SOP on computer crime response bared

By: Alfred P. Dalizon - Journal online
ONLY a computer forensic expert should search for any evidence contained in the hardware.

This is just among the standard operating procedures cops have been urged to observe in incidents involving computer crime.

Under Rule 26 of the Police Operational Procedures, computer crime response is the actual police intervention in an incident where the acquisition of evidentiary value are traceable within the computer’ hardware and its network.

Among the do’s and don’t’s in computer crime response are:

-- when the computer is OFF at the time of arrival, do not turn it ON;

-- when it is ON, do not turn it OFF nor touch its mouse or keyboard;

-- if available, call for the Computer Incident Response Team or CRT;

-- if CRT is not available, the unplugging of the computer whether it is ON or OFF at the time of unplugging should be done by pulling out the cable directly from the back of the Central Processing Unit or CPU;

-- each unplugged cable must be marked in the same marking corresponding to the socket from where the cable was unplugged. (Example: ‘Socket’ marked ‘A’ and the ‘Cable End’ also marked ‘A’). The computer should be carefully handled and packed for transport to the police station;

-- only a computer forensic expert should search for any evidence contained in the computer hardware;

-- the computer hard disk should be duplicated by the forensic expert and the original should be kept by the evidence custodian for future presentation. Search and analysis shall be undertaken using the imaged disk.

The need to remind police of the computer crime incidents procedure is necessary as criminals now use the latest computer in illicit activities such as money-laundering, cybersex, bank and credit cards fraud, kidnapping, bank robbery, drug trafficking, large-scale illegal recruitment, rebellion and terrorism.

Officials have expressed concern that improper handling of computer evidence might hamper follow-up operations to get hi-tech criminals and terrorists, including their financiers and masterminds, and worst, erase vital evidence needed in unmasking members of the syndicate as well as their activities, past and present.

Last week, the Philippine National Police Criminal Investigation and Detection Group headed by Chief Supt. Raul L. Castañeda arrested 17 suspected members of an illegal recruitment agency led by a Filipino-Chinese businessman following complaints sent to the police by relatives of the victims through Vice President Noli de Castro.

PNP chief Director General Avelino I. Razon Jr. said the suspects, led by Luciano Lim, owner of the Excellent Travel Agency with office at 1523-1525 M. H. del Pilar St. in Ermita, Manila, were arrested for violation of Republic Act 9208, otherwise known as the Anti-Trafficking of Persons Act of 2003.

CIDG agents who raided the travel agency’s office on the strength of a search warrant issued by Judge Emma Young of the Manila Regional Trial Court Branch 36 seized 13 sets of computers, a recording transmitter, a paper ticket printer and other computer paraphernalia which are now being examined by the CIDG Cyber-Crimes Center.

Castañeda said Tuesday’s operation was the first big case unearthed by the CIDG Anti-Transnational Crimes Division involving trafficking in persons as evidenced by the electronic paraphernalia seized during the raid and considering the magnitude of such illegal activity.

“There are even reports that some of them become impregnated by their ruthless employers while others were homeless for the duration of their stay in Singapore,” Razon said.

Razon congratulated Castañeda and the CIDG-ATCD headed by Senior Supt. Gilbert Sosa for losing no time in attending to the case. Sosa said they are watching the activities of at least 20 other travel agencies involved in similar illegal activities.

“This is a major breakthrough in our war against illegal human traffickers. Hence, I am encouraging other victims to come out in the open to file their complaints with the CIDG,” the PNP chief said.

(The PNP urges victims of crime and rogue officers to send their complaints through Isumbong Mo Kay Tsip at 0917-8475757, the Anti-Kotong Text 0927-5151515; PNP TXT 2920, DILG Patrol 117 or send e-mail to tsip1@pnp.gov.ph or tsip@pnp.gov.ph)

Computer crimes rising, say police

Crimes committed via computer rose sharply last year, the Philippine National Police (PNP) said Sunday.

A briefing paper on cyber crimes by the Criminal Investigation and Detection Group (CIDG) said that PNP's 1,843 crimes involving computers were reported to police in 2007, almost triple the 527 crimes reported in 2006.

Overall, a total of 2,624 computer crimes were reported from 2003 to 2007. From only 37 in 2003, the number of computer crimes rose to 56 in 2004. It surged to 161 in 2005.

Between 2004 and 2006, the PNP's cyber crime unit investigated 195 cases requiring computer forensics.

The online crimes consist of, among others, credit card fraud, cyber pornography, copyright infringement, and computer crimes defined as in Republic Act No. 8792 or the E-Commerce Act, and RA 8484 or the Access Devices Regulation Acts.

CIDG commander Chief Supt. Raul Castañeda said they were going "full blast" against cyber crimes.

"We are really focusing on cyber crimes. We have to be prepared because this is the wave of the future," Castañeda told the Philippine Daily Inquirer (parent company of INQUIRER.net).

The CIDG's efforts have resulted in the conviction in 2005 of JJ Maria Giner, the first conviction of a hacker in the country. Giner was convicted under the E-Commerce Act for hacking into government websites.

The CIDG has also disabled 21 "phishing" sites based in the country. Phishing is an attempt to fraudulently obtain sensitive information like user names, passwords and credit card details by passing oneself as friendly and trustworthy through electronic communication.

Computer and cell phone forensics were also used in other cases like the one against members of the Communist Party of the Philippines-New People's Army (CPP-NPA), the murder of former Abra Rep. Luis Bersamin, the cases against Magdalo soldiers, the Batasan blast as well as other bombing incidents, and the Peninsula Manila siege.

Castañeda revealed that training and procurement of equipment was ongoing to beef up their capabilities in computer forensics and cyber crime investigation.

He noted that computer forensics as well as cell phone forensics were becoming vital in antiterrorism and anti-criminality operations.

Castañeda said efforts to fight cyber crime were mostly concentrated in Metro Manila. But he said they would put up satellite units in Davao, Zamboanga, Cebu and Baguio cities.

At present, the CIDG's computer crimes unit only has nine operatives. But 200 CIDG personnel have received training in cyber crime investigation.

Most of the equipment being used by the CIDG came from the US Anti-Terrorism Assistance Program.

To boost its campaign against cyber crimes, the CIDG is forging closer ties with the National Bureau of Investigation, the Police Anti-Crime Emergency Response unit, Interpol, National Intelligence Coordinating Agency, Anti-Money Laundering Council and Microsoft.

The Philippines is also tying up with other countries with cyber crime units like China, India, Indonesia, Korea, Malaysia, Singapore, Thailand, Japan and Hong Kong. By Alcuin Papa - Philippine Daily Inquirer