Cybercrime Training Competences Framework
First Responders
Actor Description
It is important to distinguish between “first responder'' training and a ‘'first responder'' actor as described below.
“First responder'' training is expected for all law enforcement operational profiles.
A first responder actor refers to law enforcement officers that are the first to get in contact with potential electronic evidence. Patrol police officers, detectives, border and tax controllers are all examples of first responders. The first responder is an essential actor within the forensic process and can influence the efficiency and effectiveness of criminal investigations.
These actors require basic knowledge of digital forensics tools and practices, including live data forensics, as well as general awareness and knowledge about cybercrime.
This group should benefit from training on up-to-date electronic evidence good practices and use of dedicated tools. An understanding on what traces may be recovered by a specialised forensic examiner and how these traces may contribute to further investigation will facilitate communication and reporting. The first responder should also be able to ask crime related questions and provide basic advice to a victim of a crime facilitated by use of new technologies.
Method : Training requirements
Standards and best practices in electronic evidence identification and seizing
Basic live data forensics acquisition
Basic knowledge on digital forensics (tools, techniques, methods and best practices), including internet technology, the darkweb and cryptocurrencies
Crime scene management
Interview techniques
General cybercrime awareness