7/30/2019 Protocol of a systematic approach

1/1

provide key information regarding multiple users of a single computer or mobile device.com. Data collected by these services through commonly used Internet cookies alsoGoogle and Facebook, as well as using dedicated search engines such as www.123people.based e-commerce, communications and networking services, such as eBay, PayPal,involves requests to obtain information collected and stored in the databases of web-

This phase" Research for additional information available via Internet-based services:mobile telephone usage.toring activities o channels o communication, including in relation to fxed-line andco-workers or other associates and inormation compiled through conventional moni-tive methods, such as inormation relating to the suspect, any co-inhabitants, relevant

ough traditional investiga-" Data collection: This phase involves the collection of data thrProtocol of a systematic approach

users o the device, targeting the least sophisticated user profle.(such as the presence o antivirus protections or frewalls) and the personal profle o allcomputer, taking into consideration the technical profle o the hardware to be compromisedunder investigation. This may be achieved through direct or remote access to the relevantsuch as a virus, a Trojan Horse or a keystroke logger on the computer o the personmonitoring techniques acilitated by the installation o computer hardware or applicationsWhere permitted by domestic law, some law enorcement authorities may also employ digital

surveillance.gathered with objective identifers such as GPS coordinates, time stamps or videodata being gathered and the corroboration, to the extent possible, o any intelligenceposes. Due care should be taken with respect to ensuring the orensic integrity o thetechnologies which may be exploited or investigative or intelligence-gathering pur-particular, in recent years experience has revealed vulnerabilities in new communicationsservices provided by ISPs, such as e-mail, chat and orum communication services. Inband, mobile broadband and wireless communications, as well as with regard toundertaken in connection with telecommunications services, such as fxed-line broad-a dierent platorm: digital communication channels. Interception activity may betactics similar to those used or traditional communication channels, shiting them to

cement authorities employ interception" Interception activity: In this phase, law enortion linked to a fnancial, VoIP or e-mail account.

est based, or example, on subscriber inorma-it is common to identiy subjects o inter" Identifcation o subjects o interest: In this phase, ollowing smart analysis o the data,

multiple users, such as a common source o fnancing.hierarchy, the geolocation o members o such group, or actors common amongto highlight, inter alia, trends, chronology, the existence o an organized group ormay flter inormation or provide graphic representations o the digital data collectedor investigative purposes. This analysis may be acilitated by computer programs, whichvarious Internet services are then analysed to identiy inormation and trends useul

om VoIP servers and the providers o" Analysis: The large volume o data obtained rinormation obtained in the two prior phases.phase may also be used as a orm o smart flter or the purposes o veriying the

afliates or users o the same networking devices. The inormation collected in thisrom VoIP service providers relating to the persons under investigation and any known

" VoIP server requests: In this phase, law enorcement authorities request inormationand made available or analysis during later stages o the investigation.and cross-reerenced to build a profle o the individual or group under investigation

" The activities in phases (a) and (b) above provide information that may be combined

Extracted from: The United Nations Office on Drugs and Crime (2012), The Use of the Internet for Terrorist Purposes, pages 60-61.