Digital Evidence and Computer Crime, Second Edition

6.2 Modus Operandi

Modus operandi (MO) is a Latin term that means "a method of operating." It refers to the behaviors that are committed by a criminal for the purpose of successfully completing an offense. A criminal's MO reflects how they committed their crimes. It is separate from their motives, which have to do with why they commit their crimes (Burgess 1997; Turvey 2002).

A criminal's MO has traditionally been investigatively relevant for the case linkage efforts of law enforcement. However, it is also investigatively relevant because it can involve procedures or techniques that are characteristic of a particular discipline or field of knowledge. This can include behaviors that are reflective of both criminal and non-criminal expertise (Turvey 2002).

A criminal's MO consists of learned behaviors that can evolve and develop over time. It can be refined, as an offender becomes more experienced, sophisticated, and confident. It can also become less competent and less skilful over time, decompensating by virtue of a deteriorating mental state, or increased used of mind-altering substances (Turvey 2002).

In either case, an offender's MO behavior is functional by its nature. It most often serves (or fails to serve) one or more of three purposes (Turvey 2002):

• protects the offender's identity;

• ensures the successful completion of the crime;

• facilitates the offender's escape.

Examples of MO behaviors related to computer and Internet crimes include, but are most certainly not limited to (Turvey 2002):

• Amount of planning before a crime, evidenced by behavior and materials (i.e. notes taken in the planning stage regarding location selection and potential victim information, found in e-mails or personal journals on a personal computer).

• Materials used by the offender in the commission of the specific offense (i.e. system type, connection type, software involved, etc.).

• Presurveillance of a crime scene or victim (i.e. monitoring a potential victim's posting habits on a discussion list, learning about a potential victim's lifestyle or occupation on their personal website, contacting a potential victim directly using a friendly alias or a pretense, etc.).

• Offense location selection (i.e. a threatening message sent to a Usenet newsgroup, a conversation had in an Internet Relay Chat room to groom a potential victim, a server hosting illicit materials for covert distribution, etc.).

• Use of a weapon during a crime (i.e. a harmful virus sent to a victim's PC as an e-mail attachment, etc.).

• Offender precautionary acts (i.e. the use of aliases, stealing time on a private system for use as a base of operations, IP spoofing, etc.).