Comprehensive Study Guide to Criminal Investigation: Organic Structure, Investigative Methodology, and Specialized Operative Techniques in the Spanish National Police (CNP)
Institutional Framework and Architecture of Criminal Investigation in the Spanish National Police
Constitutional and Institutional Foundations:
The police institution is fundamentally supported by three structural master pillars: citizen security (Seguridad Ciudadana), penal and procedural legal framework (Normativa Penal y Procesal), and criminal investigation (Investigación Criminal).
The legal basis of police investigation in Spain derives directly from the Spanish Constitution (Articles 104 and 106) and Organic Law 2/1986, of March 13, on Security Forces and Corps (Article 11), supplemented by Royal Decree 769/1987, of June 19, on the Judicial Police, and Circular 2/2022, of December 20, of the State Attorney General's Office on the extra-procedural activity of the Public Prosecutor's Office in criminal investigations.
Core Functional Areas of Investigation:
Judicial Police (Policía Judicial): Responsible for investigating all general criminal modalities, ranging from common street crime to complex, transnational organized crime structures.
Information (Información): Focuses its investigative and intelligence activity exclusively on terrorism (domestic and international), violent radicalism, counter-espionage, and destructive cults.
Immigration and Borders (Extranjería y Fronteras): Dedicated to the detection, dismantling, and investigation of illegal immigration networks and human trafficking in all its forms.
The Operational Unit (Grupo de Investigación):
The core operative cell in all functional areas of investigation is the Investigation Group (Grupo de Investigación). It consists of a variable number of police officers from different scales and categories.
It is directly commanded by an Inspector (Jefe/a de Grupo Operativo), belonging to the Executive Scale, second category.
Groups are integrated hierarchically and functionally into higher echelons: Sections (Secciones) and Brigades (Brigadas), which adapt their composition, human resources, technical tools, and deployment to the territorial jurisdiction and crime typology.
Overall strategic planning, operational coordination, and institutional supervision of all operative units at both central and territorial levels are exercised by the Operational Deputy Directorate (Dirección Adjunta Operativa - DAO) in accordance with directives from the Director General of the Police.
Territorial Organization of Criminal Investigation:
Driven by the principle of subsidiarity, ensuring citizen needs are addressed initially and primarily by police services within their respective territorial demarcations. It harmoniously combines operative decentralization with centralized coordination issued by the General Commissariats and governing bodies.
Higher Police Headquarters (Jefaturas Superiores de Policía): Regional organs of command, management, operational coordination, and inspection within their designated autonomous territorial scope, without prejudice to functional dependence on specialized central services. Operatively, they feature a Territorial Operational Coordination Unit (Unidad de Coordinación Operativa Territorial - UCOT), commanded by a Regional Head of Operations (Jefe/a Regional de Operaciones), tasked with coordinating, monitoring, and supervising services across all territorial operative units.
Provincial Police Commissariats (Comisarías Provinciales): Established in every provincial capital across Spain. Led by a Provincial Operational Coordination Unit (Unidad de Coordinación Operativa Provincial - UCOP) commanded by a Provincial Head of Operations (Jefe/a Provincial de Operaciones), responsible for coordinating the five core Provincial Brigades: Judicial Police, Information, Immigration and Borders, Citizen Security, and Scientific Police. In single-province Autonomous Communities (except the Community of Madrid) and in the Autonomous Cities of Ceuta and Melilla, the Head of the Jefatura Superior directly assumes the leadership of the Provincial Commissariat.
Local Police Commissariats (Comisarías Locales): Execute the same functions as Provincial Commissariats within their assigned local borders, categorized into three distinct tiers based on demographics, crime rate, and strategic relevance:
High-Level Local Commissariats (Vigo-Redondela, Gijón, and Algeciras): Composed of a Local Operational Coordination Unit (UCOL), led by a Local Head of Operations, a General Secretariat, and five specialized Local Brigades (Judicial Police, Information, Immigration and Borders, Citizen Security, and Scientific Police).
Medium-Level Local Commissariats: Composed of a Secretariat and five specialized Local Brigades, operating without an established UCOL.
- *Low-Level Local Commissariats:* Simplified structure consisting of a Secretariat, a Local Operational Group (*Grupo Operativo Local*) conducting generalist investigations, and a Local Citizen Security Group (*Grupo Local de Seguridad Ciudadana*) executing prevention and public safety duties.
District Police Commissariats (Comisarías de Distrito): Basic organizational units in major urban metropolises, created by the Director General of the Police based on demographic, administrative, and criminal criteria. Led by a Police Commissioner (Comisario/a) or a Chief Inspector (Inspector/a Jefe/a), subordinate directly to the Provincial Commissioner. Their structure is highly variable and tailored to local operational needs:
Comparison: Comisaría de Distrito Centro (Madrid) operates with specialized Judicial Police investigation groups (focused on specialized thefts, robberies, etc.) with a total staff of approximately officers, of which nearly are dedicated exclusively to investigation. Conversely, Comisaría de Distrito Arrabal (Zaragoza) has a single Judicial Police investigation group and a total staff of approximately officers, with around assigned to investigation.
Working dynamics: Officers of the Basic Scale work complementary shifts (morning or afternoon). Daily complaints (denuncias) filed within the territorial district are reviewed each morning by the Executive Scale or Sub-inspection leadership and assigned individually to officers for investigation.
Other Joint Cooperation Units: Police and Customs Cooperation Centers (Centros de Cooperación Policial y Aduanera - CCPA), Police Cooperation Centers (CCP), and international border posts, acting as real-time intelligence exchange and operational coordination hubs.
Central Structure of Criminal Investigation:
General Commissariat of Judicial Police (Comisaría General de Policía Judicial - CGPJ): Exercises technical direction, operational support, and coordination across Spain. Structurally comprised of the Central Operational and Technical Coordination Unit (UCCCOT), Operational Coordination Brigade, General Secretariat, and specialized Central Units:
Central Drugs and Organized Crime Unit (UDYCO Central): Investigates large-scale drug trafficking and organized criminal syndicates.
Central Specialized and Violent Crime Unit (UDEV Central): Investigates crimes against persons (homicide, kidnapping), property crimes, intellectual/industrial property fraud, adult missing persons, gambling control, and sports corruption/doping.
Central Criminal Intelligence Unit (UCIC): Develops operational and strategic criminal intelligence, managing analytical repositories like DIFO.
Central Economic and Fiscal Crime Unit (UDEF Central): Investigates financial fraud, corporate corruption, money laundering, tax evasion against the Public Treasury and Social Security, industrial espionage, and currency counterfeiting.
Central Cybercrime Unit (UCC): Leads operations against cyberattacks, malware development, cryptocurrency illicit flows, and technology-facilitated crimes against persons, such as child sexual exploitation.
Central Family and Woman Care Unit (UFAM Central): Institutional authority regarding domestic violence, gender-based violence, sexual assaults, and protection of vulnerable victims and minors.
General Commissariat of Information (Comisaría General de Información - CGI): Responsible for capturing, receiving, analyzing, and exploiting operational intelligence regarding state security and public order, centrally and internationally. Covers domestic terrorism, international terrorism, violent radicalism, destructive cults, counter-espionage, illegal arms trafficking, explosives/CBRN response (TEDAX-NRBQ), and foreign intelligence liaison.
General Commissariat of Immigration and Borders (Comisaría General de Extranjería y Fronteras - CGEF): Led operatively by the Central Unit for Immigration Networks and Document Fraud (UCRIF Central), which plans, coordinates, and controls operations targeting human trafficking, migrant smuggling, and documentary falsification:
Central Brigade Against Human Trafficking (BCSTH): Operative Section (Americas - Africa) and Operative Section (Europe).
Central Brigade for Networks Investigation (BIR): Operative Service (Document Fraud Investigation Section and Networks Investigation Section) alongside the Operative Support and Intelligence Collection Section.
Operational Service for International and Institutional Relations (SORI): Operating with its dedicated International and Institutional Relations Section.
Territorial units (UCRIF territoriales and Grupos Operativos de Extranjeros - GOE) maintain dual dependence: functionally dependent on CGEF through UCRIF Central, and organically dependent on their territorial chief.
International Cooperation Division (División de Cooperación Internacional): Central organ articulating operational, technical, and strategic international collaboration:
General Secretariat & International Communications Center (CenCI): Operates in Spanish, English, and French as a national single point of contact. Coordinates cross-border surveillance requests and integrates the National Central Office of the European Union BDL Network (Bureau de Liaison, an encrypted network connecting EU police forces).
International Coordination Unit: Manages bilateral and multilateral deployments, overseeing Interior Counselors, Attachés, and Liaison Officers deployed in Spanish embassies abroad.
OIPC-INTERPOL (International Criminal Police Organization): Headquartered in Lyon, France. Connects member states through the secure communications network, managing databases and international Red Notices. Operates through the National Central Bureau (OCN-INTERPOL) in Madrid.
Europol National Unit (UNE-EUROPOL): Operates with Europol headquarters in The Hague, Netherlands, to counter international organized crime and terrorism affecting two or more EU Member States. Mandate areas: terrorism, drug trafficking, money laundering, organized fraud, euro counterfeiting, human trafficking, and cybercrime. Staffed by liaison officers from CNP, Guardia Civil, Mossos d'Esquadra, Ertzaintza, Policía Foral de Navarra, and Customs Surveillance (DAVA). Spain maintains seven permanent Liaison Officers in The Hague ( CNP, Guardia Civil).
SIRENE Office (Supplementary Information Request at the National Entry): Manages supplementary operational exchanges connected to alerts entered into the Schengen Information System (SIS / SIS-RECAST), spanning European Arrest and Surrender Warrants (EAW/OEDE), entry bans, missing person locations, discrete surveillance checks, and seized objects (motor vehicles , firearms, blank IDs, stolen banknotes).
The Scientific Method of Police Investigation: Comprehensive Phases
Core Objectives of the Investigative Process:
The complete or "perfect" police investigation must sequentially fulfill three cumulative goals:
Clear the crime (Esclarecer el delito): Identify the material and intellectual authors.
Apprehend the perpetrators (Detener a los responsables): Physically locate and execute their lawful arrest.
Provide sufficient legal evidence (Aportar las pruebas necesarias y suficientes): Supply the judicial authority with solid, lawfully gathered physical, digital, and testimonial evidence to secure a criminal conviction.
Initiation of an Investigation:
By Formal Complaint (Denuncia): Statement of knowledge regarding a public crime conveyed in writing or verbally before Judicial Police or any law enforcement unit. Requires no procedural formality other than transmitting the notitia criminis. Can be anonymous (e.g., phone call), requiring police verification before drafting the formal atestado.
By Judicial or Prosecutorial Order (Por orden judicial o del Ministerio Fiscal): Transmitted via court order (oficio), originating from pre-procedural investigative proceedings (diligencias de investigación preprocesal) or an active judicial proceeding.
Ex Officio / Command Directive (De oficio o por orden de la superioridad): Originating internally via hierarchical command or initiated by operational units detecting indications of a criminal offense.
Mandatory Reporting and Deconfliction Protocol:
Prior to initiating any investigation, it is mandatory to transmit an initial investigative intelligence notice (Parte Informativo Investiga) to the Strategic Planning and Coordination Unit (UPEC) via the relevant intelligence structure (UCIC, UCI, UTI, UPI, or ULI). Subsequent operational advances must be communicated through continuous supplementary reports (Partes Ampliatorios).
Phase 1: Information Gathering (Fase de Obtención de Información):
First Responders Protocol at the Crime Scene (Citizen Security / GAC):
Victim Assistance: Render immediate medical aid, summon medical services, coordinate hospital transport, and secure the judicial medical report (parte facultativo).
Scene Protection: Secure the perimeter against unauthorized entry. Prevent alteration, destruction, or contamination of physical evidence. Establish a perimeter cordon ( in urban areas, in open terrain) with a single controlled entry/exit point.
Identification: Log identities of victims, direct witnesses, suspects, and emergency personnel entering the scene. Broadcast suspect descriptions and getaway details immediately via CIMACC 091.
Personal Searches & Arrests: Conduct personal searches, execute arrests, and read constitutional rights where legally applicable.
Specialized Scene Examinations:
Technical Police Inspection (Inspección Técnico Policial - ITP): Carried out by the Scientific Police. Focuses on forensic photography, topographical planimetry, latent lofoscopic fingerprint development, biological sample collection (blood, semen, saliva for DNA profiling), and inorganic trace recovery (ballistic cartridges, tool marks). Documented in formal Actas de ITP sent to the investigating team. Post-LECRim reform, ITP reports are not forwarded to courts in cases of unknown perpetrators, unless dealing with serious offenses like homicides.
Specialized Investigative Scene Inspection (Inspección Ocular de Investigación Especializada - IOIE): Executed by Judicial Police investigators. Complements the ITP through a factual reconstruction: determining access/egress routes, execution trajectory, modus operandi (MO), criminal tools used, point of attack, environmental factors, and criminal motive.
Follow-up Investigative Procedures:
Statements of Victims and Witnesses: Critical starting point. Direct witnesses (eyewitnesses who perceived events with their own senses) must be distinguished from indirect or hearsay witnesses (testigos de referencia). Documented in formal statements (Actas de declaración).
Database and Registry Queries: Systemic consultation of internal databases (Argos 2.0, Sidenpol Web, Orion, Adexttra, DNI, GATI) and external registries (property, commerce, municipal census, vehicle tracking).
Photographic Identification (Reconocimientos Fotográficos): Rigorous protocol: A minimum of five photographic foils of similar physical characteristics plus the candidate must be presented simultaneously. Digital archives allow narrowing candidates by physical description, modus operandi, and specialty. The victim or witness must view the numbered photos in isolation without suggestions or bias. If positive, an individualized acta is drafted recording the witness's literal degree of certainty. If the suspect is under arrest, their defense lawyer must be present.
Surveillance Footage & DIFO System: Recovering digital video footage from private or public CCTV systems. If full positive identification fails, investigators create a formal broadcast (Difusión) using the DIFO application (managed by UCIC/CGPJ). Receptor units across Spain compare the image against known criminal databases to associate crimes or identify perpetrators.
Phase 2: Data Analysis (Análisis de Datos):
Processing and structuring gathered intelligence using specialized analytical methods.
Comparative Case Analysis (Técnica Comparativa de Casos): Compares distinct criminal complaints sharing analogous parameters (time, geography, MO, physical descriptions). Useful in serial homicides, sexual assaults, armed robberies, and burglaries.
Analytical Utilities: Pinpointing or refining the modus operandi; uncovering spatial/temporal frequencies to establish preventative traps or patrols; generating criminogenic heat maps using Geographic Information Systems (GIS); profiling victims and offenders; executing crime linkage (acumulación delictiva por indicios de autoría).
Relational Schemes (Esquemas Relacionales): Visual diagrams displaying complex interpersonal links, financial transactions, communication lines, and operational hierarchies within organized groups for prosecutors and judges.
Phase 3: Hypothesis Formulation (Planteamiento de Hipótesis):
Constructing logical, theoretical propositions based on verified physical facts and empirical data. Must remain objective, avoiding bias, subjective obsession, or premature conclusions. Hypotheses must be continually tested and adapted to facts; facts must never be distorted to fit the hypothesis. New developments require supplementary intelligence reports (Partes Ampliatorios).
Phase 4: Operational Phase (Fase Operativa):
Active verification of the investigative hypothesis through specialized, intrusive techniques.
Formal Judicialization: Presenting findings to the Investigating Judge (Juez de Instrucción) and Public Prosecutor to obtain required judicial warrants.
Investigative Techniques: Extended physical surveillance and vehicle tailing; deployment of electronic GPS tracking beacons on vehicles; cross-unit collaboration (Citizen Security for traffic stops/arrests, Scientific Police for forensic reports, Foreigners units for deportations/records, UFAM for minor-related records); intelligence queries into criminal associates (consortes) via GATI; Open Source Intelligence (OSINT) and social network exploitation; advanced judicial techniques (telecommunication intercepts, bugging, undercover agents, controlled deliveries, and European Arrest Warrants).
Phase 5: Execution Phase (Fase de Ejecución):
Tactical deployment to arrest identified perpetrators once sufficient incriminatory evidence is compiled.
Execution of judicial entry and search warrants (entradas y registros) on dwellings, stash houses, and storage lockers to seize physical evidence, weapons, proceeds of crime, and illicit assets.
If an identified suspect evades arrest, formal search-and-arrest orders are inserted into the National Wanted Database (Base de Señalamientos Nacionales - BDSN) and the Schengen Information System (SIS).
Phase 6: Documentary Phase (Fase Documental):
Compiling the complete police file (Atestado policial), highlighting the Initial Diligence (Diligencia inicial) and the Report Diligence (Diligencia informe).
Immediate booking and photographic documentation (reseña fotográfica) of detainees to preserve their appearance at the time of arrest before jail conditions alter their look; obtaining DNA buccal swabs; medical checkups.
Formal interrogation of detainees in the presence of their retained or court-appointed legal counsel.
Conducting formal physical identification parades (rueda de reconocimiento): Exceptional in police stations, requiring a minimum of five participants with similar physical traits, strict visual separation between witness and parade members prior to the act, legal counsel attendance, and LAJ certification if executed in court.
Submitting proceedings to the Duty Court (Juzgado de Guardia) and Prosecutor's Office via the Lexnet system. Registering conclusion reports (Investiga Conclusión) and the Archiva Operational Summary (ROA).
Phase 7: Exploitation Phase (Fase de Explotación):
Post-arrest analysis of seized mobile phones, laptops, ledgers, and property to unlock new lines of inquiry. Identifies undetected co-conspirators, uncovers hidden caches of stolen goods or weapons, initiates parallel money laundering investigations, or links suspects to unresolved historical offenses.
Intelligence Sourcing, Analysis, and Coordination Systems
Conceptual Dichotomy: Information vs. Intelligence:
Information: Raw, evaluated knowledge concerning a fact, event, or individual of potential relevance to public security.
Intelligence: The finished product resulting from the systematic collection, evaluation, collation, integration, and analysis of raw information. Enables tactical decision-making.
Operational Intelligence: Focused on immediate, short-to-medium-term tactical deployments (e.g., planning a specific raid, executing arrests).
Strategic Intelligence: Focuses on long-term macro-trends, structural criminal evolution, and threat forecasting, allowing policymaking and preventative measures.
Cyberintelligence: Gathering and analyzing data within cyberspace to detect, attribute, and neutralize threat actors, informing both operational cases and high-level decisions.
Legal Limits and Validity of Information Gathering:
To remain procedurally valid in a rule-of-law framework, police intelligence must meet three strict criteria:
The investigative methods employed must be strictly lawful and supported by statutory authorization.
Collection must remain exclusively within the legitimate boundaries of public security and crime prevention.
Operations must be subjected to internal police reviews as well as external judicial and governmental oversight.
Information obtained unlawfully (e.g., unauthorized telephone taps, illegal entry) is tainted by the exclusionary rule, rendering it null and void.
Intelligence Coordination Architecture (UPEC & Central Units):
Operational coordination and strategic synthesis are directed by the Operational Deputy Directorate through the Strategic Planning and Coordination Unit (Unidad de Planificación Estratégica y Coordinación - UPEC):
Central Level: Dedicated intelligence units in each General Commissariat:
Central Criminal Intelligence Unit (UCIC) – Judicial Police.
National Immigration and Borders Center (CENIF) – Immigration and Borders.
Citizen Security Intelligence (ISECI) – Citizen Security.
Central Intelligence Unit (UCI) – Information.
Forensic Intelligence Group (GIF, under UCTRI) – Scientific Police.
Territorial Level: Territorial Intelligence Units (UTI), Provincial Intelligence Units (UPI), and Local Intelligence Units (ULI). Organically integrated into the Territorial Operational Coordination Units (UCOT) of the Jefaturas Superiores, but functionally dependent on the DAO through UPEC.
Core Police Databases and Applications (GATI):
INVESTIGAApplication:Tracks all active operational investigations across the country in real-time, preventing operational interference, redundant resource allocation, and compromised investigations. Identifies overlapping targets between different units.
Mandatory Parte de Inicio: Every unit opening an inquiry on individuals, vehicles, phone numbers, addresses, or businesses must file this report. The Intelligence Unit assigns a unique Investigation Number (Número Investiga - NIV).
Follow-up is documented via Partes de Ampliación. When concluded, a Parte de Conclusión details arrests, searches, seizures, and court dispositions.
Investigation statuses: Active (Activa), Passive (Pasiva - closed without outcome), Passive/Judicial Result (Pasiva/RJ - closed with judicial proceedings).
Automatic Expiration Rule: Investigations remain open as long as periodic updates are recorded. If elapse without a supplementary report, the Intelligence Unit automatically closes the investigation.
ARCHIVAApplication:A centralized repository of operational criminal profiles. When an individual is arrested, the operational unit completes an Operational Archiva Summary (Resumen Operativo Archiva - ROA).
Records somatic traits: age, ethnicity, height, build, eye/hair color, scars, amputations, tattoos, speech impediments, regional accents, tics. It documents aliases, criminal specializations, specific modi operandi, frequented locations (bars, parks, gyms), known criminal associates (consortes), utilized vehicles, phone numbers, and addresses.
Typology of Information Sources:
By Dependency:
Internal Sources (Fuentes Propias): Maintained by the police (GATI, Sidenpol, Argos 2.0, Orion, internal criminal dossiers).
External Sources (Fuentes Ajenas): Public or private external databases (Civil Registry, Tax Agency, Social Security, municipal census).
By Origin:
Documentary Sources: Subdivided by accessibility into: Open (freely accessible, e.g., internet, commercial registry); Semi-open (accessible via official police status, e.g., municipal padrón); Closed (requires express judicial warrant, e.g., Tax Agency banking records); Classified (governed by the Official Secrets Act).
Technical Sources: Information gathered via technological tools (GPS beacons, wiretaps, video surveillance, remote spyware). Highly reliable and objective, but require human interpretation.
Human Sources: The primary and most versatile source of intelligence.
Police Personnel: Undercover Agent (Agente Encubierto, Art. 282 bis LECrim), introduced into a criminal group under false identity authorized by the Investigating Judge or Public Prosecutor; Undercover Online Agent (Agente Encubierto Informático, Art. 282 bis 6 LECrim), authorized by a judge to operate in closed communication channels, forums, and encrypted platforms using a false digital persona to exchange illicit files.
Non-Police Personnel: Occasional Informant/Collaborator (citizens, concierges, postal workers who provide data without receiving compensation); Habitual Informant / Confidant (Confidente), individuals operating within or adjacent to criminal rings (or specific professions like private security guards, locksmiths, real estate workers) providing regular intelligence, often in exchange for lawful consideration.
Police Interrogation Guidelines:
An informal, voluntary interview between investigator and suspect to clarify facts, recover stolen assets, and establish co-conspirators. It is not a formal procedural statement and carries no autonomous evidentiary weight in court.
Requirements: Extensive knowledge of the case, preparation of an interview roadmap, avoiding personality clashes, eliminating external interruptions, and systematically cross-verifying supplied data.
Three Phases: Preparation (thorough analysis of records and accomplices), Development (direct confrontation, establishing criminal roles, identifying assets), Culmination (terminating once objectives are met or reaching an impasse).
Operational Order of Interviews: 1. Victims, 2. Witnesses (most cooperative first, reluctant last), 3. Suspects (from lowest to highest presumption of guilt).
Victim Interviewing Considerations: Must address personal trauma, prevent secondary victimization, detect hidden agendas (e.g., insurance fraud, false missing person reports concealing homicide, simulated crimes), and apply trauma-informed interview techniques.
Witness Interviewing Considerations: Distinguishes willingness to cooperate from cognitive reliability. Mitigates fears of criminal retaliation or courtroom fatigue, while checking confirmation bias or suggestibility by the interviewer.
Telecommunications Interception: Legal, Technical, and Operational Aspects
Constitutional and Statutory Foundations:
Guarantees secrecy of communications under Article 18.3 of the Spanish Constitution.
Strictly governed by Organic Law 13/2015, amending the Criminal Procedure Code (Articles 588 bis a-k and 588 ter a-m LECrim). The granting of a wiretap requires compliance with five principles: Specialty, Suitability, Exceptionality, Necessity, and Proportionality.
Limited to serious offenses, offenses committed by organized criminal structures, or crimes of major social transcendence.
Statutory Durations: Initial authorizations may not exceed , extendable in equal periods up to a maximum duration of . (Standard judicial practice grants initial terms and extensions in blocks).
Emergency Counter-Terrorism Procedure: In urgent cases involving armed groups or terrorist elements, the Minister of the Interior (or the Secretary of State for Security) may authorize the interception, provided it is reported to the competent judge within a maximum of , who must validate or revoke it within the subsequent .
Technical Targets and Operator Ecosystem:
Intercept targets: MSISDN (telephone subscriber number), IMSI (International Mobile Subscriber Identity, linking the SIM card), IMEI (International Mobile Equipment Identity, linking the physical hardware device), IP connections, email addresses, and associated metadata.
Associated Data (Datos Asociados): Cell tower antenna identifiers, geographic cell positioning, call forwarding, timestamps, call duration, technical identifiers (IMEI/IMSI), dialed numbers, and billing data.
Silent SMS: SITEL features covert signaling tools allowing the silent transmission of network messages to force a target terminal to connect to local cell towers, refreshing its geographical position without alerting the user.
Network Operators with Own Infrastructure in Spain: Movistar, Vodafone, MasOrange, and DIGI Mobile (deploying its own antenna network). Mobile Virtual Network Operators (MVNOs) lack physical radio infrastructure and lease access.
The Judicial Request (Oficio de Solicitud):
Must state the exact criminal offense, summarize the investigation, detail concrete criminal indicators, specify targets, and demonstrate that alternative, less intrusive investigative avenues were exhausted.
Avoid generic terms like "all communications." Standard phrasing: "se solicita intervención y grabación del contenido de la voz y datos, así como los datos asociados a ambas comunicaciones, desde el dd/mm/aaaa hasta el dd/mm/aaaa…"
Common Drafting Errors: Switching an IMEI/IMSI intercept to an MSISDN on an extension without notifying the judge; including multiple operators in a single warrant; omitting associated data; omitting expiration dates; missing diversion email address for email intercepts; misidentifying MVNO host networks.
Mandamiento Judicial: The judicial warrant must include the court designation, procedural number (Diligencias Previas, Sumario), exact target identifier, duration, signature/stamp, and the recipient operator.
SITEL (Telecommunications Interception Legal System):
National interception architecture featuring two Central Monitoring Centers: one for the National Police (managed by the Telecommunications Area of the Logistics and Innovation Subdirectorate) and one for the Guardia Civil.
Connected directly to national telecom operators and a dedicated distributed terminal network across all Jefaturas, Provincial, Local, and District Commissariats. Operates on dedicated computers requiring personalized credentials.
Includes a secure remote solution (Movilidad) consisting of an encrypted laptop and mobile device, enabling remote system access (excluding physical generation of master legal evidence discs).
Underlying Software Platforms:
RELIANT X(used by CGEyF, CGI, and all Provincial Information Brigades) andSILC 2(used by CGPJ and all territorial Judicial Police units).WebSITEL Internal Portal Utilities: Tablón Últimas Noticias, Portabilidad (operator lookup tool), PortalInfo (information units lookup), Date Calculator, HERMES (internal ticketing system for administrative and technical incidents).
SIGMASystem (Sistema Integral de Mandamientos Judiciales):Centralized application enabling investigators to upload judicial warrants and route automated requests directly to telecommunication operators under Law 25/2007 on data retention.
Operators must receive the original electronically signed PDF warrant within a maximum of . Automated query returns take a maximum of for historical retained data.
SIGMA Functional Modules:
Evidencia Legal: Extracts digital forensic evidence packages of operator responses for court presentation.
Pre-Altas: Generates the required text to be copied into police applications for judicial warrants.
Lecrim Module: Implements Article 588 ter m LECrim, allowing police investigators to query line ownership or subscriber identities directly via police oficio without prior judicial warrant. Service providers are legally mandated to respond under penalty of criminal disobedience.
Oficios Policiales: Stores all police requests submitted under the Lecrim module.
Intervención: Uploads court warrants for live content interception (voice, IP traffic).
Conservación de Datos: Formulates court-backed requests for historical call detail records, cell tower dumps, and subscriber data.
Mandamientos Judiciales: Central tracking dashboard monitoring the judicial status of warrants.
Other Forms of Interception:
Remote Software Searches (Registros Remotos sobre Equipos Informáticos, Arts. 588 sexies a-c LECrim): Installation of specialized trojan software/malware on target computers or phones to inspect encrypted communications, cloud accounts, and storage before encryption.
Environmental Audio Recording (Grabación de Comunicaciones Orales Directas, Art. 588 quater LECrim): Installation of covert listening devices and microphones in public spaces or private domiciles (requiring specific judicial authorization detailing entry).
Operational Execution and Exploitation of Wiretaps:
Listening Protocol: Monitored at minimum three times daily (shift start, mid-shift, and end of shift), .
Audio Dossier Management: Irrelevant calls receive an objective summary with timestamps and parties. Relevant calls must be transcribed literally and verbatim (unabridged). Foreign languages must be translated. Officer identity must be logged for each session for court ratification.
Analytical Considerations: Phone contact establishes a link, but does not confirm complicity; criminals utilize "clean phones," burner SIMs, and trade handsets; wiretaps must be corroborated with physical surveillance.
Slang and Argot Reports: When criminals employ code words, the team submits a formal explanatory report (Diligencia Informe) establishing an empirical glossary of terms for the court.
Incidental Discovery of Other Crimes (Hallazgo Casual): If wiretaps reveal an unrelated crime, the investigator must inform the judge immediately, who determines whether to authorize a new investigative proceeding.
Operational Practices: Surveillance, Tracking, and Domiciliary Entries and Searches
Conceptual Distinctions:
Surveillance (Vigilancia): Observation of persons, places, and activities, conducted on static positions or moving targets. Categorized as Active (offensive intelligence gathering) or Preventive (counter-surveillance / contravigilancia checks).
Tracking (Seguimiento): A specialized subset of surveillance maintaining continuous visual and technical control over an objective in motion (pedestrian or vehicle).
Core Principles and Operational Qualities:
Principles: Security (never be detected), Efficacy (maximize intelligence yield without compromising safety), Urban Recognition (mastering street layouts, public spaces, transit hubs), Teamwork, Unbroken View (maintaining direct visual or sensor contact), Cover (cobertura - realistic pretext and persona), and Contextual Clothing (blending in).
Observer Qualities: Naturalness in movement and speech, sustained mental concentration, observational memory, situational agility, initiative, and patience.
Material and Technical Resources:
Vehicles: Unmarked camouflaged vehicles ("K"), motorcycles, specialized observation vans ("Apolo" equipped with one-way glass and optical suites), helicopters, and bicycles.
Imaging and Audio Gear: Long-range cameras, thermal/night-vision scopes, covert body-worn cameras, IP mobile transmitters, UHF/VHF portable radios, micro-recorders, and real-time SITEL integration.
Electronic Tracking Beacons (Balizas Electrónicas): Technical devices utilizing GPS and cellular/radio networks, installed by the Specialized Systems Headquarters (Jefatura de Sistemas Especiales). Require judicial warrant (Art. 588 bis LECrim). Operate in sleep mode when static to conserve battery and evade frequency scanners. Provide movement alerts, boundary geofencing alerts, and parking alarms.
Drones (UAVs): High-resolution aerial surveillance over hazardous, rural, or inaccessible areas. Limited by battery duration and detectability; require coordinated handoffs (transiciones) with ground teams.
Surveillance Execution Mechanics:
Setup: Fixed Observation Point (Punto de observación fijo, typically an "Apolo" van or covert apartment) providing initial visual control and broadcasting exits, plus a Departure Base (Base de partida) holding the mobile team.
Foot Tracking Techniques:
In-Line (En hilera): Officers follow the target in a staggered line. The lead officer maintains direct visual contact; trailing officers react to radio updates. Relevos (handoffs) occur at turns and street corners. Suited for busy, broad avenues.
Triangle (En triángulo): Two officers follow on the target's sidewalk while a third walks parallel on the opposite sidewalk slightly ahead or abreast. Provides wider angles and easier handoffs. Suited for narrow, low-traffic streets.
Mixed In-Line/Triangle: Combines both styles, requiring at least four officers ( on each sidewalk).
Parallel (En paralelo): Lead officer tracks on the target street; backup officers advance on parallel streets, checking intersections. Demands high geographic knowledge; prioritizes security over proximity.
Fixed Points (Por puntos fijos): Multiple officers station themselves statically along a anticipated route, passing coverage from one fixed post to the next without trailing. Suited for hostile environments or counter-surveillance-trained targets.
Vehicle Tracking Techniques:
In-Line: Vehicles follow the target in traffic, keeping unrelated civilian vehicles in between. Minimum two officers per car (one driving, one observing/operating radio and prepared to dismount for foot pursuit).
Parallel: Backup vehicles travel on parallel avenues, checking intersections.
Forward / American (Delantera o Americana): A police vehicle precedes the target, tracking through rearview mirrors or relaying pace to trailing chase cars. Highly secure against counter-surveillance.
Fixed Points: Stationary vehicles positioned along avenues monitor transit without pursuing.
Traffic Incident Rules: If a suspect runs a red light to check for tails, the police vehicle must not copy the infraction; a trailing motorcycle can safely proceed through the intersection if feasible.
Public Transit & Venues: In buses, officers board after the target, switch off radios to prevent acoustic detection, and take seats near exits. In the metro, multiple officers disperse along platforms while vehicles monitor street exits. In restaurants, bars, and clubs, officers enter in small numbers, seat themselves with view of the target, and immediately settle bills to allow instant departures.
Counter-Surveillance Detection & Post-Mission Documentation:
Suspects frequently employ anti-surveillance checks: sudden stops, reversing direction, inspecting store window reflections, using buildings with dual exits, boarding and leaping off buses before door closure, or circling roundabouts.
Surveillance Report (Nota de Vigilancia): Clear, objective factual log (recording date, times, locations, meetings, license plates, photos). Never reveals police tactical methods or deployed hardware. Forms the cumulative surveillance diary (Diario de vigilancias).
Debriefing (Autocrítica): Mandatory operational review held immediately after service with all participants to analyze tactical errors, security breaches, and target behaviors.
Legal Protocol for Domiciliary Entry and Search (Entrada y Registro):
Domiciliary inviolability is protected under Article 18.2 of the Spanish Constitution. Lawful exceptions: Owner Consent, Flagrante Delicto, Judicial Warrant, or Emergency Anti-Terrorism operations.
Judicial warrant requests must establish: Necessity, Suitability, Proportionality, and Concrete Utility.
Judicial Commission: Formed by the Investigating Judge (optional), the Public Prosecutor (optional), the assigned Judicial Police team, and the Court Clerk (Letrado de la Administración de Justicia - LAJ), whose presence is mandatory to certify procedural authenticity (fe pública procesal). Tactical entry is executed by specialized units (GEO/GOES).
Procedural Requirements: The presence of the interested party or detainee is mandatory throughout the search, moving from room to room with the LAJ. The presence of the defense lawyer is not legally required (unless expressly authorized by the judge), and their absence does not suspend urgent execution. An interpreter must be summoned if foreign languages are involved.
Systematic Method of Search: Predetermined, methodical progression ("leave nothing unsearched, search nothing twice"). Each room is divided into spatial planes: walls, ceiling, and floor, processed in quadrants. Checks include dismantled furniture, appliances, electrical outlets, acoustic boxes, sanitary traps, and false ceilings.
Digital Device Searches: A standard home entry warrant does not authorize reading or accessing digital files on seized computers or phones. Article 588 sexies a-c LECrim mandates express, specific judicial authorization to access data contents. In-situ acquisitions require write-blockers and immediate forensic disk cloning.
Vehicle Searches: Motorized vehicles adapted as permanent dwellings (motorhomes, camper vans, caravans) enjoy constitutional protection as a morada, requiring consent or a warrant. Standard automobiles do not enjoy domicile status. Searches cover cabin, trunk, engine bay, and undercarriage, with specialized support from the Technical Intervention Operational Group (GOIT) to detect hidden compartments (caletas).
Cybercrime, Computer Fraud, and Digital Forensics
Foundations of Internet Networking:
Originated in the 1960s with the US military network ARPANET, designed to ensure communications survivability through packet switching across decentralized nodes.
The TCP/IP 4-Layer Architecture:
Application Layer: User-facing software protocols: HTTP/HTTPS (web), SMTP/POP3 (email), FTP (file transfers), and DNS (name resolution).
Transport Layer: Manages end-to-end data transmission, segmenting information and assigning port numbers (e.g., HTTP , SMTP , FTP ). Utilizes TCP (connection-oriented, guaranteed delivery, sequenced) or UDP (connectionless, fast, no error recovery, used in video streaming).
Internet Layer: The core layer for police tracking. Encapsulates transport segments into IP packets, appending source and destination IP addresses, and routing them dynamically across autonomous networks.
Network Access Layer: Handles physical transmission across media (Ethernet, Wi-Fi, optical fiber) and converts digital packets into electrical or optical signals. Utilizes the Address Resolution Protocol (ARP) to map logical IP addresses to physical hardware Media Access Control (MAC) addresses.
IP Addressing Architecture:
IPv4: Built on , written as four decimal octets () separated by periods, yielding addresses. Private IP ranges: Class A (), Class B (), and Class C (). Reserved addresses include loopback () and broadcast (). Routers assign private IPs internally and map devices to a single external public IP via Network Address Translation (NAT).
- *IPv6:* Built on , represented as eight groups of four hexadecimal digits separated by colons (e.g., `2001:0db8:0000:0000:0000:0000:1428:57ab`). Compression rules: 1. Omit leading zeros in any four-digit block (`2001:db8:0:0:0:0:1428:57ab`); 2. Compress contiguous groups of zero blocks using double colons (`::`) exactly once (`2001:db8::1428:57ab`). Global Unicast Addresses (GUA) operate as the IPv6 public equivalent.
DNS (Domain Name System): Resolves human-readable domain names to numerical IP addresses. Domain structure features Top-Level Domains (TLDs), including generic TLDs (gTLDs:
.com,.org), country-code TLDs (ccTLDs:.es,.fr), and sponsored TLDs (sTLDs:.gov,.mil,.edu). Ownership queries use WHOIS and RDAP (Registration Data Access Protocol).Digital Tracking and Anonymization Mechanisms:
Web Tracking: Analysis of the Uniform Resource Locator (URL:
protocol://domain/path?parameters). Distinguishing domain registrars from hosting servers is critical to target judicial production orders.Email Tracking: Parsing raw SMTP message headers (
Received:tags andX-Originating-IP). Victims must forward scam emails as an attachment (.emlor.msg) to prevent stripping header routing data.Event Logs: Chronological system files recording IP addresses, user identifiers, timestamps (synchronized to UTC), and browser user-agent strings.
Anonymization Vectors: Public Wi-Fi networks (masking personal identity behind commercial IPs), Virtual Private Networks (VPNs, which encapsulate traffic in encrypted tunnels), Proxy servers, and The Onion Router (TOR) multi-node encrypted network.
Artificial Intelligence in Law Enforcement:
Threats: Automated phishing, sophisticated social engineering, generative deepfakes (synthetic audio/video generated by Generative Adversarial Networks - GANs) used in CEO fraud or identity theft.
Investigative Applications: Real-time automated CCTV pattern analysis, biometric matching against booking records, document parsing, and threat alerts.
Risks: Algorithmic bias resulting from unrepresentative training datasets, potential privacy violations, and lack of accountability, requiring human investigator review of all AI findings.
Major Computer Fraud Typologies:
According to SES data, computer fraud increased by from 2016 to 2024, representing of all reported cybercrimes in Spain.
Social Engineering Frauds:
Phishing: Deceptive emails mimicking legitimate institutions to harvest credentials or credit card numbers.
Spear Phishing: Tailored, research-driven attacks targeting a specific individual or corporation.
Business Email Compromise (BEC): Multi-stage corporate fraud: 1. Target reconnaissance; 2. Compromising/spoofing executive or supplier email accounts; 3. Deceptive payment diversion instructing accounts to pay into criminal accounts; 4. Money laundering through money mules and rapid cash withdrawals.
Smishing & Vishing: Phishing deployed via SMS messages or spoofed voice calls.
Romance Scams & "Son in Distress" (Hijo en apuros): Emotional manipulation on dating apps or WhatsApp urgent emergency messages requesting money transfers.
Technical Attacks:
Pharming: Exploiting DNS server vulnerabilities to modify IP resolution, silently redirecting users typing legitimate banking domains to clone websites.
Man-in-the-Middle (MitM): Covertly intercepting and modifying communication flows between two parties, typically on unencrypted Wi-Fi networks.
Ransomware: Extortion malware delivered via malicious attachments or vulnerabilities that encrypts organizational files and demands a cryptocurrency ransom payment.
Electronic Banking & Payment Frauds:
Carding: Illicit acquisition and trading of credit card numbers, expiry dates, and CVVs on the dark web.
Relay Attack (Shimmer): Ultra-thin electronic devices inserted into the smart-chip slot of an ATM or payment terminal, intercepting data exchanges between chip and reader and relaying them over Bluetooth to nearby accomplices.
Digital Skimming (Web Skimming / e-Skimming): Malicious JavaScript injected into e-commerce payment checkout pages to harvest customer payment card data.
SIM Swapping: Fraudulently obtaining a duplicate SIM card from a telecom carrier by impersonating the victim, intercepting SMS two-factor authentication (2FA) codes to drain bank accounts.
Investment & Mass Marketing Frauds:
Pump and Dump: Artificially inflating low-value assets or cryptocurrency tokens via deceptive marketing before dumping holdings at the peak.
Fake Crypto ICOs & Mining: Fraudulent initial coin offerings, Ponzi schemes, and fake cloud-mining contracts.
Mass Marketing Scams: Lottery notifications, fake loan fees, technical support scams, and traditional advance-fee "Nigerian letters" (419 scams).
Methodology for Investigating Economic Cybercrimes:
ODAC Reception Protocol: Chronological recording of facts, bank statements bearing official institutional stamps, transaction IDs, full Primary Account Numbers (PANs), complete IBANs, and raw email attachments. Rapid requests to Interpol via the I-GRIP mechanism can be initiated directly from the ODAC to freeze illicit funds transferred abroad.
Analytical Concepts: Distinguish "Potential Beneficiary" (the person who ultimately profits from the funds) from "Unconscious Participation" (victims whose identities or compromised accounts were co-opted without their knowledge). The financial trail is tracked through the Financial Ownership Database (Fichero de Titularidades Financieras - FTF).
Cryptocurrency Wallets & Seizure Protocol: Wallets manage cryptographic private and public keys. Divided into Hot Wallets (connected to internet platforms) and Cold Wallets (offline physical hardware).
During domiciliary searches, hardware wallets (e.g., Ledger, Trezor) must be seized along with their recovery seed phrases to access the blockchain ledger before assets are moved remotely. Mobile devices must be placed in airplane mode and stored in anti-static Faraday bags.
Documentary Closure: Proceedings are routed to court with the explicit heading "Criminalidad Tecnológica", with a copy sent to the Provincial Delegate Prosecutor for Computer Crime.
Property Crimes: Burglary, Skill Thefts, Violent Robbery, and Vehicle Trafficking
Robbery with Force (Robos con Fuerza en las Cosas):
Characterized by force applied against physical structures rather than individuals. Governed operatively by national initiatives like the Plan de actuación contra robos en domicilio y delincuencia itinerante, and operations Nómada, Rochas, Condor, and Cobre.
Attacks Without External Signs of Force ("Llave Falsa"):
Slip (Resbalón): Inserting a flexible plastic strip, X-ray sheet, or cut plastic bottle between the door leaf and frame to depress the spring-latch on unbolted doors. Frequently committed by mobile groups of Eastern European women who wear socks over their hands to avoid leaving fingerprints.
Bumping: Inserting an altered key ("bumping key") matching the lock cylinder profile. Applying light rotational torque while tapping the key head displaces the upper driver pins across the shear line, unlocking the cylinder. Highly effective on pin-tumbler locks, but ineffective against double-bit lever locks (cerraduras de borjas).
Impressioning: Applying aluminum foil or adhesive metallic tape over a blank key blade. When rotated in the cylinder, lock pins leave physical indents on the foil, creating a working key. Variants utilize malleable aluminum wire strips and pick profiles on serrated locks.
Picks & Swords (Ganzúas y Espadas): Manipulating pins with tension tools and picks. The specialized "Magic Key" tool uses interchangeable pins to defeat double-bit lever locks (cerraduras de borjas).
Attacks With External Signs of Force:
Crowbar (Palanqueta / Pata de cabra): Forcing door frames at the bolt or hinge side.
Pliers Lock-Snapping (Pico de loro / Tenaza grip): Clamping a pipe wrench or slip-joint pliers onto protruding lock cylinders to twist and snap the body at its central screw line.
Cylinder Puller (Sacacorchos / Extractor de bombines): Driving a hardened screw into the lock keyway and applying a mechanical pulling bracket to extract the cylinder core, exposing internal lock levers to manual release.
Wall and Ceiling Breaches (Butrón y Rififí): Piercing walls, floors, or roofs using sledgehammers, picks, or pneumatic drills. Rififí specifically refers to vertical roof breaches.
Attacking Safes: Breached mechanically via drills and sledgehammers, circular diamond saws (muela/radial, leaving clean, straight longitudinal cuts), oxy-acetylene or thermal torches (leaving irregular melted edges and slag), core drills (taladro pasante), and thermal lances (lanza térmica, consuming iron rods fed with pure oxygen at temperatures exceeding ).
- *Ram-Raiding (*Alunizaje*):* Crashing stolen vehicles directly into storefronts.
Motor Vehicle Crimes and Identification:
Vehicles are targeted for Joyriding, commission of other crimes/getaways, chop-shop parts sales, or illicit international trafficking.
License Plates: Issued by provincial traffic directorates (DGT). Physical plates display two mandatory codes: the manufacturer code (top center edge: "PM" followed by five digits and provincial letters) and the manipulator code (left vertical edge, read top-to-bottom: six digits identifying the embossing shop). Standard aluminum plates are used alongside high-gloss acrylic plates.
Vehicle Documentation: Registration Certificate (Permiso de Circulación, tracking vehicle ownership and administrative details) and Technical Inspection Card (Tarjeta ITV), currently managed digitally through the DGT's FIR system.
Vehicle Identification Number (VIN / Bastidor): Unified 17-character alphanumeric code (ISO 3779), stamped on the chassis frame and divided into three sections:
World Manufacturer Identifier (WMI): First characters denoting geographical region, country, and manufacturing corporation.
Vehicle Descriptor Section (VDS): Characters detailing vehicle model, engine, bodywork, and transmission specifications.
Vehicle Identifier Section (VIS): Characters , where the final six characters must be digits (with rare exceptions like Citroën) indicating the individual assembly-line serial sequence, model year, and factory code.
VIN Falsification Methods: Re-stamping (retroquelamiento - grinding off original characters and stamping new numbers over the ground area) and Grafting (injerto - cutting out the metal chassis sheet bearing the legitimate VIN and welding in a stolen vehicle's VIN plate).
Thefts by Skill and Distraction (Hurtos con Habilidad y Astucia):
Characterized by the absence of violence, intimidation, or property damage.
Modalities: Pickpockets (carteristas), retail shoplifting gangs (hurto retail), and structured distraction decoys:
"Affectionate Theft" (Hurto cariñoso/amoroso): Female perpetrators (frequently of Romanian Roma origin) target elderly victims, embracing them effusively under false pretexts (asking for hospital directions, offering sexual favors) to unfasten gold chains and luxury watches. Escalates to robbery with violence if the victim resists.
Fake Inspectors (Falsos revisores): Impersonating gas or utility technicians to enter homes, distracting elderly occupants in the kitchen while accomplices search bedrooms for cash and jewelry.
Flat-Tire Trick (Método del pinchazo): Puncturing a tire while a victim is at a bank, following them, offering help when they pull over, and looting bags from the unlocked cabin.
Dropped-Coin Trick (Método de la siembra): Dropping coins near a victim at an ATM or parking lot; when the victim bends over to assist, accomplices steal purses or cards.
Stain Trick (Método de la mancha): Spraying liquid on a victim's coat, apologizing, and cleaning the stain while picking their pockets.
Robberies with Violence and Intimidation:
Carotid Chokehold (El Ahogamiento / Mataleón): Trailing a victim from behind, applying forearm constriction to the carotid arteries to cause rapid cerebral hypoxia and unconsciousness, allowing accomplices to loot belongings.
Edged-Weapon Mugging (La Sirla): Threatening victims with knives, broken bottles, or needles in low-traffic, poorly lit public areas, commonly committed by drug-dependent or juvenile offenders.
Commercial Armed Robberies (Atracos): Targeting banks, jewelers, and armored cash carriers. Investigated by specialized robbery squads (Grupos de Atracos - UDEV / UDEV Central).
Bank Robbery Protocols: Prioritize the safety of employees and customers; never provoke a hostage situation. Bank alarms trigger the CIMACC protocol. Investigators recover bait banknotes (billetes cebo with recorded serial numbers) and examine CCTV.
Fencing and Illicit Commerce (Receptación):
Fences (peristas) purchase stolen goods knowing their illicit origin to resell them for profit. Categorized into marginal/street peristas (reselling within delinquent networks) and commercial/legal peristas (jewelers, pawnshops, antique dealers, scrap yards).
Regulated under Organic Law 4/2015 on Citizen Security. Establishments must maintain physical/digital transaction registry books (libros-registro) and contracts containing full seller identification (DNI/NIE). Monitored via the Functional Operational Plan GOLD (POF-ORO, renewed indefinitely since September 2020) and the Plan Comercio Seguro.
Crimes Against Persons: Homicide, Missing Persons, Sexual Crimes, and Assault
Homicide Investigation Protocol:
Governed by DAO Instructions of April 21, 2003, June 14, 2016, and Instruction 2/2024 regarding mandatory reporting of homicides to the CGPJ.
Verification of Death: First responders assess negative vital signs (cessation of respiration, circulation, and nervous activity) and positive cadaveric phenomena: cooling (algor mortis), post-mortem lividity (livor mortis), muscle stiffening (rigor mortis), and putrefaction.
Securing the Scene: Immediate preservation is crucial. Establish a double security perimeter: an inner operational zone and an outer exclusion zone, with a single monitored entry/exit point. Entry is restricted exclusively to authorized personnel wearing protective overshoes, gloves, and masks. The initial response team logs all entries (medical personnel, firefighters, judicial officers). A clear walkway (camino de papel) is laid down to the body to prevent cross-contamination.
Tripartite On-Scene Coordination:
Citizen Security (GAC): Cordon the area, preserve physical elements, gather preliminary witness accounts, detain suspects on site, and brief investigators.
Scientific Police (ITP / DEVI): Execute technical and photographic work, laser scanning planimetry, ballistic trajectory assessment, and collect biological/fingerprint samples.
Homicide Squad (IOIE): Direct the overall investigation, establish the crime sequence, evaluate the victim's social sphere, coordinate with the coroner (médico forense), and direct door-to-door neighborhood inquiries (información vecinal y zonal) during the critical first .
Scene Typology: Primary Scene (where the body was found / homicide occurred), Secondary Scene (where physical evidence or weapons were discarded), and Intermediate Scenes (vehicles or routes used for body disposal).
Missing Persons (Personas Desaparecidas):
Governed by SES Instruction 3/2019 and the II Strategic Plan on Missing Persons (2025–2029). Managed centrally by the National Center for Missing Persons (Centro Nacional de Desaparecidos - CNDES).
There is no requirement for a waiting period before filing a report; early reporting is vital.
Typologies of Disappearances:
Conscious Disappearances: Voluntary departures by legal adults, runaway minors (particularly institutionalized girls at risk of sexual grooming/exploitation), and potential suicides.
Involuntary Disappearances: Sudden events lacking criminal intent: cognitive impairment (Alzheimer's disease), severe psychiatric illness, natural catastrophes, or accidents.
Criminal Disappearances: Derived from criminal offenses: kidnappings, homicides, human trafficking, or parental child abductions.
Filing Complaints and Database Workflow:
Complaints are entered in
PROMETEOunder the specific missing person module. This automatically updatesPDyRH(National Database of Missing Persons and Unidentified Human Remains).
A national search-and-locate warrant is published in
BDSN, showing the confirmation: "DESAPARECIDO DIFUNDIDO CORRECTAMENTE AL SISTEMA PDYRH".
- *Alert Systems:* Public activation of Child Alert (*Alerta-Menor*, former Amber Alert) and Missing Senior Alert (*Alerta-MAYOR DESAPARECIDO*), coordinated through CEPIC.
- *Location and Closure:* Upon locating the person, an *InfoCese* is processed in `PDyRH`, canceling the warrant in `BDSN`. Rescued minors are interviewed regarding their disappearance reasons and returned to parents or protective services.
Crimes Against Sexual Freedom:
Governed by Order INT/2678/2015 and the internal operating manual of the Family and Woman Care Units (UFAM).
Immediate Response Protocol: Prioritize victim medical and psychological stabilization. Victims must be transported directly to a hospital emergency center for specialized examination by the duty forensic doctor (médico forense). The victim must not wash, shower, or discard clothing before this examination.
Evidence Collection: Clothing must be removed onto clean examination paper, dried if damp, and stored in breathable paper bags or cardboard boxes (never plastic, which degrades biological DNA samples). Swabs collect semen, saliva, skin cells, and vaginal/anal fluids.
Chemical Submission (Sumisión Química): Blood and urine samples must be collected to detect incapacitating substances. Burundanga (scopolamine) clears rapidly: detectable up to in blood and in urine. Hair analysis is required if over have elapsed.
Legal Status: Semipublic offense (Article 191 of the Criminal Code), requiring a formal complaint by the victim or legal representative, unless the victim is a minor or incapacitated, in which case the Public Prosecutor initiates proceedings directly.
Investigative Analysis: Differentiates the offender's Modus Operandi (tactical methods) from their Signature (psychologically driven, ritualistic behaviors indicating deeper motivations). DNA samples taken from suspects require informed consent or a judicial warrant.
Crimes of Bodily Harm / Assault (Lesiones):
Categorized under the Criminal Code based on medical outcome: An injury constitutes a serious or less serious crime (delito grave o menos grave) if it requires medical or surgical treatment beyond initial assistance for recovery. Injuries requiring only first aid constitute a minor offense (delito leve). Any domestic violence assault is treated as a crime regardless of treatment level.
Investigative Procedure: Grounded on the official medical injury report (parte facultativo). Covers autonomous assault (e.g., weekend nightlife altercations, mutual brawls) and concurrent assault (violence deployed as a means to commit robbery or rape).
Drug Trafficking, Human Exploitation, and Violent Radicalism
Large-Scale Organized Drug Trafficking:
Directed centrally by the Central Narcotics Brigade (Brigada Central de Estupefacientes) within UDYCO Central, and deployed regionally through Special Response Groups Against Organized Crime (GRECO).
Investigated under strict deconfliction through the Investigation Coordination System (SCI) run by the Counter-Terrorism and Organized Crime Intelligence Center (CITCO).
Logistics and Concealment Methods:
Road: Hidden custom compartments (caletas) built into vehicle bumpers, dashboards, and side panels; "Go-Fast" convoys carrying open loads; concealed loads inside commercial freight (TIR).
Maritime: Cargo ships operating as offshore motherships; commercial containers breached via the "blind hook" (gancho ciego - breaking and replacing security seals at ports without the exporter's knowledge); high-speed boats (narco-lanchas / rigid inflatable boats [RIBs] with three or four outboard engines, classified as prohibited contraband under Royal Decree-Law 16/2018); fishing vessels; and pleasure yachts.
Aviation & Couriers: Light aircraft, commercial flights using human couriers (mulas), who carry packages taped to their bodies or swallow latex-wrapped pellets.
Retail Street Drug Trafficking (Menudeo):
Direct consumer sales at local drug points (narcopisos, shantytowns, nightlife venues). Sales points are structurally fortified with steel-reinforced bunker doors and peepholes.
Division of Labor within Retail Drug Points:
Aguador: Lookout positioned at entrances to monitor and warn of police presence ("dar el agua").
Machaca: Doorkeeper providing security and regulating customer entry into the sales bunker.
Camello: Direct seller dispensing individual doses (papelinas), keeping small quantities on hand to avoid severe penalties if caught.
Reponedor / Guardador: Stash runner holding bulk inventory nearby, delivering small batches () to the seller on credit.
Guardador de dinero / joyas: Safekeeper of cash, gold jewelry, and weapons.
Proveedor: Wholesaler supplying kilograms of narcotics.
Pasador: Courier moving drugs from wholesaler to stash runner using a lead scout vehicle (coche lanzadera).
Police Operational Tactics: Covert surveillance logs transactions. Interception teams stop buyers away from the sales point, seizing drug doses under Article 36.16 of Organic Law 4/2015. Confirmed purchases build grounds for a judicial search warrant executed using tactical breaching tools.
Human Trafficking and Exploitation Networks:
Governed by the Palermo Protocol (UN, 2000) and Article 177 bis of the Criminal Code. Comprises three mandatory elements: Action (recruiting, transporting, harboring), Means (threat, force, deception, coercion, abuse of vulnerability), and Purpose (exploitation).
Trafficking in Human Beings (Trata de Seres Humanos) vs. Migrant Smuggling (Tráfico de Inmigrantes):
Trafficking: A human rights violation. Victim consent is legally void if coercive means are used. Exploitation is ongoing at the destination point.
Smuggling: A violation of state immigration boundaries. The migrant consents to transport; the transaction ends once the border is crossed.
Investigative Method: Led by UCRIF Central and territorial GOE units. Targets commercial trace points: adult ads, transport bookings, safehouse leases, and remittance wire transfers. Joint inspections involve the Labor and Social Security Inspection. Victim assistance relies on Article 59 bis of Organic Law 4/2000 (providing reflection periods, temporary residence, social protection, and witness protection).
Hate Crimes and Violent Extremism:
Hate Crime: Offenses where the victim or property is targeted due to actual or perceived affiliation with a protected group (race, ethnicity, religion, sexual orientation, disability, poverty). Governed by the National Action Plan Against Hate Crimes (III Plan approved via Instruction 6/2025).
Polarization Indicators (Indicadores de Polarización): Key evidentiary elements: subjective victim perception, victim minority affiliation, discrimination by association, hate speech/slurs, offender tattoos/clothing (neo-Nazi, RAC/OI symbols), extremist paraphernalia, prior criminal records, proximity to places of worship or NGOs, ties to radical football ultra firms, gratuitous violence, and social media activity (ciberodio).
Terrorism and Jihadist Threat:
Terrorism Framework: Governed by the EU Council Framework Decision of June 13, 2002, and the National Strategic Plan Against Violent Radicalization (PEN-LCRV). Features ideologically motivated violence seeking to intimidate populations, compel state authorities, or destabilize constitutional structures.
Terrorist Typologies: Geographic (autochthonous/national vs. international), Target (indiscriminate vs. selective), Objective (ideological, separatist, or religious).
Jihadist Doctrine: Rooted in a radical interpretation of Sunni Islam. Key concepts: Sharia (divine law), Istishhad (suicide martyrdom), Jihad (Minor Jihad used to justify warfare), Near Enemy (apostate Arab regimes) vs. Far Enemy (Western democracies), and Salafism/Wahhabism.
Historical Drivers: The pivotal year 1979 (Soviet-Afghan war triggering the global mujahideen movement, the Iranian Islamic Revolution, and the Grand Mosque of Mecca siege).
Current Threat Vectors: Centralized groups (Al-Qaeda, DAESH), autonomous cells, lone actors, Foreign Terrorist Fighters (FTF) and returnees (retornados), and prison radicalization networks.
Four-Stage Radicalization Model (National Court Ruling 38/2016):
Victimhood (Victimismo): Depicting the global Muslim community (Umma) as systematically oppressed by the West.
Blame (Culpabilización): Blaming Western states, Shiites, and moderate Arab governments for this suffering.
Solution (Solución): Prompting the individual to seek an active religious response to the injustice.
Activism (Activismo): Embracing violent extremism, justifying attacks, and pledging allegiance to terrorist groups.
Tactics: Attacking soft targets (transit networks, public events) using readily accessible weapons (knives, vehicle rammings) alongside explosives. Counter-terrorism units (CGI, Information Brigades) emphasize early prevention, intelligence deconfliction via CITCO, community detection, and tracking explosive precursors.