Interview & Interrogation Techniques Flashcards

What is the primary distinction between an 'interview' and an 'interrogation' in a cybersecurity investigation context?

Answer: Interviews are information-gathering conversations, while interrogations are accusatory and designed to obtain admissions from suspected wrongdoers

Interviews are non-accusatory and aimed at gathering information, whereas interrogations are confrontational, presuppose guilt, and are designed to elicit admissions or confessions.

A subject being interviewed about a ransomware attack asks whether they need a lawyer present. How should a corporate cybersecurity investigator respond?

Answer: Acknowledge the request and immediately pause the interview to allow the subject to obtain legal counsel if desired

Respecting a subject's right to legal counsel is ethically required and protects the admissibility of any information gathered in subsequent proceedings.

What interviewing technique involves summarizing the subject's account back to them to verify accuracy and encourage elaboration?

Answer: Reflective listening and summarization

Reflective listening and summarization confirm understanding, demonstrate active listening, and often prompt subjects to add detail or correct misunderstandings.

During a malware investigation interview, the subject's alibi is partially corroborated by system logs. How should the investigator proceed?

Answer: Continue the interview, focusing on gaps in the corroboration and exploring alternative explanations

Partial corroboration does not eliminate culpability; investigators should explore gaps and inconsistencies rather than prematurely closing lines of inquiry.

Which of the following best describes 'minimization' as an interrogation technique?

Answer: Downplaying the seriousness of the offense or offering moral justifications to make it easier for a subject to admit wrongdoing

Minimization involves making the subject feel the offense is understandable or less serious, which can lower psychological barriers to admitting involvement.

In a cybersecurity interview, a witness suddenly recalls a critical detail about the attacker's email address. What should the investigator do first?

Answer: Encourage the witness to fully describe the recollection using open-ended prompts before taking any action on the detail

Allowing the witness to fully elaborate their recollection first prevents interrupting their memory retrieval process and may surface additional corroborating details.

What role does 'active listening' play in a cybersecurity investigative interview?

Answer: It demonstrates genuine engagement, builds rapport, and helps the interviewer identify inconsistencies and follow-up opportunities in real time

Active listening improves rapport, signals respect for the subject, and helps interviewers catch subtle inconsistencies or opportunities for productive follow-up in real time.