This module is a resource for lecturers

Informal international cooperation mechanisms

Informal mechanisms for international cooperation, such as the sharing of information between law enforcement agencies (i.e., police-to-police cooperation; for further reading see the Teaching Module Series on Organized Crime, particularly Module 8 on Law Enforcement Tools and Cooperation), are also used in cybercrime investigations (James and Gladyshev, 2016). The type of information shared between law enforcement agencies using informal channels varies by state. In Australia, "authorities may be able to provide the following types of assistance on an agency to agency basis: taking voluntary witness statements, conducting voluntary witness interviews, taking voluntary witness testimony via a video link facility, hosting foreign police who are conducting inquiries in Australia, sharing intelligence, conducting physical surveillance, obtaining criminal records, or obtaining publicly available material" (UNODC, "Informal cooperation channels: Australia"). Other countries share personal data (UNODC, 2013, p. 211).

Informal cooperation mechanisms facilitate the fast transfer of information between agencies (i.e., days instead of months) (UNODC, 2013, p. 214). Additionally, 24/7 networks (e.g., G8 24/7 High Tech Crime Network and the 24/7 network of contacts of parties to the Council of Europe's Convention on Cybercrime established under Article 35 of the Convention) have been developed to receive urgent requests for digital evidence and facilitate international cooperation.

Informal cooperation channels are primarily used to obtain legal and technical advice and assistance in cybercrime cases rather than to request the collection of digital evidence (UNODC, 2013, p. 214). In Japan, for example, requests for information through informal channels is only allowed when the requesting country is not intending to use the information as evidence (UNODC, "International cooperation: Japan"). If the country is intending to use the information as evidence, a formal mutual legal assistance request is required (see Module 11 on International Cooperation to Combat Transnational Organized Crime of the University Series on Organized Crime). Digital evidence obtained from these channels may be considered inadmissible in the national courts of the requesting state if a chain of custody is not maintained (see Cybercrime Module 3 on Legal Frameworks and Human Rights, Cybercrime Module 4 on Introduction to Digital Forensics, and Cybercrime Module 6 on Practical Aspects of Cybercrime Investigations and Digital Forensics, for further information). If information is informally shared by authorities in the United States, Paraguay, and Argentina (to name a few), requesting countries are required to follow up through formal channels (UNODC, "Police to Police Cooperation: United States"; UNODC, "Informal cooperation: Paraguay"; and UNODC, "Channels for urgent requests for MLA in cybercrime cases: Argentina").

International and regional organizations also facilitate informal international cooperation. For example, urgent requests for assistance can be made to the Organization of American States (UNODC, "Channels for urgent requests"). Urgent requests for assistance can also be made via INTERPOL (UNODC, "Channels for urgent requests for MLA in cybercrime cases: Liechtenstein"), the world's largest international police organization, through itsI-24/7 global police network spanning over 190 countries. National law enforcement in this network share expertise, technology and resources to fight against transnational crimes.

INTERPOL acts as a communication hub between countries, helping to disseminate information, such as notices, and even assisting in coordinated operations between countries. For example, in 2012, INTERPOL assisted local authorities in Spain, Argentina, Chile, and Columbia to arrest 25 members of Anonymous ( Operation Unmask), an international hacker group (Whiteman, 2012; Interpol, "Operation Unmask"). In 2017, "[a]n INTERPOL-led operation… [involving] Indonesia, Malaysia, Myanmar, Philippines, Singapore, Thailand and Vietnam," as well as China and private sector organizations, led to the "identification of nearly 9,000 Command and Control (C2) servers and hundreds of compromised websites, including government portals" (INTERPOL, 2017).

Whiteman's (2012) article states that INTERPOL arrested the suspects. This is an error. INTERPOL does not have the authority to arrest criminals. INTERPOL can help create something similar to a Joint Investigation Team (Europol, n.d.) that can assist in criminal investigations, but only local investigators have the authority to make arrests locally. Unfortunately, the media, often incorrectly, portray INTERPOL as an international police force with local authority. Instead of INTERPOL having arrest authority in a country, each state creates its own National Central Bureau (NCB) (INTERPOL, 2018). INTERPOL headquarters can provide information and recommendations to NCBs, but they cannot compel them to action. Furthermore, members of the NCB are sometimes - but not always - locally sworn police officers or prosecutors.

According to the 2013 UNODC Draft Comprehensive Study on Cybercrime, countries reported that informal cooperation is still largely dependent on the existence of bilateral and regional instruments, the networks of regional and international organizations, and existing relationships and partnerships between law enforcement agencies (UNODC, 2013, p. 210). Partnerships also play a key role in cooperation between law enforcement and the private sector during cybercrime investigations (see Cybercrime Module 5 on Cybercrime Investigation for more information on public-private partnerships). The cooperation between Microsoft's Internet Crime Investigations Team and law enforcement agencies in the United States, Morocco and Turkey led to the detection and eventual arrest of the creators and distributors of the Zotob computer worm (FBI, 2006).

Next: Data retention, preservation and access

Back to top