Main Body
Chapter 3: Scenario
To provide relevance to the material that follows in this book, we start with a hypothetical scenario that a detective may encounter. There is a lot of technology referenced directly and indirectly, many of which will be unknown to investigators in the first instance. They will have to find this evidence through traditional and innovative thinking and work on the evidence as they progress.
Although this scenario involves serious criminal offences, which a detective will investigate, consider the technology referenced and think about how this technology may assist any investigation you are involved in. As this scenario evolves, the investigator may find the technical evidence works well for them, and in other instances, it provides no help. This is similar to any investigation. You may be lucky and find many examples of evidence available to you, or luck may be on the bad guy’s side, and you cannot find anything. This is one of the less endearing features of investigations.
Experienced investigators will understand investigations rarely progress as smoothly as the investigative phase of this scenario as there are many unique circumstances in any investigation. However, the scenario is written to help you understand digital evidence, its application and its meaning rather than dealing with complex investigations that may take your investigation team in many different directions over several months.
The basic outline of the scenario is a serious crime committed in a physical rather than purely digital environment. The decision to write the scenario this way is to highlight technology is everywhere we go and can be used to solve many forms of crime, not just those committed online.
As you read the scenario, look at the locations of the activity that takes place before, during and after the major events and think about what technology you may expect to find there. The scenario directly and indirectly references technology to help you think like an investigator where you see physical and digital devices directly before you and other sources of digital evidence that may not be observed at first glance which are capable to providing valuable evidence such as computer routers and smart devices in the home or workplace.
The scenario provides a lot of leads. In real life, this is often not the case, but for simplicity and to show the abundance of digital evidence that may exist in a series of crime scenes, we include a lot of evidence. Some of these items of digital evidence are initially unknown to the investigators and will have to be uncovered through traditional investigative techniques and innovative thinking.
Chapter 14 of this book will show a suggested investigative methodology focusing on the technology components and the many considerations the investigators will face and must address. It is suggested as you read these chapters, to refer your mind back to this scenario and see how it would apply and what technology may contribute to the investigation.
The Characters
Alex Potter (Alex) is a major supplier of drugs within his neighbourhood. He has six trusted distributors, each of which also supply their own clients. On a weekly basis, his distributors attend to a different designated point for collection of the multitude of drugs they supply their clients, and on occasions when demand is higher, he will arrange extra supplies. Alex prepares the packages for distribution from his home address, which is not industry best practice, however, one which is convenient. On very rare occasions, he will allow highly trusted dealers to attend his house to collect their packages when there is an urgent delivery required such as additional demand for an event occurring.
Barry Sledgman (Sledge) is one of the distributors and has 63 clients he supplies regularly and more where he knows he is their backup dealer. He specialises in driving to his clients and providing personal service, ensuring his clients get their product regularly and safely. He is very proud of the quality of this product and customer service. Both Alex and Sledge deal in cash only and will not supply credit no matter how much people ask. He believes once he offers credit, he will be in a never-ending cycle of chasing people up for money and once they know his cash only terms, there are no problems.
Character use of technology and communication methods
Alex has his clients listed on his phone under headings such as sports and community groups. He has “Find My Friends” activated on his phone so he can keep track of who is in his neighbourhood and sometimes offers “spot deals” to clients he finds close by during the day when he has surplus stock. Sledge thinks this is very innovative in helping to clear old stock and keep his clients hooked. It has also enabled him to collect new clients from those he was the backup supplier.
Alex and Sledge communicate via WhatsApp, a secure encrypted communication application using iPhone 11. They had considered buying a specialist encrypted phone but chose to stick with the iPhone for convenience believing the secure app was sufficient for security and practicality. Also, if ever spoken to by the police, having a secure encrypted phone is a clear indicator they are up to no good whereas an iPhone 11 is a common phone.
Sledge is a huge fan of technology and uses whatever technology he can to keep track of his clients and finances. He stores his spreadsheets on a cloud service based in foreign jurisdictions believing this will make it very hard for police should they ever try and investigate him. The cloud service is encrypted, and the key is kept on an encrypted USB key he hides at home. Sledge records daily notes on his phone and updates his records at the end of his shift. These notes are firstly in the Notes application on his phone, then later updated into a Word document which is linked through his mobile devices to his cloud account. This is not particularly good practice for a drug dealer; however, he is very confident in his operational security and believes he is too smart to ever get caught, particularly since he has been dealing drugs for several years without a problem.
Sledge has the wireless and Bluetooth on his phone enacted for convenience and the Media Access Control address which uniquely identifies his phone on wireless networks has not been modified. He had recently bought an Apple smartwatch which is synced to his phone. Alex was impressed and also purchased the same smartwatch after seeing Sledge showing him how technologically advanced and convenient it was.
The situation
One day, Sledge provides his clients with their cocaine orders as usual. He is very proud of the quality of products and their purity and charges his clients accordingly. The following day, he starts getting angry messages from clients complaining of the poor batch of cocaine with several ending up in hospital emergency rooms with police questioning them about their drug habits. Subsequently, several homes were raided by police with Sledge’s clients facing charges of drug use, possession of drug utensils and their phones being seized. Several had Sledge’s phone number in their phone, which is now in the hands of the police. Even though they were all told to communicate with Sledge through WhatsApp, several have his phone number stored from the early days of their dealing before they all agreed to use encrypted apps.
Sledge is now highly stressed expecting police to visit him at any time. He is also angry he gave his clients poor-quality drugs, which has badly damaged his reputation. The local media are also reporting poor quality cocaine in the neighbourhood that Sledge services and sales have plummeted as clients dump him for their backup dealers.
Sledge blames Alex and aims to confront him and demand immediate reparation for his lost trades. Sledge fancies himself as a “hard man” not to be messed with and is keen to develop this reputation. Sledge has visions of being the major supplier in his neighbourhood and has a reputation and lifestyle to maintain.
Sledge contacts Alex through the app and unloads on Alex. He is told the deals were bad luck and not the fault of Alex. Sledge is also told to pull his head in and not make threats he cannot back up. This sends Sledge into a rage, and he starts plotting his revenge.
Sledge’s plan
Sledge commences putting a plan together to take physical revenge on Alex. He uses Google to search online websites on how to break into houses using the phrases “lock-picking houses” and “How-to cut-glass windows”. He is determined to break into Alex’s home and confront him.
Sledge also searches these terms: “How to kill someone” and “How to dispose of a body.” He spends several hours at home through his wireless network researching these terms and buys a hunting knife online using his credit card. His device is a Windows laptop.
Sledge starts observing Alex’s home and movements. He knows Alex picks up his drugs at 2 pm Monday afternoon and then distributes them to his suppliers late that evening after breaking up the packages to meet the orders. The plan is to watch the delivery and kill Alex afterwards, thus getting his revenge and all the drugs to re-establish his network. This will also strengthen his reputation in his community as a person not to be messed with.
Sledge catches a ride-share service to a neighbouring street booked over the app on his phone and walks towards Alex’s home. It is dark so he approaches Alex’s house undiscovered. He is unaware of the CCTV cameras as they are not prominent on the outside of the house and Sledge has never had reason to check the security at Alex’s house. He hides in a neighbour’s front yard directly across the road hidden by the trees, hedges, and a small fence. He can observe Alex’s house unseen. The property where he is hiding is situated at the front of the property near the street front.
Sledge watches the address, knowing Alex will be hard at work preparing that evening’s deliveries. He leaves his hiding place and walks across the road, knocking on the front door after deciding that breaking into the house was too hard. After all, Alex knows him and they have worked together for a long time and built a relationship, despite the recent problem.
Arrival at Alex’s house
Unknown to Sledge, Alex is a very technically savvy individual who fully understands the risks involved in his trade. He has a fully connected smart home with strategically hidden external CCTV, which Sledge was unaware of, and numerous Internet of Things (IoT) devices. As it is a large house, the power setting on the internal router is turned up high meaning the Service Set Identifier (SSID) can be identified several houses away. The SSID name is “Potter.”
Alex sees on the CCTV camera it is Sledge at the door and phones him to ask what he wants. Sledge says he has come to collect his weekly order as usual and makes no reference to the recent argument. As Sledge does not seem angry, Alex lets him in. Alex also has a Ring smart door lock. He does not notice Sledge is carrying a bag, and even so, as he was collecting his order, this would not have created concern. Alex said he was angry Sledge had come to his house as this was a major breach of safety protocol. Sledge stated this was because he had some early orders to satisfy.
The crime
Once inside, Sledge started complaining about the poor-quality cocaine and demanded full compensation and extra product he could use to get his clients back. An argument developed which quickly became physical when Alex refused. Sledge pulled the knife and swung it at Alex shouting his name. The home assistant Amazon Alexa heard the name Alex mispronounced by Sledge and activated awaiting instructions.
Sledge killed Alex in a rage and left a bloody scene. Sledge was covered in blood and there was damage across the room. Sledge knew he could not leave like this and went to clean himself up after putting all the drugs into his carry bag. He had a shower in Alex’s bedroom ensuite.
Sledge opened the fridge, which was connected to the home assistant and took out a bottle of water, as he was highly dehydrated after killing Alex. He showered and put his clothes in the washing machine, which was also Internet-connected. The smart water meter records the increased use of water. Sledge took the opportunity to walk through the house and take items that he liked. The smart home sensors monitored his movements, turning on lights as he moved throughout the house. All movement through the home is recorded on the smart home assistant which acts as a hub.
Sledge finds Alex’s phone and uses Alex’s clean finger to log in. He uses this same method to log into Alex’s bank account and transfers the balance into Sledge’s personal account. This was already registered with the bank due to an old transaction several years ago.
Sledge decides to take Alex’s car and finds the keys. He opens the garage door, which is connected to the smart house. He then locks the front door, which is a smart lock. The car is a late model with a lot of connected technology. To calm his nerves, Sledge connects his phone to the car and turns up his music. The car is connected to the home Wi-Fi to allow regular updates of the vehicle’s control units.
Sledge drives away, unaware the car has a GPS tracking device installed, as Alex had enacted the GPS and registered it with the manufacturer shortly after purchase. Sledge goes home and begins contacting his clients offering new deals and bonus drugs. He washes his clothes again.
Due to a lack of movement, Alex’s smart house identifies no one is home and turns the lights off. Alexa also turns itself off.
The following day
The following day, Sledge takes the car to a mate who rebirths stolen vehicles. They negotiate a price that will be paid in cash with the plan to return and dismantle the car in a couple of days as Sledge is enjoying driving it and does not want to give it away too quickly.
Sledge logs onto his Facebook page and posts a comment: “Loose ends tied up. Time to step things up a bit. A new boss is in town.”
Amongst the property Sledge originally took from Alex’s house was his laptop. Sledge had opened it using Alex’s fingerprint. He changed the access password and wrote it down on a piece of paper he placed in his home office desk drawer. Sledge logged onto Alex’s computer using his home router and started viewing the private messages on Alex’s Facebook and identified he had a cloud account no one knew about. Sledge downloaded all the documents he could find onto his USB for later viewing. Sledge also changed the access passwords to the cloud accounts and stored these on his USB that he used to access his own cloud accounts, congratulating himself for making long, hard-to-break passwords.
In an attempt to cover his tracks, Sledge posted several comments on Alex’s Facebook page and liked several random images. Sledge identified Alex’s suppliers and decided to phone them tomorrow and take over Alex’s business.
Sledge was feeling anxious about the killing and decided to go back to the house and cover his tracks. Using Alex’s car, he drove back and used the remote to access the house and opened the smart house using the app on Alex’s phone. He found the house as he had left it. He decided to move the body, so placed it in the back of the car and left in the same manner as previously. He drove through the city towards a forest, taking several toll roads to speed things up before the early morning traffic started. He disposed of Alex in a forest of trees that had been planted as a local council clean air initiative and returned to his home, arriving just before the sun started to rise. As he pulled into his house, he was grateful for having an automatic remote synced to his phone which allowed him access to the house without having to get out of Alex’s car.
Sledge started to feel confident now. He had disposed of Alex’s body and was certain that no one had seen him. He had valuable property from Alex to pawn and a new car to sell to his vehicle rebirthing mates. He also had a supply of drugs and Alex’s Deal book. He was confident, that once he disposed of the car, there was no evidence linking him to the disappearance of Alex and planned on advancing his criminal enterprise.
Sledge was also preparing to take over Alex’s distribution network and logged into his cloud server looking for the spreadsheets but could not find them. This was a different cloud service, so he spent more time on the unfamiliar site than he planned, however, he felt this was important. Sledge felt he had to pay more attention to detail now.
Sledge placed his phone and watch on charge and started working through the drugs he had taken. He had a large supply network to deal with and started making contact with people with Alex’s phone advising them he was the new boss, and that they would no longer have to deal with Alex. As Sledge became more confident, he decided to keep Alex’s car for a week to send a message to those who had doubts that Sledge was the new boss.
The girlfriend
Jenny, the girlfriend of Alex, arrived home and found a major disturbance had occurred in the house. Alex is missing and there was a large amount of blood on the floor. In a panic, she runs through the house and discovers her jewellery has been stolen along with her designer handbags. She calls Alex’s number and there is no reply. She did not know that Sledge saw her name come up on the phone’s screen and thought better about answering it. Although Jenny knew Alex was heavily involved in the drug trade and was averse to any dealings with the police, she looked at the large pool of drying blood on the floor and knew no person could have survived that amount of blood loss. She phones the police and awaits their arrival.
As mentioned in the introduction, this is an oversimplified representation of a serious crime. Experienced investigators will have recognized many leads they can immediately start working on whilst the scene examination is undertaken. However, the following chapters will introduce the numerous forms of digital evidence identified in this scenario, as well as other potential formats and discuss how they can be applied to the investigation.
Chapter 14 presents an example of a full investigation from the time of arrival of the detectives through to the arrest and prosecution of the suspect through the eyes of the detectives as they identify and assimilate the evidence and discount that which leads them into false lines of inquiry.
