1. Conducting Reactive and Proactive Internet InvestigationsBy
Ayodeji Omotade BSc, PgDip, MSc, CEH, CHFI
Digital Forensics Limited

2. Introduction
According to a recent United Nations survey over 90% of responding countries indicated that cybercrime most frequently comes to Law Enforcement’s attention through reports by individual or corporate victims.

3. Internet Investigations
When police responds to crime that has already occurred, we call it ‘Reactive’.
Proactive investigations occur before and during the commission of the offence.

4. Challenges of Reactive Internet Investigations
Jurisdictional Blind Spot as Compared to Offline Crimes
Lack of Basic Training Regarding Internet Crimes
The Costs of Investigation is High
Preservation of Evidence can be very Fragile

5. Proactive Internet Investigations
Varieties of Proactive Internet Investigations includes
Intelligence Collection of Information such as Undercover Investigations Looking for Child Pornographers or Traditional Vice Violations.
Investigations Concerning Peer to Peer Networks for Sharing of Contraband or Illegal Trade in Music or Videos.
These are Just Examples

6. Proactive Investigations
According to The Bureau of Justice Assistance, The Presence of Social Media, Law Enforcement and Private Sector need to take a broader approach, getting the community at large involved.
This brings us to Community Policing in Cyberspace.

7. Community Policing in Cyberspace

8. Community Policing in Cyberspace Initiatives
Collaboration between the police And community at large that identifies and solves community problems.
The creation of police department webpage or portal for community members to facilitate online communication.
Chicago Tribune reported a police department sergeant for creating a dynamic website for the community for reporting crime online which was later picked up by other police departments. This increase in number of success rates in both proactive and reactive investigation were many times higher than when a static webpage which only gave the police information only existed.

9. Community Policing in Cyberspace Initiatives
The use of social media sites such as Facebook, Twitter, Youtube and others.
The partnership between private technology cyber security organizations.
Sharing of information amongst other arms of law enforcement agencies.
In 2012, LexisNexis Risk Solutions, in partnership with PoliceOne, conducted a survey of 1,221 law enforcement officers. The findings revealed that 4 out of 5 police officers were using social media platforms, such as Facebook, Youtube and Twitter to help solve crimes. The investigations consisted of both reactive and proactive responses.

10. 3 Ways of Proactive and Reactive Internet Investigation on Social Media
Apparent or Overt use: This when an officer access public areas of the internet for instance ‘Googling’ or open Facebook search.
Discreet use: This occurs when the investigator uses undercover techniques and even attempts to conceal the IP address to avoid being tracked.
Covert use: Most intrusive investigative use which involves not only concealing the information but includes creating an identity

11. Key Elements for Police Developing Social Media Policy for Investigation
The use of social media resources will be consistent with applicable laws
Define if and when social media sites or tools are authorized
Articulate and define authorization level needed to use information on social media sites
Specify that information obtained from sites visited will undergo evaluation: source reliability and content evaluation.

12. Key Elements for Police Developing Social Media Policy for Investigation
Specify the documentation storage and retention requirements related to information obtained.
Identify dissemination procedure for criminal intelligence and investigative products that contain information obtained.

13. Internet Monitoring Tools: Social Media
There are three categories of monitoring tools for both reactive and proactive investigations
Free tools: like icerocket, plancast, socialpointer etc
Commercial Tools: Netbase, Topsy etc
Law Enforcement Specific : like IBM solutions, Encase range of solutions
SOCMINT which is Social Media Intelligence is a department created by the Metropolitan Police in the United Kingdom to monitor social media for proactive and reactive investigations, gathering of intelligences and also doubles as a CCTV on ground.

14. Law Enforcement and Private Sectors Working Together
Cybercrime investigations are carried out by specialists in specific skills.
The scope of Cybercrime investigations are very wide in relation to the traditional offline crimes.
The synergy of high technology companies and Law Enforcement in Nigeria can be a starting point to increase successful proactive and reactive investigations

15. Operations Planning for Internet Investigation
Identify intent and scope of the undercover operation
Identify the legal restrictions around the undercover operations
Determine the limit of the investigators Authority
Identify the available resources to support the undercover investigations
Prepare risk assessment of the operation
Identify data collection requirements

16. MPS (UK) Association of Chief Police Officers (ACPO): Principles
Principle 1: No action taken by law enforcement agencies, persons employed within those agencies or their agents should change data which may subsequently be relied upon in court.
Principle 2: In circumstances where a person finds it necessary to access original data, that person must be competent to do so and be able to give evidence explaining the relevance and the implications of their actions.
Principle 3: An audit trail or other record of all processes applied to digital evidence should be created and preserved. An independent third party should be able to examine those processes and achieve the same result.
Principle 4: The person in charge of the investigation has overall responsibility for ensuring that the law and these principles are adhered to.
Extracts from Janet Williams QPM
Deputy Assistant Commissioner
Metropolitan Police Service
ACPO lead for the e-Crime Portfolio
ACPO Good Practice Guide
for Digital Evidence

17. Cybercrimes (Prohibition and Prevention) ACT May 2015
The act provides an effective, unified and comprehensive legal, regulatory framework for the prohibition, prevention, detection, prosecution and punishment of cybercrimes in Nigeria.
This act also ensures the protection of critical national infrastructure, and promotes cyber security and the protection of computer systems and networks, electronic communications, data and computer programs, intellectual property and privacy rights.

18. An Idea of Some Cybercrime Investigations
Offences against critical national information infrastructure
Unlawful access to a computer.
System Interference
Interception of Electronic messages
Tampering with Critical Infrastructure
Computer Related Forgery
Theft of Electronic Devices

19. Some more Ideas on Types of Investigations.
Unauthorized Modification of Computer Systems, Network Data and Systems Interference.
Electronic Signature
Cyber Terrorism
Exceptions to Financial Institutions Posting and Authorized Options
Reporting Cyber Threats

20. Cont… Identity Theft and Inpersonation Child Pornography Cyberstalking
Attempt, Consipracy, Aiding and Abeting
Breach of Confidence by Service Providers
Manipulation of ATM/POS Terminals
Phishing
Electronic Cards Related Fraud

21. Investigative Tools
All Law Enforcement Agencies conducting investigations that may require the use of digital forensics must ensure the investigations can be supported by forensically sound and legally sufficient digital forensic examinations.

22. Conclusion
Reactive and Proactive investigations is still at its infancy in Nigeria. With the advent of the cybercrime act which still needs to be streamlined and the increased awareness of the wide scope which cybercrime in relation to many major crimes affecting our society especially in areas of terrorism, financial fraud and blatant corruption, a lot needs to be done in areas of infusing technology, advocating of new policies and providing resources for capacity building, increased manpower and financial resources.

23. Digital Forensics Limited