Criminology Research Project Inc.

The Internet has thrown wide the windows of the world, allowing us to learn and communicate and conduct business in ways that were unimaginable 20 years ago.  This is the upside of globalization, as  author Tom Friedman has noted in best-sellers such as The World is Flat.  The downside of our increasingly flat world is that the Internet is not just a conduit for commerce, but also a conduit for crime.

The Internet has created virtual doors into our lives, our finances, our businesses, and our national security. Criminals, spies, and terrorists are testing our doorknobs every day, looking for a way in.

Cyber crime is a nebulous concept.  It is difficult to grasp intangible threats, and easy to dismiss them as unlikely to happen to you.  So far, too little attention has been paid to cyber threats—and their consequences.

Have you ever though of strangers walking through your offices, homes, and dorm rooms?  What if they were opening drawers, reading your files, accessing your bank accounts, or stealing your company’s research and development?

Friends, this is happening at this very moment!  Intruders are reading our mail and hacking into our networks every day, looking for valuable information,.  Unfortunately, they are finding all of this because many of us are not aware of the threat these people pose to our privacy, our economic stability, and even our national security.

Most of us, including myself, assume that we will not be targets of cyber crime.  We, as a result, are not as careful as we know we should be.  The Director of the Federal Bureau of Investigation, Robert S. Mueller,III tells this true story; Not long ago, the head of one of our nation’s domestic agencies received an e-mail purporting to be from his bank.  It looked perfectly legitimate, and asked him to verify some information.  He started to follow the instructions, but realized this might not be such a good idea.  It turned out that he was just a few clicks away from falling into a classic Internet “phishing” scam.  This is someone who spends a good deal of his professional life warning others about the perils of cyber crime!  He, however, barely caught himself in time.  Director Mueller knows this is a true story as this person!

In July of 2008, a California oil and gas company called Pacific Energy Resources contacted the FBI and the Long Beach Police Department to report a computer attack.  Six computer servers had been rendered inoperable, disabling the critical leak-detection systems of three off-shore oil platforms.  This was the last in a series of network attacks which cost the company over $100,000 in losses.’’   An investigation led the FBI to a former IT contractor.  After he had been dismissed from his job, he retaliated by remotely accessing the computer system.  His actions could potentially have resulted in significant environmental damage. He pled guilty to a federal computer intrusion charge and faces up to 10 years in prison.

This past April, someone hacked into the database of the Virginia Department of Health Professionals.  The intruder blocked over 8 million patient records—records that hospitals, doctors, and pharmacies depend on in order to accurately prescribe and dispense medication.  Those records are no longer blocked and the FBI continues to investigate.

In the book, The Cuckoo’s Egg, the author chronicles the electronic adventure of Cliff Stoll, a systems manager at a Berkeley laboratory.  In the mid-1980s, he noticed an accounting disparity of 75 cents.  This was before the Internet as we know it today.  He tracked it to an unauthorized user who had repeatedly broken into the system and then used the lab’s computers to tap into military networks.  He eventually traced the attacks to a German hacker who was part of an espionage ring.  The book was prescient.  Twenty years later the entire world is online.  Because the web offers near-total anonymity it is much more difficult to discern the identity, motives, and location of an intruder.

In an early stage investigation it is not known if the problem is the dealing with a spy, a company insider, or an organized criminal group.  Something that looks like an ordinary phishing scam may be an attempt by a terrorist group to raise funding for an operation.  An intrusion into a corporate network could be the work of a high school hacker across the street or it could be a hostile foreign power across the globe.

Cyber threats present a unique challenge to law enforcement because so little is known and, equally, there is a tendency for investigators to compartmentalize an early investigation.  Criminal cases are usually separate from espionage cases, which in turn are separate from counterterrorism cases.  When it come to cyber threats, however, there is almost always some overlap.

It is the job of the FBI to serve both as a law enforcement and national security agency.  This is critical because what may start as a criminal investigation may lead to a national security threat.

Part 2 of this series continues tomorrow.  (CRP wishes to recognize the research efforts of the FBI in making this article possible)

They were crimes born of the Internet age — romantic solicitations on popular Web site Craigslist that police say led to the fatal shooting of one woman and the robbery of another in Boston hotels this past spring.

And it was high-tech, 21st-century sleuthing, along with some old-fashioned gumshoe detective work, that put police on the trail toward a suspect and eventually an arrest.

CNN’s Randi Kaye recently took a behind-the-scenes look at how technology was used to lead police to 23-year-old medical student Philip Markoff, who has been indicted on seven counts, including first-degree murder.

Prosecutors said Julissa Brisman, a model from New York who advertised as a masseuse on Craigslist, was shot three times at close range and suffered blunt head trauma at the Marriott Copley Place hotel on April 14. And a 29-year-old Las Vegas, Nevada, woman was robbed of $800 in cash and $250 in American Express gift cards at the Westin Copley Place hotel, police reports said.

Investigators knew they had crimes born of the Internet on their hands, but how were they able to use that same technology to help them find a suspect who went to great lengths to hide his tracks?

“The figures involved communicated with each other [via] text and e-mail, and they only met at the very last minute,” said special correspondent Maureen Orth, who investigated the story for Vanity Fair magazine. “And then the way the police were able to solve the crime was going back, using the clicks and the Internet addresses.”

In Brisman’s case, police knew she had communicated on Craigslist with a person calling himself “Andy.”

Mark Rasch once headed the computer crimes unit at the U.S. Department of Justice. Now an Internet forensic expert, he helped Boston police track the alleged killer.

“The first thing you start with was the e-mail address. In this case, it’s an e-mail address from Live.com, which is Microsoft,” Rasch explained to CNN’s Kaye.

Rasch showed Kaye the tracer program he used to help follow the e-mails from “Andy.”

“Trace Back does what it says — traces the route that the e-mail took on its way from its origin to the destination,” Rasch said.

Rasch says police got the Internet protocol address for the e-mailer’s computer. From there, investigators tracked down the company providing Internet service to the suspect, which told them that the subscriber lived in a Quincy apartment building, outside Boston.

Even though police had what they believed was the killer’s real name and home address, that still was not enough, Kaye reports.

“They have to validate and actually get this guy’s fingers on the keyboard,” Rasch said. “So in the end, they reverted to the old gumshoe thing of a stakeout.”

Police zeroed in on Markoff.  They’d seen a tall, blond male they believed was the killer on the hotel surveillance cameras. And they did what many people do on a daily basis — they Googled him.

Police learned their prime suspect was a medical student at Boston University. He was engaged to be married.

Again, the Internet helped. They got a better look at him through pictures with his fiancee online. It’s a piece of a digital trail criminals rarely think about, Kaye reported.

“As one of the law enforcement people told me, if you can see it, they can see it,” Orth said.

Markoff’s cyber footprint was growing more clear to authorities every day. On April 20, six days after Brisman’s slaying, detectives arrested him.

They said he was carrying on him a New York driver’s license with a photo of someone named Andrew or Andy Miller. Police say Markoff used that driver’s license to purchase the gun that killed Brisman and that his fingerprints were on the paperwork.

In June, Markoff pleaded not guilty to Brisman’s death and the other charges against him. He remains in jail.

For only $100, YourHackerz.com will provide anyone with the password of any e-mail account!  There is no way of detecting this invasion.  Also provided is a “spoofing service” to disguise a woman’s voice as a man’s, vice-versa. 

Services like YourHackerz.com are active and plentiful, with clever names like piratecrackers.com and hackmail.net.  They boast of having little trouble hacking into such Web-based e-mail systems as AOL, Yahoo, Gmail, Facebook and Hotmail and they advertise openly.  Experts said, there doesn’t appear to be much anyone can do about it.

Peter Eckersley, a staff technologist for the Electric Frontier Foundation in San Francisco said, “This is an important point that people haven’t grasp.  According to Professor Orin Kerr, a law professor at George Washington University,” Federal law probibits prohibits hacking but any hacker that is competent and spends the time and targets you, he’s going to get you.”  Professor Kerr was a trial attorney in the United States Justice Department’s computer crime section before his move to academics.  Kerr says, “The feds usually don’t have the resources to investigate and prosecute misdemeanors and part of the reason isi that normally it’s hard to know when an account has been compromised, because e-mail snooping doesn’t leave a trace.”

“Web Based e-mail password hacking or cracking is one of our all time favorite and unique hobbies,” writes the folks at YourHackerz.com.  It’s not clear where YourHackerz.com is located but experts suspect that most of the businesses are based overseas.  These outfits, with a 100% guarantee, claim they will provide original Passwords, no questions asked.  They require payment only after a buyer is convinced.  They also guarantee “total privacy of your information and no legal hassles.”

SlickHackerz.com boast, “We are professionals interested in helping serious people for whom an e-mail password wouldl mean saving a marriage, knowing the truth, preventing a fraud, protecting their family, job and interests only when conventional ways and normal procedures do not work.”

All the services advertise that they will e-mail a screenshot of the target’s in-box or even send an e-mail from the target-s e-mail as proof that they’ve cracked the password.  The customer then sends payment.  One service, whose fee is only $33, then responds with the script from a scene from a Shakespeare play, with the stolen poassword hidden in the copy.

The FBI cannot police the Internet, a spokesman said.  “The FBI is aware of these illegal services and we have been successful in the past in identifying criminal activity and working with prosecutors to bring indictments.  Users of these services should know that just because a product is marketed on the Internet does’s mean it’s legal.”

According to FBI spokesman Paul Bresson, “Agents must be made aware of specific illegal acts ocurring in the United States before they can pursue a provider.  They can’t investigate and online service without evidence of a particular crime.”

Alissa Cooper of the Center for Democracy and Technology in Washington says, “This kind of thing has been on the radar of law enforcement already, but with many of the hackers overseas in practice it takes a lot of resources and time to build up relationships with law enforcement in other countries.  They’re starting to do that in the cybersecurity realm.”

Criminology Research Project, Inc., in monitoring newspapers from throughout the United States, obtained this information from the Washington Post in an article written by Tom Jackson.   CRP realizes cybersecurity does not fall under “murder oriented subject matter,” nevertheless it does fall within the definition of general criminology.  It’s important, in my opinion, that everyone become aware of this illegal activity.  Any suggestions?  Certainly…change your password often and hope for the best.

Just yesterday I attempted to sign on to one of my e-mail accounts only to be told that someone was already signed in!  I promptly reported it to the FBI and received a speedy reply.  However, what will be done? Very little in my opinion.

Cybersecurity is a new area for law enforcement is presents a most difficult dilemma.  Law enforcement is accustomed to having a physical crime scene which is absent in this type crime.  For thet present it seems cybercrime has out foxed law enforcement’s best efforts therefore, out of necessity, it is the obligation of each of use using the Internet to take computer security into our own hands.