What to do if you get caught in a cybercrime

Father

Professional
Messages
2,602
Reaction score
837
Points
113
It may seem that in the digital world it is safer to go beyond the law than in the real world: it is easier to destroy the traces of a crime, and there are not so many specialists. The profile is required by the authorities. In fact, this is not the case. He worked for seven years at the preliminary investigation (commission of inquiry, Ministry of Internal Affairs) and investigated many crimes in the field of information technology. In this article, I will tell you what to expect and how to alleviate your situation if you pay attention to law enforcement.

Content
1. Types of crime
2. Internet aggravates
3. Time is against you
4. How can law enforcement agencies find out about you at all?
5. Checking before the initiation of a criminal case
6. Criminal case
7. General advice on how to deal with the investigation
8. Memo

Types of crimes
Cybercrimes are very different. I will highlight the main ones that you have to deal with almost every day.

Theft using information technology
This category includes phishing scams, theft of funds from accounts, including carding.

Drug trafficking crimes
It has been almost a decade since the illegal Silk Road market emerged, and since then, the fight against anonymous markets around the world has not subsided. There are also adventurers who believe that no one will find their online store. Just look at the statistics and you will see how many similar companies are hiding each year - these are huge numbers; But you can easily serve a quarter of a century for selling drugs.

Purchase of special means
This and the next paragraphs are "people's articles," and here's why. The law enforcement system loves statistics: the more people are taken into account, the better - bonuses, awards, and ranks of employees depend on it.

Several years ago, there was a mistake in the legislation that made it possible to prosecute "geeks" who buy mobile phones, GPS beacons and micro cameras not licensed in the Russian Federation - for the purchase of funds for secretly obtaining information.

Internet extremism
Everyone has heard the terms "memasics" or "reposts". Now they are not so cruel under this article, and nevertheless, hundreds of people have already received sentences, albeit suspended ones, and convicted ones.

Creation, distribution of malware or illegal access to computer information​

This is already a real hacker article and is quite rare. The less frequent the crime, the more interesting it is for statistics. So if you become aware of the authorities in connection with something like this, they will "develop" you more than usual.

Distribution of child pornography
Fans of torrents come across such a composition: downloaded and forgot to delete - consider that you are already committing a crime. Have you caught malware and transferred your computer to a botnet? They will come for you.
Our authorities "calculate by IP" without any jokes. Anyone caught in this way is more likely to turn out to be not an intruder-hacker, but an innocent lover of hacked programs. Nevertheless, the matter will not do without the withdrawal of equipment.

Internet aggravates
I would like to note that in accordance with the Criminal Code for fraud, theft and drug trafficking on the Internet, there are more severe penalties than for the same crimes committed without the use of information technology.

Cybercrimes are more difficult to solve, so not so long ago they were "escalated" - now these connections have become serious and especially serious. So for the theft of two thousand rubles from the pocket of your bag, during the preliminary investigation you will sit on recognizance not to leave and separate yourself with a suspended sentence, and if two thousand are stolen from your bank card account, you can easily be arrested and get a very real term of up to ten years.

Time is against you
If you crossed the line of the law (by negligence or deliberately), then neither tomorrow nor the day after tomorrow, most likely, they will not come for you. Even operational units are burdened with bureaucratic requirements, do not always live up to their name and act quickly.

In addition, all operational research manuals advise not to rush, but to gain a foothold in the evidence. If you catch the attacker too early, then all the work will go down the drain: there will not be enough evidence, and he will have to be released.

Law enforcement officials aren't always smarter than criminals, but they can wait. I've seen cases of cybercriminals flourishing for over a year. Sooner or later, the attacker will lose vigilance and make an obvious mistake. Here the whole crime can be attributed to him at once. After all, any theft or other activity is a separate crime, and it is always beneficial for the authorities to attract a person for 10-20 crimes, and not for one.

How can law enforcement agencies find out about you at all?
The first "thread" can come from anywhere: informants, data from providers, some kind of analytical traffic results or messages from citizens about an illegal action committed against them.

What are the signs that you can understand that you are “under the hood”? The main tool is intuition. But there are also more objective signs.
  • Your phone started working strangely; there are suspicions that you are being bugged.
  • “New friends” appear who are interested in your activities.
  • Strangers ask your neighbors about you - they can be employees of the authorities.
If you are really doing something illegal, you still have a chance to stop in time. However, if government officials began to openly interview neighbors or relatives, it means that your development is approaching the final stage and there is already a test material that they are preparing to hand over to the investigator to start criminal proceedings.

Checking before the initiation of a criminal case
Before initiating a criminal case, law enforcement agencies study the materials of the check. If there is such material, it means that law enforcement agencies already have information about a possible crime.

One of the tactics is to collect all the evidence at this stage so that the investigation of the criminal case does not drag out. Sometimes the investigator, after considering the materials of the check, can only process and transfer the criminal case to the court.

The trick is that the check lasts up to 30 days, so the employee makes a formal decision to refuse to initiate a criminal case, the prosecutor cancels the decision, and the check period starts over. Thus, it is possible to consider the verification materials for a long time and look for evidence: I saw the verification materials five years ago, and this is not uncommon.

However, the criminal case cannot be extended indefinitely. Investigators intend to conduct an investigation within two months. Only cases that have received a great public response can be investigated for more than a year.

A number of investigative actions can be carried out even as part of an audit:
  • inspections of the scene of the incident (for example, your apartment), within the framework of which equipment may be confiscated;
  • interrogation (this is not an investigative action in the full sense, but interrogation will be based on the testimony of the interrogation, also if the article is suddenly under investigation by the body of inquiry, then the interrogation can be evidence);
  • expertise;
  • obtaining samples of voice, handwriting, fingerprints and palms of hands, genotype - for comparative research;
  • inquiries to providers, banks, cellular companies and other organizations;
  • assignments to other services, including foreign ones through Interpol.

Inspection
The search will not take place unless a criminal case is initiated. However, if you have clear evidence of a crime in your home, they can do whatever is necessary as part of a routine inspection of the scene - and even against your will. The search must subsequently be legalized by the court so that the seized evidence can be considered legal. However, investigators take such a step only if they have concrete grounds in their hands and the courts in most cases agree to legitimize such measures.

In addition, if the circumstances do not allow for delays, even a search can be carried out without the prior permission of the court and subsequently legalized.

How is a home inspection different from a search? In any case, the action can be against your will and be accompanied by the seizure of things, but according to the law, the difference lies in the goals. But there are no clear boundaries here either.
In practice, examinations are usually "softer", do not turn everything inside out, but simply examine the place. However, even on inspection, employees can search anywhere and anything.

Interview
As part of the check, you may be asked to be interviewed (not questioned!). You are allowed to take a lawyer with you to your interview. This is not necessary, but it is important to be realistic about the risks. Perhaps, immediately after the interview, a criminal case will be opened against you and your problems will suddenly become serious.

Be sure to find a good lawyer who will come to you urgently. Once in custody, you will not be able to leave the law enforcement building on your own.

Criminal case
If a criminal case is brought against you, you will, of course, find out right away. Most likely, the investigator will not even notify you by mail, but already in his office, officially inviting you to investigative actions.

But there is a nuance - a criminal case can be initiated against an unidentified person. The investigation may not have sufficient evidence, or the perpetrator has not yet been identified. Or maybe you have already been "identified" informally, the investigator simply uses such a trick to conduct operational searches and investigations while you remain in the dark.

Scenarios of interaction with the investigation
Scenario one: you learned about the initiation of a criminal case against an unidentified person. Personally, you are not affected by any active actions of the authorities, but you are really involved in the crime (if not, then there is nothing to worry about, I have not heard that innocent people go to jail for cybercrime).

The second scenario: you discover that an unidentified person is under investigation in a criminal case and take part in inactive investigative actions (interrogation as a witness, searches in the status of a witness, etc.); in this case, you will have less rights than in the status of a suspect, which simplifies the investigation.

The third scenario: when a criminal case is initiated against you or you are interrogated as a suspect (these events are equivalent - in both you have the status of a suspect).
According to the first two scenarios, it is enough to build a line of self-defense and, if possible, discuss with a specialist how events can develop, what could mitigate and what could aggravate the punishment.

In the third case, you need to immediately conclude an agreement with a lawyer.
In any case, if you find that something is being started against you, even if this is a test action, you need to stop any illegal activity as soon as possible and take off your white hat once and for all, go to the bright side. Perhaps you are lucky and you will get off with an alarm call and waste your nerves in vain.

Preliminary investigation
The preliminary investigation is divided into several stages.

The first stage - the initiation of a criminal case - we have already sorted out.

Interrogation
The second stage will begin soon - this is an interrogation. During the preliminary investigation, he will give you the status of a criminal: witness, suspect, accused.
Each of these statuses implies its own rights and obligations within the framework of a specific criminal case, you can familiarize yourself with them in the Code of Criminal Procedure on your country.
If the crime is not serious, you will be summoned for questioning, a non-custodial precaution will be taken (stay in place and behave appropriately), and if summoned, you will be summoned to other investigative actions.

In the event of a serious crime, you may be detained even before a criminal case is initiated. The operatives will pick you up anywhere except your home (after all, you need a court decision and start a criminal case), take you to the investigator and draw up a detention report.

Detention
The staff can approach you at any time, even if you are walking slowly down the street. They will introduce themselves and say that you are under arrest. Better not to resist, because bruising on the body of a working employee is a crime.

You need to call your relatives or a lawyer, but do it without aggression, otherwise the phone will be instantly confiscated during a search.

You will be brought before the investigator, and he will draw up a protocol of detention. During the arrest, the presence of a lawyer is not essential. All the same, you cannot influence the detention if it is legal. And it is legal in three exceptional cases:
  • if the detainee is caught while committing a crime or immediately after committing it;
  • if the victims or eyewitnesses point to him as a person who has committed a crime;
  • when clear traces of a crime are found on a person or on his clothes, with him or in his home.
The arrest report must be signed, as the mark of the investigator “refused to sign” will negatively affect the consideration of the criminal case by the court.

Make sure that the time of detention on the protocol matches the time of the actual detention. From this moment, 48 hours are counted, during which the investigator must appear in court with a petition for arrest and prepare materials proving why imprisonment is necessary for an objective investigation of a criminal case.

When detained, the investigator is obliged to give you the opportunity to call you, use this right wisely. Don't call your accomplices, because your entire conversation will be overheard by employees (and you can trace the call), and coming up with a word code on the go is a bad idea.

Your best bet is to call your loved ones to bring you bedding and warm clothes as soon as possible so you don't get cold alone. The investigators will meet you halfway and will wait, because then it will be much more difficult to transfer things to the pre-trial detention center.

Search
In the early stages of an investigation, a site visit or search should be conducted with at least two witnesses. Any items under investigation will be searched and seized. You will not be able to leave the search area. At the end, the staff will prepare a search report, you can read it and make a photocopy.

If your hardware - whether it’s a hard drive or an entire computer - needs to be shut down and removed, an IT professional (civilian or forensic expert) must be present during the search. An operational employee, even if he is from the FBI, Secrete Service or police, cannot replace such a specialist.

Expertise
If you are a suspect or a witness, further examinations await you.

Expertise can be different: from a computer to phonoscopy, fingerprints, biology. It all depends on the tested objects. In any case, the suspect will be familiar with the investigation. A witness only when samples were taken from him.

Other investigative actions
  • Testimony on the spot: under video or photo recording, you will tell and show what you did and how you did it right at the crime scene.
  • Investigative Experiment: Employees will reproduce the conditions under which the crime was committed to make sure that their or your assumptions are realistic.
  • Confrontation. Even if you have built an ideal technical defense, refuse to admit guilt, and the investigation has no objective evidence, your partner can always turn you in. In this case, the investigation will conduct a confrontation between you and your partner, where he will tell you "how it was," and you will either stand your ground or agree with him. In any case, you will have a confrontation between versions, the purpose of which is to establish the truth.

Accusation
After all, when the survey has shaped the qualification of your actions, you will be charged. You can agree with the accusation, partially agree or disagree. At this point, you will definitely be interrogated again - already as an accused, in order to highlight the "i" and understand your attitude to the criminal case (whether you regret it or not) and the final position on your act, with which you will appear before the court.

The final part of the preliminary investigation
All the materials of the criminal case, on which a protocol will be drawn up, will be handed over to you for review. You will be able to study all the evidence that the investigator has gathered and, together with a lawyer, choose the final line of defense for the court. In the acquaintance protocol, you can apply for the choice of proceedings (for example, in a special order or by a jury).

This concludes the investigative measures. Then the criminal case is submitted to the prosecutor for approval, and then to the court.

Confession of guilt, confession and special procedure
To admit guilt or not is up to you. The main rule: in no case do not admit what you have not done. If you have been subjected to violence or threats ("confess, otherwise we will beat you"), threaten to write a statement to the commission of inquiry. This is where the threats will most likely end, since "knocking out" testimony is a crime on the part of employees and entails severe penalties.

When you do commit a crime, denial is the worst option if the criminal case goes to court. The court will give the maximum term, and even with imprisonment.

On the other hand, criminal proceedings are very humane in relation to those who confess. If you committed a crime for the first time and confessed to it, there will not even be a trial, only a court fine. As a result, you will not be convicted. This is new in legislation. The application of a court fine has its own nuances, for more details in the Code of Criminal Procedure of the Russian Federation.

What will help? A confession. Previously, she was the "queen of evidence", but now it is a life hack that allows you to remove the maximum punishment. Even if you wrote a confession, and then the whole investigation was rejected, and you were found guilty in court, the appearance will help you.

A special procedure applies if the conditions for imposing a court fine are not met. Is it admitted to be full of guilt? Ask for a special order. Then the court does not consider the case on the merits, but only decides the issue of sanctions. In most cases, a special order will result in a suspended sentence or (if you also feel guilty) a minimum sentence.

Lawyer
A lawyer is your main defense tool. You can hire him "by appointment" or hire a free lawyer provided by the state. The appointment of a lawyer is not just a formality, many of them are being defended in good faith, and the famous "pocket attorneys of the investigator" are a thing of the past long ago, since they are appointed by turns of the bar association, and not by summons of the investigator. ... A qualified lawyer is often enough, especially if your strategy is to plead guilty. In this case, it is more efficient to spend money not on a lawyer, but on damages.

If you realize that you will have to pay more, hire a lawyer on a contract basis. A good defender is expensive and he never guarantees that you will not be held accountable, and will even warn you directly. Provided, of course, that this is indeed a professional and not a marketing lawyer who imitates hectic activities and makes promises for your money. Unfortunately, there are no assessments of the professionalism of lawyers, you need to focus on lips, previous experience in the relevant category of cases and reputation.

General advice on how to communicate with the investigation
They do not contradict the representatives of the state, they always have more powers. This is especially true of the investigator, since this is the only employee who can really influence the fate of a criminal case. From “unproven” to “maximum duration and worst conditions in the temporary detention center and in the zone”.

Subordination is an important point. How many times have I seen a suspect pay bitterly for his insolent behavior with the investigator? On the other hand, seeing respect and understanding on your part, the investigator is likely to respond in kind.

It is also not worth giving in to the investigation, because their job is to send the most serious criminal cases to court in order to improve statistics.

The optimal behavior model is negotiable. For example, an investigator often forgets to familiarize a suspect with rights prior to initiating an investigation. It is better not to write a complaint, but to sympathetically mention it. Ask him to accommodate him to reduce your guilt. Your complaint will not be satisfactory in any case, but the location of the investigator will be helpful.

The investigator is also human and strives to do his job honestly. If you find that the investigator is torn between conscience and the demands of the authorities to improve the severity and the number of convictions, then show the best you have. Tell him you just made a mistake. But now you are ready to become another "Kevin Mitnick" and teach young hackers not to make mistakes and not break the law.

Memo
  • Online crime carries harsher penalties.
  • The police know how to wait, and the criminals lose their vigilance.
  • If it smells of burning, immediately stop dark deeds.
  • Each violation is a separate crime.
  • Watch for signs that you are being developed.
  • They can dig under you without initiating a criminal case.
  • Consult with a lawyer about tactics and arrange an urgent departure in advance.
  • Witness status does not guarantee your safety.
  • An accomplice can set you up.
  • Do not resist when detained.
  • Don't call your accomplice, call your lawyer or relatives.
  • Ask your relatives to bring you warm clothes for the isolation ward.
  • Check the time of detention and sign the protocol.
  • [A special order, confession and confession will reduce your punishment.
  • Do not confess what you did not do - even under pressure.
  • A free lawyer is not always useless.
  • A paid lawyer is not always good, choose according to reviews.
  • Do not conflict with the investigator, but negotiate with him!
 
Top