As a result the person settles down, begins conduct himself more freely and loses his sense of watchfulness.
There are two variants of the inspector’s actions at the delay of implementation:
1) a waiting for a definite period in the hope of that the suspected person will fulfil some actions, which will be used to obtain an evidentiary information;
2) a purposeful forming of the suspected person’s conviction that the inspector does not plan certain investigatory actions.
While reconducting investigatory actions the suddenness is connected with that after their initial realization the suspected person counting on their completeness also calms down, loses his prudence and carries out actions, which allow to collect evidences proving his guilty.
So, according to the interrogation of convicted persons, in 88,2% of cases the repeated search was effective due, to the emergency of objects, which had lain earlier in the other place. The repeated searches conducted in some time can become more effective because the criminals settle down after the first search and persons,...
Next
Add comment
Email to a Friend
