Unformatted text preview: he other two individuals. Computer Criminal Behavior
Like traditional criminals, computer criminals have a specific modus operandi (MO).
In other words, criminals use a distinct method of operation to carry out their crime
that can be used to help identify them. The difference with computer crimes is that
the investigator, obviously, must have knowledge of technology. For example, an MO
for computer criminals may include the use of specific hacking tools, or targeting
specific systems or networks. The method usually involves repetitive signature behaviors, such as sending e-mail messages or programming syntax. Knowledge of the
criminal’s MO and signature behaviors can be useful throughout the investigative
process. Law enforcement can use the information to identify other offenses by the
same criminal, for example. The MO and signature behaviors can also provide information that is useful during the interview and interrogation process as well as the
Psychological crime scene analysis (profiling) can also be conducted using the
criminal’s MO and signature behaviors. Profiling provides insight into the thought processes of the attacker and can be used to identify the attacker or, at the very least, the
tool he used to conduct the crime.
NOTE Locard’s Principle of Exchange also provides information that is handy
for profiling. The principle states that a criminal leaves something behind and
takes something with them. This principle is the foundation of criminalistics.
Even in an entirely digital crime scene, Locard’s Principle of Exchange can shed
light on who the perpetrator(s) may be. Incident Investigators
Incident investigators are a breed of their own. Many people suspect they come from a
different planet, but to date that hasn’t been proven. Good incident investigators must
be aware of suspicious or abnormal activities that others might normally ignore. This is
because, due to their training and experience, they may know what is potentially going ch10.indd
View Full Document