Mobile surveillance

Mobile surveillance is one of the more commonly used methods of physical surveillance. A mobile surveillance team, riding solo or in pairs in inconspicuous vehicles, simply follow a suspect as he or she travels in a vehicle. However simple it sounds, conducting a mobile surveillance operation that does not alert the suspect requires skill and coordination within the team, relying upon radio communication. The need for fluidity, coordination, and detailed planning increases as the number of surveillance operators is involved.

A single vehicle surveillance operation creates a high risk that the operation will be compromised, or “burned” as a single vehicle will not be able to be out of the line of sight of the suspect. Having more vehicles involved in mobile surveillance allows for the lead vehicle, known as the “eye” to be switched randomly at various locations or turns. The altering of the lead vehicle prevents the suspect from seeing the same vehicle often enough to recognize it during the surveillance operation.

The lead vehicle will also have primarily control of radio communications during mobile surveillance. When the “eye” has been transferred to another surveillance vehicle, the replacement lead vehicle will take primary for radio communications. As long as the lead vehicle has the suspect in a visual line of sight, other surveillance vehicles should not be in view of the suspect to prevent being compromised.

A visual line of sight does not mean the lead vehicle is directly behind the suspect, but rather in a position to have constant and rarely interrupted visual contact, such as seen in Figure 3.1. Normal traffic is used as cover cars, in that other vehicles on the roads are used to cover, or hide, the lead surveillance vehicle.

Intelligence derived from mobile surveillance should answer questions such as; with whom did the suspect interact, what did the suspect do, where did the suspect travel, which routes were taken, and what are the obvious reasons for each location visited. Having a suspect’s normal activities documented will assist in identifying associates, obtaining sources of information, corroborating information from sources, future suspect interviews, and search warrant planning.

The environment and suspect actions affect specific methods of mobile surveillance. Crowded urban areas with high traffic decrease the ability for the lead vehicle to frequently change as other surveillance vehicles cannot weave through traffic without potentially drawing attention. Rural areas pose a problem of surveillance team vehicles outnumbering the average amount of vehicles on the road, or even being the only vehicles in the area. Suspects that park and enter buildings require that surveillance operators consider leaving their vehicles and conduct surveillance on foot.

To obtain the identity of suspects during surveillance, check the ownership of the suspect vehicle through the Department of Motor Vehicles. This information may be accurate only if the vehicle being driven is owned by the suspect. Another avenue of potentially identifying the suspect is through recovering fingerprints. Should the suspect touch items during the surveillance through eating in a restaurant, it may be possible to recover a glass from the suspect’s table for fingerprinting or possibly from a credit card used to pay for the meal depending upon the environment and potential cooperation of the business.

Internet cafés or businesses that provide access to computer systems are a source of suspect fingerprint identification. Suspects that are seen using a publicly accessed computer system may be checked for the possibility of recovering fingerprints from the keyboard or other items the suspect may have touched and left identifiable fingerprints.

Fingerprints could also be recovered from discarded property in garbage from the suspect’s property after having been collected by the waste management company. Electronic devices used by the suspect and examined covertly or after seizure with arrest or search warrants should be dusted for fingerprints. If for no other reason than to show the suspect actually touched that evidence item, but also to fully identify other potential suspects that may have touched or used the electronic devices.

Potentially, items that the suspect may have used in a crime, such as a hacking incident or sending harassing emails, may be tossed in a public trash receptacle. Surveillance operators that are in the position to observe this activity and recover the items most likely will have collected some of the best evidence in the investigation.

Mobile surveillance may seem to be an overly exhaustive effort for a cybercrime investigation. However, when an investigation requires placing a cybercriminal at a computer, this type of surveillance may be necessary. The benefits of the resources spent on surveillance with expected outcomes as compared with other investigative methods should be considered.

Aerial surveillance

Aerial surveillance affords a near invisibility of investigators for suspect mobile surveillance. Most persons never look up as they travel which makes aerial surveillance one of the best methods to track a suspect’s movements. Depending upon the type of aircraft, ranging from small drones, helicopters, or fixed wing aircraft, the flying height can be virtually invisible to persons on the ground. As can been in Figure 3.2, aerial surveillance covers a larger area with ease as compared to mobile surveillance alone seen in Figure 3.1.

Aerial surveillance also brings the ability to video record the surveillance. Using infrared (night) vision and thermal imaging cameras, nearly any time of day or night is effective. However, aerial surveillance is rarely even an option for most agencies. Unless the investigation is high profile, the odds of obtaining aerial surveillance support will be low. Even with a high profile investigation, the financial cost per flying hour along with the few aircraft available make aerial surveillance a luxury to which few may have access.

Without supporting ground surveillance, suspect activities occurring within public buildings, such as a coffee shop or shopping mall, will be unobserved from the air. Aerial surveillance in combination with mobile surveillance brings coordination efforts to a new level. Just the communication between air and ground surveillance between different agencies may require a re-configuration or sharing of radios and radio frequencies. Though not to be discounted as a viable means of surveillance, the use of aerial assets does require intensive coordination and resources.

Video surveillance

In an Orwellian surveillance world, all public places would be monitored with video surveillance, documenting every person and all activities. At least the goal of such a Big Brother World of an all-encompassing surveillance system could be so much. Most likely, should any government place such a system into operation monitoring all citizens, public outcry would most likely demand the systems removed.

However, certain systems are already in place by various government jurisdictions. Some of the most common systems currently employed are Department of Transportation cameras along freeways, red-light cameras at intersections, and real-time cameras placed at either high crime or high traffic areas.

Figure 3.3 shows an example of a real-time (live feed) video camera at a controlled intersection which can capture all traffic. Red-light cameras, that is, those cameras that just take still photos should a vehicle run a red-light, will only capture those vehicles violating a traffic law. The view from the camera in Figure 3.3 can be seen in Figure 3.4. Many of these cameras can pan, tilt, and zoom (PTZ) for more targeted detail.

Government agencies maintaining traffic cameras may allow for public viewing on the Internet, although live streaming video may not be available. Since many of these cameras allow for panning/tilting/zooming, investigators should seek the agency responsible for the cameras in order to gain access to internal viewing, control, and recording.

Although photos taken with the red-light camera most likely are maintained for any period of time, the camera feed for live videos may not be recorded or even constantly monitored. Having internal access to multiple cameras can increase the effectiveness of suspect surveillance with an additional video recording.

To corroborate a suspect’s alleged alibi, obtaining recorded video or photos that might exist should be undertaken quickly. Some systems may retain recordings for weeks where others may only maintain previous day’s recordings. During a suspect interview, locations that the suspect claimed to have been (or not been) may have security cameras to prove or disprove an alibi. This would also include locations where the suspect may have made purchases at gas stations, used an ATM, or other locations with security cameras present.

In addition to cameras in use by government agencies, private companies employ the same technology in more locations for the security of businesses. These locations include security cameras in department stores, gas stations, banks, and even coffee shops. Figure 3.5 shows a commonly used security camera used in many business locations. Businesses with high value property at risk, such as casinos and banks, will not only maintain recordings of the videos, but may also employ full-time monitoring of live feeds to detect criminal activity. As these systems are fairly inexpensive, many businesses employ the security cameras. As an example to the normalcy of security cameras, patrons of most coffee shops hardly pay a glance to the numerous cameras mounted on the ceiling.

The combination of government placed security cameras with private business cameras affords a great amount of coverage of public areas. During mobile surveillance operations, investigators should take note of cameras seen during the surveillance. These would include government cameras on freeways and at intersections as well as private business cameras that surround the perimeter or a business or within the business. A subsequent follow-up to each entity having control of these cameras may recover recorded still images or video of the suspect. These photos and videos would be pertinent documentation of the location, time, and visual identification of the suspect.

Suspects that exhibit a pattern of travel or visits to specific businesses allow for investigators to take full advantage of security camera systems. Given a specific location where a suspect frequents, in which a security system with cameras exist, may present an opportunity for close surveillance without fear of being compromised. Security cameras that are monitored in real-time usually allow control of the individual cameras in varying the angle and magnification.

In some situations, it may be possible to view a computer monitor through a security camera in a public area, such as a coffee shop, as well as record that activity. Figure 3.6 shows an example of a business lobby captured by a ceiling installed security camera. Although the ceiling mounted camera is clearly visible, patrons rarely are concerned or aware of these types of cameras.

Businesses cooperating with law enforcement or conducting their own internal investigations can take full advantage of a range of security camera systems. Installation can take place afterhours and be installed specific to monitor a single person or multiple persons. However, there most certainly are limitations as to the extent of surveillance that can be conducted in regard to a person’s privacy, even in the workplace.

Covertly installed cameras

Even as there are private and government owned security cameras throughout public areas in most cities, not every location is covered by a camera. For those areas, investigators may choose to install a security camera specific to the needs of the surveillance. These cameras can be real-time live feeds, monitored constantly or recorded constantly, or configured to take still photos based on programmed schedule or motion detection.

Self-installed systems can be directed at a specific area for a specific purpose. If the suspect activity is suspected to occur at a certain location, such as an Internet Café or a residence, by a specific individual, recording the suspect arriving and departing that location can be matched to later identified acts. A covert surveillance camera can practically eliminate investigators organizing surveillance teams and only requires periodically reviewing the recordings.

Covert surveillance cameras offer more flexibility than overtly exposed cameras. These cameras can be installed in vehicles, such as the classic Hollywood surveillance van, or can be attached to buildings and outdoor fixtures. As one example, Figure 3.7 shows where a covert camera can be installed on a telephone pole or near a power transformer without detection. Issues of personal privacy still need to be considered, even in public areas, as to the legality of placing any device capable of capturing video or photos.

Some criminal investigations require the covert installation of audio and/or video in a suspect residence or vehicle. These instances require court approved search warrants and highly skilled professionals. Covertly entering a residence, business, or vehicle without activating alarms and without leaving traces of having entered is a risky activity. Additionally, nearly any covertly installed device can be discovered either visually or with electronic countermeasures.

Other sources of surveillance records

Rather than using keys to unlock doors, many businesses employ access-control systems. Access-control systems assist in tracking employee access to any location of a business location that has an access-device installed. Few are foolproof, but some systems are more accurate and less able to be defeated than others.

One of these security devices is the keycard access system. This system utilizes a Radio Frequency Identification (RFID) to control access to secure areas. An RFID chip, about the size of a grain of rice, is usually embedded in a credit card shaped item, a key fob, or other easily carried container. The RFID chip is programmed with the employee’s information and specific security authorization for different access points. The RFID is placed near a receiver that reads the RFID chip. If access authority has been programmed, the door will be unlocked and the action logged by date, time, and user. Without additional evidence, it can only be assumed that the suspect was using the card and not another employee using the suspect’s card. Figure 3.8 is an example of an RFID chip in a handheld, credit card size container.

Businesses with heightened security may usually have additional security measures that not only log employee access, but prevent unauthorized access by those that attempt to portray themselves as an employee. These additional security measures, known as biometrics, can be physical biometrics or behavioral biometrics. Physical biometrics recognition devices rely upon a person’s physical features and include retinal scanners, fingerprint scanners, and facial recognition.

Behavioral biometrics relies upon an individual’s behavior for identification. These include signature recognition, speech recognition, and even keystroke dynamics, where a computer user’s timing of using the keyboard is an identifying factor. Any of these methods contributes to the identification of the suspect and timeline of activity.

Surveillance notes and timelines

Throughout any type of investigation, notes are taken to memorialize events with written documentation. Investigators later transcribe handwritten notes to formalized documents, such as reports, declarations, and affidavits. In addition to these forms of documentation, importing handwritten notes of events into timelines has become a more common method of visualizing a series of events.

An example of handwritten notes taken from a physical surveillance is shown in Figure 3.9. The format for handwritten notes is usually any form available at the time that an event is observed, even on a scrap of paper if necessary. It is not the appearance as much as it is documenting activity observed to later be transcribed into useful information.

All persons involved in a surveillance operation are responsible for their own notes. Notes recorded electronically, such as using a digital recorder, should be transcribed to paper. All notes from every person need to be transferred to the case investigator as a central repository of information. In criminal cases, these notes, even the haphazardly written notes on a napkin, are evidence and depending upon agency policy, need to be preserved as such.

The transcription of notes taken throughout surveillance can be entered into an ongoing timeline of events. Investigators are intimately aware of all information in their cases, so much so, that they may assume everyone else is also fully aware of all information in the cases. The creation of an activity timeline, created specifically to show event, helps to visually describe related activity of an investigation. The transcription of handwritten notes into an investigation timeline is shown in Figure 3.10.

A spreadsheet is perhaps one of the easiest methods to store events. A database will have more capability to store more information but the ease to which a spreadsheet can be more quickly created and shared with other persons. A spreadsheet timeline can be sorted by any sorting column to find information or view specific information. Events can be entered in the order received, not necessarily as they occurred, yet the timeline can be sorted by time of event quickly.

A visual representation using the sample information from Figure 3.10 is seen in Figure 3.11. Case presentation methods involving massive amounts of data from forensic analysis and physical surveillance operations will be detailed in a later chapter. But, it will be helpful to keep in mind the reason for keeping track of all events, even events that may seem inconsequential, for later analysis and case presentation. One of the end results of constantly working on a timeline is the visual representation of physical suspect activity and computer activity across a multitude of devices and locations.

Complex cases will have complex visual representations. Copious notes and voluminous phone records will add to this complexity. Organization skills are a valued trait in these types of investigations, especially when event information from multiple electronic devices is merged with surveillance activity notes.

Oral intercepts

The most publicly well-known type of electronic surveillance authority is the wiretap, also referred to as Title III (Federal Wiretap Act). The Title III is not found in the United States Code under “Title 3.” It is actually under Title 18. Title III refers to the title number in Omnibus Crime Control and Safe Streets Act of 1968 which is Title III. Some states, such as California, also allow for wiretaps conducted by local law enforcement. The wiretap of oral communications requires a high burden of necessity for approval, usually because other investigative means are shown ineffective or expected to be ineffective. Some states, such as California, approve wiretaps only as the last resort.

Wiretap authority applies not only to the interception of telephones and cell phones, but also real-time capture of text messages, email communication, and Internet Relay Chat through network monitoring and use of Sniffer software. Sniffer software are programs that intercept routed data and examine each packet for information such as passwords and other data transmitted in clear text. Sniffer software can be configured to capture specified data or targeted data, depending upon the needs of the investigation.

Wiretaps are an extremely effective means to collect evidence in real-time, capturing the actual spoken words of suspects. Wiretaps also require intensive resources, both in personnel and finances, but as mentioned, may be the last resort in some investigations. An important note with wiretaps is that it is usually the suspect and all the communication devices used that are authorized for a wiretap. As it is common for criminals to use disposable phones, roving oral interceptions are approved to cover for the devices used.

Dialed number recorders

Pen Registers and Trap and Trace devices are electronic devices that record all outgoing and incoming information from telephone calls and Internet communications. Practically, a Pen Register records outgoing numbers with the Trap and Trace device recording incoming numbers. More accurately, the devices can be called Dialed Number Recorders (DNR). The type of information captured is in the form of dialed telephone numbers, the length of calls, and the identities of an email message’s sender and recipient. Although the content of phone calls and emails is not captured, intelligence can be derived by the capture of this information and merged into a case timeline.

An example of phone records, also known as “phone tolls,” is seen in Figure 3.12, from State of Florida v. Casey Marie Anthony (2011). Cell phone records, showing calls/text made and received, combined with cell tower analysis, can give indications of suspect location. Further investigation of phone records, such as interviewing those listed communicating with the suspect phone, may confirm that the suspect possessed the phone, discrediting a suspect’s claim that someone else possessed the phone.

Identifying a suspect’s cell phone is problematic unless the cellular number is publicly available. When the cellular is not publicly available, or the suspect frequently changes cell phones, law enforcement can obtain the numbers through use of a device known as the “Triggerfish.” The Triggerfish device mimics a cell phone tower. By being seen as a cell phone tower by cell phones in the area, or an area targeted by the Triggerfish, the cell phones will reveal their phone numbers, serial numbers, and location to the Triggerfish device. Neither the cell phone nor cell phone tower is alerted to the use of the Triggerfish.

A Triggerfish was used in the capture of one of the world’s most well-known hackers, Kevin Mitnick (Shimormura, 1996). Mitnick’s hacking career started when he was 16 in 1979 and continued until 1995, where he was arrested and convicted and served over 4 years in prison.

The Triggerfish also assists in obtaining cell phone information for Dialed Number Recorder (DNR) applications and wiretaps. The need for a DNR in an investigation can be determined in the same manner as any investigative method. Will it be beneficial to the investigation? Are there other more effective methods? Does this method pertain to the suspect’s use of cellular phones? What legal authority is needed?

Residence landlines are a source of information that can also corroborate a suspect’s location. Retrieving records from the phone service provider will show calls made and received by the home landline. Interviews with the owners of numbers listed in the records may be able to confirm that the suspect used the phone in question on a specified day. Claims that a suspect was not at home during an incident, such as the downloading of contraband on a home computer, may be able to be disproven through phone records, even though no physical surveillance was conducted. A partial listing of home phone records from State of Florida v. Casey Marie Anthony (2011) can be seen in Figure 3.13.

Trash runs

The legality of collecting another person’s trash from the curb varies state to state, and federally. If legal authority exists in which investigators can collect the suspect’s trash, evidence obtained from the trash may be able to place the suspect at various locations. Examples would be finding receipts from locations that provide access to wireless networks such as a café. An example of such a fantastic find is seen in Figure 3.14.

The significance of evidence that can be recovered from trash is that purchases made in cash, in which the suspect kept the receipt only to throw it away, would not be found through a search of bank records or credit card purchases. Even with multiple persons living at a single residence, receipts and other items placing a person at a location will be beneficial to the investigation. Many investigations are solved through pure luck. Timing plays a part. Skill plays a part. Suspect mistakes also play a part. But in many cases, it seems as if pure luck breaks a case.

In the example of finding receipts with dates, times, and locations that provided wireless access, if there were IP addresses previously obtained that were identified used in criminal activity result that matched, then luck in finding these receipts could break the case. Potentially, store video could be obtained based on thrown away receipts. The term “luck” is used loosely as good investigators seem to be lucky all the time when in fact, it is just hard work and tenacity.

Tracking cell phones

For a cell phone to be able to make and receive calls, it must communicate with cell phone towers. As a cell communicates with cell phone towers, the provider of the cell phone service generates a log of the connections. The phone service provider maintains those logs of communication with the cell towers for a length of time. The retention of data varies with providers, but most times will be available for at least one or more billing cycles.

Cell phones with Global Positioning System (GPS) enabled can be tracked remotely, in real-time. Currently, there are few, if any cell phones being manufactured without GPS capability. Corporate owned cell phones can be tracked by GPS and monitored online by the owner, just as a corporation can employ GPS on its fleet vehicles. The corporate monitoring of physical assets is conducted without the need of court approved search warrants.

Obtaining and analyzing cell tower records allow the investigator to track the movements of the phone through a given time period, nearly like a Global Positioning Device would. Investigators can plot the communication with cell towers on a map, and if the device can be tied to the suspect, it can be assumed that the travel of the cell phone was similarly that of the suspect.

Cell tower information accuracy depends upon various factors. The type of tower, number of towers in the area, terrain, buildings, weather, and even the time of day will affect the accuracy of location. There are numerous online sources to find locations of towers based on location. One such website is http://www.antennasearch.com. The results for cell towers for 200 Mill Ave S, Renton, Washington returned the following visual representation of cell phone towers seen in Figure 3.15. As can been seen in the visual, there are many towers for which the suspect cell phone could communicate with better accuracy than locations with fewer cell towers.

Cell tower analysis contributes to physical surveillance efforts. Relying solely upon cell tower analysis does not confirm the suspect possessed the phone, only the location of the phone itself. Potentially, any cell phone may be shared or even inadvertently forgotten in another person’s vehicle and recovered at a later time by the suspect. Combined with other surveillance methods, a cell tower analysis can corroborate intelligence gathered throughout the investigation as to the whereabouts of the suspect.

Vehicle tracking

Installing a GPS device on a suspect vehicle allows for constant monitoring without fear of losing sight of the vehicle with mobile surveillance. Combined with an identified cell phone belonging to a suspect, movements can be tracked using cell tower analysis of the cell phone which can result in surveillance resources able to be curtailed.

As with any electronic surveillance method, investigators must abide by the current law in their jurisdiction, which will change as technology changes. There are different methods to employ GPS on vehicles. Attaching a GPS device can be either magnetic (“slap on”) or hardwired to a power source on the vehicle. The use of the GPS and ease of covertly installing the device usually determines the type of installation.

Depending upon the GPS device, information can be stored and not transmitted or data can be transmitted wirelessly for real-time review. For regularly transmitted GPS data, which can be once every second to any time afterward, the power needs for the GPS will be higher. Wireless transmission configuration is best when the GPS is hardwired to a power source from the vehicle.

GPS units that do not transmit data usually require the investigator to manually recover the data by either connecting to a computer or be within a close distance to connect with a short-range wireless connection. If a suspect is identified as renting a vehicle that has GPS installed, obtaining the data after the vehicle is returned could lead to pertinent location information.

As newer vehicles have options for factory installed GPS systems, the ability to remotely activate (if not already activated) the vehicle’s onboard GPS system exists. However, having access to the suspect’s GPS system could potentially be compromised due to factors such as the suspect activating or deactivating the GPS through the provider of the service.

GPS devices are also becoming common for home detention, where a person convicted of a crime such as drunk driving, may opt to serve their jail sentence at home, and agree to wear a GPS device. This allows for the person to travel between work and home while under electronic supervision. These GPS devices most always transmit real-time data, accessible by the agency responsible for monitoring the persons.

Automated toll collection devices are a source of location information for a suspect’s vehicle. These toll collection devices will log the vehicle’s date, time, and location for billing purposes. Automated toll collection data collection can be in the form of scanning license plates using cameras or through Radio Frequency Identifying devices (RFID) attached to vehicles. This information is available from the billing third party and can add to the suspect’s location.

Another method to determine historical locations of a suspect and vehicle is through a check of the suspect’s driving record. Traffic stops by any law enforcement agency that issues a citation will be entered into the suspect’s driving record. Even if a citation was not entered, should the traffic officer check the driver’s name for wants and warrants, this information may be available for some time. Traffic stops have placed suspects in close proximity to crimes for many years. A classic example of a common traffic stop resulting in the arrest of a suspect is the case of United States America v. Timothy James McVeigh (1997), bombing of the Alfred P. Murrah Federal Building Oklahoma City, where one McVeigh was identified through a traffic stop shortly after the bombing.

Keystroke logging

The installation of keyloggers will almost always require the authority of an approved search warrant. A keylogger may be a software program that covertly logs selected or all keystrokes or it may be a hardware device connected to a computer system to collect keystrokes. Either system requires installation on the suspect computer system in a covert manner. Hardware keyloggers, disguised as a keyboard connection adaptor, must be physically installed by attaching the adaptor to the computer.

A software keylogger program must be installed as any other software program. Both of these methods inherently cause a risk of compromise with the initial installation since physical access to the computer system is needed. Software keyloggers can be installed remotely through an email or other network connected means.

Hardware keyloggers pose a risk of discovery only if the computer user inspects the connection of the device, such as when replacing a keyboard or mouse. The computer operating system is not able to detect a hardware keylogger as the device does not interact with the system. Software keyloggers may be detected by anti-virus software, which would immediately disclose to the suspect compromise of the computer system.

Sophisticated computer user logging software not only captures keystrokes, but also captures screenshots, all of which may be covertly sent to investigators for remote viewing. It is also possible to remotely access the entire system of the suspect computer, at the operating system level and physical level without alerting the suspect. This access allows for forensic capabilities to search for specific data or recover deleted files remotely. However, to gain remote access, the system needs to be compromised through the installation of these programs through an email or having physical access to the suspect machine.

With the use of the on-screen keyboard, where a keyboard is literally displayed on a computer monitor, keystrokes are actually mouse clicks on this virtual keyboard. Keystroke monitoring software may log the mouse clicks, but not the letters or numbers clicked on the virtual keyboard with the mouse. The use of a virtual keyboard to log in to password protected accounts renders a keystroke logging software useless.

Several cases have been successful with the use of keyloggers. One such example is case, United States of America v. Nicodemo S Scarfo and Frank Paolerico (2001). In this particular case, the suspects were employing encryption programs to protect their electronic communications. The FBI obtained approval to install a keylogger to log passphrases used in encrypting communication. Through the use of this program, the FBI had access to passphrases needed for email accounts and encrypted files.

Consumer purchase records

Once a suspect’s activities have been detailed to some extent through surveillance and other information, locations which are frequented may be of a great resource. Shopping clubs, gyms, hotels, grocery stores, and other locations where the suspect may make purchases when using a membership card can yield historical information that may be of value.

Obtaining and analyzing credit card purchases quickly lead to past suspect locations for each purchase. Many locations, such as gas stations, will maintain video surveillance records for a time period. To place a suspect in an area of activity, the use of a credit card combined with a video surveillance of the purchase will be best evidence. This type of information can be used to corroborate an alibi if a suspect denies having physical access to a computer system if it can be shown through purchase records or video surveillance records.

Real-time monitoring of a suspect’s credit card purchases may also provide investigators with potential leads to a crime in progress. Should a known cybercriminal regularly visit a location to use an open wireless connection, any purchases made could be indicative of using that wireless connection again for a crime.

Neighbors as Surveillance Agents

Depending upon the surrounding environment, surveillance of a suspect’s residence is typically not a difficult task. But, there are instances where surveillance may be impossible due to a multitude of factors, such as existing in remote location. The investigator can consider contacting a neighbor of the suspect to assist in surveillance. The risk of using any citizen is that the surveillance and investigation may be intentionally or accidently disclosed by the neighbor.

Depending upon the severity of the investigation, in which violent offenders may be involved, neighbors may be placed at risk when asked by investigators to watch their neighbor. Confrontations between the suspect and witness neighbors also increase the risk of compromise especially for any neighbor now believing to have police powers.

At times, a neighbor may be the most reasonable, or only, option, but rarely is it the first option to consider. Usually, neighbors are best contacted afterward in search for historical information they may have observed about the suspect. Having citizens engage in active investigations without constant supervision incurs a risk of the investigation becoming compromised inadvertently.