Translate this page:
Please select your language to translate the article


You can just close the window to don't translate
Library
Your profile

Back to contents

Police activity
Reference:

Appointment of comprehensive forensic examinations in case of the study of digital traces in the investigation of economic crimes

Buinov Dmitrii Olegovich

Postgraduate, Department of Forensic Science, Kutafin Moscow State Law University

125993, Russia, Moscow, Moscow, Sadovaya-Kudrinskaya str., 9

buinovdmitrii@mail.ru

DOI:

10.7256/2454-0692.2022.4.38601

EDN:

VAWNXO

Received:

10-08-2022


Published:

03-09-2022


Abstract: Due to the ongoing digitalization of the economy, the study of digital traces in the framework of forensic examinations in criminal cases in the field of economic activity is one of the most relevant topics in forensic expert science. The purpose of this study is to identify and analyze the features of the production of complex forensic economic and computer–technical expertise in the study of digital traces, to determine the limits of competence of an expert economist in the expert study of digital traces. Within the framework of the study, the author set the following tasks: to analyze the types of crimes in the field of economics and the ways of their commission for the possibility of the formation of digital traces during the implementation of these offenses, to determine the types of digital traces characteristic of crimes in the field of economic activity, to determine the appropriateness of the appointment of comprehensive examinations, to analyze an example of expert practice for the use of special economic knowledge and special knowledge in the field of forensic computer-technical expertise.The author came to the conclusion that the appointment of a comprehensive forensic computer-technical and economic expertise is unnecessary in most cases, since the simultaneous joint participation of an expert economist and an expert in the field of IT technologies in writing an opinion and formulating a general conclusion is not necessary in most cases when investigating crimes in the field of economic activity. As a rule, the participation of a specialist in the field of IT technologies is sufficient to withdraw computer information from the carrier and then provide this information to an expert economist for research. At the same time, an expert economist is able to work independently with software products and computer files, for the study of which there is enough well-known knowledge.


Keywords:

digital footprints, forensic examination, forensic economic examination, forensic computer-technical examination, comprehensive examination, complex of forensic examinations, the limits of the expert's competence, economic crimes, criminal proceedings, investigation of economic crimes

This article is automatically translated.

The ongoing process of digitalization of economic relations undoubtedly brings positive results, such as simplification and cheapening of the document flow accompanying the entire process of economic activity; creation of the latest business models that are mutually beneficial for both the manufacturer of goods and services and its customers, etc. Along with these processes, the types of evidence that can be considered by the court in resolving economic disputes are also changing. In connection with the digital transformation of the economy and law, fundamentally new, previously unknown categories of assets and transactions with them appear, which determines the development of forensic expertise [1, p. 60]. Computer information of economic content is of great evidentiary value in civil law processes – when considering civil and arbitration disputes between organizations and citizens. However, in the context of the topic under study, we will focus on the digital traces investigated in the investigation of crimes in the field of economic activity.

In recent years, the number of crimes committed using information technology, including the Internet, has been steadily growing. With the beginning of a special military operation of the Armed Forces of the Russian Federation on the territory of Ukraine, the number of such crimes has sharply decreased. Nevertheless, the number of individual crimes in the sphere of economic activity, which are also committed through the use of IT technologies, is growing. From the report of the Federal State Institution "Main Information and Analytical Center" of the Ministry of Internal Affairs of the Russian Federation on the state of crime in Russia for January-May 2022, it follows that the increase in the number of cases of illegal entrepreneurship compared to the same period of the previous year amounted to 46.7%, the number of detected crimes on the production, acquisition, storage, transportation or sale of goods and products without labeling and (or) the application of information provided for by the legislation of the Russian Federation increased by 10.2% compared to the previous period. Thus, we can conclude that the category of crimes we are considering remains quite common.  However, the difficulties with countering crimes in the field of economic activity committed with the help of IT technologies are not so much in the number of these offenses as in the process of proving a criminal case, including the seizure and examination of evidence (computer information, media, devices, etc.).

Due to the continued emergence of new types of criminalistically significant computer information, as well as the spread of new automated digital means of recording, storing, processing and researching evidentiary and orienting information, criminology and forensic expert science required a theoretical justification and study of the patterns of occurrence, movement and modification of computer information of interest for the purposes of investigation. According to E.R. Rossinskaya, the development of the theory of information and computer support of criminalistic activity within the framework of criminalistics and forensic expert science continues in several aspects, one of which is the doctrine of digital traces as sources of criminalistically significant computer information [2, p. 198].

The concept of digital traces is given various definitions in the works of Russian scientists. According to one of the positions, the digital footprint can be defined as "a set of information (data) about the user's visit to the information and communication network and his actions in the digital space." This option was proposed in the draft "Concept of complex legal regulation of relations arising in connection with the development of the digital economy" of the Institute of Legislation and Comparative Law under the Government of the Russian Federation. It is worth noting that in this document, when determining the digital footprint, emphasis is placed on data arising during the commission of actions in information and communication networks. At the same time, we must not forget that, for example, when investigating criminal cases in the field of economic activity, it is necessary to study various electronic documents that can be formed without the use of information and communication networks. In this regard, it can be argued that this definition narrows the concept of digital traces.

From the point of view of criminalistics and forensic expert science, the most accurate definition is given by E.R. Rossinskaya and I.A. Ryadovsky, according to whom the digital footprint is criminalistically significant computer information about events or actions reflected in the material environment, in the process of its occurrence, processing, storage and transmission [3, p. 7]. Close in meaning the definition of a digital footprint was given in the monograph by Bagmet A.M., Bychkov V.V., Skobelin S.Yu., Ilyina N.N.: "A digital footprint is any criminalistically significant computer information, i.e. information (messages, data) presented in the form of electrical signals, regardless of the means of their storage, processing and transmission" [4, p. 8].

It is worth noting that a number of researchers distinguish active and passive digital traces [5, p. 132]. At the same time, an active digital footprint is understood as a set of information that is intentionally left by the user in information networks. In turn, a passive trace is formed due to data that is left by the user unintentionally or during the operation of the software.

When investigating crimes in the sphere of economic activity, the removal of information carriers for their subsequent examination by an expert is of great importance. The most important objects for expert research by an economist are accounting and tax accounting and reporting documents, according to which it is possible to establish the facts of economic activity, as well as other circumstances of forensic significance.

In accordance with the norms of criminal law, the seizure of electronic media during the production of investigative actions requires the participation of a specialist. A specialist in the field of IT technologies, computer programs and devices is called upon to withdraw media in such a way as to preserve the information stored on them, preventing its modification, distortion or loss. In addition, this specialist can also copy (duplicate) the digital traces stored on the data carriers.

One of the most widely used automated accounting systems in Russia is the 1C system:Enterprise". In the process of using this system for accounting or tax accounting, a database is created in the form of a file 1Cv8.CD . This file can store various information system data, for example, configuration, database, etc. Through the study of these files and the databases contained in them, it is possible to obtain information about various operations, generate accounting registers or accounting statements, which allows you to establish facts of interest to the investigation.

It is not uncommon for cases when during the investigation, according to Article 201 of the Code of Criminal Procedure of the Russian Federation (Criminal Procedure Code of the Russian Federation // SZ RF. 2001. No. 52. Article 4921.), for the study of files of this type, allowing to obtain various tax and accounting data, a comprehensive forensic computer-technical expertise and judicial economic expertise. At the same time, the subject of the appointment of expertise obviously proceeds from the fact that the study of a computer file of this type in order to obtain accounting and tax accounting data is possible only with the simultaneous participation of an expert economist and an expert in IT technologies. However, is a comprehensive examination really necessary in this case? Let's consider this issue on the example of a case of investigation of a tax crime, when a database file of an automatic accounting system is submitted for examination.

When investigating tax crimes, the investigation must establish the amount of tax paid by a legal entity. The expert economist is faced with the task of determining the amount of tax that the company had to pay for a certain period, the amount of tax that the company actually paid, as well as the difference between the two indicators obtained. To solve this task, the expert needs to examine accounting documents (accounting registers and primary accounting documents), on the basis of which it is possible to determine the tax base calculated according to tax legislation. In this case, the objects of tax expertise are the above accounting documents [6, p. 53].

In the case we are considering, an expert economist can download the above documents contained in the database. However, an expert economist is not always able to independently obtain these documents (for example, in case of incorrect operation of a file or a computer information carrier). In addition, the investigation may be interested in various facts of modification of the database, the facts of changing the configuration of the database by employees of the enterprise for accounting purposes. Thus, the investigation appoints a comprehensive forensic computer-technical and judicial tax examination.

However, is the appointment of a comprehensive examination in this case justified? After all, the essential feature of a comprehensive examination is the impossibility of solving the issue without the simultaneous joint participation of experts of various types of forensic examinations in writing a conclusion and formulating a general conclusion [7, p. 15]. The solution of which of the tasks in the case under consideration requires the simultaneous application of special knowledge from various fields? During the production of forensic computer-technical expertise in order to establish the facts of modification of the database, configuration, etc., there is no need for special economic knowledge. Also, in the case of the study of accounting documents in order to verify the correctness of tax calculation, there is no need for an expert in the field of forensic computer-technical expertise to participate in this study. After all, in this case, it may only require the participation of an IT specialist who could provide access to the database of an expert economist and the presentation of accounting data in a readable form, as well as prevent accidental modification of the database file.

Nevertheless, in the presence of damaged files, incorrect operation of the software, it becomes necessary to conduct a forensic computer examination. At the same time, this task is also solved by an expert in IT technologies independently without the participation of an expert economist. It is obvious that there are no grounds for the appointment of a comprehensive examination, but there is a need for the appointment of a complex of consistently conducted examinations [8, 130].

One of the ways to copy digital traces is to create an image of the operating system. This technique allows you to fully copy not only the operating system itself, but also all settings, files, programs, configurations, etc. Having created this image with the help of specialized software, an IT specialist makes it possible to analyze accounting and tax accounting and reporting documents without compromising the information carrier itself and the digital traces contained on this carrier.

The process of researching the information contained in such an image or other computer files can also be carried out with the involvement of a specialist in the field of IT technologies. At the same time, the task of such a specialist is to provide access to the database of an expert economist and the presentation of accounting data in a readable form, to prevent accidental modification of the database file, giving the expert economist the opportunity to investigate the facts of economic life through the analysis of accounting and tax documents. However, it is not always necessary to involve a specialist when conducting an expert study of documents copied in the image of the operating system. Let's consider a similar situation in the following practical example.

According to the resolution of 03/31/2021 on the initiation of criminal proceedings No. 12102450002000177, the investigator found that the head of a limited liability company, using the details of fictitious and controlled organizations, reflected in the registers of the current accounting of a limited liability company, as well as in tax returns for value added tax, false information concerning the costs of relations with the above fictitious organizations, and also, the amount of value added tax to be paid, submitted in electronic form by means of telecommunication channels the above–mentioned tax declarations containing deliberately false information to the tax authority - the Federal Tax Service of Russia No. 18 in Moscow.

During the inspection, a specialist seized an information carrier – a computer, through which the accounting and tax accounting of the organization was carried out using a specialized accounting automation program 1C. Also, a specialist using the Oracle VM VirtualBox virtualization software product created an image of the Windows 10 operating system, copying all digital traces contained in this system, subsequently placed on an external hard disk. As you can see, the removal of the carrier and the creation of the above image was carried out by a person with special knowledge in the field of computer science and computer technology, in order to avoid loss, damage to the data stored on the carrier.

When appointing a forensic economic examination, the investigator was provided with an external hard disk containing an image of the computer's operating system, through which the fictitious operations were reflected, as well as all the files of this system. This image can be investigated using software that does not require the user to qualify as an expert in forensic computer-technical expertise, higher education in the field of cybernetics, computer science or automation. Therefore, there is no need for a specialist to participate directly in the study of these files or the appointment of a complex of examinations, an expert economist can independently use the image created by a specialist and conduct a forensic economic examination.

Thus, it can be concluded that the appointment of a comprehensive forensic computer-technical and economic expertise in the study of such objects is in most cases unnecessary, since the simultaneous joint participation of an expert economist and an expert in the field of IT technologies in writing a conclusion and formulating a general conclusion is not necessary in most cases when investigating crimes in the sphere of economic activity. As a rule, the participation of a specialist in the field of IT technologies is sufficient to withdraw computer information from the carrier and then provide this information to an expert economist for research. At the same time, an expert economist is able to work independently with software products and computer files, for the study of which there is enough well-known knowledge.

References
1. Savitskiy A.A. (2021). Topical issues of the formation and development of forensic economic and digital expertise in the context of digitalization of the social and economic sphere of the state. Laws of Russia: experience, analysis, practice, 3, 60-64.
2. Rossinskaya E.R. (2019). Theory of information and computer support of criminalistic activity: concept, system, basic patterns. Bulletin of the East Siberian Institute of the Ministry of Internal Affairs of Russia, 2(89), 193-202. doi: 10.24411/2312-3184-2019-00019
3. Rossinskaya E.R., Riadovskii I.A. (2019). The concept of digital traces in criminology. Aubakirov readings: materials of the international scientific and practical conference. Almaty, 6-8.
4. Bagmet A.M., Bychkov V. V., Skobelin S. U., Ilin N. N. (2021). Digital traces of crimes. Moscow : Prospekt. doi:10.31085/9785392328680-2021-168
5. Nikishin V. D. (2020). Digital and speech traces in terms of information (ideological) security in internet environment.Forensic science, 1(61), 131-139. doi:10.25724/VAMVD.MABC
6. Golikova V.V. (2018). The subject, objects and tasks of the forensic tax examination of settlements with the budget for the value-added tax. Courier of the Kutafin Moscow State Law University (MSAL), 7(47), 53-60. doi:10.17803/2311-5998.2018.47.7.053-060
7. Rossinskaya E.R. (2014). Methodological and legal problems of complex forensic examinations during the reform of legislation on forensic activities, Bulletin of the Moscow University of the Ministry of Internal Affairs of Russia, 6, 12-18.
8. Nersesyan M. G., Semikalenova A.I. (2011). Issues of the production of complex forensic economic and computer technical expertises which have accounting automatization software as their matter. Theory and practice of forensic science, 2(22), 128-132.

Peer Review

Peer reviewers' evaluations remain confidential and are not disclosed to the public. Only external reviews, authorized for publication by the article's author(s), are made public. Typically, these final reviews are conducted after the manuscript's revision. Adhering to our double-blind review policy, the reviewer's identity is kept confidential.
The list of publisher reviewers can be found here.

A REVIEW of an article on the topic "The appointment of complex forensic examinations in the study of digital traces in the investigation of economic crimes." The subject of the study. The article proposed for review is devoted to topical issues related to the appointment of complex forensic examinations in the study of digital traces in the investigation of economic crimes. The author considers promising areas for the development of expertise in this area, taking into account the modern digitalization of social and economic life. The subject of the study was statistical data, practice materials, and opinions of scientists. Research methodology. The purpose of the study is not stated directly in the article. At the same time, it can be clearly understood from the title and content of the work. The purpose can be designated as the consideration and resolution of certain problematic aspects of the issue of the specifics of the appointment of complex forensic examinations in cases where it is necessary to study digital traces in the investigation of economic crimes. Based on the set goals and objectives, the author has chosen the methodological basis of the study. In particular, the author uses a set of general scientific methods of cognition: analysis, synthesis, analogy, deduction, induction, and others. In particular, the methods of analysis and synthesis made it possible to summarize and share the conclusions of various scientific approaches to the proposed topic, as well as draw specific conclusions from the materials of practice. The most important role was played by special legal methods. In particular, the author actively applied the formal legal method, which made it possible to analyze and interpret the norms of current legislation (primarily the norms of the criminal procedure legislation of the Russian Federation), which are interpreted taking into account the purposes of conducting comprehensive examinations. The author of the article also actively analyzes practical examples. For example, the following arguments of the author: "According to the resolution of 03/31/2021 on the initiation of criminal proceedings No. 12102450002000177, the investigator found that the head of a limited liability company, using the details of fictitious and controlled organizations, reflected in the registers of the current accounting of a limited liability company, as well as in tax returns for value added tax, false information concerning expenses for in relation to the above–mentioned fictitious organizations, as well as the amount of value-added tax payable, submitted the above-mentioned tax declarations containing deliberately false information in electronic form via telecommunication channels to the tax authority - IFNS of Russia No. 18 in Moscow." In this regard, the possibilities of the empirical research method should be positively assessed. Thus, the methodology chosen by the author is fully adequate to the purpose of the study, allows you to study all aspects of the topic in its entirety. Relevance. The relevance of the stated issues is beyond doubt. There are both theoretical and practical aspects of the significance of the proposed topic. From the point of view of theory, the topic of conducting examinations is important and ambiguous. The author is right that digitalization affects all spheres of public life. It also concerns the commission of crimes, including the creation of new ways of committing economic crimes. When investigating them, including when appointing examinations, this point should be taken into account. The author is right to highlight this aspect of relevance. On the practical side, it should be recognized that scientifically based recommendations related to the procedure for assigning complex forensic examinations in the study of digital traces in the investigation of economic crimes may be useful to practitioners. The examples from judicial practice given by the author in the article clearly demonstrate this issue. Thus, scientific research in the proposed field should only be welcomed. Scientific novelty. The scientific novelty of the proposed article is beyond doubt. Firstly, it is expressed in the author's specific conclusions. Among them, for example, is the following conclusion: "the appointment of a comprehensive forensic computer-technical and economic expertise in the study of such objects is in most cases unnecessary, since the simultaneous joint participation of an expert economist and an expert in the field of IT technologies in writing an opinion and formulating a general conclusion is not necessary in most cases when investigating crimes in the field of economic activity. As a rule, the participation of a specialist in the field of IT technologies is sufficient to remove computer information from the media and then provide this information to an expert economist for research. At the same time, an expert economist is able to work independently with software products and computer files, for the study of which there is enough well-known knowledge." These and other theoretical conclusions can be used in further scientific research. Secondly, the author suggests ideas for generalizing the practice. In particular, "During the inspection by a specialist, an information carrier was seized – a computer through which the accounting and tax accounting of the organization was carried out using a specialized accounting automation program 1C. Also, a specialist using the Oracle VM VirtualBox virtualization software product created an image of the Windows 10 operating system, copying all digital traces contained in this system, subsequently placed on an external hard drive. As you can see, the removal of the media and the creation of the above image was carried out by a person with special knowledge in the field of computer science and computer technology, in order to avoid loss, damage to the data stored on the media." The above conclusion may be relevant and useful for practical activities in order to avoid future violations of the law, in particular, by investigators, specialists, and other entities. Thus, the materials of the article may be of particular interest to the scientific community in terms of contributing to the development of science. Style, structure, content. The subject of the article corresponds to the specialization of the journal "Police Activity", as it is devoted to legal problems related to the specifics of the investigation of economic crimes. The content of the article fully corresponds to the title, as the author considered the stated problems and achieved the research goal. The quality of the presentation of the study and its results should be recognized as fully positive. The subject, objectives, methodology and main results of the study follow directly from the text of the article. The design of the work generally meets the requirements for this kind of work. No significant violations of these requirements were found. Bibliography. The quality of the literature used should be highly appreciated. The author actively uses the literature presented by authors from Russia (Savitsky A.A., Rossinskaya E.R., Ryadovsky I.A., Bagmet A.M., Bychkov V. V., Skobelin S. Yu., Ilyin N. N. and others). Many of the cited scientists are recognized scientists in the field of criminology. I would like to note the author's use of a large number of practice materials, which made it possible to give the study a law enforcement orientation. Thus, the works of the above authors correspond to the research topic, have a sign of sufficiency, and contribute to the disclosure of various aspects of the topic. Appeal to opponents. The author conducted a serious analysis of the current state of the problem under study. All quotations of scientists are accompanied by author's comments. That is, the author shows different points of view on the problem and tries to argue for a more correct one in his opinion. Conclusions, the interest of the readership. The conclusions are fully logical, as they are obtained using a generally accepted methodology. The article may be of interest to the readership in terms of the systematic positions of the author in relation to the appointment of complex forensic examinations in the study of digital traces in the investigation of economic crimes. Based on the above, summing up all the positive and negative sides of the article, "I recommend publishing"