Forensic examination in the investigation of cyber incidents and cyber attacks: practical cases and methodological recommendations
On October 26, 2023, the Interdepartmental Scientific and Practical Seminar “Forensic Expertise in the Investigation of Cyber Incidents and Cyber Attacks: Practical Cases and Methodological Recommendations” was held.
The event was organized and held by the Ukrainian Research Institute of Special Equipment and Forensic Science of the Security Service of Ukraine, with the participation of the National Academy of the Security Service of Ukraine, the apparatus of the National Security and Defense Council of Ukraine, the Ministry of Justice, the CyberLab (Computer Forensics) company, as well as with the informational and educational support of the Ukrainian Institute for Advanced Training of Television, Radio Broadcasting and Press Workers.
The moderator of the Interdepartmental scientific and practical seminar is Oleg Parfylo.
Opening the event, the Rector of the National Academy of the Security Service of Ukraine, Doctor of Law, Associate Professor Andrii Chernyak cited stunning data on the increase in the intensity of cyber threats and cyber attacks on Ukrainian objects, which were discovered by the department’s specialists. If in 2021 there were 1,500 such facts, then in 2022 there were three times more, and in just four months of this year there are more than four thousand cyberattacks. However, cybercriminals are not always punished, and not because it is difficult to catch them red-handed, but because of gaps in the legislation, incompetence of employees who draw up primary documents, open proceedings, and collect physical evidence. Therefore, all these and other problems require a professional approach, discussion and bringing them to a common denominator.
Deputy Secretary of the National Security Council Serhiy Demidyuk, addressing the audience with a welcome speech, called on the participants of the seminar to constructively develop the conceptual apparatus, definitions, requirements for documentation so that the evidence base of cybercrimes is not destroyed in the courts for technical or technological reasons.
The deputy director of the the Ukrainian Research Institute of Special Equipment and Forensic Science of the Security Service of Ukraine Mykola Ocheretny drew the attention of his colleagues to the fact that mass cyberattacks in Ukraine began long before the full-scale invasion of Russia on the territory of our country and caused us significant damage. However, cyber attacks, although they are identified as component of wars, unfortunately, regarding Ukraine, crimes in cyber space were not identified as military attacks and military influence, violation of humanitarian law.
However, the head of the information security and cyber security service – Head of the Department for Ensuring the Activities of the National Coordination Center for Cybersecurity , staff of the National Security and Defense Council of Ukraine, Associate Professor Nataliya Tkachuk noted that the National Security Strategy of Ukraine contains novelties regarding cyber security, and it’s important to improve not only the legal field of Ukraine for bringing cybercriminals to criminal responsibility, as well as international legislation, so that the International Criminal Court would be able to identify criminal activities in the information space as war crimes, that the head of the International Criminal Court Karim Khan noted. According to Natalia Tkachuk, more than 100,000 such war crimes have already been recorded and documented in Ukraine.
Acting Director of the Ukrainian Institute for Advanced Training of Television, Radio Broadcasting and Press Workers, Doctor of Pedagogical Sciences, Secretary of the National University of Ukraine, Honored Journalist of Ukraine Glib Golovchenko reminded the audience that during the previous scientific and practical conference on detection and protection against malicious computer programs, the issue of recording and documenting crimes, their examinations, since the judicial perspective of punishing crimes in the information sphere depends on the quality of the primary work. Therefore, the scientific and practical seminar should equip specialists and workers of the information sphere with the necessary knowledge.
The speakers of the Interdepartmental scientific and practical seminar, in particular, the executive director of the “Laboratory of Computer Forensics” Serhii Denysenko explained the legal and methodological problems in the conclusions of computer and technical examinations of electronic communications, the deputy head of the Department CERT-UA of the Administration of the State Service of Special Communications and Information Protection of Ukraine Yevhen Brixin told about the peculiarities of the analysis of digital data of the Windows operating system during the investigation of cyber incidents.
Leading Ukrainian experts presented interesting reports for cyber experts, demonstrated appropriate techniques for detecting unauthorized interventions by cybercriminals, and extremely productive special discussions took place.
The quintessence of the discussion of the mega-topical Interdepartmental Scientific and Practical Conference is the opinion that the fight against cybercrime, which is developing at a frantic pace, is not effective enough due to the lack of a system to neutralize it not only in Ukraine, but in the world as a whole. And this is despite the fact that Ukraine is practically a global battlefield with a surge of cybercrime. Oleg Plahotniuk, Associate professor of the Department of notary, enforcement and advocacy, prosecutor’s office, judiciary of the Educational and Scientific Institute of Law of Taras Shevchenko National University of Kyiv., stated this while explaining the procedural aspects of the investigation of cybercrimes by units. And from the report of Yevhen Vladimirov, an employee of the National Academy of Security Service of Ukraine, on the justification of the organizational and legal foundations of cyber defense of Ukraine, it becomes obvious that in fact the world is currently faced with such a powerful battlefield as cyberspace, with the technologies of cyber wars, which, by the way, are recognized by NATO as a form of military aggression, and finally, as the speaker said, it is now easier to hide physically on planet Earth than in the information field.