Cyber Crime and Cyber Terrorism

A. 
Assume nothing
B. 
Believe nothing
C.
 
Challenge and check everything (p. 271).
All investigators, especially those progressing complex cyber investigations, must 
ensure that nothing is taken for granted and it cannot be assumed that things are 
what they seem or that processes have been performed correctly (
Caless et al., 
2012
). Looking for corroboration, rechecking, reviewing, and confirming all as-
pects of the investigation are hallmarks of an effective cyber detective, and shall 

---

34
CHAPTER 4
Police investigation processes
ensure that no potential line of enquiry is overlooked during a dynamic and fast-
moving cyber investigation.
INVESTIGATIVE PROBLEM SOLVING
Essential to the core investigative skills of decision making are elements of prob-
lem solving. A logical approach to making decisions to effectively resolve problems 
within cyber investigations is demonstrated by the Cyber Investigators Staircase 
Model (CISM). Adapted for law enforcement from leadership and management 
models, the CISM contains important and sequential elements to ensure effective 
problem solving shown in 
Figure 4.1
.
The model works on the basis that it is preferable to choose a particular course of 
action out of a range of possible “options” (
Staniforth, 2014
). The basic point here is 
that a cyber investigator should not assume there is only one option available, there 
are always alternatives, especially in cyber investigations which have a tendency to 
quickly gather large volumes of data. Information lies at the heart of an investigation 
and gathering sufficient information helps to populate the number of options which 
can then be worked through a decision making processes as to which option is the 
most compelling.
In order to gather and collect information to satisfy the requirements of Step 2 
on the CISM, a set of interrogative pronouns, commonly known in the law enforce-
ment field as the “5
×
WH 
+
H” method—Who, What, When, Where, Why 
+
How 
can be put to good use (
Cook and Tattersall, 2010
). This formula helps to organize