Criminal Activity Training for Staff

MANDATORY TRAINING FOR ALL TEAM MEMBERS

1. INTRODUCTION AND SCOPE

1.1. Purpose of This Training

This training document provides guidance for all Team members on recognising, responding to and managing criminal activity within our community. Team members must be prepared to identify potential criminal activity and respond appropriately. They must comply with legal obligations whilst protecting community members and maintaining platform integrity.

1.2. Integration with Existing Policies

This training operates within our safety and legal compliance framework:

(a) Community Code of Conduct: Behavioural expectations and community safety standards.

(b) Content and Moderation Policy: Enforcement procedures and content restrictions.

(c) Crisis Response Policy: Emergency response procedures for safety concerns.

(d) Child Safety Policy: Procedures for protecting minors and reporting child exploitation.

(e) Legal Compliance Requirements: Mandatory reporting obligations and legal responsibilities.

(f) Staff Handbook: General staff responsibilities and expectations.

1.3. Critical Disclaimer

REMEMBER: WE ARE NOT LAW ENFORCEMENT PROFESSIONALS

We cannot conduct criminal investigations or make legal determinations.
Our role is limited to recognition, immediate response, evidence preservation and appropriate escalation.
We must maintain clear professional boundaries and avoid interfering with law enforcement investigations.
When in doubt, escalate immediately to senior staff and appropriate authorities.

WHO TO CONTACT: Escalate all suspected criminal activity to Naomi directly on Discord straight away.

Legal reporting obligations may require immediate action regardless of uncertainty.
Do not attempt to investigate or confront suspected criminals.

2. UNDERSTANDING CRIMINAL ACTIVITY IN ONLINE COMMUNITIES

2.1. Types of Criminal Activity

2.1.1. Violent Crimes and Threats (IMMEDIATE ACTION REQUIRED)

Threats of Violence:

Direct threats of physical harm to individuals or groups
Threats of mass violence or terrorism
Threats involving weapons or explosives
Threats targeting specific individuals or locations
Threats made in response to conflicts or disputes

Stalking and Harassment:

Persistent unwanted contact that causes fear
Tracking or monitoring of individuals without consent
Threats combined with unwanted contact
Pattern of harassment that escalates to threats
Cyberstalking behaviours targeting community members

Doxxing and Privacy Violations:

Unauthorised release of personal identifying information
Publishing addresses, phone numbers or other private information
Attempts to locate or identify individuals without consent
Sharing information intended to enable harassment or harm
Coercion through threat of information release

2.1.2. Financial Crimes (ESCALATE WITHIN 15 MINUTES)

Fraud and Scams:

Phishing attempts targeting community members
Advance fee fraud schemes
Investment scams and Ponzi schemes
Romance scams and catfishing
Impersonation for financial gain

Money Laundering:

Suspicious financial transactions or requests
Attempts to move funds through community platforms
Requests for payment in unusual forms (gift cards, cryptocurrency)
Patterns suggesting money laundering operations
Connections between accounts suggesting criminal networks

Theft and Identity Theft:

Unauthorised access to accounts or information
Identity theft attempts
Credit card fraud or unauthorised charges
Account takeover attempts
Social engineering for financial gain

2.1.3. Cybercrime (ESCALATE WITHIN 15 MINUTES)

Hacking and Unauthorised Access:

Attempts to gain unauthorised access to systems
Distribution of hacking tools or instructions
Account compromise attempts
Malware distribution
Denial of service attack planning or execution

Data Breaches:

Unauthorised access to user data
Attempts to extract or sell user information
Breaches of platform security
Distribution of stolen credentials
Sale of compromised accounts

Online Exploitation:

Sextortion schemes
Revenge porn distribution
Non-consensual image sharing
Coercion through digital means
Exploitation of vulnerable individuals

2.1.4. Illegal Content Distribution (ESCALATE WITHIN 15 MINUTES)

Copyright Infringement:

Distribution of pirated software, media or content
Large-scale copyright violation operations
Commercial piracy activities
Distribution of cracked software or media
Organised piracy networks

Illegal Material:

Distribution of illegal drugs or substances
Sale of illegal goods or services
Distribution of weapons or weapon components
Human trafficking indicators or advertisements
Other illegal goods or services

2.1.5. Extremism and Terrorism (IMMEDIATE ACTION REQUIRED)

Terrorist Content:

Content promoting or glorifying terrorism
Recruitment materials for terrorist organisations
Instructions for carrying out attacks
Threats of terrorist activity
Material supporting designated terrorist organisations

Extremist Activity:

Content promoting violent extremism
Recruitment for extremist groups
Planning or coordination of extremist activities
Distribution of extremist propaganda
Radicalisation attempts targeting community members

2.2. Recognising Criminal Activity Patterns

2.2.1. Behavioural Indicators

Suspicious Communication Patterns:

Rapid account creation and deletion
Use of multiple accounts for similar purposes
Evasive responses to questions about identity or purpose
Inconsistent information across interactions
Attempts to avoid verification or identification

Coordination Indicators:

Multiple accounts coordinating activities
Organised campaigns or operations
Network of accounts working together
Rapid spread of criminal content or schemes
Patterns suggesting organised criminal activity

2.2.2. Content Indicators

Red Flag Language:

Requests for personal or financial information
Pressure to act quickly or keep things secret
Requests to move conversations to private platforms
Offers that seem too good to be true
Threats or coercion attempts

Suspicious Requests:

Requests for money or financial assistance
Requests for personal identifying information
Requests to share accounts or credentials
Requests to participate in suspicious activities
Requests to keep activities secret from others

3. IMMEDIATE RESPONSE PROCEDURES

3.1. Violent Crimes and Threats Response Protocol

IMMEDIATE ACTIONS (Within 5 minutes):

DO NOT DELAY: Threats of violence require immediate action.
PRESERVE EVIDENCE SAFELY: Screenshot text communications and record user IDs, message links and timestamps. Never copy sexual imagery of a minor or intimate images shared without consent (see Section 3.6).
ESCALATE IMMEDIATELY: Notify Naomi and senior staff in staff chat.
DO NOT CONFRONT: Do not directly confront suspected perpetrators.
PROTECT TARGETS: Make sure potential targets are notified and protected.
DOCUMENT EVERYTHING: Record all relevant information whilst it is fresh.
CONTACT AUTHORITIES: Report to law enforcement if the threat appears credible.

Example Response Template:

URGENT CRIMINAL ACTIVITY CONCERN: THREAT OF VIOLENCE

[Brief description of threat]
[User IDs involved]
[Platform/channel where threat occurred]
[Time and date]
[Target information if known]
[Screenshots attached]

Escalating immediately to Naomi and senior staff.
Law enforcement notification recommended.

3.2. Financial Crimes Response Protocol

ACTIONS (Within 15 minutes):

PRESERVE EVIDENCE: Document and preserve all relevant communications and transactions.
PROTECT VICTIMS: Notify potential victims and provide support resources.
REMOVE CONTENT: Remove fraudulent content from public view immediately.
ESCALATE: Notify Naomi and senior staff.
DOCUMENT: Create full documentation of the incident.
REPORT: Report to appropriate authorities (FBI Internet Crime Complaint Center, local law enforcement).
FOLLOW UP: Make sure appropriate follow-up actions are taken.

Example Response Template:

CRIMINAL ACTIVITY CONCERN: FINANCIAL FRAUD

[Description of fraudulent activity]
[User IDs involved]
[Platform/channel where activity occurred]
[Time and date]
[Victim information if known]
[Screenshots and evidence attached]

Escalating to Naomi. Reporting to appropriate authorities.

3.3. Cybercrime Response Protocol

ACTIONS (Within 15 minutes):

SECURE SYSTEMS: Take immediate steps to secure affected systems.
PRESERVE EVIDENCE: Document all evidence of cybercrime activity.
PROTECT USERS: Notify affected users and provide security guidance.
ESCALATE: Notify Naomi and the technical team immediately.
DOCUMENT: Create full documentation of the incident.
REPORT: Report to appropriate cybercrime authorities.
MITIGATE: Take steps to prevent further damage or spread.

3.4. Illegal Content Distribution Response Protocol

ACTIONS (Within 15 minutes):

REMOVE CONTENT: Immediately remove illegal content from public view.
RECORD EVIDENCE SAFELY: Record links, user IDs and timestamps for authorities rather than copying the content itself. Follow Section 3.6 for sexual imagery.
ESCALATE: Notify Naomi and senior staff.
DOCUMENT: Create full documentation of the incident.
REPORT: Report to appropriate authorities (copyright holders, law enforcement).
FOLLOW UP: Make sure appropriate follow-up actions are taken.

3.5. Extremism and Terrorism Response Protocol

IMMEDIATE ACTIONS (Within 5 minutes):

DO NOT DELAY: Extremist content requires immediate action.
REMOVE CONTENT: Immediately remove extremist content.
PRESERVE EVIDENCE: Document and preserve all evidence.
ESCALATE: Notify Naomi and senior staff immediately.
REPORT: Report to appropriate counter-terrorism authorities.
PROTECT COMMUNITY: Take steps to protect community members from radicalisation.
DOCUMENT: Create full documentation.

3.6. Sexual Imagery of Minors and Non-Consensual Intimate Images

Staff must never screenshot, download, copy, forward or re-upload sexual imagery of a minor, or intimate images shared without the subject’s consent, even as evidence. Doing so can be a criminal offence and causes further harm to the person depicted.

STOP VIEWING: Stop viewing the content as soon as you recognise it.
REMOVE: Remove or hide it with the platform’s moderation tools, without saving a copy.
RECORD: Record only user IDs, content links, channel and timestamps.
ESCALATE: Message Naomi directly on Discord straight away, and notify senior staff.
REPORT: Report through the platform’s reporting tools and to the relevant authorities.

For sexual content involving a minor, follow the full procedure in Child Safety.

4. LEGAL OBLIGATIONS AND REPORTING REQUIREMENTS

4.1. Mandatory Reporting Obligations

4.1.1. When Reporting Is Required

Legal Requirements:

Threats of Violence: Credible threats of violence must be reported to law enforcement.
Child Exploitation: Any suspected child exploitation must be reported (see Child Safety Policy).
Terrorism: Content promoting terrorism or terrorist activities must be reported.
Financial Crimes: Significant financial crimes may require reporting to financial authorities.
Cybercrime: Serious cybercrime may require reporting to cybercrime units.
Data Breaches: Data breaches may require reporting to data protection authorities.

Jurisdictional Considerations:

Reporting requirements vary by jurisdiction.
Some crimes require reporting in multiple jurisdictions.
International crimes may require reporting to multiple agencies.
When in doubt, consult with legal counsel and report.
Different types of crimes require reporting to different agencies.

4.1.2. How to Report

Internal Reporting:

Immediate Escalation: Notify Naomi and senior staff immediately.
Documentation: Provide full documentation of concerns.
Follow Procedures: Follow established internal reporting procedures.
Coordination: Coordinate with other Team members as appropriate.

External Reporting:

Law Enforcement: Report to local law enforcement for violent crimes and threats.
FBI Internet Crime Complaint Center (IC3): Report cybercrime and online fraud.
National Center for Missing & Exploited Children (NCMEC): Report child exploitation.
Counter-Terrorism Authorities: Report terrorism-related content.
Financial Authorities: Report significant financial crimes.
Legal Counsel: Consult with legal counsel for guidance on reporting obligations.

4.2. Documentation Requirements

4.2.1. Required Information to Document

Incident Details:

Date and Time: Exact date and time of incident or discovery
Platform and Location: Where the incident occurred
Parties Involved: All user IDs and any known identifying information
Content: Screenshots of text communications, links, logs and written descriptions of relevant content. Never copy sexual imagery of a minor or non-consensual intimate images (see Section 3.6).
Actions Taken: All actions taken in response to the incident
Evidence: All preserved evidence and documentation

Context Information:

Historical Context: Any previous interactions or concerns involving the parties
Witnesses: Any other staff or community members who witnessed the incident
Victim Information: Information about any victims (whilst respecting privacy)
Risk Assessment: Assessment of immediate and ongoing risk
Follow-up Plans: Planned follow-up actions and monitoring

4.2.2. Evidence Preservation

Preservation Requirements:

Screenshots: Take screenshots of relevant text content and records immediately. Never screenshot, download or save sexual imagery of a minor or non-consensual intimate images. Record links, IDs and timestamps instead.
Logs: Preserve all relevant logs and system records.
Communications: Preserve all relevant communications and messages. Do not preserve sexual imagery of a minor or intimate images shared without consent, even where they appear inside a message, log or backup. Record links, user IDs and timestamps instead (see Section 3.6).
Metadata: Preserve metadata when possible (timestamps, IP addresses and similar).
Chain of Custody: Maintain clear chain of custody for all evidence.

Legal Considerations:

Admissibility: Preserve evidence in a way that maintains admissibility.
Privacy: Balance evidence preservation with privacy requirements.
Retention: Follow legal requirements for evidence retention.
Access Controls: Limit access to evidence to authorised personnel only.
Legal Holds: Preserve evidence when legal action is possible.

5. ESCALATION PROCEDURES

5.1. When to Escalate

ALWAYS ESCALATE IMMEDIATELY:

Any threat of violence
Any suspected child exploitation
Any terrorism-related content
Any credible threat to community safety
Any significant financial crime
Any serious cybercrime
Any situation where you feel uncertain about the appropriate response

5.2. How to Escalate

Internal Escalation:

Staff Chat Alert: Post an urgent alert in staff chat with @security-coordinator.
Direct Contact: Contact Naomi directly on Discord.
Senior Staff Notification: Notify senior staff and leadership immediately.
Documentation: Provide all documentation and context immediately.
Follow Instructions: Follow any specific directions from senior staff.

Emergency Escalation:

Immediate Danger: Contact emergency services if there is immediate physical danger.
@Naomi Alert: Alert @Naomi immediately for critical situations.
Legal Counsel: Consult legal counsel for guidance on reporting obligations.
External Authorities: Report to appropriate law enforcement or regulatory agencies.

5.3. Escalation Chain

Standard Escalation:

Naomi
Senior Staff / Leadership
Legal Counsel (if needed)
External Authorities (as required by law)

Emergency Escalation:

Emergency Services (if immediate physical danger)
Naomi
Senior Staff / Leadership
Legal Counsel
External Authorities

6. COMMUNICATION AND COORDINATION

6.1. Communicating with Victims

6.1.1. Victim Support

Do:

Believe and Validate: Believe victims and validate their experiences.
Provide Support: Connect victims with appropriate support resources.
Explain Process: Explain what will happen next in clear language.
Maintain Privacy: Respect victim privacy and confidentiality.
Provide Resources: Share resources for reporting to authorities and getting help.

Do Not:

Do Not Investigate: Do not attempt to conduct your own investigation.
Do Not Promise Outcomes: Do not promise specific outcomes or consequences.
Do Not Minimise: Do not minimise the seriousness of the crime.
Do Not Blame: Do not suggest the victim did anything wrong.
Do Not Share Details: Do not share details about actions taken against perpetrators.

6.1.2. Resource Connection

Support Resources:

Law Enforcement: Information about reporting to law enforcement
Victim Support Services: Connect with victim support organisations
Legal Resources: Information about legal options and resources
Counselling Services: Connect with counselling and mental health resources
Financial Recovery: Resources for financial crime victims

6.2. Coordinating with Authorities

6.2.1. Law Enforcement Cooperation

When Working with Law Enforcement:

Follow Legal Requirements: Comply with all legal requirements and orders.
Preserve Evidence: Make sure all evidence is properly preserved.
Provide Information: Provide requested information within legal boundaries.
Maintain Boundaries: Maintain appropriate boundaries and avoid interfering with investigations.
Document Interactions: Document all interactions with law enforcement.

Legal Considerations:

Warrants and Subpoenas: Comply with legal warrants and subpoenas.
Privacy Rights: Balance compliance with user privacy rights.
Legal Counsel: Consult legal counsel when dealing with law enforcement requests.
Documentation: Maintain documentation of all law enforcement interactions.
User Notification: Notify users of law enforcement requests when legally required.

6.2.2. Platform Security Coordination

Internal Coordination:

Security Team: Coordinate with security team for technical responses.
Legal Team: Coordinate with legal team for compliance and reporting.
Senior Leadership: Keep senior leadership informed of significant incidents.
Cross-Platform: Coordinate with other platforms when appropriate.
Documentation: Make sure all teams have the necessary information.

7. PREVENTION STRATEGIES

7.1. Community Safety Measures

7.1.1. Detection and Monitoring

Proactive Monitoring:

Monitor for patterns of criminal activity
Use automated tools to detect suspicious behaviour
Regular review of high-risk areas and interactions
Pattern recognition for common criminal schemes
Regular security audits and assessments

Community Education:

Provide education about common scams and frauds
Share information about recognising criminal activity
Educate community members about online safety
Provide resources for reporting suspicious activity
Regular reminders about security best practices

7.1.2. Access Controls and Verification

Account Security:

Implement appropriate account verification measures
Monitor for suspicious account creation patterns
Implement rate limiting and access controls
Regular review of account security measures
Quick response to account compromise reports

Content Controls:

Automated detection of suspicious content
Manual review of flagged content
Quick removal of criminal content
Prevention of content re-upload
Regular review of content moderation effectiveness

7.2. Staff Training and Preparedness

7.2.1. Ongoing Training

Regular Updates:

Quarterly criminal activity training updates
Regular review of new criminal schemes and patterns
Updates on legal reporting requirements
Training on new platforms and security features
Case study reviews and learning sessions

Skill Development:

Recognition of criminal activity patterns
Appropriate response procedures
Evidence preservation best practices
Documentation requirements
Legal compliance and reporting

7.2.2. Policy and Process Improvement

Continuous Improvement:

Regular review of criminal activity policies
Updates based on new threats and patterns
Improvement of detection and response procedures
Enhancement of prevention measures
Integration of community feedback

8. SELF-CARE AND EMOTIONAL SUPPORT

8.1. Managing the Emotional Impact

8.1.1. Understanding the Impact

Emotional Demands:

Exposure to criminal activity can be distressing and traumatic
Supporting victims of crime requires emotional resilience
Dealing with threats and violence can be frightening
Maintaining professional boundaries whilst providing support can be difficult
Repeated exposure can lead to secondary trauma and burnout

Signs of Emotional Strain:

Physical Symptoms: Fatigue, headaches, sleep disturbances, tension
Emotional Symptoms: Anxiety, fear, anger, emotional numbness
Professional Symptoms: Decreased effectiveness, avoidance, difficulty making decisions
Personal Symptoms: Relationship strain, social withdrawal, loss of interest in activities

8.1.2. Self-Care Strategies

During Incidents:

Take Breaks: Take breaks when needed during difficult situations.
Seek Support: Reach out to colleagues or supervisors for support.
Maintain Boundaries: Remember your role and maintain professional boundaries.
Focus on Impact: Remember the positive impact of protecting community members.

Between Incidents:

Debriefing: Participate in debriefing sessions after difficult incidents.
Professional Support: Access counselling or professional support when needed.
Restoration: Engage in activities that restore emotional equilibrium.
Reflection: Regular self-reflection on emotional responses and needs.

8.2. Support Systems

8.2.1. Team Support

Peer Support:

Regular check-ins with colleagues working on criminal activity response
Debriefing sessions after difficult incidents
Sharing successful strategies and lessons learned
Mutual support and understanding
Recognition of positive outcomes

Supervisory Support:

Regular meetings with supervisors to discuss challenges
Access to additional resources and support
Workload management and distribution
Recognition of difficult work
Professional development opportunities

8.2.2. Professional Resources

Mental Health Support:

Access to counselling and mental health resources
Support groups for professionals working in security and safety
Trauma-informed therapy resources
Crisis support when needed
Ongoing mental health maintenance

Professional Development:

Training on trauma-informed practices
Education on secondary trauma and burnout prevention
Skills development for managing difficult situations
Access to professional resources and networks
Career development support

9. PRACTICE SCENARIOS AND TRAINING EXERCISES

9.1. Scenario 1: Threat of Violence

Situation: A community member posts a detailed threat of violence targeting a specific individual, including specific location and time information. The threat appears to be in response to a personal dispute.

Your Response:

What risk level is this?
What immediate actions should you take?
What evidence should you preserve?
Who should you escalate to?
Should law enforcement be contacted?

Correct Answer: High-risk situation requiring immediate escalation. Preserve all evidence, notify Naomi immediately, contact law enforcement and make sure the potential target is notified and protected.

9.2. Scenario 2: Financial Fraud Scheme

Situation: Multiple community members report receiving messages from an account claiming to be a Team member, requesting gift cards or cryptocurrency payments to resolve account issues. The messages include urgent language and threats of account suspension.

Your Response:

What type of criminal activity is this?
What immediate actions are required?
How do you protect potential victims?
What documentation is needed?
What reporting obligations exist?

9.3. Scenario 3: Suspicious Account Activity

Situation: You notice a pattern of accounts being created, used to send suspicious messages requesting personal information, and then deleted. The accounts appear to be part of a coordinated operation targeting community members.

Your Response:

What criminal activity indicators are present?
How do you investigate without interfering with potential law enforcement investigation?
What evidence should be preserved?
What prevention measures should be implemented?
When should authorities be notified?

10. TRAINING REQUIREMENTS

This training document is part of the mandatory training curriculum. For information about initial onboarding requirements, annual review requirements and compliance policies, see Mandatory Training Requirements in the Staff Handbook.

Key Points:

This document must be reviewed during initial onboarding and annually thereafter.
Failure to complete annual training review will result in dismissal from staff positions.
All training completions are documented in staff records for accountability, legal compliance and quality assurance.

This Criminal Activity Training document is part of our Team development programme. It is designed to help Team members recognise and respond to criminal activity appropriately whilst protecting community members and maintaining legal compliance. Criminal activity response is critical to community safety. All Team members must complete this training before assuming moderation responsibilities. For questions about criminal activity procedures or to report training completion, please contact Naomi through designated Team channels.