---
title: Criminal Activity Training for Staff
---

**MANDATORY TRAINING FOR ALL TEAM MEMBERS**

## 1. INTRODUCTION AND SCOPE

### 1.1. Purpose of This Training

This training document provides essential guidance for all Team members on recognising, responding to, and managing criminal activity within our community. Team members must be prepared to identify potential criminal activity, respond appropriately, and ensure compliance with legal obligations whilst protecting community members and maintaining platform integrity.

### 1.2. Integration with Existing Policies

This training operates within our comprehensive safety and legal compliance framework:

**(a)** **Community Code of Conduct**: Behavioural expectations and community safety standards;

**(b)** **Content and Moderation Policy**: Enforcement procedures and content restrictions;

**(c)** **Crisis Response Policy**: Emergency response procedures for safety concerns;

**(d)** **Child Safety Policy**: Procedures for protecting minors and reporting child exploitation;

**(e)** **Legal Compliance Requirements**: Mandatory reporting obligations and legal responsibilities;

**(f)** **Staff Handbook**: General staff responsibilities and expectations.

### 1.3. Critical Disclaimer

**REMEMBER: WE ARE NOT LAW ENFORCEMENT PROFESSIONALS**

- We cannot conduct criminal investigations or make legal determinations
- Our role is limited to recognition, immediate response, evidence preservation, and appropriate escalation
- We must maintain clear professional boundaries and avoid interfering with law enforcement investigations
- When in doubt, escalate immediately to senior staff and appropriate authorities
- Legal reporting obligations may require immediate action regardless of uncertainty
- Do not attempt to investigate or confront suspected criminals

## 2. UNDERSTANDING CRIMINAL ACTIVITY IN ONLINE COMMUNITIES

### 2.1. Types of Criminal Activity

#### 2.1.1. Violent Crimes and Threats (IMMEDIATE ACTION REQUIRED)

**Threats of Violence:**
- Direct threats of physical harm to individuals or groups
- Threats of mass violence or terrorism
- Threats involving weapons or explosives
- Threats targeting specific individuals or locations
- Threats made in response to conflicts or disputes

**Stalking and Harassment:**
- Persistent unwanted contact that causes fear
- Tracking or monitoring of individuals without consent
- Threats combined with unwanted contact
- Pattern of harassment that escalates to threats
- Cyberstalking behaviours targeting community members

**Doxxing and Privacy Violations:**
- Unauthorized release of personal identifying information
- Publishing addresses, phone numbers, or other private information
- Attempts to locate or identify individuals without consent
- Sharing information intended to enable harassment or harm
- Coercion through threat of information release

#### 2.1.2. Financial Crimes (ESCALATE WITHIN 15 MINUTES)

**Fraud and Scams:**
- Phishing attempts targeting community members
- Advance fee fraud schemes
- Investment scams and Ponzi schemes
- Romance scams and catfishing
- Impersonation for financial gain

**Money Laundering:**
- Suspicious financial transactions or requests
- Attempts to move funds through community platforms
- Requests for payment in unusual forms (gift cards, cryptocurrency)
- Patterns suggesting money laundering operations
- Connections between accounts suggesting criminal networks

**Theft and Identity Theft:**
- Unauthorized access to accounts or information
- Identity theft attempts
- Credit card fraud or unauthorized charges
- Account takeover attempts
- Social engineering for financial gain

#### 2.1.3. Cybercrime (ESCALATE WITHIN 15 MINUTES)

**Hacking and Unauthorized Access:**
- Attempts to gain unauthorized access to systems
- Distribution of hacking tools or instructions
- Account compromise attempts
- Malware distribution
- Denial of service attack planning or execution

**Data Breaches:**
- Unauthorized access to user data
- Attempts to extract or sell user information
- Breaches of platform security
- Distribution of stolen credentials
- Sale of compromised accounts

**Online Exploitation:**
- Sextortion schemes
- Revenge porn distribution
- Non-consensual image sharing
- Coercion through digital means
- Exploitation of vulnerable individuals

#### 2.1.4. Illegal Content Distribution (ESCALATE WITHIN 15 MINUTES)

**Copyright Infringement:**
- Distribution of pirated software, media, or content
- Large-scale copyright violation operations
- Commercial piracy activities
- Distribution of cracked software or media
- Organised piracy networks

**Illegal Material:**
- Distribution of illegal drugs or substances
- Sale of illegal goods or services
- Distribution of weapons or weapon components
- Human trafficking indicators or advertisements
- Other illegal goods or services

#### 2.1.5. Extremism and Terrorism (IMMEDIATE ACTION REQUIRED)

**Terrorist Content:**
- Content promoting or glorifying terrorism
- Recruitment materials for terrorist organisations
- Instructions for carrying out attacks
- Threats of terrorist activity
- Material supporting designated terrorist organisations

**Extremist Activity:**
- Content promoting violent extremism
- Recruitment for extremist groups
- Planning or coordination of extremist activities
- Distribution of extremist propaganda
- Radicalization attempts targeting community members

### 2.2. Recognising Criminal Activity Patterns

#### 2.2.1. Behavioural Indicators

**Suspicious Communication Patterns:**
- Rapid account creation and deletion
- Use of multiple accounts for similar purposes
- Evasive responses to questions about identity or purpose
- Inconsistent information across interactions
- Attempts to avoid verification or identification

**Coordination Indicators:**
- Multiple accounts coordinating activities
- Organised campaigns or operations
- Network of accounts working together
- Rapid spread of criminal content or schemes
- Patterns suggesting organised criminal activity

#### 2.2.2. Content Indicators

**Red Flag Language:**
- Requests for personal or financial information
- Pressure to act quickly or keep things secret
- Requests to move conversations to private platforms
- Offers that seem too good to be true
- Threats or coercion attempts

**Suspicious Requests:**
- Requests for money or financial assistance
- Requests for personal identifying information
- Requests to share accounts or credentials
- Requests to participate in suspicious activities
- Requests to keep activities secret from others

## 3. IMMEDIATE RESPONSE PROCEDURES

### 3.1. Violent Crimes and Threats Response Protocol

**IMMEDIATE ACTIONS (Within 5 minutes):**

1. **DO NOT DELAY** - Threats of violence require immediate action
2. **PRESERVE EVIDENCE** - Screenshot all relevant communications immediately
3. **ESCALATE IMMEDIATELY** - Notify senior staff and security coordinator in staff chat
4. **DO NOT CONFRONT** - Do not directly confront suspected perpetrators
5. **PROTECT TARGETS** - Ensure potential targets are notified and protected
6. **DOCUMENT EVERYTHING** - Record all relevant information whilst it's fresh
7. **CONTACT AUTHORITIES** - Report to law enforcement if threat appears credible

**Example Response Template:**
```
URGENT CRIMINAL ACTIVITY CONCERN - THREAT OF VIOLENCE

[Brief description of threat]
[User IDs involved]
[Platform/channel where threat occurred]
[Time and date]
[Target information if known]
[Screenshots attached]

Escalating immediately to security coordinator and senior staff.
Law enforcement notification recommended.
```

### 3.2. Financial Crimes Response Protocol

**ACTIONS (Within 15 minutes):**

1. **PRESERVE EVIDENCE** - Document and preserve all relevant communications and transactions
2. **PROTECT VICTIMS** - Notify potential victims and provide support resources
3. **REMOVE CONTENT** - Remove fraudulent content from public view immediately
4. **ESCALATE** - Notify security coordinator and senior staff
5. **DOCUMENT** - Create comprehensive documentation of the incident
6. **REPORT** - Report to appropriate authorities (FBI Internet Crime Complaint Center, local law enforcement)
7. **FOLLOW UP** - Ensure appropriate follow-up actions are taken

**Example Response Template:**
```
CRIMINAL ACTIVITY CONCERN - FINANCIAL FRAUD

[Description of fraudulent activity]
[User IDs involved]
[Platform/channel where activity occurred]
[Time and date]
[Victim information if known]
[Screenshots and evidence attached]

Escalating to security coordinator. Reporting to appropriate authorities.
```

### 3.3. Cybercrime Response Protocol

**ACTIONS (Within 15 minutes):**

1. **SECURE SYSTEMS** - Take immediate steps to secure affected systems
2. **PRESERVE EVIDENCE** - Document all evidence of cybercrime activity
3. **PROTECT USERS** - Notify affected users and provide security guidance
4. **ESCALATE** - Notify security coordinator and technical team immediately
5. **DOCUMENT** - Create comprehensive documentation of the incident
6. **REPORT** - Report to appropriate cybercrime authorities
7. **MITIGATE** - Take steps to prevent further damage or spread

### 3.4. Illegal Content Distribution Response Protocol

**ACTIONS (Within 15 minutes):**

1. **REMOVE CONTENT** - Immediately remove illegal content from public view
2. **PRESERVE EVIDENCE** - Document and preserve evidence for authorities
3. **ESCALATE** - Notify security coordinator and senior staff
4. **DOCUMENT** - Create comprehensive documentation of the incident
5. **REPORT** - Report to appropriate authorities (copyright holders, law enforcement)
6. **FOLLOW UP** - Ensure appropriate follow-up actions are taken

### 3.5. Extremism and Terrorism Response Protocol

**IMMEDIATE ACTIONS (Within 5 minutes):**

1. **DO NOT DELAY** - Extremist content requires immediate action
2. **REMOVE CONTENT** - Immediately remove extremist content
3. **PRESERVE EVIDENCE** - Document and preserve all evidence
4. **ESCALATE** - Notify security coordinator and senior staff immediately
5. **REPORT** - Report to appropriate counter-terrorism authorities
6. **PROTECT COMMUNITY** - Take steps to protect community members from radicalization
7. **DOCUMENT** - Create comprehensive documentation

## 4. LEGAL OBLIGATIONS AND REPORTING REQUIREMENTS

### 4.1. Mandatory Reporting Obligations

#### 4.1.1. When Reporting Is Required

**Legal Requirements:**
- **Threats of Violence**: Credible threats of violence must be reported to law enforcement
- **Child Exploitation**: Any suspected child exploitation must be reported (see Child Safety Policy)
- **Terrorism**: Content promoting terrorism or terrorist activities must be reported
- **Financial Crimes**: Significant financial crimes may require reporting to financial authorities
- **Cybercrime**: Serious cybercrime may require reporting to cybercrime units
- **Data Breaches**: Data breaches may require reporting to data protection authorities

**Jurisdictional Considerations:**
- Reporting requirements vary by jurisdiction
- Some crimes require reporting in multiple jurisdictions
- International crimes may require reporting to multiple agencies
- When in doubt, consult with legal counsel and report
- Different types of crimes require reporting to different agencies

#### 4.1.2. How to Report

**Internal Reporting:**
1. **Immediate Escalation**: Notify security coordinator and senior staff immediately
2. **Documentation**: Provide comprehensive documentation of concerns
3. **Follow Procedures**: Follow established internal reporting procedures
4. **Coordination**: Coordinate with other Team members as appropriate

**External Reporting:**
- **Law Enforcement**: Report to local law enforcement for violent crimes and threats
- **FBI Internet Crime Complaint Center (IC3)**: Report cybercrime and online fraud
- **National Center for Missing & Exploited Children (NCMEC)**: Report child exploitation
- **Counter-Terrorism Authorities**: Report terrorism-related content
- **Financial Authorities**: Report significant financial crimes
- **Legal Counsel**: Consult with legal counsel for guidance on reporting obligations

### 4.2. Documentation Requirements

#### 4.2.1. Essential Information to Document

**Incident Details:**
- **Date and Time**: Exact date and time of incident or discovery
- **Platform and Location**: Where the incident occurred
- **Parties Involved**: All user IDs and any known identifying information
- **Content**: Screenshots, logs, and descriptions of all relevant content
- **Actions Taken**: All actions taken in response to the incident
- **Evidence**: All preserved evidence and documentation

**Context Information:**
- **Historical Context**: Any previous interactions or concerns involving the parties
- **Witnesses**: Any other staff or community members who witnessed the incident
- **Victim Information**: Information about any victims (whilst respecting privacy)
- **Risk Assessment**: Assessment of immediate and ongoing risk
- **Follow-up Plans**: Planned follow-up actions and monitoring

#### 4.2.2. Evidence Preservation

**Preservation Requirements:**
- **Screenshots**: Take screenshots of all relevant content immediately
- **Logs**: Preserve all relevant logs and system records
- **Communications**: Preserve all relevant communications and messages
- **Metadata**: Preserve metadata when possible (timestamps, IP addresses, etc.)
- **Chain of Custody**: Maintain clear chain of custody for all evidence

**Legal Considerations:**
- **Admissibility**: Ensure evidence is preserved in a way that maintains admissibility
- **Privacy**: Balance evidence preservation with privacy requirements
- **Retention**: Follow legal requirements for evidence retention
- **Access Controls**: Limit access to evidence to authorized personnel only
- **Legal Holds**: Preserve evidence when legal action is possible

## 5. ESCALATION PROCEDURES

### 5.1. When to Escalate

**ALWAYS ESCALATE IMMEDIATELY:**
- Any threat of violence
- Any suspected child exploitation
- Any terrorism-related content
- Any credible threat to community safety
- Any significant financial crime
- Any serious cybercrime
- Any situation where you feel uncertain about appropriate response

### 5.2. How to Escalate

**Internal Escalation:**
1. **Staff Chat Alert**: Post urgent alert in staff chat with @security-coordinator
2. **Direct Contact**: Contact security coordinator directly if available
3. **Senior Staff Notification**: Notify senior staff and leadership immediately
4. **Documentation**: Provide all documentation and context immediately
5. **Follow Instructions**: Follow any specific directions from senior staff

**Emergency Escalation:**
- **Immediate Danger**: Contact emergency services if there is immediate physical danger
- **@Naomi Alert**: Alert @Naomi immediately for critical situations
- **Legal Counsel**: Consult legal counsel for guidance on reporting obligations
- **External Authorities**: Report to appropriate law enforcement or regulatory agencies

### 5.3. Escalation Chain

**Standard Escalation:**
1. Security Coordinator
2. Senior Staff / Leadership
3. Legal Counsel (if needed)
4. External Authorities (as required by law)

**Emergency Escalation:**
1. Emergency Services (if immediate physical danger)
2. Security Coordinator
3. Senior Staff / Leadership
4. Legal Counsel
5. External Authorities

## 6. COMMUNICATION AND COORDINATION

### 6.1. Communicating with Victims

#### 6.1.1. Victim Support

**Do's:**
- **Believe and Validate**: Believe victims and validate their experiences
- **Provide Support**: Connect victims with appropriate support resources
- **Explain Process**: Explain what will happen next in clear language
- **Maintain Privacy**: Respect victim privacy and confidentiality
- **Provide Resources**: Share resources for reporting to authorities and getting help

**Don'ts:**
- **Don't Investigate**: Do not attempt to conduct your own investigation
- **Don't Promise Outcomes**: Do not promise specific outcomes or consequences
- **Don't Minimise**: Do not minimise the seriousness of the crime
- **Don't Blame**: Do not suggest the victim did anything wrong
- **Don't Share Details**: Do not share details about actions taken against perpetrators

#### 6.1.2. Resource Connection

**Support Resources:**
- **Law Enforcement**: Information about reporting to law enforcement
- **Victim Support Services**: Connect with victim support organisations
- **Legal Resources**: Information about legal options and resources
- **Counselling Services**: Connect with counselling and mental health resources
- **Financial Recovery**: Resources for financial crime victims

### 6.2. Coordinating with Authorities

#### 6.2.1. Law Enforcement Cooperation

**When Working with Law Enforcement:**
- **Follow Legal Requirements**: Comply with all legal requirements and orders
- **Preserve Evidence**: Ensure all evidence is properly preserved
- **Provide Information**: Provide requested information within legal boundaries
- **Maintain Boundaries**: Maintain appropriate boundaries and avoid interfering with investigations
- **Document Interactions**: Document all interactions with law enforcement

**Legal Considerations:**
- **Warrants and Subpoenas**: Comply with legal warrants and subpoenas
- **Privacy Rights**: Balance compliance with user privacy rights
- **Legal Counsel**: Consult legal counsel when dealing with law enforcement requests
- **Documentation**: Maintain documentation of all law enforcement interactions
- **User Notification**: Notify users of law enforcement requests when legally required

#### 6.2.2. Platform Security Coordination

**Internal Coordination:**
- **Security Team**: Coordinate with security team for technical responses
- **Legal Team**: Coordinate with legal team for compliance and reporting
- **Senior Leadership**: Keep senior leadership informed of significant incidents
- **Cross-Platform**: Coordinate with other platforms when appropriate
- **Documentation**: Ensure all teams have necessary information

## 7. PREVENTION STRATEGIES

### 7.1. Community Safety Measures

#### 7.1.1. Detection and Monitoring

**Proactive Monitoring:**
- Monitor for patterns of criminal activity
- Use automated tools to detect suspicious behavior
- Regular review of high-risk areas and interactions
- Pattern recognition for common criminal schemes
- Regular security audits and assessments

**Community Education:**
- Provide education about common scams and frauds
- Share information about recognising criminal activity
- Educate community members about online safety
- Provide resources for reporting suspicious activity
- Regular reminders about security best practices

#### 7.1.2. Access Controls and Verification

**Account Security:**
- Implement appropriate account verification measures
- Monitor for suspicious account creation patterns
- Implement rate limiting and access controls
- Regular review of account security measures
- Quick response to account compromise reports

**Content Controls:**
- Automated detection of suspicious content
- Manual review of flagged content
- Quick removal of criminal content
- Prevention of content re-upload
- Regular review of content moderation effectiveness

### 7.2. Staff Training and Preparedness

#### 7.2.1. Ongoing Training

**Regular Updates:**
- Quarterly criminal activity training updates
- Regular review of new criminal schemes and patterns
- Updates on legal reporting requirements
- Training on new platforms and security features
- Case study reviews and learning sessions

**Skill Development:**
- Recognition of criminal activity patterns
- Appropriate response procedures
- Evidence preservation best practices
- Documentation requirements
- Legal compliance and reporting

#### 7.2.2. Policy and Process Improvement

**Continuous Improvement:**
- Regular review of criminal activity policies
- Updates based on new threats and patterns
- Improvement of detection and response procedures
- Enhancement of prevention measures
- Integration of community feedback

## 8. SELF-CARE AND EMOTIONAL SUPPORT

### 8.1. Managing the Emotional Impact

#### 8.1.1. Understanding the Impact

**Emotional Demands:**
- Exposure to criminal activity can be distressing and traumatic
- Supporting victims of crime requires emotional resilience
- Dealing with threats and violence can be frightening
- Maintaining professional boundaries whilst providing support can be difficult
- Repeated exposure can lead to secondary trauma and burnout

**Signs of Emotional Strain:**
- **Physical Symptoms**: Fatigue, headaches, sleep disturbances, tension
- **Emotional Symptoms**: Anxiety, fear, anger, emotional numbness
- **Professional Symptoms**: Decreased effectiveness, avoidance, difficulty making decisions
- **Personal Symptoms**: Relationship strain, social withdrawal, loss of interest in activities

#### 8.1.2. Self-Care Strategies

**During Incidents:**
- **Take Breaks**: Take breaks when needed during difficult situations
- **Seek Support**: Reach out to colleagues or supervisors for support
- **Maintain Boundaries**: Remember your role and maintain professional boundaries
- **Focus on Impact**: Remember the positive impact of protecting community members

**Between Incidents:**
- **Debriefing**: Participate in debriefing sessions after difficult incidents
- **Professional Support**: Access counselling or professional support when needed
- **Restoration**: Engage in activities that restore emotional equilibrium
- **Reflection**: Regular self-reflection on emotional responses and needs

### 8.2. Support Systems

#### 8.2.1. Team Support

**Peer Support:**
- Regular check-ins with colleagues working on criminal activity response
- Debriefing sessions after difficult incidents
- Sharing successful strategies and lessons learned
- Mutual support and understanding
- Celebration of positive outcomes

**Supervisory Support:**
- Regular meetings with supervisors to discuss challenges
- Access to additional resources and support
- Workload management and distribution
- Recognition of difficult work
- Professional development opportunities

#### 8.2.2. Professional Resources

**Mental Health Support:**
- Access to counselling and mental health resources
- Support groups for professionals working in security and safety
- Trauma-informed therapy resources
- Crisis support when needed
- Ongoing mental health maintenance

**Professional Development:**
- Training on trauma-informed practices
- Education on secondary trauma and burnout prevention
- Skills development for managing difficult situations
- Access to professional resources and networks
- Career development support

## 9. PRACTICE SCENARIOS AND TRAINING EXERCISES

### 9.1. Scenario 1: Threat of Violence

**Situation**: A community member posts a detailed threat of violence targeting a specific individual, including specific location and time information. The threat appears to be in response to a personal dispute.

**Your Response:**
1. What risk level is this?
2. What immediate actions should you take?
3. What evidence should you preserve?
4. Who should you escalate to?
5. Should law enforcement be contacted?

**Correct Answer**: High-risk situation requiring immediate escalation. Preserve all evidence, notify security coordinator immediately, contact law enforcement, and ensure the potential target is notified and protected.

### 9.2. Scenario 2: Financial Fraud Scheme

**Situation**: Multiple community members report receiving messages from an account claiming to be a Team member, requesting gift cards or cryptocurrency payments to resolve account issues. The messages include urgent language and threats of account suspension.

**Your Response:**
1. What type of criminal activity is this?
2. What immediate actions are required?
3. How do you protect potential victims?
4. What documentation is needed?
5. What reporting obligations exist?

### 9.3. Scenario 3: Suspicious Account Activity

**Situation**: You notice a pattern of accounts being created, used to send suspicious messages requesting personal information, and then deleted. The accounts appear to be part of a coordinated operation targeting community members.

**Your Response:**
1. What criminal activity indicators are present?
2. How do you investigate without interfering with potential law enforcement investigation?
3. What evidence should be preserved?
4. What prevention measures should be implemented?
5. When should authorities be notified?

## 10. TRAINING REQUIREMENTS

This training document is part of the comprehensive mandatory training curriculum. For complete information about initial onboarding requirements, annual review requirements, training confirmation submission, and compliance policies, see [Mandatory Training Requirements](/staff/handbook#81-mandatory-training-requirements) in the Staff Handbook.

**Key Points:**
- This document must be reviewed during initial onboarding and annually thereafter
- Training confirmation must be submitted at [forms.nhcarrigan.com](https://forms.nhcarrigan.com)
- Failure to complete annual training review will result in dismissal from staff positions
- All training completions are documented in staff records for accountability, legal compliance, and quality assurance

---

*This Criminal Activity Training document is part of our comprehensive Team development programme designed to ensure appropriate recognition and response to criminal activity whilst protecting community members and maintaining legal compliance. Criminal activity response is critical to community safety, and all Team members must complete this training before assuming moderation responsibilities. For questions about criminal activity procedures or to report training completion, please contact the Security Coordinator through designated Team channels.*

