Putting It All Together
This chapter provides various investigative scenarios and examples of steps needed to successfully solve them. The purpose is to demonstrate how the investigator can collect online evidence and identify the witnesses and potential suspects for various common Internet crimes.
Keywords
Internet crime scenarios; eBay fraud; Craigslist stolen property; Internet threat; cyberharassment; Internet murder; email threat
We passed important laws to give the authorities responsible for investigation wide powers to defend us.
George Pataki, Former Governor
Concepts in action
Investigating Internet crimes requires a basic skill set to identify where the evidence is and to track it to a possible perpetrator. We have laid out techniques and tactics to accomplish a successful investigation. We will now apply these new skills to various investigative scenarios. The intention is to demonstrate how the investigator can collect online evidence and identify the witnesses and potential suspects for various common Internet crimes.
Basic Internet investigative steps
The following steps and actions, adopted from the International Association Chief’s of Police resource for investigating and identifying theft, are intended to be a guide for understanding the Internet crime investigative process. Every online investigation is different and needs to be evaluated based on the known facts. The steps given below can be added to or subtracted from depending on what the investigator determines during the investigation. Table 17.1 provides possible investigative actions corresponding with each step.
1. Review the initial reports of the incident or crime.
2. Contact the reporting party/victim and determine if reported information is correct and additional information is not documented in initial reports.
3. Validate that a crime involving the Internet actually occurred.
4. Prepare an investigative plan.
5. Identify initial investigative information.
6. Document Internet evidence.
7. Subpoena ISP or other online services to ID IP address usage by suspects.
8. Assess additional cases for similar comparison.
9. Review collected data and determine sufficiency of evidence.
10. Submit evidence to counsel/prosecutor for potential prosecution.
Case studies
The following scenarios have been designed to provide the investigator with the concept of how to follow up on and investigate an Internet crime. These scenarios are based on actual cases, but the facts have been changed. Of course, every case is different and each case requires an evaluation of the known facts. The case examples are designed to provide a concept of the potential investigative possibilities and not what should be done in every case. The investigator should review the case examples as a guide to planning their own investigations and to identify possible actions. Each scenario listed is a different possible Internet crime that has occurred in the real world. For the purposes of the text, the examples are simplified and actual cases can tend to be more complex. Additionally, the evaluation as to whether an arrest is made, submission for prosecution or termination of an employee under the examples is beyond this text’s substance. The intent here is to only provide the investigator with investigative concepts and how an Internet investigation and online ESI collection can occur in real life. The investigator should always have a clear understanding of the law related to the crimes he/she is investigating and consider including legal counsel’s advice throughout the investigative process. Also, each of these Internet cases ends with the investigator contacting the target of the investigation in the real world. The investigation may start with facts known to have occurred through the Internet, but the scenarios all come down to the investigator being able to tie the investigation to a real person in a real place using a real computing device to commit the offense. Ultimately, any Internet investigation comes down to the investigator’s ability to conclude the investigation by connecting a law violation to the person or individuals using the Internet as a smoke screen to hide their unlawful activities. The scenarios are broken down into the following three parts:
1. The case facts known at the time of the initial report. This is an outline of the information reported by the victim and provided to the initial report taker.
2. The investigator’s follow-up. This section includes the actions that can be taken by the investigator during this investigation, based on the known facts and identified information.
3. Internet evidence to document and collect. This section provides the investigator with the possible online ESI that can be collected from the Internet or holders of the Internet data.
Conclusion
This chapter was intended to provide the reader with some basic approaches to conducting an Internet investigation. The scenarios are only guides and should only be used to grasp the concepts of an Internet investigation. Each example has provided a number of steps based on the facts known at the time and the type of evidence that could be collected. The investigator can use these case studies to better understand what it is that they need to plan for when investigating Internet crimes.
Further reading
1. Investigative Steps Identity Crime Toolkit for Investigators. (n.d.). International Association Chief’s of Police. Retrieved from <www.theiacp.org/investigateid/investigation/nuts-and-bolts-of-investigation/investigative-steps/>.