Use Of ICT in Police investigation Flashcards
Provides a target rich environment for criminals
Cyberspace
It is easy to carry out an attack, has lower risks associated with it, is hard to trace technically, and hard to prosecute.
Sophisticated tools are readily available on the Internet publicly.
Access and attack can be from anywhere and anonymous.
Cyberspace
Cybercrime Offenses
- Offense against Confidentially, Integrity and Availability (CIA) of computer data and system
- Computer-Related Offense
- Content- Related Offense
Offense against Confidentiality, Integrity and Availability of computer data and system
- Illegal access
- Illegal interception
- Data Interference
- Misuse of devices
except fine should be no more than ₱500,000. - Cyber-squatting
Offense against CIA of computer data and system penalty
*(imprisonment of 6 years and 1 day up to 12 years) or a fine of at least P200,000 up to a maximum amount commensurate to the damage incurred or BOTH. And
If committed against critical infrastructure:
- (imprisonment for 12 years and 1 day up to 20 years) or a fine of at least P500,000 up to a maximum amount commensurate to the damage incurred or both
- Prision mayor
* Reclusion Temporal
Computer-Related Offense
Computer-related Forgery
Computer-related Fraud
Computer-related Identity theft
Prison Mayor (imprisonment of 6 years and 1 day up to 12 years) or a fine of at least P200,000 up to a maximum amount commensurate to the damage incurred or BOTH. And
On provided that no damage has yet been caused, the penalty imposed shall be one (1) degree lower
Computer-Related Offense
Content-Related Offense
- Cybersex
- Child Pornography
- Unsolicited Commercial Communications (SPAMMING)
- Libel
Defined in Article 355 of the Revised Penal Code
Prision mayor (imprisonment of 6 years and 1 day or a fine at least P200,000 but not exceeding P1,000,000. Penalty to be imposed shall be one (1) degree higher than that provided for in Republic Act 9775, if committed through a computer system. THIS PROVISION WAS STRUCK DOWN BY THE SUPREME COURT AS UNCONSTITUTIONAL Penalty to be imposed shall be one (1) degree higher than that provided for by the Revised Penal Code, as amended, and special laws, as the case may be.
Content-Related Offense
CHAPTER IV ENFORCEMENT AND IMPLEMENTATION
Section 10. Law Enforcement Authorities - The National Bureau of investigation (NBI) and Philippine National Police (PNP) shall be responsible for the efficient and effective law enforcement of the provisions of this Act. The NBI and the PNP shall organize a cybercrime unit or center manned by special investigator to exclusively handle cases involving of this Act.
RA 10175 ALSO KNOWN AS “CYBERCRIME PREVENTION ACT OF 2012”
“Cybercrime Prevention Act of 2012”;
• R.A. 10175 –
“Data Privacy Act of 2013”;
• R.A. 10173 –
“Anti-Photo and Voyeurism Act of 2009”;
• R.A. 9995 –
“Anti-Child Pornography Act of 2009”;
R.A. 9775 –
“E- Commerce Act of 2000”;
• R.A. 8792 –
“Access Device Regulation Act of 1998”;
R.A. 8484 –
- Crime occurs
- Policemen responds
3.
4.
5. - Writes report
- Prosecution
Reactive law enforcement
Cybercrime Investigation Process
Step 1 - Interview the Complainant
Step 2 - Gathering & Documentation of Evidence
Step 3 - Complaint & Witness detailed sworn statement
Step 4 - Request for the conduct of Digital Forensic Examination on the submitted electronic evidence
Step 5 - Coordination, Verification & Presentation with TELCO/ISP and/or Website Admin/Provider.
Step 6 - Preparation of MLAT (Mutual Legal Assistance Treaty).
Step 7 - Preparation & Application for Court Order to TELCO/ISP to give the preserve information requested.
Step 8 - investigation Report
Step 9 - Referral to the Office of the Prosecutor
Cybercrime Investigation Process
Recognizing and Identification Arrival in the electronic crime scene Documentation 1. Sketch of Location 2. Photograph - 4 shots corners room - 2 shots outside room 3. Photograph and Sketch digital Evidence 4. Log at the working notes 5. Examine 6. Interview
Recognizing and Identification
Can be seized in a variety of different forms, and from a variety of different sources.
Digital Evidence
Devices
Computers and Drives
Personal Devices
Removable Media
Miscellaneous
Identifying Digital Evidence
Devices
Data
Email account contents
Social media accounts
Cloud storage account
Server data
Data
Servers
Workstations
Laptops
External Hard Disk Drives
Computes and Drives
Mobile handsets
Tablets
Personal Devices
USB drives
SD Media cards
DVD- R
CD-R
Removable Media
Digital Cameras Web cameras Wireless access point Routers Gaming system
Miscellaneous
Collection and Preservation of Computers and Drives
Running state => Implement “Bag and Tag” procedure
Off
Collection and Preservation of Computes and Drives
Running State => Check network => Implement “Bag and Tag” Procedure
ON and Not connected to Network
Collection and preservation of Computers and drives
Running State => Check Network => Screen Saver Running => Implement “Incident Response” => Implement “Bag and Tag” Procedure
ON, Connected to Network, Screen Saver Not running, with password
Collection and Preservation of Computers and drives
Note:
See also flow chart
- Photograph monitor
- Move arrow keys
- Photograph monitor
- Document
SOP in providing cybercrime assistance to requesting operating PNP units and other LEAs
See handout
Collection and preservation of Computer Drives
- remove power source from the system, not from wall outlet.
- remove any removable media that are present to ensure safe transport.
Bag and Tag Procedure
Collection and preservation of computers and drives
Bag and Tag Procedure
A and A1
E MTY E and E2
D MTY
B MTY
Labeling
Collection and Preservation of Personal Devices
For smartphone and similar devices
- Do not turn ON
- Place phone in a sealed envelope before placing in an evidence bag to prevent from being turned ON
- if possible, seize the mobile phone charger
Of power is OFF
Collection and Preservation of Personal Devices
For smartphone and similar devices:
- Consideration should be given before turning OFF the device because of password/passcodes
- Immediately switch to flight mode or place phone on a faraday bag.
If power is ON
•In case that there is/are electronic evidence presented. Investigator will prepare necessary memorandum request to * for the conduct of forensic examination on the submitted electronic evidence.
ACG Digital Forensic Laboratory
Request for the conduct of Digital Forensic Examination
Collection and Preservation of Data
Outlook
Outlook Express
Mozilla Thunderbird
Stand-alone
Collection and Preservation
Hotmail
Gmail
Yahoo
Web-based Data
Collection and Preservation of Data
- To determine the “sender” of an e-mail message, investigators need to review the *
- **is the information added to the actual message
- Entries in the email header is stamped by *** handing the email.
- e-mail header
- *Email header
- **mail server
Collection and Preservation of Data
- “Received lines” show how message entered the Internet. * are most formative. Some may be fake.
- “From” Line is address given by the sender; may be **
- Lines that start with *** are comments added by software; may be true or false
- Last one or two
- *totally false
- **X
Collection and preservation of Data
- can be one of the most effective tools the investigator uses during his research.
Searching with Google
Special Search Characters
These characters have special meaning to Google. Always use these characters without surrounding spaces!
- force inclusion of something common
- exclude a search item
- ** use quotes around search phrases
- *** a single-character wildcard
- ** any word
- ***** Boolean ‘OR’
- (+)
- (-)
- ** (“)
- ***(.)
- ** (*)
- ***** (|)
ATM
ATM skimming
Importance of Camera Security System
In the present day * has become one of the most important factors governing everyday life.
Facilities that are monitored by CCTV Cameras may be an aid on investigating theft, robbery, etc. With a ** in a place it becomes easier to monitor the premises and also gathers formation of an accident.
- security
* *security system
Importance of Camera Security Systems
• For what regards the license plate enhancement, which is for sure one of the most common requests, according to our experience we can say that in a typical CCTV video of the resolution of a certain subject to be enhance is (*) we cannot obtain any meaningful improvement.
less than 2.0 megapixel or 1600x1200 pixels
Find my IP
Whois.net/domaintool
