UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 11.9 Free with a free account
How Police and Federal Agencies Investigate and Prosecute Crimes Committed Online
Ethics in Technology · Chapter 11: Secure Tunnels, Digital Rights, and Intellectual Property in a Connected WorldSection 11.9 · lesson 66 of 11615 min · free with a free account
Free preview
Create a free account to keep watching
It takes a minute and costs nothing. Your free account unlocks all of Chapter 1 and 3 more lessons of Ethics in Technology.
Lesson complete
Earn the 3 college credits for Ethics in Technology
Enrolling adds a quiz after each lesson, the graded work and the official transcript. Recommended for credit by NCCRS.
Next lesson: What Cyberstalking Looks Like, How It Escalates, and Why It Is Dangerous →← The Laws That Protect Your Personal Data and Control How Organizations Use ItNext lesson: What Cyberstalking Looks Like, How It Escalates, and Why It Is Dangerous →
In this lesson
Jurisdiction, trustworthy evidence, constitutional limits, and international cooperation.
- Identify overlapping investigative, reporting, regulatory, and national security roles.
- Explain the forensic sequence, documented custody, and integrity checks.
- Apply Riley and Carpenter, with the June 2026 Chatrie update.
- Compare cross-border evidence routes and assess lawful ways to reduce delay.
Free study notes
Get this lesson's notes by email
The key points and 4 practice questions with answers, in your inbox. One email, free.
One email. Unsubscribe in one click.
Transcript
Everything said in the video, section by section (1,724 words). Read along, or search it.
Chapter 11
Investigating Online Crime
Online investigations involve the conduct, victims, evidence, and laws, rather than a single universal cybercrime agency. Several organizations may therefore have legitimate, overlapping responsibilities. We will distinguish investigation, complaint reporting, regulatory enforcement, prosecution, and national security work. Digital forensics helps preserve and evaluate evidence through documented methods. Custody records and integrity checks allow an opposing party to challenge findings. They support reliability, but do not make every recorded statement true. We will examine the Fourth Amendment and two landmark digital-evidence cases. A June twenty twenty-six Supreme Court decision adds a newer location-data development. Cross-border records require appropriate authority and cooperation, not simply technical access. Encryption, retention, volume, attribution, and changing systems create further obstacles. The ethical problem is improving investigation while preserving privacy, trustworthy evidence, and accountable state power.
Who Investigates
Jurisdiction Follows the Conduct and Applicable Law
Jurisdiction follows the applicable conduct and law, rather than the technology alone. The FBI investigates major intrusions, national security threats, and other federal offenses. Child exploitation also involves dedicated FBI programs, rather than only one cyber unit. The Secret Service investigates cyber-enabled financial crimes, payment fraud, and related threats. Its Cyber Fraud Task Forces combine investigators, prosecutors, technical experts, and other partners. IC three is the FBI’s complaint reporting and analysis center, not an independent police agency. Its annual reports aggregate submitted complaints and losses, rather than measuring every cybercrime. State and local units address offenses such as stalking, harassment, fraud, and identity theft. Their trained staffing and technical capacity vary substantially. Sector regulators address securities, consumer, or health-data obligations under their own authority. Military and intelligence organizations perform different national security functions, rather than ordinary criminal prosecution. A retailer intrusion can involve FBI, Secret Service, state, and securities inquiries, each with distinct legal limits.
Forensic Process
Five Stages Create Evidence That Others Can Evaluate
A useful forensic sequence is identify, preserve, analyze, document, and present. Documentation and custody tracking continue throughout, rather than starting only near the end. Identification records possible sources, device state, legal authority, and risks before uncontrolled interaction. Preservation uses an appropriate validated acquisition method and protects available original evidence. A physical forensic image can copy storage bit for bit. Logical or live acquisition captures a different scope, which must be explained. Stable physical captures can compare source and image hashes to support an accurate copy. Matching secure hashes support integrity of the particular captured data that were hashed. They do not prove who created a file or whether its contents are true. Analysis normally uses protected working copies, with tools, versions, actions, and limitations recorded. Documentation explains findings and methods so others can review and reproduce appropriate steps. Presentation communicates conclusions clearly and allows scrutiny, including expert questioning and cross-examination.
Custody and Integrity
Record Who Handled the Evidence, When, and What They Did
Chain of custody records who handled evidence, when, where, and what they did. It includes transfers, storage, access, and actions affecting originals or copies. Preserved originals and controlled working copies help support reliable re-examination. Avoidable changes should be minimized, while justified live interactions must be explained. An active device can change continuously, so literal claims of zero change are misleading. An undocumented custody interval creates an opportunity to question authenticity or alteration. It does not automatically require every court to exclude everything. An uncontrolled laptop boot can change timestamps, logs, temporary files, or other stored information. Defense counsel can ask which findings depend on those changes and what baseline was preserved. A recorded boot is an integrity concern, rather than necessarily an undocumented transfer. The court evaluates authentication, reliability, admissibility rules, and evidentiary weight in context.
Technical Obstacles
Knowing Where Evidence Might Be Does Not Guarantee a Reliable Acquisition
Five technical obstacles recur in digital evidence work. Volatile memory, connections, and short-lived logs may disappear if devices or conditions change. Some lost information cannot be recreated, making expert preservation choices important. Volume creates long searches, substantial cost, and disputes about justified scope. A phone can contain years of messages, photos, locations, and application records. Encryption can prevent readable access even when legal authority exists. Recovery depends on the system and available keys; neither success nor impossibility is universal. Data jurisdiction becomes complicated when the provider, storage, user, and investigator occupy different countries. Authority over one organization does not automatically compel another country. Applications, file systems, and tools also change, requiring validated methods and stated limitations. Finally, neither a warrant nor an image hash establishes every fact about a record’s meaning or author.
Fourth Amendment
Riley and Carpenter Apply Constitutional Protection to Digital Evidence
The Fourth Amendment prohibits unreasonable searches and seizures. A warrant generally requires probable cause, neutral review, and particular description of the authorized search. In twenty fourteen, Riley addressed phones seized incident to arrest. Their enormous quantity and variety of information differ from a wallet-like physical container. Police generally need a warrant to examine their digital contents. Securing a device differs from reading it, and recognized case-specific exceptions remain. In twenty eighteen, Carpenter addressed historical cell-site location records held by carriers. The Court treated qualifying acquisition as a search, generally requiring a probable-cause warrant. Comprehensive retrospective tracking can expose private movements despite third-party storage. MetroPCS produced one hundred twenty-seven days of records, while Sprint produced two days. Sprint’s request covered seven days, and Carpenter held seven days of acquisition sufficient to constitute a search. That holding did not make all shorter requests automatically exempt. The Court limited the third-party doctrine for this category, rather than abolishing it for every business record.
Dated Legal Update
Chatrie in June 2026 Addresses Google Location History and Shorter Collection
A newer decision must be distinguished from Carpenter’s original twenty eighteen boundaries. On June twenty-ninth, twenty twenty-six, the Supreme Court decided Chatrie. Police had obtained Google Location History through a multi-step geofence process. The Court held that acquiring Chatrie’s location information was a Fourth Amendment search. Selecting a short interval from a comprehensive location database did not remove the privacy interest. Ordinary phone-service use did not automatically surrender protection for this information to government access. However, finding a search does not resolve whether that search was reasonable. The Court remanded questions about the warrant’s particularity and probable-cause adequacy at its various stages. It did not declare every geofence warrant universally valid or invalid. Later decisions refine particular data categories, rather than supplying one answer for every digital record. Compelled passcodes remain a separate Fifth Amendment question, not a result established by these search cases.
Cross-Border Evidence
Three Cooperation Routes Have Different Authorities and Limits
Cross-border evidence can involve treaty assistance, qualified direct process, and convention cooperation. An MLAT provides government-to-government assistance under the applicable treaty. The requested country reviews and acts under its own authority, while treaty conditions differ. Multiple steps can take months or years, risking loss through retention expiry. The twenty eighteen CLOUD Act clarified reach over covered providers subject to American jurisdiction. Valid process reaches data in their possession, custody, or control, regardless of storage location. This does not compel a foreign sovereign or eliminate competing legal restrictions. Qualifying executive agreements remove specified barriers for covered direct orders under the issuing country’s authority. They require serious-crime, rights, targeting, and oversight safeguards. Qualifying foreign orders cannot target American persons or people located in the United States. An agreement does not itself establish jurisdiction over every provider. The two thousand one Budapest Convention supplies defined offenses, compatible powers, cooperation, and urgent contact points. Its broad participation does not override every domestic rule or make nonparties automatically bound.
Structural Difficulties
Fast Data Movement Meets Different Legal Systems and Technical Realities
Five structural difficulties connect the international and technical problems. First, data cross borders instantly, while obtaining lawful authority can take much longer. Second, a valid demand in one country may encounter disclosure restrictions in another. Third, apparent attack origins can be compromised intermediaries, rather than the offender’s actual location. Fourth, readable access may remain impossible without keys the provider does not possess. Fifth, records can expire before the appropriate legal process is complete. For European-stored records, consider treaty assistance and valid process to a covered provider under American jurisdiction. Also consider a qualifying agreement route where available and applicable convention cooperation. Identify control, jurisdiction, conflicting obligations, urgency, and lawful preservation possibilities. The server address alone does not choose the correct mechanism. Nonparties need other arrangements, and no cooperation framework guarantees every request can be answered.
Compelled Passcode Scenario
Authority to Search and Authority to Compel Testimonial Help Are Separate
Consider an encrypted phone seized during an arrest, with probable cause linking it to fraud. The investigator must obtain appropriately scoped lawful search authority. The individual’s Fourth Amendment interest concerns the extensive private information in the phone. Seizure at arrest does not, by itself, authorize examining all its contents. Compelling the owner to reveal a memorized passcode raises a different issue. The Fifth Amendment protects against compelled incriminating testimonial communication. The government may argue that relevant facts are already established under a foregone-conclusion theory. Courts differ about its application to passcode disclosure, device decryption, and the required prior knowledge. Revealing a code, entering it, producing specific files, and using biometrics need not receive identical analysis. Riley and Carpenter reinforce digital privacy interests, but neither decides this compelled-testimony dispute. A valid search warrant therefore must not be treated as an automatic answer to compelled self-incrimination.
Speed and Safeguards
Improve Procedures While Preserving Legal Authority and Review
Digital offenses can occur much faster than the investigation and legal process that follow. Judicial review, probable cause, and documented handling deliberately constrain state power. However, unnecessary administration, limited resources, and technical obstacles also create delay. It is inaccurate to attribute every delay solely to constitutional safeguards. A proposal to remove safeguards should explain the privacy and accountability costs it creates. Better coordination can clarify agency authority and avoid incompatible duplicate demands. Efficient electronic warrant procedures and available judicial review can reduce avoidable waiting. Lawful preservation requests can protect available records while the required disclosure process proceeds. Preservation does not itself authorize reading or disclosing everything retained. Validated forensic capacity and appropriate international arrangements can address additional bottlenecks. The goal is effective, justified investigation, rather than treating speed alone as proof of legality or fairness.
Review and Application
Five Questions Test Jurisdiction, Reliability, Privacy, and Cooperation
For review, first explain overlapping authority after a retailer’s payment-card intrusion. Separate federal intrusion and financial-crime roles, state protections, and possible securities-disclosure enforcement. Second, explain why booting a laptop before preservation can weaken particular findings. Identify changes, baseline limitations, documentation, authentication, and weight without assuming automatic exclusion. Third, explain Carpenter’s reasoning and its limit on the third-party doctrine. Qualifying location records expose comprehensive retrospective movements, rather than merely isolated information voluntarily shared. Fourth, compare routes to European-stored evidence using jurisdiction, control, treaty terms, safeguards, and retention. Fifth, assess ways to reduce delay while preserving accountable search authority. Agency coordination, lawful preservation, efficient review, capacity, and cooperation address different problems. Keep custody, evidence meaning, lawful search, compelled testimony, and foreign disclosure authority analytically distinct. Trustworthy investigation requires both reliable methods and justified limits on how state power obtains the evidence.
About Ethics in Technology at UPI Study
Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.
Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Enroll now → Course details Download the syllabus All Computer Science courses
Compare: Cybersecurity vs Ethics in Technology · Which ethics course?
Why take it here
Why students take Ethics in Technology with UPI Study
Where the credit goes
Universities that work with NCCRS
Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Thomas Edison State UniversitySigned partner
University of the PeopleSigned partner
Charter Oak State CollegeSigned partner
Strayer UniversitySigned partner
Columbia Southern UniversitySigned partner
Indiana TechSigned partner
Penn StateWorks with NCCRS
Southern New Hampshire UniversityWorks with NCCRS
SUNYWorks with NCCRS
+many more cooperating universitiesFind my college →Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.
FAQ
Questions students ask us
About How Police and Federal Agencies Investigate and Prosecute Crimes Committed Online
Which federal agencies investigate cybercrime in the United States?
What is chain of custody in digital forensics?
Do police need a warrant to search a cell phone or its location records?
What is the CLOUD Act?
About the Ethics in Technology course
How many college credits is Ethics in Technology?
How much does Ethics in Technology cost and what is included?
Which universities accept UPI Study credits?
How long does Ethics in Technology take?
How are the exams done?
How do my credits reach my college?
Ready for the full course? Earn 3 credits in Ethics in Technology.
116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.
3 credits · NCCRSEnroll →