Defintions

Question 1

Account Takeover

Answer 1

Means when a trained internet investigator (level 3 or higher) assumes the Social Networking account of another person for the purposes of capturing evidence

Question 2

Communication based application

Answer 2

means a category of systems whose main purpoose is to communicate using text, audio, and video messages. The most common tools are email, chat, and messaging applications. This does not include social media platforms which offer direct messaging services

Question 3

Covert Device

Answer 3

means a compuer, laptop, hand held device, etc. that is nonattributate to York Regional police or information technology (it) Bureau through purchase or support and does not contain any YRP -specific documents or files. A covert device does not include a personally owned device

Question 4

Cybercrime

There are two parts

Answer 4

means a criminal offence, which is committed through the Internet and/or utilizing technology such as computers, tablets, personal digital assistants, or mobile devices. Cybercrime is divided into two categories

a.) Technology-as-Target - criminal offenses targeting computers and other information technologies, such as those involving the unauthorized use of computers or mischief in relation to data (i.e., computer hacking, defacing websites, ransomware)

b.) Technology-as-Instruments/Technology-as-Tool - criminal offences where the Internet and information technologies are instrumental in the commission of a crime, such as those involving fraud, identiy theft, intellectual property infringements, money laundering, drug trafficking, human trafficking, organized crime or terrorist activities, child sexual exploitation or cyber bullying (i.e. harassment through email or social networks, fraud over the internet)

Question 5

Internet investigator

Answer 5

means a Police Officer, Crime Analyst, Computer Forensic Examiner, or a Civilian member that has the required training as determined by the Technical Investigations unit Cybercrime Section to conduct an internet investigation

Question 6

Open Source Search

Answer 6

means information and/or evidence that is obtained from publicly available sources on the internet, using available search engines and social media websites.

Question 7

Online Engagement

Answer 7

means when an internet investgator trained in conducting a covert internet investigation uses an online covert profile/account to message, befriend, or add contacts, for the purposes of gaining information and furthering / initiating an online relationship, etc. Online engagement does not include using communication based applications.

Question 8

Passive Online Engagment

Answer 8

Means when a internet investigator trained in conducting a covert internet investigation uses an online covert profile/account to only befriend or follow another person in order to obtain access to their public information without any interaction with the subject

Question 9

Cybercrime unit will take primary lead in investigations where

Answer 9

1. Technology as target attacks to region of York critical infrastructure
2. Ransomware attacks and data breaches to medium and large size businesses (greater than 100 employees)
3. Pure Cybercrime Criminal Code investigations (ie. Mischief to data or unauthhorized use of a computer)

Question 10

Level 1 - Worked related - General internet inquiry

Answer 10

a. There is no Online Engagement at this level

b. No social media investigations shall be conducted at this level

c. Level 1 inquiries consist of the use of a YRP Workstation or Communication device connected to the YRP network to complete day-to-day as outlined in procedures AI-308 information technology, use of technology and responsible internet use and AI-319 telecommunication devices.

d. A member may communicate with a subject(s) on the internet on behalf of YRP and is expected to openly identify that they are YRP employee (ie. email)

e. Members may conduct general internet searches utilizing search engines such as Google, phone directories and mapping programs.

f. When a member locates information which should be captured for evidentiary purposes, they should consult with a level 2 Internet investigator or the Technical investigations unit Cybercrime section to ensure the digitial evidence is captured properly

g. No specialized training is necessary to utilize a YRP Electronic device for day to tday operational requirements.

Question 11

Level 2 - Open Source Search

Answer 11

a. Only Passive Online Engagement is allowed at this level

b. An open Source Search shall be conducted in a professional and lawful manner while ensuring that an individual’s and group’s civil rights, and civil liberties are protected.

c. to perform a level 2 open source search, members must be a designated internet investigator

Any Open Source Searches must be conducted using a covert device and Internet connection which is not attributable to the YRP network. The connections to the internet must utilize a VPN, Proxy, or covert internet connection as approved by the Technical Investigation unit.

Question 12

Level 3 - Account Takeover - No Engagement

Answer 12

a. There is no Online Engagement at this level. An Account takeover with online engagement is considered a Covert internet investigation

b. Level 3 account takeovers are an approved investigation by an internet investigator who assumes a users internet profile for the purposes of gathering information and/or evidence through informed consent, judicial authorization, and any other lawful means.

c. An account takeover shall only be conducted by a Technical investigations unit member, a member of Internet child exploitation section who has received the required training, or a qualified level 3/4/5 internet investigator under the guidance of the technical investigations unit Cybercrime section.

d. All account takeovers must be conducted using an approved non-government electronic device and the internet connection shall not be attributable to the YRP network. The connections to the internet must utilize a VPN, proxy, or covert internet connection as approved by the Technical investigations unit Cybercrime section.

Question 13

Level 4 - Covert Internet Investigation (Online Engagement)

Answer 13

a. Covert internet investigations are an authorized Online Engagement by a trained Undercover internet investigator who uses a covert internet identity or profile to engage a subject online regarding an investigation. These investigations shall be conducted in accordance with procedure LE-306 Undercover investigations.

b. The undercover internet investigator must be sworn YRP member who is designated pursuant to the criminal code Section 25.1

c. The investigation must be approved by a Supervisor within the Technical investigations unit and the Officer in charge of the Bureau/ Unit responsible for the investigation.

d. Online engagement does not include communication based applications

e. Any covert internet investigations must be conducted using a covert device and the internet connection is not atributable to the YRP network. Thhe connections to the internet must utilize a VPN, Proxy, or covert internet connection as approved by the Technical investigations unit Cybercrime section

f. This does not include use of a covert device to maintain an online undercover identity

Question 14

Level 5 - Covert operation (undercover & online engagement)

Answer 14

a. An authorized Covert Operation shall be conducted by a trained undercover internet investigator who establishes and/or maintains a relationship online and conducts traditional undercover operations with a subject for a particular investigation that potentially may involve voice, “face to face”, or other contact between the undercover officer and a subject. These investigations shall be conducted in accordance with procedure LE-306 Undercover investigations

b. The undercover internet investigator must be a sworn YRP member who is designated pursant to the Criminal Code Section 25.1

c. The covert operation shall be approved by a Supervisor within the Technical investigations unit and Officer in charge of the Bureau/Unit responsible for the investigation

d. There shall be an undercover handler assigned to the investigation

e. Any covert operations shall be conducted using an approved covert device and the internet connection is not attributable to the YRP network. he connections to the internet must utilize a VPN, proxy, or covert internet connection as approved by the Technical investigations unit Cybercrime Section.

Question 15

mischief to data Section 430(1.1).

Answer 15

In the Criminal Code of Canada, the term “mischief to data” is covered under Section 430(1.1). It refers to the act of willfully destroying or altering data, rendering data meaningless, useless, or ineffective, or obstructing, interrupting, or interfering with the lawful use of data or with any person’s lawful use of data.

To summarize:

Destruction or alteration: Intentionally destroying or altering data in a way that makes it unusable or ineffective.

Rendering data useless: Doing something to data that makes it meaningless or unusable.

Obstruction or interference: Preventing or hindering someone from lawfully accessing or using data.

These acts are considered a form of mischief, similar to damaging physical property, but applied to data in a digital context.

Question 16

unauthorized use of a computer Section 342.1

Answer 16

The “unauthorized use of a computer” is addressed under Section 342.1 of the Criminal Code of Canada. It outlines several offenses related to the unauthorized access and use of computer systems. The key points include:

1. Accessing a computer system: Knowingly accessing or causing to be accessed a computer system without authorization.
2. Using a computer service: Knowingly using or causing to be used any computer service without authorization.
3. Interception of computer communication: Knowingly intercepting or causing to be intercepted any function of a computer system.
4. Using or attempting to use passwords or security codes: Knowingly using, possessing, or attempting to use or possess any password, encryption key, or other means of securing access to data without authorization.
5. Altering or interfering with data: Knowingly altering, destroying, or interfering with data without authorization.

These acts are criminal offenses under the Canadian Criminal Code, with penalties varying depending on the nature and severity of the offense.

Question 17

What is NCECC? and what do they do?

Answer 17

The RCMP National Child Exploitation Coordination Centre

Works with law enforcement partners across Canada and internationally to combat the online sexual exploitation of children. The NCECC also works closely with the Canadian Centre for Child Protection, a charitable organization that operates Canada’s national tipline for reporting the online sexual exploitation of children.

Question 18

What is DDoS?

Answer 18

Distributed Denial of Service
attacks inundate targeted computer servers or websites with false request until an online service is disrupted and rendered inoperable, which may in turn prevent legitimate consumers from using the targeted services.

The impact of a DDoS attack can range from temporary inconvenience to more noticeable effects, including lost business opportunities and reputational damage from service disruption. These attacks can be politically, ideologically or financially motivated, or simply used to challenge and disrupt a public or private organization. These criminal activities may also link to “insider threats”

Question 19

What is a Cyber insider threat

Answer 19

An insider threat is a malicious and often criminal threat to a public or private organization that comes from inside the organization, such as an employee or contractor, who is attempting to disrupt the activities of the organization. While not unique to cybercrime, insider threats involving unauthorized computer use or data mischief represent a growing risk to organizations that rely on the Internet, networked systems and related technologies. These threats extend the ways in which insiders can steal from an organization or commit criminal breach of trust.

Cyber-related insider threats are of significant concern to critical infrastructure organizations (like those in government, transportation, finance, manufacturing or energy industries) and others that use information technology systems. Through inside and direct access, criminals can bypass “air gaps” - computer security layers that isolate networks from unsecured networks - and directly compromise a secure computer network, such as installing a virus on a network via a USB drive.

Question 20

What is a Criminal Botnet Operation?

Answer 20

a “botnet” involves a network of computers that are remotely controlled by a command-and-control server. Botnets may be used to deploy malware and infect thousands or potentially millions of computers for various criminal purposes, such as distributing a malware program for data access, screen and password captures, or keystroke loggers to obtain personal and financial credentials.

Question 21

Carding Crimes

Answer 21

Carding crimes are offences in which the Internet is used to traffic and exploit personal and financial data and share cybercrime techniques, such as the online buying and selling of stolen identity and counterfeit documents, credit card and bank account information, or criminal hacking tools. Carding crimes and others like it show how pure cybercrimes can be instrumental in facilitating and altering the scope of more traditional criminal offences. For example, a criminal may gain unauthorized access to a computer database to steal personally identifiable information and credit card numbers. In turn, the criminal may use anonymous online forums, many of which are not detectable through online search engines, to exchange this information for illegitimate purposes.

Question 22

Online Mass marketing fraud and Ransomware

Answer 22

Links between pure and instrumental cybercrimes are arguably most common in fraud. The Internet has transformed this long-standing criminal offence to the extent where ‘mass marketing’ is now linked to many types of fraud. Internet-based mass marketing frauds such as phishing emails, lottery scams, ‘419’ scams and romance scams are used to deceive victims and steal personal identifiers for a variety of financially motivated criminal purposes. These scams easily target large populations across multiple jurisdictions in a far more ubiquitous, anonymous and efficient manner when compared to similar offline crimes. One of these fraud-based cybercrimes is exemplified through ‘ransomware.’

Ransomware scams involve a type of malware that locks a computer and its data content and uses social engineering tactics, such as threats, to coerce victims into paying fees for regained computer access. Recent threats involving ransomware scams are described below.