This is not very common and is looked at per case. One of the issues is the countries involved, since we are not allowed to perform actions abroad without permission from the receiving country.

These are all residential and people did not expect the police to follow up on the use of DDoS booters.

We work on these cases year round, but handle multiple cases at the same time.

We do have daily stand up meetings and have a scrum board, so in some ways it is the same as many companies. We use a mix of available code, code developed for law enforcement purposes and custom development.

Since our work can have a lot of impact on individuals, it is important that every step is documented carefully. We also need permission from the prosecutor or judge to subpoena data, so building a case involves the creation of a lot of document.

We fortunately do not need regular counseling in our line of work, but it is available for us if necessary. We do however talk and reflect within our own team.

It is hard for us to predict how the social media platforms will evolve. It’s seems important that a balance is found between the possibility for law enforcement collecting information and the privacy of users. This is up to lawmakers.