Interpol and Drone Investigation
INTERPOL Framework for Responding to a Drone Incident for First Responders & Digital Forensic Practitioners
“Many law enforcement officers still lack awareness and understanding of drone technologies. Drones pose a significant threat to public safety and security if abused. It is therefore crucial that officers are equipped with the necessary knowledge and training to respond to drone incidents safely and effectively. Furthermore, drones contain valuable data which need to be extracted and analysed to provide evidence to support an investigation.
INTERPOL engages with drone experts drawn from law enforcement, the private sector and academia across the world. This network was the driving force behind the creation of the INTERPOL Framework for Responding to a Drone Incident – For First Responders and Digital Forensics Practitioners.”
Jürgen Stock
INTERPOL Secretary General
“I am pleased to present the INTERPOL Framework for Responding to a Drone Incident – For First Responders and Digital Forensics Practitioners.
This Framework provides an overview of drones and associated devices, first responder guidance for responding to a drone incident, and guidance for digital forensic practitioners responsible for the acquisition, examination, analysis, and presentation of drone digital evidence.
This framework will hopefully contribute to closing the gap in knowledge of global law enforcement on drones, as well as increase the capacity of global law enforcement – particularly first responders and digital forensics practitioners – to safely and effectively respond to a drone incident”
Anita Hazenberg
Director, INTERPOL Innovation Centre
Key questions to be considered when investigating drone offences
What are the facts to be establish?
- Location of offence.
- Time and date of offence.
- Have the pilot and other suspects been identified and detained?
- What was the purpose of the drone flight?
- Was there an intended target? If so, who/what was it and what was the intention of the drone operator?
- Who and where is the pilot and associated suspects.
First Responder Guidance
This guidance has been created to maximize potential investigational avenues, and ensure the safety of the investigator and general public.
Crime Scene Processing Sequence
- Initial Response & Receipt of Information
- Safety Procedures
- Emergency Care
- Secure and Control Persons at the Scene
- Boundaries: Identify, Establish, Protect and Secure
- Turn Over Control of the Scene & Brief Investigator(s) in Charge
- Document Actions and Observations
- Establish a Command Post & Make Notifications
- Manage Witnesses
- Conduct Scene Assessment
- Conduct Scene Walk-Through and Initial Documentation
- Note-Taking and Logs
1. Initial Response & Receipt of Information
Principle:
One of the most important aspects of securing the crime scene is to preserve the scene with minimal contamination and disturbance of the physical evidence. The initial response to an incident should be expeditious and methodical.
Policy:
The initial responding officer(s), upon arrival, shall assess the scene and treat the incident as a crime scene. They shall promptly, yet cautiously, approach and enter the crime scene, remaining observant of any persons, vehicles, events, potential evidence, and environmental conditions.
Summary:
It is important for the initial responding officer(s) to be observant when approaching, entering, and exiting a crime scene. The initial responders should ensure the safety of law enforcement personnel and the general public located in or near the crime scene.
2. Safety Procedures
Principle:
The safety and physical well-being of officers and other individuals in and around the crime scene are the initial responding officer(s’) priority.
Policy:
The initial responding officer(s) arriving at the scene shall identify and control any dangerous situations or persons.
Summary:
The control of physical threats will ensure the safety of officers and others present.
3. Emergency Care
Principle:
After controlling any dangerous situations or persons, the initial responding officer(s’) next responsibility is to ensure that medical attention is provided to injured persons while minimizing contamination of the scene.
Policy:
The initial responding officer(s) shall ensure that medical attention is provided with minimal contamination of the scene.
Summary:
Assisting, guiding and instructing medical personnel during the care and removal of injured persons will diminish the risk of contamination and loss of evidence.
4. Secure and Control Persons and Potential Evidence at the Scene
Principle:
Controlling, identifying, and removing persons at the crime scene, and limiting the number of persons who enter the crime scene is an important function of the initial responding officer(s) in protecting the crime scene.
Policy:
The initial responding officer(s) shall identify persons at the crime scene and control their movement.
Summary:
Controlling the movement of persons at the crime scene and limiting the number of persons who enter the crime scene is essential to maintaining scene integrity, safeguarding evidence, and minimizing contamination.
5. Turn Over Control of the Scene and Brief Investigator(s) in Charge
Principle:
Briefing the investigator(s) taking charge assists in controlling the crime scene, helps establish
further investigative responsibilities and assists with the managing of resources.
Policy:
The initial responding officer(s) at the scene shall provide a detailed crime scene briefing to the investigator(s) in charge of the scene.
Summary:
The scene briefing is the only opportunity for the next in command to obtain initial aspects of the crime scene before subsequent investigation.
6. Document Actions & Observations
Principle:
All activities conducted and observations made at the crime scene must be documented as soon as possible after the event to preserve information.
Policy:
The initial responding officer(s) shall maintain documentation as a permanent record.
Summary:
The initial responding officer(s) at the crime scene must produce clear, concise, documented
information encompassing their observations and actions. This documentation is vital for later investigation and court processes.
7. Establish a Command Post
(Incident Command System) & Make Notifications
Principle:
Setting up a location where crime scene investigation activities can be coordinated, media meetings can be held, and team meetings can occur is very valuable. This command post provides a central location for crime scene investigation activities and an assessment of resources. Establishing a command post also helps to ensure that other key investigative participants are told of the investigation and included in activities as needed.
Policy:
The investigator(s) in charge shall set up a location where crime scene investigation activities can be coordinated, media meetings can be held, and team meetings can occur.
Summary:
The establishment of a command post is critical to the communication among the crime scene responders. Dispatch and others providing information to the crime scene responders.
8. Manage Witnesses
Principle:
The timely interviewing of witnesses is crucial to the solution of a crime.
Policy:
The investigator(s) in charge shall identify and secure witnesses to crimes, interview them at the scene, if applicable, and process them according to departmental regulations.
Summary:
Scene assessment allows for the development of a plan for the coordinated identification, collection, and preservation of physical evidence and identification of witnesses. It also allows for the exchange of information among law enforcement personnel and the development of investigative strategies.
9. Conduct Scene Assessment
Principle:
Assessment of the scene by the investigator(s) in charge allows for the determination of the type of incident to be investigated and the level of investigation to be conducted.
Policy:
The investigator(s) in charge shall identify specific responsibilities, share preliminary information, and develop investigative plans in accordance with departmental policy, and local, state, and federal laws.
Summary:
Scene assessment allows for the development of a plan for the co-ordinated identification, collection, and preservation of physical evidence and identification of witnesses. It also allows for the exchange of information among law enforcement personnel and the development of investigative strategies.
10. Boundaries: Identify, Establish, Protect & Secure
Principle:
Defining and controlling boundaries provides a means for protecting and securing the crime scene(s). The number of crime scenes and their boundaries are determined by their location(s) and the type of crime. Boundaries are established beyond the initial scope of the crime scene(s) with the understanding that the boundaries can be reduced in size if necessary but cannot be as easily expanded.
Policy:
The initial responding officer(s) at the scene shall conduct an initial assessment of the extent of the crime scene(s) and then establish and control its boundaries.
Summary:
Establishing boundaries is a critical aspect of controlling the integrity of evidentiary material.
IMPORTANT NOTE:
Persons should NOT smoke, use the telephone or bathroom, eat or drink, move any items from the scene including weapons (unless necessary for the safety and well-being of persons at the scene), adjust the thermostat or open windows or doors (maintain scene as found), touch anything unnecessarily (note and document any items moved), reposition moved items within the established boundaries of the scene.
Do not allow a suspect to use bathroom facilities, or to alter his/her appearance, including brushing hair or washing hands.
11. Conduct Scene Walk-Through & Initial Documentation
Principle:
The scene walk-through provides an overview of the entire scene, identifies any threats to sceneintegrity, and ensures the protection of physical evidence. Written and photographic documentation provides a permanent record. A walk-through should only be completed if there will be no disturbance of the evidence. There may be the need for the immediate documentation and collection of evidence before
the walk through.
Policy:
The investigator(s) in charge shall conduct a walk-through of the scene. The walk-through shall be conducted with individuals responsible for processing the scene.
Summary:
Conducting a scene walk-through provides the investigator(s) in charge with an overview of the entire scene. The walk-through provides the first opportunity to identify valuable and fragile evidence, and determine initial investigative procedures, providing for a systematic examination and documentation of the scene. Written and photographic documentation records the condition of the scene as first observed, providing an important permanent record.
12. Note-Taking and Logs
Principle:
Note-taking and logs provide a permanent record of crime scene activities.
Policy:
All personnel assigned to the crime scene investigation shall maintain notes and logs of their activities.
Summary:
Note-taking and an entry/exit log record the persons present at a crime scene for investigative and prosecutorial purposes.