Tactical features of inquiry actions at computer crime investigation
Date: October 15, 2003Source: Computer Crime Research Center
By:
... />
- Technical and criminalistical expert examination of documents. Among the enumerated expert examinations, it is the most specific kind because in this case the expert works with documents stored not on the usual paper carrier but on the machine one.
There is a need to assign the complex expert examination in some cases.
During the preparation for the court expert examination, it is necessary to establish facts, which should be cleared up wit the expert opinion, namely:
- Qualification of events – breakdown in access to the system resources, program malfunction, operator’s mistake or computer crime;
- Causes that resulted in violating access to the computer system resources, reasons of work interruption;
- Object and way of committing a crime when it takes place;
- Circumstances that favored the computer crime commitment, as well as place, time and criminal (-s);
- Size and type of inflicted damage. Not only theft of money, programs, services, information but also moral detriment should be taken into account.
When preparing this inquiry action, it is necessary to take complex measures:
- Determine, examine and protect objects that are sent for expert examination. They can be account or other documents, means of computer technique, carriers of machine information;
- Choose an expert office or a specialist.
It should be pointed out that some programs of a criminal character developed by criminals are very sophisticated. Therefore, an invited expert should be ready to resolve various difficult problems from the professional standpoint. When choosing an expert office or a specialist, the specific character of future investigations should be taken into consideration. For example, when dealing with enciphered information, the expert in cryptography should be called. These can be representatives from MIA and USS special departments.
Services of electronics engineers should be used to study odd elements of computer technique. Program engineers should be engage in examining software and computer system hardware. Experts in radio- and electric connections can give competent advices when determining features of the interconnection between local and global computer networks.
In addition to technical experts, the assistance of specialists who possess knowledge in that or other field of using computer technique can be useful as well. In this case, the inspector has to be ready for the complex expert examination. He needs making out a list of questions, which are addressed to the expert (-s) according to his (their) profession. The possibility of effective interaction between experts in various spheres should be paid special attention to. Then it is required to prepare technical means and additional equipment for uninterrupted investigation and record of obtained results.
The enumerated requirements aim to get and record concrete data on the origin of material evidences and their distinctive features thereby creating conditions to elucidate their connection with the investigated case and authenticity of gained information. The law provided procedural order of fixing material evidences must ensure the authenticity of material evidences used in the case and impossibility of their substitution and falsification.
The complex use of scientific and technical means, personal electronic computers and video-recording can considerably facilitate the procedural registration of inquiry actions as a protocol and can help avoiding mistakes at the further study of video-materials on the part of persons who did not participate directly in the inquiry actions. It should be noted that comments of an expert who took part in the inquiry actions could play an important role in estimating those events where he had to be a spectator, he being questioned as a witness in this case.
On the initial phase of investigating computer crimes, the inspector has to take into consideration offered recommendations because they will favor:
- Correct assessment of information on events;
- Optimal choice of immediate inquiry actions;
- Rational use of special knowledge and scientific and technical means.
Solving only tactical and technical problems on the preparation stage does not suffice to conduct successfully inquiry actions. The inspector should be ready for taking into account some features established by:
- Specific conditions of inquiry action course;
- Order and rules of conducting them;
- Specific character of evidentiary information obtained during the primary investigation.
It can be generally concluded that the initial phase of investigating crimes committed by using electronic computers is not exhausted with the enumerated inquiry actions. However, the conducted research showed that they were the most difficult for practical officials who were engaged in investigating computer crimes. The presented tactical features of particular inquiry actions (examination of crime commitment place, interrogation of witnesses, search of rooms, questioning of suspected persons) and checking measures (receiving of explanations, demanding of materials) at the investigation of these offences make it possible to increase its effectiveness and obtain larger amount of evidentiary information.
R. Belkin “Criminalistics course in three volumes”. – V.3. – Ch.6. – M., 1997. – P.129-148;
I. Luzguin “Methods of studying, estimating and solving reference inquiry situations” // Reference inquiry situations and criminalistical ways of settling them: Collection of scientific works. – M., 1991. – P.10-21.
I. Shumilov “Criminalistical aspects of information security”. Dissertation of Candidate of Juridical Science. - St-P., 1997. – P.108-114.
V. Krilov “Investigation of information crimes”. – M., 1998. – P.235.
V. Agaphonov, A. Philipov “Criminalistics. Questions and answers”. – M., 2000. – P.92.
N. Shurukhnov, I. Levchenko, I. Luchin “Specific character of search at the withdrawal of computer information” // Actual problems of improving DIA activity under the new economic and social conditions. – M., 1997. – P.28/
E. Rossinskaya “ Court expert examination in the criminal, civil and arbitrary processes”. – M., 1996. – P.173.
Add comment
Email to a Friend
