Job Specification

Purpose of Position :

To provide computer and mobile forensic expertise on an enterprise wide basis in the area of
forensics and to lead and conduct investigations, reviews of sensitive, contentious situations, potential risks or allegations of offences against all provincial and federal statutes investigated by OPS ministries and agencies.

To conduct computer forensic investigations involving non compliance and/or frauds relating to evasion of tax and/or obtainment of grants or subsidies under all statutes administered by the Ministry of Finance and under the Criminal Code of Canada, as a Provincial Offences Officer and/or a Special Constable, in order to prosecute individual or corporate violators. To assist investigations involving forensic accounting for other agencies

To provide forensic data recovery expertise and investigative assistance to other ministries and agencies in relation to offences against Provincial or Federal statutes.

To provide advice, recommendations, identify problems and issues arising from the collection and analysis of data and preparation of prosecution reports

Duties / Responsibilities :

1) Planning, leading, and conducting forensic data recovery investigations, search and seizure actions, obtaining digital evidence by ensuring proper collection, custody, control and identification; interviewing, third party witnesses, suspected violators and/or their legal/financial representatives; obtaining and evaluating information on alleged violators; liaising with external agencies on joint investigations.

2) Retrieving, examining and analyzing all digital evidence, to obtain proof of tax evasion, non compliance, fraud or any other offences against provincial or federal statutes. Retrieving, deciphering and
analyzing data from electronic media to ensure protection and continuity of evidence. Assessing and interpreting findings; consolidating data; preparing reports and prosecution briefs and recommending further investigative or prosecution action. Researching legislation, case law/summaries/decisions

3) Assisting in the drafting of affidavits and search warrants to search computerized electronic systems;

planning, organizing, coordinating, leading and executing search warrants to seize electronic media stored in standalone or network systems; seizing hardware and software, retrieving and/or recovering hidden electronic data; reconstructing usage of or access to a computerized system by forensic analysis of system log files and other electronic data; utilizing techniques to be able to dealwith material that has been encrypted or concealed with-in the system, ensuring evidence seized is
protected and a chain of custody is established; determining the accuracy and authenticity of electronic evidence; providing testimony as a witness at trial to establish the foundation for the introduction of electronic evidence.

4) Participating in the prosecution of violators by ensuring that sufficient evidence has been accumulated to meet a successful prosecution; assisting counsel in preparing and presenting evidence, including the drafting of charges, swearing of information, serving of summons or subpoenas and appearing as Crown witness, occasionally be sworn in as an expert witness.

5) Participating in Joint Forces Investigations/Operations with other tax jurisdictions or enforcement ministries and agencies eg. Canada Revenue Agency, Royal Canadian Mounted Police, Ontario Provincial Police and Ministry of Environment.

6) Securing confidential ministry, branch and accused records to protect the integrity of the branch operations and evidentiary material under custody and control.

7) Securing information obtained on behalf of other Provincial Ministries/Agencies and law enforcement agencies to ensure, and protect the integrity and confidentiality of the information.

8) Recommending referrals to raise assessments or to recover tax defalcations to product branches and other jurisdictions.

9) Assisting in investigations and seizure of electronic devices associated with contraband commodities distributed through underground networks with the purpose of thwarting tax administration in Ontario.

10) Assist in the development of training programs.

11) Ongoing research of recent and relevant case law, investigative technology, preservation and analysis of documentary and electronic data and computer hardware and software issues.

12) Assisting in the collection of electronic data for intelligence initiatives by providing linkages, planning, advice and analysis.

13) Collecting, collating, evaluating and analyzing and disseminating digital intelligence data collected from ministry staff, other provincial and federal enforcement agencies, informants, sources and external clients. Assessing the relevancy of information in order to gather reliable and objective information about individuals, groups, events and/or trends.

14) Participating in the Branch's Outreach Program, including the preparation and delivery of presentations to other program areas within the Ontario Public Service (OPS) and outside agencies. Researching and learning other statutes and/or investigative techniques. Liaising with other Ministry, OPS and Federal/Municipal government staff in an effort to further the outreach program and deliver investigative services

15) Management has the right to assign additional duties and/or projects in matters pertinent to the delivery of the enforcement function of the Ministry of Finance and other clients and agencies.

Knowledge :

1) Work requires a superior knowledge of computer hardware, software, computer forensic methodology and computer crime investigative techniques; business EDP systems, computers and mobile communication devices to locate, extract and analyze digital information to supplement investigations;

2) Superior knowledge of computer and mobile forensic analysis software, tools and computer and mobile forensic investigative procedures and methodology, local area networks and network server architecture.

3) Work requires an expert knowledge of computer forensic investigative processes, judicial process, rules of evidence and court procedures, as well as related legislation (e.g. Provincial Offences Act, Criminal Code of Canada, Ontario and Canada Evidence Act and Charter of Rights) to carry out and lead investigations, gather evidence, interview individuals, prepare evidence disclosure and assist with prosecutions, execute legal papers and appear in court as an expert witness in the field of computer and mobile communications forensics.

4) This knowledge is normally gained through successful completion of an Information Technology degree or diploma from a recognized university/college plus COMPTIA A+ certification or equivalent work experience.

5) Knowledge of relevant legislation administered by the Ministry of Finance, Compliance Programs Division (eg. Land Transfer Tax, Tobacco Tax Act, Fuel Tax Act, Gasoline Tax Act, etc.), related regulations and ministry guidelines to investigate alleged contraventions, interpret evidence, recommend whether further legal actions are warranted. Knowledge of the ministry and other government databases.

6) Comprehensive knowledge of branch policies, procedures and practices. Excellent understanding and interpretation of legislation in order to apply enforcement policies, with sound judgment, to the most complex and sensitive non compliance matters.

7) Interpersonal skills appropriate to deal comfortably with all levels of staff, executive, other government agencies and Crown Prosecutors.

8) Knowledge of accounting in order to understand and analyze business accounting systems to be able to identify areas requiring investigation.

Skills :

Job requires analytical/planning/problem solving skills required to: Determine if there is evidence of an offence or wrong-doing Assess the nature of alleged contraventions in relation to the legislation/regulations/statutes
Develop a plan of action by establishing how evidence will be collected
Gather information/evidence sufficient to warrant legal action from a variety of sources (i.e. title/registration searches) and using a range of methods/techniques (i.e. police departments, informants and associates)
Conduct computer forensic search and analysis activities
Analysis and troubleshoot computer hardware and software
Organize the preparation and process of legal documents and court orders (i.e. subpoena, search warrants, summons)
Investigate individuals and/or corporations
Assemble/consolidate/translate evidence into a coherent format for court presentation
• Provide evidence and for recommendations for further action
Develop investigative strategies adapting/modifying them to allow for complications
resulting from extensive and elaborate efforts to hide violations

Job requires excellent oral and written communication skills to interview complainants, informants, witnesses, suspects and/ or their representatives to obtain evidence, discuss and review with the violators, their staff, corporate representatives, legal counsel and/or police the information;
interpret the evidence, brief legal counsel, provide expert testimony and be subject to cross­ examination, draft documents, prepare prosecution reports, reports documents for court proceedings and present case or assist in the prosecution in court.
Job requires excellent oral and written communication skills to prepare and deliver presentations. Job requires excellent interpersonal skills to interview and/or interrogate suspects and witnesses
who may be unwilling or evasive.

Job requires working under minimal supervision and making decisions within established guidelines, protocols, methodologies and procedures

Freedom of Action :

Job is guided by the provisions of legislation and related regulations, precedents, policies, standards and program objectives as well as within investigative and legal processes. Job exercises wide latitude in decision making in planning/conducting investigations, identifying and resolving practical/technical/procedural problems in situations requiring an immediate response and in determining how best to obtain evidence/information to pursue legal action. Judgement is exercised in planning/executing search and seizure action in a computerized environment, in
identifying technical needs and establishing standards of application, in program development, co­
ordination and presentation. Manager or Senior Computer Forensic Investigator monitors process and reviews work when job recommends prosecution or other follow-up activities. Job refers to Manager or Senior Computer Forensic Investigator issues/problems (i.e. joint investigations, inter­ governmental requests) or request for additional resources to complete an investigation. Job provides assistance in the training of new investigators and acting as team leader in search actions and/or surveillance activities.

Job is guided by the provisions of provincial statutes, related regulations, Criminal Code of Canada, precedents, policies, standards, program objectives as well as within investigative and legal processes. Care must be taken in identifying the need for and defining the extent and scheme of non-compliance and fraud for all cases including the most complex and sensitive cases and projects. All work must be property carried out and completed as required by the judicialprocess. Evidence must be presented coherently and
must be property assembled, translated and consolidated. The job requires the development of investigative
strategies with the flexibility to modify them for complications and changes as they occur.