Computer Crime

views updated

COMPUTER CRIME

According to the U.S. Uniform Crime Reporting Statistics, by 2000 more than 300 million users around the globe accessed the World Wide Web. Of those, at least 1 million were engaged in illegal Internet activities (computer crime or "cyber-crime"). Cyber-crimes include Internet-related forgery, embezzlement, fraud, vandalism, and the disposal of stolen goods. The potential threat to the overall development of e-commerce was serious—so much so that online security expenditures were expected to double to $30 billion in 2004.

The Computer Crime and Security Survey, issued by the Computer Security Institute (CSI) and the FBI, reported that 85 percent of the 538 firms and governmental institutions surveyed found security breaches in 2000. Sixty-five percent admitted that such breaches had caused financial losses. The 186 respondents willing to quantify their losses claimed they totaled $378 million, a 42-percent increase from 1999 and the highest amount recorded since the surveys began in 1995. Seventy percent cited their Internet connections as the source of security problems.

Perhaps 80 percent of all computer-related crimes result from insider attacks, sometimes perpetrated by recently laid-off employees with still-active computer accounts. Fraud and forensic experts reported that organized crime and terrorist groups recruit telecommunications workers to use telephone networks to commit fraud, piracy, and money laundering.

DEFINITIONS

Computer crime includes traditional criminal acts committed with a computer, as well as new offenses that lack any parallels with non-computer crimes. The diversity of offenses renders any narrow definition unworkable. The U.S. Department of Justice (DOJ) broadly defines computer crimes as "any violations of criminal law that involve a knowledge of computer technology for their perpetration, investigation, or prosecution." Accurate statistics on the extent of this phenomenon have proven to be elusive because of the difficulty in adequately defining computer crimes. The statistics also are untrustworthy due to victims' failure to report incidents. The aggregate annual losses to businesses and governments are estimated to be in the billions of dollars.

Some of the most notorious computer crimes have involved computer viruses, such as the Melissa virus that appeared on the Internet in March 1999 and infected systems in the United States and Europe, and the February 2000 distributed denial of service (DDS) attacks on several leading commercial Web sites including Yahoo!, E*Trade, Amazon.com, and eBay.

Cyber-crimes are frequently grouped into three categories. The first are those in which the computer comprises the "object" of a crime and in which the perpetrator targets the computer itself. This includes theft of computer processor time and computerized services. The second category involves those in which the computer forms the "subject" of a crime, either as the physical site of the offense or as the source of some form of loss or damage. This category includes viruses and related attacks. Finally, the third category includes those in which the computer serves as the "instrument" used to commit traditional crimes in cyberspace. This encompasses offenses like cyber-fraud, online harassment, and child pornography.

Though teenage hackers and underage, e-fraud perpetrators have captured headlines, no "typical" cyber-criminal exists. Perpetrators also commit cyber-crimes for a variety of reasons. Motives range from a desire to showcase technical expertise, to exposing vulnerabilities in computer security systems, retaliating against former employers, or sabotaging government computer systems.

TYPES OF COMPUTER CRIMES

Distributed denial of service attacks rank among the most widely reported cyber-crimes. They first appeared in mid-1999 and are relatively easy to perpetrate. Many of the tools required to carry them off are freely available online. Often, DDS attack networks consist of hundreds of compromised systems. The attacker inaugurates the attack sequence from one or more consoles, and it can affect thousands of systems worldwide.

Virus programs infect computer files by inserting copies of themselves into those files; they are spread from host to host when users transmit infected files by e-mail, over the Internet, across a company's network, or by disk. The Melissa Virus interrupted e-mail service around the world when it was posted to an Internet newsgroup on March 26, 1999, affecting perhaps 100,000 users and one-fifth of all U.S. businesses. Related problems include worms, which can travel within a computer or network without a user transmitting files; trojan horses, which are disguised as innocuous files but which, once activated, can steal users' login names and passwords, thus facilitating identity theft; and logic bombs, programs activated by a specific event.

Two reports issued by the CIA's National Intelligence Council and the Center for Strategic and International Studies in December 2000 predicted that, during the first two decades of the 21st century, Internet-enabled terrorists would launch attacks on the United States with computer viruses and logic bombs in an attempt to destroy America's private-sector infrastructure. The reports also envisioned a future cyber-arms race, for which the United States would need to develop a "cyber-arsenal."

The Internet facilitates terrorism by permitting virtually anonymous communication among terror-ists—transmissions that are very difficult to track and intercept. The targets of cyber-terrorists could include air-traffic systems and stock exchanges. Hackers even have successfully broken into governmental systems and launched denial-of-service attacks, such as the 2000 hacker penetration of a printer at the U.S. Navy's Space and Naval Warfare Center that resulted in the transmission of potentially sensitive information to a server in Russia. In 1994, hackers breached the Air Force's main command and control research center. The following year, the Pentagon reported 250,000 attacks on its computers, with 65 percent resulting in computer network entry.

Other widely publicized computer crimes involved online fraud, such as stock scams and securities fraud via the Internet. The Securities and Exchange Commission (SEC), which receives about 300 complaints a day concerning online scams, devotes one-fourth of its enforcement staff to computer-related offenses. Theft of online content also is common. A Software & Information Industry Association study maintained that one-third of all business software applications in use in 1999 were pirated copies. And the Internet has made the distribution of information obtained in identity thefts, such as a person's name or social security number, much quicker and easier. The dissemination of child pornography online also has garnered widespread public and law-enforcement attention. Other offenses, such as stalking victims via the Internet, have only recently begun to be addressed.

ANTI-CYBER-CRIME LEGISLATION

Approximately 40 federal statutes govern the prosecution of computer-related crimes. Among the most prominent are the Copyright Act, the National Stolen Property Act, mail and wire fraud statutes, the Electronic Communications Privacy Act, the Communications Decency Act of 1996, the Child Pornography Prevention Act, and the Child Pornography Prevention Act of 1996.

Congress recognized computer-related crimes as discrete federal offenses with the 1984 passage of the Counterfeit Access Device and Computer Fraud and Abuse Law, which was revised four times in the following decade. This law narrowly protected classified U.S. defense and foreign relations information, files of financial institutions and consumer reporting agencies, and access to governmental computers.

Congress enacted another major anti-cyber-crime law in 1996, the National Information Infrastructure Protection Act (NIIPA). NIIPA broadened the scope of protection offered by the Computer Fraud and Abuse Law by covering all computers attached to the Internet and, therefore all computers used in interstate commerce. It also criminalized all unauthorized access of computer files in order to transmit classified government information; intentional access of U.S. department or agency non-public computers without permission; and accessing protected computers, without or beyond authorization, to defraud and obtain something of value.

The Copyright Act covers computer-related copyright infractions, such as software piracy. The act provides criminal remedies for any intentional infringement of a copyright perpetrated for commercial advantage or private financial gain. Given the ease and anonymity of nearly identical reproductions made of online intellectual property, such as software, digitized text, and audio and visual files—and the ability to disseminate those copies worldwide—many see copyright as an increasingly costly cyber-crime offense. Traditional exceptions to copyright privileges, such as "fair use" and the "right of first sale," may be eroded under evolving copyright protection laws in cyberspace. Digital intellectual property rights also are regulated by the No Electronic Theft Act of 1996, which criminalizes the electronic reproduction and dissemination of copyrighted material.

The National Stolen Property Act (NSPA) has been extended to cover the fraudulent transfer of funds online, as well as the theft of tangible hardware. The courts have determined that federal mail and wire fraud statutes, which outlaw the use of interstate wire communications or the mail to defraud persons of money or property, also can apply to computer-aided theft. However, the case law on this point is still evolving.

One of the most controversial areas of cyber law, the extent of online privacy protection, was addressed in the Electronic Communications Privacy Act of 1986 (ECPA). ECPA has been utilized to prosecute computer hacking, since it strengthens the privacy rights of computer users and permits law enforcement to use electronic surveillance when investigating computer crimes. ECPA also has been used in cases of the theft of encrypted, satellite-transmitted television broadcasts.

The problem of online child pornography spawned several laws intended to block the online transmission of pornographic material to minors. Congress passed the Communications Decency Act of 1996 (CDA, also Title V of the Telecommunications Act of 1996), which prohibited the transmission of "indecent," "patently offensive," and "obscene" material to minors over the Internet. However, the Supreme Court invalidated certain sections of the DCA in Reno v. American Civil Liberties Union, stating that they infringed the First Amendment protection of free speech.

In response, Congress passed the Child Online Protection Act, which penalized any commercial Web site that allowed children to access content that was "harmful to minors." By summer 2001, this act was challenged on First Amendment grounds in a U.S. circuit court. The Internet's role in the production and dissemination of child pornography also is addressed by the Child Pornography Prevention Act of 1996 (CPPA), intended to criminalize the production, distribution, and reception of computer-generated, sexual images of children. The CPPA has survived constitutional challenges in court.

Despite the plethora of anti-cyber-crime laws, few cases have been adjudicated under them. This is due to the reluctance of victims to lodge suits, the difficulty of gathering evidence and identifying perpetrators in cyberspace, the desire of many victims to pursue matters privately, and the fact that many such incidents were prosecuted under state, rather than federal, laws. Prosecution of cyber-crime raises several difficult constitutional dilemmas. Among these are Fourth Amendment concerns about the legality of the search and seizure of computer records and software, First Amendment concerns about freedom of speech, and general questions about the extent of citizens' online privacy.

Since 1978, the states also have addressed cyber-crimes in their own legislation, with Arizona and Florida being the first to do so. Every state has some such legislation on the books. The states have taken the lead in specifically addressing some forms of cyber-crime, such as online harassment. However, the expansion of state computer crime legislation also generates conflicts between federal and state authorities regarding cyber-crime prosecution.

ENFORCEMENT AGENCIES

Despite the relative infrequency of cyber-crime prosecutions to date, the U.S. government has backed numerous initiatives to encourage and invigorate prosecution efforts. In 1995, the Federal Bureau of Investigation (FBI) launched its "Innocent Images" probe to track down online child pornography. By March of 1999, the effort had resulted in more than 200 convictions. The FBI also hosts computer crime teams in its 56 field offices and organized the Infrastructure Protection and Computer Intrusion Squad (ICPIS) in Washington D.C., which constitutes a national investigative body and resource on cyber-crime. The FBI's InfraGard program fosters cooperation between federal law enforcement officials and the private sector. InfraGard maintains a secure Web site so businesses can alert law enforcement agencies about suspicious network activity or attacks.

The DOJ addresses computer crime through its Computer Crime and Intellectual Property Section (CCIPS), founded in 1991. Among other duties, CCIPS enforces the NET Act and collaborates with assistant U.S. attorneys around the country to target cyber-crimes. Other sections of the DOJ's Criminal Division target e-crime within their areas of particular concern, such as fraud, child exploitation and obscenity, and terrorism and violent crime.

The Electronic Crimes Task Force (ECTF) forms a central clearinghouse dedicated to computer-related crimes for all local, state, and national law enforcement. Based in New York City, it is headed by the U.S. Secret Service and cooperates with selected partners from private industry. ECTF has successfully cracked large drug cartels, organized crime groups, and individual hackers. The ECTF also generated the precedent for e-mail wiretapping when it arrested 44 members of the John Gotti Jr. crime group for telecommunications fraud.

The DOJ, FBI, Department of Defense, and members of business also cooperate in the National Infrastructure Protection Center (NIPC), created in 1998 to aid in the enforcement of existing anti-cyber-crime laws and to foster cooperation among public-and private-sector prosecution efforts. The NIPC focuses on identifying viruses, issuing warnings, and locating cyber-criminals.

Another government and industry collaboration is the Computer Emergency Response Team (CERT) Coordination Center, dedicated to detecting, disseminating information about, and disabling computer viruses. CERT, part of the Software Engineering Institute (SEI), a publicly and privately funded research and development center, was founded in 1988. CERT has combated more than 17,000 different viruses.

The September 11, 2001 terrorist attacks on the World Trade Center and the Pentagon threw into high relief the vulnerability of the United States to terrorist incursions. In response, the Bush administration authorized the creation of a new, cabinet-level National Homeland Security Agency (NHSA), which had been originally proposed in a series of recommendations by the U.S. Commission on National Security in January 2001. NHSA's responsibilities would include coordinating government and private sector efforts to protect the nation's critical infrastructure from cyber and physical attacks. Additional measures under discussion were the expansion of enforcement authority to investigate money laundering, control borders, detain immigrants, and to wiretap phones and screen e-mails without a warrant. Authorities also could use techniques such as data-mining programs to locate terrorists in cyberspace. Such efforts will build on the emerging field of computer forensics, which dissects storage media to find evidence via specialized software and techniques. One such tool is an IP filter, which uses fuzzy logic to track down e-mail addresses and URLs associated with Internet use.

INTERNATIONAL COMPUTER CRIME

Since the Internet is not limited by geography, crimes committed in cyberspace can easily achieve global dimensions. Systems can be accessed from anywhere in the world, and locating perpetrators is difficult. Many computer fraud and embezzlement schemes target international financial networks. Organized crime groups can utilize information technology to evade identification and carry out drug trafficking and money laundering on a global scale. Questions of jurisdiction and apprehension become much more complicated in international cyberspace.

Estimates place annual business losses to cyber crime at roughly $1.5 billion. Many hackers are based in countries far from those they affect. For example, the author of the Love Bug virus that affected the United States was located in the Philippines. Many authorities suspect that organized "cyber-crime gangs" frequently originate in developing countries, such as the former Soviet republics where computer-crime laws are lax and enforcement is haphazard.

Individual countries vary widely in the legal approaches they have taken to regulating the Internet. Some strictly observant Islamic nations have tried to contain the dissemination of information online, which they view as containing messages potentially harmful to their populaces. Germany has tried to restrict Web sites containing Neo-Nazi content. China installed firewalls to prevent its citizens from accessing unauthorized sites, and Burma bans Internet access completely.

Britain has led in the passage of legislation designed to combat "cyber-terrorism." In February 2000 it passed the British Terrorism Act, which includes in its ban on terrorist groups those who disrupt hospitals or power supplies by hacking into computer systems. A revision of the Regulation of Investigatory Powers Act gives police broad access to e-mail and other online communications.

The Council of Europe's proposed cyber-crime treaty, the initial draft of which was released in April 2000, generated the most controversy of any international cyber legislation proposed to date. It spans a broad spectrum of cyber-crimes from copyright infringement to online terrorism. The treaty seeks to harmonize European criminal laws regarding data interception, interference, and online fraud. Any member nation's enforcement authorities would be granted online entry to any other state in order to pursue a cyber-crime investigation. Governments also could also employ new powers on wiretapping, real-time collection of traffic data, and the search and seizure of digital information. Opponents worry that the treaty ignores individual civil liberties and intellectual property rights. Many U.S. business and governmental officials also oppose adoption of the treaty in its proposed form.

Finally, the global interconnection of computer systems fostered a push for international cooperation to combat computer-related crimes. In 1998 Britain, Canada, France, Germany, Italy, Japan, Russia, and the United States agreed to coordinate efforts to investigate and prosecute cyber-crimes. Among the solutions under debate was an international treaty to standardize domestic cyber-crime laws. Thorny topics include the extent to which governments should allow the free movement of data encryption, which protects the electronic information from compromise but also can be used by criminals to shield their activities. Increased government surveillance of online communications is criticized by privacy advocates and members of various ethnic and racial groups, who feel that it constitutes a form of illegal profiling. The regulation of content, which might suppress hate speech or child pornography, faces obstacles from proponents of free expression.