C. Creating Specialized Cybercrime Units The investigation of cybercrime and forensic analysis of e- evidence and the prosecution of cybercrime require specific skills (see section 2 D, below). Authorities—investigatory, prosecutorial, judicial and advisory—should be supported in the setting up or strengthening of units that offer specialized support. Relatedly, mechanisms for assuring feedback and information sharing among agencies and units must be developed. Particular attention should be paid to assuring that there is sufficient expertise among law enforcement authorities. Particular points of interest include (1) police-type cybercrime or high-tech units with strategic and operational responsibilities, (2) prosecution-type cybercrime units and (3) most generally, developing computer forensic resources for other law enforcement agencies that may not be created with the goal of tackling cybercrime, by either embedding small specialized units within, or by creating separate structures, or, at minimum, by creating focal points and procedures for looping specialized units into matters, wherever appropriate. Because cybercrime is not a “siloed” area of concern, it should be expected that even non-specialized units will have to be able to utilize e-evidence in non-computer crime, physical-world cases. As such, while certain tasks will necessarily require handling by trained specialists, many impediments could be prophylactically overcome by having these specialized units disseminate their knowledge and skills to the entirety of their agencies; indeed, in many case, knowledge dissemination might merely entail spreading awareness. Beyond the law enforcement authorities, the judiciary should also have a place of recourse for matters of cybercrime. However, unlike with law enforcement authorities, setting up specialized cybercrime courts is not a preferable solution because the near-ubiquity of e-evidence means that all judges will have to consider such matters, regardless of the nature of the case in question. Good practices have shown that a better first step is to train some judges, and to use those judges as focal points for acting as a resource and disseminating knowledge more widely. More generally, it is important that interagency cooperation be facilitated and actively encouraged. Such a unifying and integrative element is essential, as, to be effective, cybercrime units must cooperate both with other police services (such as economic crime units, child protection units) and with other institutions (such as financial intelligence units, CIRTs). Conclusion To support cybersecurity is to support and increase society’s ability to grow more robustly and more equitably. Cybercrime capacity-building is an essential element therein. And while resource-scarcity is a concern for all governments and institutions, it is generally—and increasingly—recognized that cybercrime capacity-building programs cannot be left unattended. Reasons for supporting cybercrime capacity-building include the great and growing reliance of society writ large on ICTs, Page 50 | Chapter 1 | § D. Framework for a Capacity-building Program Table of Contents