"Prove what you are not doing yourself, try proving innocence", discovered what the police said in confession by the remote controlled virus case of iesys.exe

ByWallie-The-Frog

"There was a chocolate cake in the kitchen. You were next to that. The cake is gone. There is chocolate around your mouth. Who took it? I have not eaten. You are the same as you now"The police said," furthermore, "the analysts have no knowledge of referrers", "analysts do not understand that it is" Google Analytics ", such as expert group A verification report that has been made clear of lack of understanding / knowledge shortage of cyber crime countermeasure center, the cyber crime prevention center of so-called police headquarters life cyber crime prevention center, so-called "cyber center" personnel is published on Kanagawa prefectural police official website .

(PDF file) Results of verification of problems of police investigation etc. in case of suspected jamming of power to Yokohama municipal elementary school
http://www.police.pref.kanagawa.jp/pic2/b0999_01.pdf

※ Although it was deleted from the police official website at the end of December 2012,Continue to download on this pageIt has become.

It is 20 page in all, and as a report of this hand it is very easy to read, and various things are written clearly. The police himself also said "I confirmed that there was no wireless LAN facility at Mr. Ko's house"Since "IP address = culprit" is not, careful investigation is necessarySo, it turned out that the recognition itself was not wrong at the initial stage.


However, it has become strange since the arrest warrant has started to investigate and, for example, for the case that a trace that wrote a letter of intimidation letter was not found from the hard disk, the cyber center that should be an expert "As a result of examination, it was judged that trace was not left by creating intimidation wording using the external recording medium or cloud and erasing the traceBy this reasoning every person will be able to create a blackmail letter. Originally "should search for the external recording medium and the cloud!", But why did not investigate for some reason without thoroughly going through, "what will not investigate what what?" It has become obvious that it was appropriately done depending on the mood of the police.

In addition, the cyber center does not consider the possibility of using original remote control software such as "iesys.exe" or remote control virus at all, "Cyber ​​Center checked that there was no infection as a result of carrying out the virus check inside Mr. K 's PC using antivirus softwareIt has become and has become.


More than anythingI doubt that there is only one second between the storage of the cash related to browsing the homepage of Yokohama City and the storage of the cash related to viewing the submission content confirmation screen, and for such a short time I asked if there was a way to enter letters inBy saying that, hereCSRFAlthough it was able to prevent a false accident if it knows about the method of, it is revealed in this report that there was no knowledge of it.

If you look only at the above part, you can just say "Mistakes due to not thoroughly investigating methods", "Cause of lack of knowledge and skills", but the problem is the contents of actual interrogation. Specific statements that have not been clarified in the past coverage have been revealed one after another.

◆ Testimony of a 19-year-old victim of what he was told by the interrogation

○ "If you are rejecting it, you will be sent to a public prosecutor and if you stay as it is, you will enter" hospital ". There is evidence. "This case is not a case like entering the hospital." "It comes to trial when it comes to a prosecutor, and a lot of people come to see it, it will be reported as a real name."

○ Since I was shown to the interrogation officer in advance, I knew the handle name etc. I explained my reasoning quickly. With my own background, I wrote about motive.

○ Although he insisted that there was no history on the homepage of Yokohama City, he said, "You can erase history yourself."

○ There was a chocolate cake in the kitchen There was you beside you There was no cake There is chocolate around your mouth Who has eaten I am not eating I am not eating, It is the same as that. "

○ "Prove what you do not do for yourself, try proving innocence".

○ I said "I am funny to say that it is 2 seconds, I want you to investigate", but then, there was no tone.

In response to the above testimonies, the investigator's opinion is as follows and it turns out that the story of "chocolate cake" was a routine means.

◆ Testimony of the police investigator who conducted the interrogation

○ The interrogator who thought that Mr. A who was arrested for the first time on July 2 th will be concerned about future procedures will write a line on a blank paper on future criminal procedures, and on the arrest date, to the public prosecutors office , A detention day of 10 days, a further 10 days of detention with the permission of the judge for a total of 20 days, after which the family court entered a 4-week classification center as a custody measure, Explanation that the referee commencement date was decided, to explain that he will receive juvenile judgment, and Ms. Ka answered that because there was a question about juvenile training school and probation observation. Furthermore, there is a system called backward delivery, sometimes trial just like an adult, and that it explains that anyone in the trial can listen freely.

○ In the interrogation of July 4, when the interrogator asked Mr. A who approved the crime about the meaning of the handle name "Kishi gunstuff", Mr. Kaka saw "Kishimaru" at a convenience store In the name of the sake which is called "gun storage", it marks the ominous figure 13 and puts it in "Junpu" and translated it in the Supreme Report, and as for the origin of the handle name, the number 13 is ominous , That Judas, the thirteenth disciple of Christianity, betrayed it.

○ In the interrogation of July 13, Mr. A noted that there is no history of browsing to Google and Yokohama from the Internet browsing history shown, but the interrogator can delete the browsing history is Hodogaya Since hearing from the investigation executive, it explains that the browsing history can be deleted by oneself.

○ On the interrogation of the morning of July 4, the interrogating official asked Mr. A, "My mother prepared a chocolate cake for the snack at 3 o'clock, someone picked it up and the mother asked the child who picked it up. The child answered "I am not me" while chocolate is attached around the mouth.The mother talks to the effect that when I look at it it said, "You know who pinched and eaten." about.

○ In the interrogation of July 9, because Mr. Kawaii was facing downwards, the interrogator asked, "Even if I heard it, even if I heard it, I just do not remember" I do not remember. "Why do not you explain that" I did not do it for this reason? "

○ In the interrogation of July 13, the analysis result of the cyber center indicated by the interviewer (Internet browsing history and browser's cache used by Mr. Ka) was informed that Mr. A can not drive in 2 seconds In response to the request, the interrogator thinks that it can be done in the same way as it can send sentences with attached files at the time of sending mail, save the intimidation in advance and send it as an attached file, it can be done for 2 seconds, Explaining that there are other methods, etc.

The reflection and lessons of the Kanagawa prefectural police who came out receiving this whiplashic explanation are as follows.

◆ reflections and lessons learned by the police obtained from the above

○ The explanation of the series of criminal procedures for Mr. A, who had no experience of interrogation by the police, may have promoted anxiety entering juvenile training schools.

○ The question that I asked about the meaning of the "hand-picked gobo" of the handle name that I went to ask for a statement directly linked to judgment of criminality was that I should have done more carefully.

○ The analogy of the chocolate cake is one that the interrogator used to adhere to a juvenile who denies it in other cases, as necessary, but by forcing this kind of parable, forced to self-confess There was a possibility that it was accepted as if there was, and more careful consideration was needed.

○ The behavior of the interrogator asking Mr. A, who is disapproving of himself, to specifically explain what he is not committing is a juvenile in particular, and he may possibly have confused Mr. Ka who was innocent There are, and it is recognized that it falls under the supervised action.
* 6 Activated by supervision means inappropriate interrogation conducted by a police officer against suspects, as stipulated in the regulation on supervision for proper interrogation of interrogators (Regulation No. 4 of the National Public Safety Commission of 2008) It refers to the following acts that may possibly occur.
① Except for unavoidable circumstances, contact with the body.
② To exercise tangible force directly or indirectly.
③ To make yourself to feel uneasy or to be puzzled even more.
④ Unjustly requesting to take a certain attitude or action.
⑤ Offering or promising to provide or provide for convenience.
⑥ To act to severely harm the human dignity.

○ The interrogator explains the possibility of being able to transmit in 2 seconds by other methods, but in order to elucidate the unnatural communication history, the questioner from Mr. Ka should be resolved Was it.

In short, it is content that admits that the interrogation was very inappropriate.

Also,"I did not undertake concrete underpinning investigation"And it is written as follows.

Mr. Ka makes an affirmation that he acknowledges the fact that he sent the intimidation sentence in the Supreme Court created by himself, and describes "motive for criminal act", "means method", "content of intimidation sentence", "origin of handle name", etc. ing. Although Hodogaya station explained the origin of the handle name more specifically, even though Mr. Ka further strengthened the anxiety that Mr. Ka is a culprit, regardless of its backing investigation, the crime motivation, the method of means, We did not conduct detailed backing investigation such as listening to parents, friends, etc. to support the statement. Although a concrete and characteristic expression is described in the actual intimidation sentence, it is not consistent with the concrete expression described by Mr. Ko in the written report.

It also describes in detail what kind of specific backing investigation did not exist.

(A) Even in the interrogation of July 13, we have not conducted an investigation to solve unnaturalness against the question about "driving in 2 seconds" indicated by Mr. A.

(A) At the interrogation of July 17, the interviewer asked us to look up the three central URLs from Mr. Ka regarding the cash history, the interrogator said heard that the contents of the three URLs are not known at Cyber ​​Center I did not report Mr. Ka's assertion to my boss and confirmed or inquired about the headquarters.

(C) On July 11, at the Hodogaya station, from Mr. Hino, pointed out that "There is no possibility that things that third parties are doing, such as remote control, viruses, stepping stones, etc." Hodogaya officer explained that "No virus was detected from Mr. Kazu's personal computer", he does not report Mr. Hin's point to his boss and does not confirm or refer to the headquarters.

In other words, although he was actively pursuing "investigating to black" to collect evidence that "he must be the culprit", despite the fact that as many as there are unnatural things come out, a culprit It is because there was not done "investigation to make it to Shi" to counter that there was. "I do not punish suspicionThis report shows that the police are conducting practically far apart from the situation.

As long as there is only one meaning, it is a very well done report so thinking about the possibility of future recurrence prevention measures is also greatly written, and as you read through it, it means that "the future recurrence prevention measures" So, there were items to worry about as below.

(1) Strengthen analysis functions in cyber crime investigation

(A) In order to thoroughly manage systematically in the analysis work, after clarifying the location of responsibility concerning confirmation of contents at each stage of analysis and judgment of return method to the site, the involvement of each class executive in accordance with the lightness of the case In addition to reviewing the operation management system in the cyber analysis department, such as establishing an analysis guidance team (tentative name), etc.

A) In order to improve the analytical ability of analysts, strengthen cooperation with private enterprises, etc. with personnel exchanges with the Information and Communication Department and advanced technology, and strengthen instructional curriculum in the analysis field as a whole.

In addition to establishing the cyber crime countermeasure section (provisional name), consider a part-time commission for technical persons etc. of private companies.

I do not feel the premonition that the "cyber crime countermeasure section (tentative name)" is going to be a new celestial destination for the private sector, but the above contents do not have any measures to prevent recurrence about the interrogation. However, as I continued reading further I had the following description.

○ To give full consideration to the characteristics of the juvenile and to ensure guidance and education on interrogation that does not produce false confessions.

○ In case of a denial case or a case where the suspects' statements have been transitioning, thoroughly conduct an investigation (so-called "investigation to shiro") to counteract the suspect being a criminal.

(5) Improvement of interrogation technology etc. based on the characteristics of juveniles

In the interrogation of the juvenile, in order to conduct interrogation with keen inquiry in mind that it has strong inductivity, implications and compliance, we will establish a new juvenile interrogation discipline and designate "juvenile inspector (tentative name)". Also, in addition to strengthening cooperation with juvenile training division juvenile counselors, we regularly hold workshops etc. with lecturers such as child welfare workers, clinical psychologists and doctors etc, to understand the characteristics of juveniles and to communicate with juveniles Improve.

In short, this time the false confession caused by forced interrogation is said to be caused by "characteristics of the boy", and a word such as "visualization of interrogation", "to record in video", "attendance by a lawyer" It was not done.

Even if you can catch the author of iesys.exe as it is, the fundamental police will not be changed at all in this case, so similar cases will always be repeated, and every time There is a high possibility that people who are not doing anything will be treated as a criminal.

In other words, anytime, anywhere, even by me, you and me, the possibility that it will be unfortunately destroyed life has been left largely. Rather than solving the fundamental problem, it is very disappointing that only policy to keep police members' preference as symptomatic therapy is given priority.

2012/12/14 21:04 Addendum
The Metropolitan Police Department, the Osaka Prefectural Police Department, and the Mie Prefectural Police Department also publish similar materials.

About the problem of police investigation etc. on the crime notice notice using the Internet etc. [PDF]
(PDFファイル)http://www.keishicho.metro.tokyo.jp/image/20121214.pdf
* Since it is protected, you can not copy character strings

Osaka prefectural police | Verification result of crime notice · virus use cases using the Internet
http://www.police.pref.osaka.jp/15topics/kensyou.html

Verification result of the crime notice · virus use case using the Internet (case of disturbance of power work to Ise shrine)
(PDFファイル)http://www.police.pref.mie.jp/wp/wp-content/uploads/kensyo.pdf

※ Although it was deleted from the police official website at the end of December 2012,Continue to download on this pageIt has become.