 |
|
 |
|
|
|
|
|
9 TYPES OF CYBER CRIME
1. THEFT OF TELECOMMUNICATIONS SERVICES
The "phone phreakers" of three decades ago set a precedent for what has become a major criminal industry. By gaining access to an organisation's telephone switchboard (PBX) individuals or criminal organisations can obtain access to dial-in/dial-out circuits and then make their own calls or sell call time to third parties (Gold 1999). Offenders may gain access to the switchboard by impersonating a technician, by fraudulently obtaining an employee's access code, or by using software available on the internet. Some sophisticated offenders loop between PBX systems to evade detection. Additional forms of service theft include capturing "calling card" details and on-selling calls charged to the calling card account, and counterfeiting or illicit reprogramming of stored value telephone cards.
It has been suggested that as long ago as 1990, security failures at one major telecommunications carrier cost approximately £290 million, and that more recently, up to 5% of total industry turnover has been lost to fraud (Schieck 1995: 2-5; Newman 1998). Costs to individual subscribers can also be significant In one case, computer hackers in the United States illegally obtained access to Scotland Yard's telephone network and made £620,000 worth of international calls for which Scotland Yard was responsible (Tendler and Nuttall 1996).
2. COMMUNICATIONS IN FURTHERANCE OF CRIMINAL CONSPIRACIES
Just as legitimate organisations in the private and public sectors rely upon information systems for communications and record keeping, so too are the activities of criminal organisations enhanced by technology.
There is evidence of telecommunications equipment being used to facilitate organised drug trafficking, gambling, prostitution, money laundering, child pornography and trade in weapons (in those jurisdictions where such activities are illegal). The use of encryption technology may place criminal communications beyond the reach of law enforcement.
The use of computer networks to produce and distribute child pornography has become the subject of increasing attention. Today, these materials can be imported across national borders at the speed of light (Grant, David and Grabosky 1997). The more overt manifestations of internet child pornography entail a modest degree of organisation, as required by the infrastructure of IRC and WWW, but the activity appears largely confined to individuals.
By contrast, some of the less publicly visible traffic in child pornography activity appears to entail a greater degree of organisation. Although knowledge is confined to that conduct which has been the target of successful police investigation, there appear to have been a number of networks which extend cross-nationally, use sophisticated technologies of concealment, and entail a significant degree of coordination.
Illustrative of such activity was the Wonderland Club, an international network with members in at least 14 nations ranging from Europe, to North America, to Australia. Access to the group was password protected, and content was encrypted. Police investigation of the activity, codenamed "Operation Cathedral" resulted in approximately 100 arrests around the world, and the seizure of over 100,000 images in September, 1998.
3. TELECOMMUNICATIONS PIRACY
Digital technology permits perfect reproduction and easy dissemination of print, graphics, sound, and multimedia combinations. The temptation to reproduce copyrighted material for personal use, for sale at a lower price, or indeed, for free distribution, has proven irresistable to many.
This has caused considerable concern to owners of copyrighted material. Each year, it has been estimated that losses of between US$15 and US$17 billion are sustained by industry by reason of copyright infringement (United States, Information Infrastructure Task Force 1995, 131).
The Software Publishers Association has estimated that $7.4 billion worth of software was lost to piracy in 1993 with $2 billion of that being stolen from the Internet (Meyer and Underwood 1994).
Ryan (1998) puts the cost of foreign piracy to American industry at more than $10 billion in 1996, including $1.8 billion in the film industry, $1.2 billion in music, $3.8 billion in business application software, and $690 million in book publishing.
According to the Straits Times (8/11/99) A copy of the most recent James Bond Film The World is Not Enough, was available free on the internet before its official release.
When creators of a work, in whatever medium, are unable to profit from their creations, there can be a chilling effect on creative effort generally, in addition to financial loss.
4. DISSEMINATION OF OFFENSIVE MATERIALS
Content considered by some to be objectionable exists in abundance in cyberspace. This includes, among much else, sexually explicit materials, racist propaganda, and instructions for the fabrication of incendiary and explosive devices. Telecommunications systems can also be used for harassing, threatening or intrusive communications, from the traditional obscene telephone call to its contemporary manifestation in "cyber-stalking", in which persistent messages are sent to an unwilling recipient.
One man allegedly stole nude photographs of his former girlfriend and her new boyfriend and posted them on the Internet, along with her name, address and telephone number. The unfortunate couple, residents of Kenosha, Wisconsin, received phone calls and e-mails from strangers as far away as Denmark who said they had seen the photos on the Internet. Investigations also revealed that the suspect was maintaining records about the woman's movements and compiling information about her family (Spice and Sink 1999).
In another case a rejected suitor posted invitations on the Internet under the name of a 28-year-old woman, the would-be object of his affections, that said that she had fantasies of rape and gang rape. He then communicated via email with men who replied to the solicitations and gave out personal information about the woman, including her address, phone number, details of her physical appearance and how to bypass her home security system. Strange men turned up at her home on six different occasions and she received many obscene phone calls. While the woman was not physically assaulted, she would not answer the phone, was afraid to leave her home, and lost her job (Miller 1999; Miller and Maharaj 1999).
One former university student in California used email to harass 5 female students in 1998. He bought information on the Internet about the women using a professor's credit card and then sent 100 messages including death threats, graphic sexual descriptions and references to their daily activities. He apparently made the threats in response to perceived teasing about his appearance (Associated Press 1999a).
Computer networks may also be used in furtherance of extortion. The Sunday Times (London) reported in 1996 that over 40 financial institutions in Britain and the United States had been attacked electronically over the previous three years. In England, financial institutions were reported to have paid significant amounts to sophisticated computer criminals who threatened to wipe out computer systems. (The Sunday Times, June 2, 1996). The article cited four incidents between 1993 and 1995 in which a total of 42.5 million Pounds Sterling were paid by senior executives of the organisations concerned, who were convinced of the extortionists' capacity to crash their computer systems (Denning 1999 233-4).
5. ELECTRONIC MONEY LAUNDERING AND TAX EVASION
For some time now, electronic funds transfers have assisted in concealing and in moving the proceeds of crime. Emerging technologies will greatly assist in concealing the origin of ill-gotten gains. Legitimately derived income may also be more easily concealed from taxation authorities. Large financial institutions will no longer be the only ones with the ability to achieve electronic funds transfers transiting numerous jurisdictions at the speed of light. The development of informal banking institutions and parallel banking systems may permit central bank supervision to be bypassed, but can also facilitate the evasion of cash transaction reporting requirements in those nations which have them. Traditional underground banks, which have flourished in Asian countries for centuries, will enjoy even greater capacity through the use of telecommunications.
With the emergence and proliferation of various technologies of electronic commerce, one can easily envisage how traditional countermeasures against money laundering and tax evasion may soon be of limited value. I may soon be able to sell you a quantity of heroin, in return for an untraceable transfer of stored value to my "smart-card", which I then download anonymously to my account in a financial institution situated in an overseas jurisdiction which protects the privacy of banking clients. I can discreetly draw upon these funds as and when I may require, downloading them back to my stored value card (Wahlert 1996).
6. ELECTRONIC VANDALISM, TERRORISM AND EXTORTION
As never before, western industrial society is dependent upon complex data processing and telecommunications systems. Damage to, or interference with, any of these systems can lead to catastrophic consequences. Whether motivated by curiosity or vindictiveness electronic intruders cause inconvenience at best, and have the potential for inflicting massive harm (Hundley and Anderson 1995, Schwartau 1994).
While this potential has yet to be realised, a number of individuals and protest groups have hacked the official web pages of various governmental and commercial organisations (Rathmell 1997). http://www.2600.com/hacked_pages/ (visited 4 January 2000). This may also operate in reverse: early in 1999 an organised hacking incident was apparently directed at a server which hosted the Internet domain for East Timor, which at the time was seeking its independence from Indonesia (Creed 1999).
Defence planners around the world are investing substantially in information warfare-- means of disrupting the information technology infrastructure of defence systems (Stix 1995). Attempts were made to disrupt the computer systems of the Sri Lankan Government (Associated Press 1998), and of the North Atlantic Treaty Organization during the 1999 bombing of Belgrade (BBC 1999). One case, which illustrates the transnational reach of extortionists, involved a number of German hackers who compromised the system of an Internet service provider in South Florida, disabling eight of the ISPs ten servers. The offenders obtained personal information and credit card details of 10,000 subscribers, and, communicating via electronic mail through one of the compromised accounts, demanded that US$30,000 be delivered to a mail drop in Germany. Co-operation between US and German authorities resulted in the arrest of the extortionists (Bauer 1998).
More recently, an extortionist in Eastern Europe obtained the credit card details of customers of a North American based on-line music retailer, and published some on the Internet when the retailer refused to comply with his demands (Markoff 2000).
7. SALES AND INVESTMENT FRAUD
As electronic commerce becomes more prevalent, the application of digital technology to fraudulent endeavours will be that much greater. The use of the telephone for fraudulent sales pitches, deceptive charitable solicitations, or bogus investment overtures is increasingly common. Cyberspace now abounds with a wide variety of investment opportunities, from traditional securities such as stocks and bonds, to more exotic opportunities such as coconut farming, the sale and leaseback of automatic teller machines, and worldwide telephone lotteries (Cella and Stark 1997 837-844). Indeed, the digital age has been accompanied by unprecedented opportunities for misinformation. Fraudsters now enjoy direct access to millions of prospective victims around the world, instantaneously and at minimal cost.
Classic pyramid schemes and "Exciting, Low-Risk Investment Opportunities" are not uncommon. The technology of the World Wide Web is ideally suited to investment solicitations. In the words of two SEC staff "At very little cost, and from the privacy of a basement office or living room, the fraudster can produce a home page that looks better and more sophisticated than that of a Fortune 500 company" (Cella and Stark 1997, 822).
8. ILLEGAL INTERCEPTION OF TELECOMMUNICATIONS
Developments in telecommunications provide new opportunities for electronic eavesdropping. From activities as time-honoured as surveillance of an unfaithful spouse, to the newest forms of political and industrial espionage, telecommunications interception has increasing applications. Here again, technological developments create new vulnerabilities. The electromagnetic signals emitted by a computer may themselves be intercepted. Cables may act as broadcast antennas. Existing law does not prevent the remote monitoring of computer radiation.
It has been reported that the notorious American hacker Kevin Poulsen was able to gain access to law enforcement and national security wiretap data prior to his arrest in 1991 (Littman 1997). In 1995, hackers employed by a criminal organisation attacked the communications system of the Amsterdam Police. The hackers succeeded in gaining police operational intelligence, and in disrupting police communications (Rathmell 1997).
9. ELECTRONIC FUNDS TRANSFER FRAUD
Electronic funds transfer systems have begun to proliferate, and so has the risk that such transactions may be intercepted and diverted. Valid credit card numbers can be intercepted electronically, as well as physically; the digital information stored on a card can be counterfeited.
Of course, we don't need Willie Sutton to remind us that banks are where they keep the money. In 1994, a Russian hacker Vladimir Levin, operating from St Petersburg, accessed the computers of Citibank's central wire transfer department, and transferred funds from large corporate accounts to other accounts which had been opened by his accomplices in The United States, the Netherlands, Finland, Germany, and Israel. Officials from one of the corporate victims, located in Argentina, notified the bank, and the suspect accounts, located in San Francisco, were frozen. The accomplice was arrested. Another accomplice was caught attempting to withdraw funds from an account in Rotterdam. Although Russian law precluded Levin's extradition, he was arrested during a visit to the United States and subsequently imprisoned. (Denning 1999, 55).
The above forms of computer-related crime are not necessarily mutually exclusive, and need not occur in isolation. Just as an armed robber might steal an automobile to facilitate a quick getaway, so too can one steal telecommunications services and use them for purposes of vandalism, fraud, or in furtherance of a criminal conspiracy.1 Computer-related crime may be compound in nature, combining two or more of the generic forms outlined above.
The various activities of Kevin Mitnick, as described in Hafner and Markoff (1991) are illustrative.
Problem areas
Telecommunications
Electronic vandalism, terrorism and extortion
Stealing telecommunications services
Telecommunications piracy
Pornography and other offensive material
Telemarketing fraud
Electronic fund transfer crime
Electronic money laundering
Legal areas
Here are just a few rhetorical questions about the law relating to search and seizure of electronic evidence. These were formulated in October 1998 at a special expert working group meeting convened in Tokyo under the auspices of the United Nations and with the involvement of the Australian Institute of Criminology.
(a) Investigative issues
(i) Does the law distinguish between the search and seizure of stored data in a computer, and the interception of data that is being communicated from one computer to another or within a computer system?
(ii) Can a person voluntarily provide law enforcement agents with electronic data that may afford evidence of a crime? Can a person voluntarily permit law enforcement agents to undertake a search for such data, rather than provide it to them? Could continuing cooperation of this nature by a person with law enforcement have a legal effect on the ability of law enforcement to obtain or use the data?
(iii) In most jurisdictions, the ability of law enforcement to obtain data that may afford evidence usually requires some form of prior judicial approval. What legal authority is required for obtaining electronic stored data without the consent of the persons concerned?
(iv) Electronic data under most jurisdictions is considered as being intangible. The law of some jurisdictions may only permit seizure of tangible material. In such cases, intangible data can only be obtained by seizing the physical medium (e.g., data on diskette or other storage medium) on which the data is stored and found. Do your nation's laws provide for the seizure of intangible data without seizure of the physical medium which it is found?
(v) In some cases, the precise location of electronic data within a computer system may not be apparent. How specific must be the description in the judicial authority (e.g., search warrant) of the place to be searched or the data to be seized?
(vi) In most jurisdictions, the scope of a warrant should be as narrow as possible. The precise location of the electronic data may not be immediately apparent at the time a warrant is sought, or even when law enforcement agents arrive at the scene. Does the law provide guidance on whether to seize the entire computer system, or merely one or more of its components? What practical criteria do law enforcement use to make this decision? How would this be done in practice?
(vii) Does your law obligate a suspect or a third person to provide access (including passwords) to a computer system that is the target of a lawful search? If not, what practical measures or tools can be employed by law enforcement to gain access?
(viii) Seizure of, or during the course of a search the shutting down of, an entire computer system may be extremely intrusive, and particularly burdensome to an ongoing business. What practical circumstances would justify seizing or shutting down a complete system rather than merely taking a copy of the data? Does the law provide for copying of relevant data as an alternative to seizure, and can the copy be regarded as admissible evidence? Would the law permit the seizure of the entire data base for the purpose of subsequently identifying the relevant data? What practical means can be used to copy large volumes of data?
(ix) In the course of a search, law enforcement authorities may come across incriminating data related to the crime under investigation, but which was not originally specified within the scope of the warrant. Can this data be legally seized without obtaining another warrant?
(x) In the course of a search, law enforcement authorities may come across electronic data relating to a crime different from that which is under the current investigation. Can this data be legally seized without obtaining another warrant?
(xi) Does the law permit seizure of data, without a warrant, under exigent circumstances, such as when there is risk of erasure or destruction of data? Alternatively, are law enforcement agents able to secure the premises or computer system, pending the obtaining of a warrant?
(xii) In some cases, the data sought may be located on another computer system that is networked to the system currently being searched. Does the law permit an extension of the search into the connected system in order to search and seize relevant data within the scope of the warrant? Can the warrant include an authorization to extend the search to the connected system? Alternatively, can law enforcement obtain a second warrant to extend the search from one system to the other?
(xiii) Are there any circumstances under which the law permits stored data to be obtained by means of a judicial order to deliver such data to law enforcement authorities, as opposed to the law enforcement authorities themselves searching and seizing it?
(b) Stored transaction data
(i) Records of service use, also known as transaction data, may be kept by some telecommunication carriers and internet service providers. Some carriers or ISPs may, for business or security purposes, retain such data for a period of time. In some jurisdictions, the cooperation of Internet service providers (ISPs) in identifying suspects may be obtained informally. Can this data be voluntarily provided to law enforcement agents by carriers and service providers? Does the law provide a means by which this data can be compulsorily obtained by law enforcement authorities?
(ii) Which types of transaction data does law enforcement require? Which types of transaction data do telecommunications carriers retain? For how long do the carriers or ISPs retain such data? Are there any laws or regulations which require them to retain such data, or to dispose of it after a certain period of time?
(c) Electronic communications
(i) Does the law permit law enforcement to collect current or future transaction data (including the source or destination of communications)? Can this authority for collection of current and future transaction data be achieved by satisfying legal conditions less onerous than that required to intercept the content of communications? What practical or technological means can be used to collect such data? Does law enforcement have the capability to undertake such techniques?
(ii) Even when one is able to determine the location from which a communication originates, identifying the human source of the communication may prove to be challenging. What legal and/or technological tools are available for this purpose?
(iii) How is the ability to collect such current or future transaction data affected if the communication crosses jurisdictional borders, including international borders?
(iv) Does the law permit interception of communications for the purpose of obtaining their content? Does the law permit this interception in respect of communications between computer systems or their components, as well as between persons? Does law enforcement have the practical capability to undertake such investigative techniques?
(v) In some cases, search or interception may be more efficiently and more effectively carried out by representatives of the telecommunications or ISP industry rather than law enforcement personnel. Does the law provide authority or obligation for private organizations or individuals to engage or assist in interception or search on behalf of the state? How does this affect the admissibility of the data as evidence in judicial proceedings? If there is no such authority or obligation, are there trained law enforcement personnel to undertake this task, and how would they do so?
(d) Analysis of data
(i) What legal, practical or technical means are available to preserve the data seized or intercepted in order to ensure its presentation and admissibility in judicial proceedings? What procedures should be followed?
(ii) If the data seized are encrypted, what legal, practical or technical means are available to allow law enforcement to decrypt data? Does law enforcement have legal authority to decrypt seized data using technical means? Can an order be sought from a judicial authority to compel decryption by the suspect or a third person? Can an order be sought to compel a suspect or a third person to hand over the encryption key or algorithm to law enforcement?
(e) Human rights and privacy safeguards
(i) Can a person to whom compulsory measures are applied, as above, challenge the lawfulness of such measures before a court, either before or after execution?
(ii) What legal protections exist for law enforcement agents who are undertaking a coercive investigative measure such as a search and seizure, or interception?
(iii) Which types of remedies may be ordered by a judicial authority?
(iv) How would such remedies be obtained or enforced in the context of a trans-border search?
(v) To what extent would legal protections or immunities apply to law
enforcement from another country who are undertaking a trans-border search
in your country?
See the AIC website http://www.aic.gov.au for other publications and papers on cyber crime.