Use Of ICT in Police investigation Flashcards

1
Q

Provides a target rich environment for criminals

A

Cyberspace

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

It is easy to carry out an attack, has lower risks associated with it, is hard to trace technically, and hard to prosecute.
Sophisticated tools are readily available on the Internet publicly.
Access and attack can be from anywhere and anonymous.

A

Cyberspace

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Cybercrime Offenses

A
  1. Offense against Confidentially, Integrity and Availability (CIA) of computer data and system
  2. Computer-Related Offense
  3. Content- Related Offense
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Offense against Confidentiality, Integrity and Availability of computer data and system

A
  1. Illegal access
  2. Illegal interception
  3. Data Interference
  4. Misuse of devices
    except fine should be no more than ₱500,000.
  5. Cyber-squatting
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Offense against CIA of computer data and system penalty

*(imprisonment of 6 years and 1 day up to 12 years) or a fine of at least P200,000 up to a maximum amount commensurate to the damage incurred or BOTH. And

If committed against critical infrastructure:

  • (imprisonment for 12 years and 1 day up to 20 years) or a fine of at least P500,000 up to a maximum amount commensurate to the damage incurred or both
A
  • Prision mayor

* Reclusion Temporal

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Computer-Related Offense

A

Computer-related Forgery
Computer-related Fraud
Computer-related Identity theft

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Prison Mayor (imprisonment of 6 years and 1 day up to 12 years) or a fine of at least P200,000 up to a maximum amount commensurate to the damage incurred or BOTH. And

On provided that no damage has yet been caused, the penalty imposed shall be one (1) degree lower

A

Computer-Related Offense

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Content-Related Offense

A
  • Cybersex
  • Child Pornography
  • Unsolicited Commercial Communications (SPAMMING)
  • Libel
    Defined in Article 355 of the Revised Penal Code
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q
Prision mayor (imprisonment of 6 years and 1 day or a fine at least P200,000 but not exceeding P1,000,000.

Penalty to be imposed shall be one (1) degree higher than that provided for in Republic Act 9775, if committed through a computer system.

THIS PROVISION WAS STRUCK DOWN BY THE SUPREME COURT AS UNCONSTITUTIONAL

Penalty to be imposed shall be one (1) degree higher than that provided for by the Revised Penal Code, as amended, and special laws, as the case may be.
A

Content-Related Offense

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

CHAPTER IV ENFORCEMENT AND IMPLEMENTATION
Section 10. Law Enforcement Authorities - The National Bureau of investigation (NBI) and Philippine National Police (PNP) shall be responsible for the efficient and effective law enforcement of the provisions of this Act. The NBI and the PNP shall organize a cybercrime unit or center manned by special investigator to exclusively handle cases involving of this Act.

A

RA 10175 ALSO KNOWN AS “CYBERCRIME PREVENTION ACT OF 2012”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

“Cybercrime Prevention Act of 2012”;

A

• R.A. 10175 –

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

“Data Privacy Act of 2013”;

A

• R.A. 10173 –

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

“Anti-Photo and Voyeurism Act of 2009”;

A

• R.A. 9995 –

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

“Anti-Child Pornography Act of 2009”;

A

R.A. 9775 –

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

“E- Commerce Act of 2000”;

A

• R.A. 8792 –

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

“Access Device Regulation Act of 1998”;

A

R.A. 8484 –

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q
  1. Crime occurs
  2. Policemen responds
    3.
    4.
    5.
  3. Writes report
  4. Prosecution
A

Reactive law enforcement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Cybercrime Investigation Process
Step 1 - Interview the Complainant
Step 2 - Gathering & Documentation of Evidence
Step 3 - Complaint & Witness detailed sworn statement
Step 4 - Request for the conduct of Digital Forensic Examination on the submitted electronic evidence
Step 5 - Coordination, Verification & Presentation with TELCO/ISP and/or Website Admin/Provider.
Step 6 - Preparation of MLAT (Mutual Legal Assistance Treaty).
Step 7 - Preparation & Application for Court Order to TELCO/ISP to give the preserve information requested.
Step 8 - investigation Report
Step 9 - Referral to the Office of the Prosecutor

A

Cybercrime Investigation Process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q
Recognizing and Identification
Arrival in the electronic crime scene
Documentation
1. Sketch of Location
2. Photograph
- 4 shots corners room
- 2 shots outside room
3. Photograph and Sketch digital Evidence
4. Log at the working notes
5. Examine 
6. Interview
A

Recognizing and Identification

20
Q

Can be seized in a variety of different forms, and from a variety of different sources.

A

Digital Evidence

21
Q

Devices

A

Computers and Drives
Personal Devices
Removable Media
Miscellaneous

22
Q

Identifying Digital Evidence

A

Devices

Data

23
Q

Email account contents
Social media accounts
Cloud storage account
Server data

A

Data

24
Q

Servers
Workstations
Laptops
External Hard Disk Drives

A

Computes and Drives

25
Q

Mobile handsets

Tablets

A

Personal Devices

26
Q

USB drives
SD Media cards
DVD- R
CD-R

A

Removable Media

27
Q
Digital Cameras
Web cameras
Wireless access point
Routers
Gaming system
A

Miscellaneous

28
Q

Collection and Preservation of Computers and Drives

Running state => Implement “Bag and Tag” procedure

A

Off

29
Q

Collection and Preservation of Computes and Drives

Running State => Check network => Implement “Bag and Tag” Procedure

A

ON and Not connected to Network

30
Q

Collection and preservation of Computers and drives

Running State => Check Network => Screen Saver Running => Implement “Incident Response” => Implement “Bag and Tag” Procedure

A

ON, Connected to Network, Screen Saver Not running, with password

31
Q

Collection and Preservation of Computers and drives
Note:

See also flow chart

A
  1. Photograph monitor
  2. Move arrow keys
  3. Photograph monitor
  4. Document
32
Q

SOP in providing cybercrime assistance to requesting operating PNP units and other LEAs

A

See handout

33
Q

Collection and preservation of Computer Drives

  • remove power source from the system, not from wall outlet.
  • remove any removable media that are present to ensure safe transport.
A

Bag and Tag Procedure

34
Q

Collection and preservation of computers and drives

Bag and Tag Procedure

A and A1
E MTY E and E2
D MTY
B MTY

A

Labeling

35
Q

Collection and Preservation of Personal Devices

For smartphone and similar devices

  • Do not turn ON
  • Place phone in a sealed envelope before placing in an evidence bag to prevent from being turned ON
  • if possible, seize the mobile phone charger
A

Of power is OFF

36
Q

Collection and Preservation of Personal Devices

For smartphone and similar devices:

  • Consideration should be given before turning OFF the device because of password/passcodes
  • Immediately switch to flight mode or place phone on a faraday bag.
A

If power is ON

37
Q

•In case that there is/are electronic evidence presented. Investigator will prepare necessary memorandum request to * for the conduct of forensic examination on the submitted electronic evidence.

A

ACG Digital Forensic Laboratory

Request for the conduct of Digital Forensic Examination

38
Q

Collection and Preservation of Data

Outlook
Outlook Express
Mozilla Thunderbird

A

Stand-alone

39
Q

Collection and Preservation

Hotmail
Gmail
Yahoo

A

Web-based Data

40
Q

Collection and Preservation of Data

  • To determine the “sender” of an e-mail message, investigators need to review the *
  • **is the information added to the actual message
  • Entries in the email header is stamped by *** handing the email.
A
  • e-mail header
  • *Email header
  • **mail server
41
Q

Collection and Preservation of Data

  • “Received lines” show how message entered the Internet. * are most formative. Some may be fake.
  • “From” Line is address given by the sender; may be **
  • Lines that start with *** are comments added by software; may be true or false
A
  • Last one or two
  • *totally false
  • **X
42
Q

Collection and preservation of Data

  • can be one of the most effective tools the investigator uses during his research.
A

Searching with Google

43
Q

Special Search Characters

These characters have special meaning to Google. Always use these characters without surrounding spaces!

  • force inclusion of something common
    • exclude a search item
  • ** use quotes around search phrases
  • *** a single-character wildcard
  • ** any word
  • ***** Boolean ‘OR’
A
  • (+)
    • (-)
  • ** (“)
  • ***(.)
  • ** (*)
  • ***** (|)
44
Q

ATM

A

ATM skimming

45
Q

Importance of Camera Security System

In the present day * has become one of the most important factors governing everyday life.

Facilities that are monitored by CCTV Cameras may be an aid on investigating theft, robbery, etc. With a ** in a place it becomes easier to monitor the premises and also gathers formation of an accident.

A
  • security

* *security system

46
Q

Importance of Camera Security Systems

• For what regards the license plate enhancement, which is for sure one of the most common requests, according to our experience we can say that in a typical CCTV video of the resolution of a certain subject to be enhance is (*) we cannot obtain any meaningful improvement.

A

less than 2.0 megapixel or 1600x1200 pixels

47
Q

Find my IP

A

Whois.net/domaintool