Cyber Crime and Cyber Terrorism

cycle
FIGURE 4.2
The SARA process cycle.

---

37
 
Investigative innovation
Of course, knowledge and experience of previous cases will also greatly assist in 
constructing relevant hypothesis. Generating and building hypotheses is an obvious 
and natural activity for cyber investigators, particular during the early stages of an
investigation. Clearly, if there is sufficient information or evidence already available 
then there will be no need to use the hypothesis method. However, cyber investiga-
tors are being increasingly called to establish the most basic of facts at the com-
mencement of investigations, such as whether a crime has been committed or not. 
Hypotheses are important to provide initial investigative direction where there is 
little information to work with. All cyber investigators must “keep an open mind” 
and remember that it is better to gather as much information as possible before plac-
ing too much reliance on any speculative theory (
Cook and Tattersall, 2010
). It is a 
mistake for cyber investigators to theorize before sufficient data is collected as it is 
easy to fall into the trap of manipulating and massaging facts to suit theories, instead 
of ensuring that theories suit the facts.
Cook and Tattersall (2010)
provide professional police investigative practice 
guidance which is commonly used by law enforcement officers across the world. 
Their advice, based on extensive investigative experience in the UK, includes check-
lists for consideration when building hypothesis. 
Cook and Tattersall (2010)
 recom-
mend that when developing theoretical assumptions, cyber investigators would be 
well advised to give due consideration to the following:
• Beware of placing too much reliance on one or a limited number of hypotheses 
when there is insufficient information available.
• Remember the maxim ‘keeping an open mind’.
• Ensure a thorough understanding of the relevance and reliability of any material 
relied upon.
• Ensure that hypotheses are kept under constant review and remain dynamic, 
remembering that any hypothesis is only provisional at best.
• Define a clear objective for the hypothesis.
• Only develop hypothesis that ‘best fit’ with the known information and 
material.
• Consult with colleagues and experts to discuss and formulate hypothesis.
• Ensure sufficient resources are available to develop or test the hypothesis (
Cook 
and Tattersall, 2010
, p. 45).
Progressing cyber investigations is a collaborative effort and police officers must con-
sult, listen and consider the advice and guidance provided by specialist hi-tech inves-
tigators. Any cyber investigator who ignores specialist advice does so at their peril.