Natalia Akhtyrskaja
www.crime-research.org

Forms of Counteracting the Cyber Crime Investigation

While detecting and investigating computer information crimes it is necessary to seek computer information which is of a great importance for establishing truth on a case rather than to get and trace messages which are transmitted through networks. Search of computer data deals with opposing the investigation.

First of all a fight against crimes must be waged in the interests of protecting personal rights and freedoms. While carrying out sociologic researches the people were put a questions: «How do you estimate the state activity in fighting against crimes?» Only 2,6% of the interviewees gave a positive assessment, a satisfactory one – 21,3%, unsatisfactory – 47,5% and extremely negative – 28,6%.

The main faults of the state activity in fighting against crimes were ranged from global ones (lack of a purposeful and objective work of the state bodies on fighting against crimes) to individual – nonpayment of earnings.

Three basic reasons of the unsatisfactory work on fighting against crimes more often include:
- increase in the criminal professionalism
- corruption of the state structures
- decrease in the maintenance.

According to the research carried out by the Kiev international institute of sociology, the main reasons of the ineffective fight against crimes are that:
1) high officials have many privileges – 61,2%
2) use of budgetary funds does not serve its purpose – 50,6%
3) the majority of people does not adhere to the Law requirements – 48,1%
4) state body officials are mercenary – 46%
5) laws do not stipulate sanctions against actions which are crimes themselves – 36,5%

A problem of resisting the investigation has become recently especially urgent and acute. It is caused by the scope of the organized criminal activity and closely connected with the corruption of officials from power structures and law enforcement bodies. Earlier the counteraction to investigation was considered mainly as various forms and ways of concealing crimes, today it can be determined as a deliberate work on hindering to establish truth on a criminal case.

The counteraction to investigation (to avoid the responsibility) always accompanied the commitment of crimes. Since crimes came into existence, it has been developed from elementary counteraction up to the system of a refined and open resistance to the state activity on fighting against crimes.

The modern counteraction to investigation has undergone not only qualitative changes (new forms, means and methods of realizing it) but also quantitative ones, especially within the framework of the organized crime activity. There- fore, if earlier the professional skill and technical means sufficed for inspectors and operative officials to reveal and overcome cunnings and dodges used by criminals for evading responsibility, now they are not obviously enough, because law enforcement body officials are opposed by not more professional criminals equipped with up-to-date technical means but also an organized crime which ventures to fight against the state.

Taking it into account, the development and realization of effective measures to overcome the counteraction to investigation needs a thorough and deep study of a modern phenomenon of resistance as a component of confrontation between crimes and society.

Here two constituents should be singled out and separated: that which can be exposed and overcome by the law enforcement bodies and that which can be overcome only by the state and society as a whole.

One of the reasons of a qualitative worsening of the law enforcement body activity is an ineffective overcoming of the counteraction to investigation. The successful counteraction to the law enforcement bodies can be explained by a high level of latent crimes in Ukraine.

The counteraction to investigation presupposes this or that form of a dialogue between a criminal and inspector.

The structure of dialogue distinguishes three components: perceptive, communicative and interactive. The perceptive component consists of processes of perception and a mutual understanding between the dialogue participants. The communicative component deals with exchanging information between the dialogue participants. The interactive component is characterized by the interaction between the dialogue participants.

While percepting, a subject of the counteraction understands purposes and directions of an inspector’s actions and at the same time aspires to influence them in his favor. While communicating, a subject of the counteraction wants to gain information on an inspector’s plans and actions on the one hand and to give an inspector false and disguised data or conceal them on the other hand. In this case the interactive component is expressed by the disputed interaction, i.e. incompatibility of purposes of the interacting parties.

Since the preliminary investigation is carried out by authorized persons – inspectors and officials from inquiry agencies – the counteraction is expressed by impeding these people to act in conformity with their legal authorities. The counteraction is not always turned against a specific inspector, it can be directed at preventing a concrete crime from being detected and investigated by the inquiry bodies on the whole.

The «internal» and «external» counteraction should be distinguished in the process of investigating a specific crime.

The internal counteraction is rendered by these people who participate in the investigation: suspects, witnesses and victims , experts and casual persons. It is typical for them to possess any data on an event and hide, change or destroy this information and its carriers.

The external counteraction is rendered by people who have nothing to do with an event to be investigated and a person carrying out the inquiry or those who are connected with an inspector in many respects.

Subjects of the internal counteraction realize their plans mainly by concealing a crime whereas subjects of the external counteraction – by influencing and putting pressure upon an inspector, forcing him to commit an official offence.

Subjects of the external counteraction are officials from enterprises, establishments and organizations, where a crime was committed, as well as employees of the authorities and representative bodies, control and audit agencies, and law enforcement bodies. The counteraction rendered by the representatives of certain labor collectives is extended enough. The relatives and friends of a suspect can counteract as well.

Actions on preparing, committing and concealing a crime are distinguished in the structure of the criminal activity. As an object of criminalistics they are incorporated into three systems:
1) a way of committing a crime which includes all three actions (preparation, commitment and concealment)
2) a way of committing a crime which consists of preparation and commitment of an offence
3) a way of concealing a crime which contains only one component (concealment of a crime)

The whole way of committing a crime is a system of actions on preparing, committing and concealing it which are determined by conditions of the environment and psycho-physiological properties of a person, as well as connected with selective use of appropriate tools and means, conditions of time and place, and combined by a common criminal plan. This definition reflects the contents of the so-called full-structural way of committing a crime, when it incorporates ways of realizing all items of a criminal plan.

The lack of a common criminal plan can be caused by that:
1) while preparing and committing a crime, a criminal does not plan his actions on concealing an offence or ignores them and supposes that he will be not able to implement them and then, after committing a crime , in view of an unexpectedly arisen intention or suddenly appeared circumstances he takes measures to conceal a crime.
2) while preparing and committing a crime, a criminal does not plan actions on concealing it because he expects that his traces will disappear under the influence of natural or other factors and then after being deceived by these expectations he improvises measures to conceal a crime.
3) while preparing and committing a crime, a criminal does not plan actions on concealing a crime for the same reasons as in the first item, but these actions are undertaken without his knowledge by other people interested in the outcome of an affaire (those who will be exposed as a criminal’s accomplices of former crimes, relatives and friends who detected an offence and took measures to conceal it).
4) while preparing and committing a crime, a criminal plans actions on concealing an offence with the help of other people (accomplices, concealers), but when they did not manage to do it for these or those reasons, with a gap in the time he himself takes measures which were not planned earlier and do not correspond to a common criminal plan.
5) while preparing and committing a crime, a subject plans actions on concealing it, but owing to the changed circumstances he is compelled to take measures which do not correspond to a common criminal plan and provide no optimum variant of the crime concealment stipulated by the plan. It means that there is no logical connection between the elements of the criminal activity when one of these elements – actions on concealing a crime – is replaced by another, that is homogeneous but not connected with an initial criminal plan.

Thus, there can be an independent way of concealing a crime and actions on concealing an offence can be combined or not by a common plan on preparing and committing a crime.

The concealment of a crime can be defined as the activity directed at counteracting the investigation by hiding, destroying, disguising or falsifying evidences of an offence or their carriers. In this case the activity covers not only an active form of the human behavior – action, but also passive one – inaction.

The prevention of investigation consists in hiding an appropriate evidentiary information from legal proceedings/ the counteraction to inquiry is rendered by various ways of concealing an offence. On the substantial side ways of concealing a crime can be divided into the following groups:
1) concealing information on a crime and its carriers
2) destroying information or its carriers
3) disguising data on a crime or its carriers
4) falsifying data on an offence or its carriers
5) mixed ways.

Hiding information means to keep an inspector in ignorance of those and other circumstances of a case to be investigated and a source which is required to establish truth of information. The concealment of data can be rendered both in the active and passive forms.

The concealment of an object of encroachment, material evidences, money and valuables gained in a criminal way, other objects – sources of information, and avoidance from reporting for the inquiry bodies are attributed to the active ways of hiding data.

Passive ways of concealing information are a holding back, non-reporting, non-informing of required data and rejection to give evidences. Destroying data means to destruct evidences of a crime and those of a criminal, i.e. both evidentiary information and its carriers. Destruction can be full and partial. Partial destruction borders on the falsification and sometimes serves as its way.

Disguise of data aims to change a view of the way of committing a crime, the personality of a suspect, a purpose of objects – carriers of information and their circle. The ways of disguising information are:
– moving objects (e.g.: from the place where they should stay according to the existing or ordered rules to another as it happens while infringing rules of documents storage and transference)
– changing appearance of a criminal
– making a show of using an object in a way that does not serve its real purpose
– concealing data with the help of actions to be taken simultaneously.

A falsifying of data means to fake, create a false information or its carriers. Ways of concealing crimes by means of falsification are:
– giving obviously false evidences
– making an obviously false report, denunciation or statement
– creating faked traces and other material evidences
– fully or partially forging documents
– substituting, duplicating objects
– partially destroying an object, changing its appearance or falsifying its purpose.

A faked alibi – when a criminal makes a false show of his staying at another place in the space jf time that is interested for investigation – is a combined way of falsification. The investigatory practice knows two ways of creating a false alibi. The first way is that a suspect comes to an arrangement with his accomplices or persons who will subsequently become witnesses of an alibi. They give false evidences about an alibi of a criminal. Sometimes for making evidences reliable all these persons really spend some time together before or after committing a crime and then in their testimonies they change data and hours of their joint stay over those which are favorable for a suspect. The second way of making a faked alibi is based on that a suspect deceives witnesses as to the date and time of staying together with them. In this case witnesses who confirm an alibi, conscientiously delude themselves.

Mixed ways of concealing a crime are presented in the investigatory practice with various kinds of an imitation of circumstances of a crime.

Imitation of a crime means to create a situation which does not correspond to the event which has actually happened at this place and can be supplemented with an imitator and his accomplices' behavior and false reports to be conformed to the situation.

An artificial creation of material evidences of an event is always the basis of a crime imitation. Behavior and statements of an imitator and his accomplices which pursue an object to intensify the influence on an inspector the influence on an inspector, are always a supplement to material evidences and on time can precede their being found and percepted by an inspector.

There are cases when an imitator informs the investigation body about detecting evidences of a supposedly commited crime or about his assumptions of a possible penetration into the information system.

Imitation can pursue following objects:
- making a show of committing a crime to conceal evidences of an original one
- making a show of an affair that is of a criminal nature in order to conceal a really committed crime.
- making a show of a committed crime to conceal a fact of an immoral behavior, carelessness and other actions which are not of a criminal character.
- making a false show of some details of an actually committed crime or some elements of its structure; imitation of a crime committed by other people at other place, for other purposes and from other motives.

Imitation of a crime can be classified by:
- a purpose – concealing a crime or uncriminal affair
- an object – imitating a crime, uncriminal event, some details or elements of a crime structure, as well as imitation.
- time of committing a crime – before, during or after committing a crime or uncriminal event.
- a place – on a spot of a crime or at another place.
- a way of legalization – a crime is detected through confession of a criminal or his accomplices or report of a stranger.
- duration of influence – if a crime remains to be undetected, a criminal wins a gain in time or other term advantages over an inspector.
- contents – imitating material evidences in connection with a corresponding behavior and giving a false information.

Two more groups of factors, which make strangers and victims conceal a crime, should be specified as well. There are some cases when a stranger conceals a fact of detecting a crime in order to obtain reasons for subsequently blackmailing a criminal.
Thus a blackmailer aspires to “materialize” an obtained information and hide from the inquiry agency material evidences which prove guiltiness of a suspect.

A crime can be concealed by a victim in following three cases:
- When a crime bears a character that shames him, i.e. testifies such his qualities as dishonesty, conviction (abduction of a dossier). A crime can be estimated by a victim as something that shames him, inflicts damage to his reputation. So when money is drawn from banking accounts, it is perceived as something that undermines a financial authority and information security and that is why a victim quite often prefers to conceal a committed crime in order to save his reputation.
- when a victim is threatened by desclosing a crime.
- when a victim desires to settle a score with a perpetrator.

The external counteraction to investigation can differ in orientation. It depends on a subject, his possibility and purpose of prevention. The motive of counteraction and a criminal’s possession of information on facts of a case are of great importance. Subjects jf the external counteraction can be divided into two groups:
1) those who pursue their own objects and understand the unlawfulness of their actions
2) those who act under the influence of a conscientious error as to circumstances of a crime, the personality of a criminal , actions of the investigation body and do not pursue their objects.

The counteraction can be directed at:
- The process of investigation, settlement of its problems, conditions of its execution.
- A person who execute investigation – an inspector and official of the inquiry body.
- Carriers of evidentiary information – witnesses, victims and their relatives, friends or workmates.

The counteraction to investigation on the part of subjects from the first group can be expressed by:
1) concealing a crime committed in their organization or enterprise to save their face and reputation. It applies equally to hiding facts which favor commitment of a crime
2) concealing a crime for mercenary reasons, for example, to evade taxes or obtain illicit products
3) concealing a crime because of a false understanding of professional interests (threat to a career or promotion)
4) concealing a crime or opposing the investigation for mercenary objects or because of corruption and participation in the activity of organized criminal groups
5) concealing a crime for personal reasons: at request of the relatives, friends, business partners, if the reputation, society position, business ties are threatened by disclosing an offence. The counteraction to investigation on the part of subjects from this group can be directed at a person who executes the inquiry and expressed by:
- forcing an inspector to take illegal actions which are not caused by interests of investigation: a changing of a preventive punishment, dismissal of a case, redetermination of a crime as more simple, singling out af materials for separate proceedings to dismiss a case or enforce an insignificant punishment.
- applying an illegal violence against an inspector: threat to life and health of his own and his relatives, threat with discharge, blackmail of divulging old deeds which defame his reputation.

Subjects from the second group, who do not pursue their objects and illegal interests, counteract the inquiry while being conscientiously deluded by the personality of a suspect or his actions or their legal evaluation under the influence of a false or deformed information on actions of an inspector or motives of witnesses and victims. They can be guided by feelings of humanity, pity and sympathy for a perpetrator. Their actions are usually expressed by complaining and soliciting the law enforcement bodies and mass media, making an inspector, witnesses and victims have a favorable opinion of a suspect and sometimes a low one of a victim or witness, at times giving a biased assessment of an inspector’s behavior and actions.

According to the analysis of questioning carried out in Ukraine, 44% of investigatory officials run into opposition while inquiring crimes on illegally disturbing computer systems. The counteraction was expressed by regulary “delaying” the realization of necessary inquiry and search measures (56%) and interfering with the inquiry. In 70% of cases the counteraction was overcome by privately performing an operative work (11%).

Crimes committed in the field of information technologies are difficult to investigate because of:
1) irregularity of information
2) incompleteness of information
3) inaccuracy of information
4) unwillingness of a financial structure authorities to fix a true condition

75% of interrogated investigatory officials noted that crimes were not inquired properly because of an insufficient methodical provision and unisolated structure.

The extension of harmful programs stated below can be considered as a form of counteracting the inverstigation:
- “computer viruses” (programmes which are capable to join spontaneously other ones and take various prejudical actions when the programmes are started, recopy themselves, change a programme which they were joined and disturb its normal operation, spoil some files and catalogues, distort result of calculations).
- “Trojan horses” (programmes which externally seem to be useful but at the same time contain a latent module carrying out various unauthorized and often harmful for users functions)
- “logic bombs” (programmes which intentionally change a programme code, put a programme or computer system out of action under conditions specified beforehand, for example, in a certain space of time.

Penetration of computer viruses into programmes at the Office of Public Prosecutor in the town of N can serve as an example of such a situation. A victim made a request to give him for a further appeal a decision of staying proceedings but the process dragged on because the information had vanished from an inspector’s files. The data were restored due to the availability of a material paper carrier.

Increase of computer crimes requires a coordinated approach to developing legal regulations aimed to fight against this kind of offences.

On the analogy of a list of crimes recommended to include without fail into the home criminal legislation (computer fraud, computer forgery, computer sabotage, unauthorized access, unauthorized interception, unauthorized recopying of a computer programme with reserved copyright, unauthorized reproduction of microcircuits), it is advisable to develop:
1) criteria of the lawfulness and permissibility of taking some investigatory actions to reveal evidences of a computer crime commitment
2) conditions for regarding an obtained information as evidentiary one
3) strategy of taking investigatory actions aimed to inquire cases of such a category
4) character of a legal consideration of counteraction to investigation rendered in a way similar to that of committing an ordinary crime ( as recommitment of a crime or prevention of inquiry actions).



1. Bahin V. P., Karpov N. S. Some aspects of studying a practice in fighting against crimes. – Kiev, 2002. – page 8.
2. Karagodin V. N., An overcoming of counteraction to preliminary investigation. – Sverdlovsk, 1992.