Which of the following are basic cybercrime considerations for patrol officers?

• A. Take photos of the scene; call a supervisor; search for digital devices; arrest suspects.
• B. Preserve digital evidence; document metadata; secure devices; report cyber incidents.
• C. Ignore digital devices unless there is a warrant.
• D. Only preserve evidence if a computer is involved.

Answer: (B)

When officers first encounter a potential cybercrime, the key practice is to safeguard digital evidence, understand the data’s context, keep devices secure, and promptly report the incident so investigators can take over with solid footing.

Preserving digital evidence is crucial because it maintains the integrity and admissibility of what might be used in court. That means avoiding altering data, noting the scene’s condition, and preserving the device’s state as found to prevent spoliation. Documenting metadata is an essential subset of this work; metadata reveals when a file was created or modified, who authored it, and the sequence of events, which helps establish timelines and credibility of the information.

Securing devices at the scene helps prevent tampering or inadvertent data loss. This includes controlling access to the device, preserving power and network state when possible, and labeling and safeguarding hardware and media until proper crime scene handling can occur. Reporting cyber incidents ensures the right specialists are involved—cybercrime units or digital forensics teams—so the evidence is processed correctly and investigated thoroughly.

These elements together form the practical, ready-to-act approach for patrol officers. The other options either miss these critical steps, rely on overbroad or inappropriate actions (like ignoring devices without a warrant), or narrow preservation to only certain kinds of devices, which isn’t correct for most cybercrime scenarios.