Appointment of comprehensive forensic examinations in case of the study of digital traces in the investigation of economic crimes

Buinov Dmitrii Olegovich Postgraduate, Department of Forensic Science, Kutafin Moscow State Law University 125993, Russia, Moscow, Moscow, Sadovaya-Kudrinskaya str., 9 buinovdmitrii@mail.ru

The ongoing process of digitalization of economic relations undoubtedly brings positive results, such as simplification and cheapening of the document flow accompanying the entire process of economic activity; creation of the latest business models that are mutually beneficial for both the manufacturer of goods and services and its customers, etc. Along with these processes, the types of evidence that can be considered by the court in resolving economic disputes are also changing. In connection with the digital transformation of the economy and law, fundamentally new, previously unknown categories of assets and transactions with them appear, which determines the development of forensic expertise ^{[1, p. 60]}. Computer information of economic content is of great evidentiary value in civil law processes – when considering civil and arbitration disputes between organizations and citizens. However, in the context of the topic under study, we will focus on the digital traces investigated in the investigation of crimes in the field of economic activity.

In recent years, the number of crimes committed using information technology, including the Internet, has been steadily growing. With the beginning of a special military operation of the Armed Forces of the Russian Federation on the territory of Ukraine, the number of such crimes has sharply decreased. Nevertheless, the number of individual crimes in the sphere of economic activity, which are also committed through the use of IT technologies, is growing. From the report of the Federal State Institution "Main Information and Analytical Center" of the Ministry of Internal Affairs of the Russian Federation on the state of crime in Russia for January-May 2022, it follows that the increase in the number of cases of illegal entrepreneurship compared to the same period of the previous year amounted to 46.7%, the number of detected crimes on the production, acquisition, storage, transportation or sale of goods and products without labeling and (or) the application of information provided for by the legislation of the Russian Federation increased by 10.2% compared to the previous period. Thus, we can conclude that the category of crimes we are considering remains quite common.  However, the difficulties with countering crimes in the field of economic activity committed with the help of IT technologies are not so much in the number of these offenses as in the process of proving a criminal case, including the seizure and examination of evidence (computer information, media, devices, etc.).

Due to the continued emergence of new types of criminalistically significant computer information, as well as the spread of new automated digital means of recording, storing, processing and researching evidentiary and orienting information, criminology and forensic expert science required a theoretical justification and study of the patterns of occurrence, movement and modification of computer information of interest for the purposes of investigation. According to E.R. Rossinskaya, the development of the theory of information and computer support of criminalistic activity within the framework of criminalistics and forensic expert science continues in several aspects, one of which is the doctrine of digital traces as sources of criminalistically significant computer information ^{[2, p. 198]}.

The concept of digital traces is given various definitions in the works of Russian scientists. According to one of the positions, the digital footprint can be defined as "a set of information (data) about the user's visit to the information and communication network and his actions in the digital space." This option was proposed in the draft "Concept of complex legal regulation of relations arising in connection with the development of the digital economy" of the Institute of Legislation and Comparative Law under the Government of the Russian Federation. It is worth noting that in this document, when determining the digital footprint, emphasis is placed on data arising during the commission of actions in information and communication networks. At the same time, we must not forget that, for example, when investigating criminal cases in the field of economic activity, it is necessary to study various electronic documents that can be formed without the use of information and communication networks. In this regard, it can be argued that this definition narrows the concept of digital traces.

From the point of view of criminalistics and forensic expert science, the most accurate definition is given by E.R. Rossinskaya and I.A. Ryadovsky, according to whom the digital footprint is criminalistically significant computer information about events or actions reflected in the material environment, in the process of its occurrence, processing, storage and transmission ^{[3, p. 7]}. Close in meaning the definition of a digital footprint was given in the monograph by Bagmet A.M., Bychkov V.V., Skobelin S.Yu., Ilyina N.N.: "A digital footprint is any criminalistically significant computer information, i.e. information (messages, data) presented in the form of electrical signals, regardless of the means of their storage, processing and transmission" ^{[4, p. 8]}.

It is worth noting that a number of researchers distinguish active and passive digital traces ^{[5, p. 132]}. At the same time, an active digital footprint is understood as a set of information that is intentionally left by the user in information networks. In turn, a passive trace is formed due to data that is left by the user unintentionally or during the operation of the software.

When investigating crimes in the sphere of economic activity, the removal of information carriers for their subsequent examination by an expert is of great importance. The most important objects for expert research by an economist are accounting and tax accounting and reporting documents, according to which it is possible to establish the facts of economic activity, as well as other circumstances of forensic significance.

In accordance with the norms of criminal law, the seizure of electronic media during the production of investigative actions requires the participation of a specialist. A specialist in the field of IT technologies, computer programs and devices is called upon to withdraw media in such a way as to preserve the information stored on them, preventing its modification, distortion or loss. In addition, this specialist can also copy (duplicate) the digital traces stored on the data carriers.

One of the most widely used automated accounting systems in Russia is the 1C system:Enterprise". In the process of using this system for accounting or tax accounting, a database is created in the form of a file 1Cv8.CD . This file can store various information system data, for example, configuration, database, etc. Through the study of these files and the databases contained in them, it is possible to obtain information about various operations, generate accounting registers or accounting statements, which allows you to establish facts of interest to the investigation.

It is not uncommon for cases when during the investigation, according to Article 201 of the Code of Criminal Procedure of the Russian Federation (Criminal Procedure Code of the Russian Federation // SZ RF. 2001. No. 52. Article 4921.), for the study of files of this type, allowing to obtain various tax and accounting data, a comprehensive forensic computer-technical expertise and judicial economic expertise. At the same time, the subject of the appointment of expertise obviously proceeds from the fact that the study of a computer file of this type in order to obtain accounting and tax accounting data is possible only with the simultaneous participation of an expert economist and an expert in IT technologies. However, is a comprehensive examination really necessary in this case? Let's consider this issue on the example of a case of investigation of a tax crime, when a database file of an automatic accounting system is submitted for examination.

When investigating tax crimes, the investigation must establish the amount of tax paid by a legal entity. The expert economist is faced with the task of determining the amount of tax that the company had to pay for a certain period, the amount of tax that the company actually paid, as well as the difference between the two indicators obtained. To solve this task, the expert needs to examine accounting documents (accounting registers and primary accounting documents), on the basis of which it is possible to determine the tax base calculated according to tax legislation. In this case, the objects of tax expertise are the above accounting documents ^{[6, p. 53]}.

In the case we are considering, an expert economist can download the above documents contained in the database. However, an expert economist is not always able to independently obtain these documents (for example, in case of incorrect operation of a file or a computer information carrier). In addition, the investigation may be interested in various facts of modification of the database, the facts of changing the configuration of the database by employees of the enterprise for accounting purposes. Thus, the investigation appoints a comprehensive forensic computer-technical and judicial tax examination.

However, is the appointment of a comprehensive examination in this case justified? After all, the essential feature of a comprehensive examination is the impossibility of solving the issue without the simultaneous joint participation of experts of various types of forensic examinations in writing a conclusion and formulating a general conclusion ^{[7, p. 15]}. The solution of which of the tasks in the case under consideration requires the simultaneous application of special knowledge from various fields? During the production of forensic computer-technical expertise in order to establish the facts of modification of the database, configuration, etc., there is no need for special economic knowledge. Also, in the case of the study of accounting documents in order to verify the correctness of tax calculation, there is no need for an expert in the field of forensic computer-technical expertise to participate in this study. After all, in this case, it may only require the participation of an IT specialist who could provide access to the database of an expert economist and the presentation of accounting data in a readable form, as well as prevent accidental modification of the database file.

Nevertheless, in the presence of damaged files, incorrect operation of the software, it becomes necessary to conduct a forensic computer examination. At the same time, this task is also solved by an expert in IT technologies independently without the participation of an expert economist. It is obvious that there are no grounds for the appointment of a comprehensive examination, but there is a need for the appointment of a complex of consistently conducted examinations ^{[8, 130]}.

One of the ways to copy digital traces is to create an image of the operating system. This technique allows you to fully copy not only the operating system itself, but also all settings, files, programs, configurations, etc. Having created this image with the help of specialized software, an IT specialist makes it possible to analyze accounting and tax accounting and reporting documents without compromising the information carrier itself and the digital traces contained on this carrier.

The process of researching the information contained in such an image or other computer files can also be carried out with the involvement of a specialist in the field of IT technologies. At the same time, the task of such a specialist is to provide access to the database of an expert economist and the presentation of accounting data in a readable form, to prevent accidental modification of the database file, giving the expert economist the opportunity to investigate the facts of economic life through the analysis of accounting and tax documents. However, it is not always necessary to involve a specialist when conducting an expert study of documents copied in the image of the operating system. Let's consider a similar situation in the following practical example.

According to the resolution of 03/31/2021 on the initiation of criminal proceedings No. 12102450002000177, the investigator found that the head of a limited liability company, using the details of fictitious and controlled organizations, reflected in the registers of the current accounting of a limited liability company, as well as in tax returns for value added tax, false information concerning the costs of relations with the above fictitious organizations, and also, the amount of value added tax to be paid, submitted in electronic form by means of telecommunication channels the above–mentioned tax declarations containing deliberately false information to the tax authority - the Federal Tax Service of Russia No. 18 in Moscow.

During the inspection, a specialist seized an information carrier – a computer, through which the accounting and tax accounting of the organization was carried out using a specialized accounting automation program 1C. Also, a specialist using the Oracle VM VirtualBox virtualization software product created an image of the Windows 10 operating system, copying all digital traces contained in this system, subsequently placed on an external hard disk. As you can see, the removal of the carrier and the creation of the above image was carried out by a person with special knowledge in the field of computer science and computer technology, in order to avoid loss, damage to the data stored on the carrier.

When appointing a forensic economic examination, the investigator was provided with an external hard disk containing an image of the computer's operating system, through which the fictitious operations were reflected, as well as all the files of this system. This image can be investigated using software that does not require the user to qualify as an expert in forensic computer-technical expertise, higher education in the field of cybernetics, computer science or automation. Therefore, there is no need for a specialist to participate directly in the study of these files or the appointment of a complex of examinations, an expert economist can independently use the image created by a specialist and conduct a forensic economic examination.

Thus, it can be concluded that the appointment of a comprehensive forensic computer-technical and economic expertise in the study of such objects is in most cases unnecessary, since the simultaneous joint participation of an expert economist and an expert in the field of IT technologies in writing a conclusion and formulating a general conclusion is not necessary in most cases when investigating crimes in the sphere of economic activity. As a rule, the participation of a specialist in the field of IT technologies is sufficient to withdraw computer information from the carrier and then provide this information to an expert economist for research. At the same time, an expert economist is able to work independently with software products and computer files, for the study of which there is enough well-known knowledge.