Cybercrime

Law enforcement, security and surveillance in the information age

Brian D. Loader, Douglas Thomas

• Publisher: Routledge
• Year: 2013
• Print ISBN:
  9780415213264
• eBook ISBN:
  9781135122645
• Topic: Law
• Subtopic: Criminal Law
• Index: Law

Cybercrime focuses on the growing concern about the use of electronic communication for criminal activities and the appropriateness of the countermeasures that are being adopted by law enforcement agencies, security services and legislators to address such anxieties. Fuelled by sensational media headlines and news coverage which has done much to encourage the belief that technologies like the Internet are likely to lead to a lawless electronic frontier, Cybercrime provides a more considered and balanced perspective on what is an important and contested arena for debate. It looks at:
*legislation
*electronic criminal behaviour
*privacy and liberty
*the dangers of surveillance.
Cybercrime explains the basic issues surrounding cybercrime and its impact on society.

1 Introduction

Cybercrime: law enforcement, security and surveillance in the information age

Douglas Thomas and Brian D. Loader

A deep-seated social anxiety can be recognized as a close companion to the recent impressive advances in Internet and web-based information and communications technologies (ICTs). Its popular manifestation through the media of newspapers, magazines, radio and TV broadcasts has often focused upon speculation about the detrimental effects of ICTs upon various aspects of law enforcement, security and social order. The Internet, for example, is frequently depicted as a kind of dark virtual domain inhabited by a mixture of dissenting computer hackers, organized criminals, extremist political groups and purveyors of pornographic images. Interactive ICTs are consequently seen as a means for facilitating anti-social criminal activities which undermine national security and law enforcement and thereby threaten the very social fabric of democratic capitalist societies. Scarce wonder then that we may witness public alarm about the new media as a consequence of such sensational reporting.

But do these highly publicized and sensational selections of the use of ICTs for criminal undertakings provide us with an accurate picture of the perceived threat to our social and economic order? What is the extent of felony on the Internet? Is there not a danger that this publicity may contribute towards a ‘moral panic’ and a backlash against free expression? Moreover, what are the safeguards to privacy and anonymity in the face of demands for such technologies to be used for surveillance and detection? The challenges facing legal systems, critical national infrastructures and security agencies as a consequence of the use of the new ICTs by criminal activists are certainly nothing short of momentous. The validity and effectiveness of the actions and policies adopted to tackle them however require more considered deliberation than are presently to be found in the hysterical verbiage emanating from most of the popular media.

This short introductory chapter attempts to provide the reader first with a clearer idea of the defining characteristics of cybercrime with a brief exploration of some of its most common manifestations before considering a number of themes and issues that arise from attempts to frame legislation enabling secure electronic commerce, the protection of intellectual property rights, data protection for citizens and the safeguard of freedom of expression in a global information age. The intention is thereby to move beyond polemic and emphasize the need for consideration of checks and balances between a number of competing interests, such as, national security and cryptography, individual liberty and effective law enforcement, enhanced protection from the development of transnational policing and concern over democratic accountability.

What do we mean by cybercrime?

One might easily be forgiven for thinking that ‘cybercrime’ is a rather pretentious expression to refer simply to the use of computers by criminals; merely the latest variant of the ubiquitous prefix cyber in a book title to boost sales. There is, after all, nothing very new in the adoption by criminals of new technologies. Cases of bank robbers using portable radios to intercept police transmissions and more recently the utilization of mobile cellular phones for evading police detection provide obvious examples. So too technologies have been an increasingly important aspect of crime detection throughout the twentieth century, including most famously the use of a wireless signal to aid the arrest of Dr Crippen. So what, if anything, is different about cybercrime?

To understand cybercrime as a significantly new phenomenon, with potentially profound consequences, it is necessary it recognize it as a constituent aspect of the wider political, social and economic restructuring currently affecting countries worldwide. In particular, the processes of economic globalization, which are being facilitated by the new ICTs, not only provide the opportunities for the profitable development of international informational markets (Castells 1996) but also simultaneously raise the spectre of new criminal activities arising to exploit them. The very technologies which enable multinational corporations to do business more easily and challenge the individual controls and regulations of nation states also offer the prospect of globally organized criminal networks (Castells 1998). Moreover, the free flow of uncensored information on electronic networks and websites is as attractive to insurgents and extremist groups as it is to dissidents proclaiming their human rights.

Cybercrime can be regarded as computer-mediated activities which are either illegal or considered illicit by certain parties and which can be conducted through global electronic networks. Its distinctiveness is derived from the versatile capabilities provided by the new ICTs. The global connectivity of the Internet, for example, makes it much easier for criminals to act beyond national boundaries to conduct their illegal affairs. It also makes it possible for existing organized crime to use more sophisticated techniques to support and develop networks for drugs trafficking, money laundering, illegal arms trafficking, smuggling and the like. For hackers with the requisite computer skills, a large market exists for security and trade secrets which can be accessed and transmitted electronically. Furthermore, the many-to-many communication which is an essential feature of the Internet enables the production and worldwide dissemination of information and knowledge which could be potentially harmful, threatening or liable to incite violence.

The nascent threat of cybercrime to affect national and international economies, security and social and political relations provides a serious challenge to the future roles and practices of law enforcement agencies and security services. A flexible communications system designed to withstand attack by means of rerouteing messages has also proved difficult for governments to control (Loader 1997). Sources of illegal activity often require advanced computer skills to be detected as a consequence of their anonymous character. More recently however many national and regional law enforcement and security agencies have established dedicated squads to tackle the threat posed by cybercrime. Such a trend has not surprisingly fuelled the imagery in the popular media of the arrival of the sheriff to tame the electronic frontier.

Of even greater significance perhaps is the blurring of the distinction between internal and external security. The transforming qualities of ICTs make it increasingly difficult to distinguish between warfare, terrorism and criminal activities. Extremist political groups, for example, may engage in all three. The trial of Timothy McVeigh for his part in the Oklahoma City bombing provides perhaps the most dramatic illustration to date. Also, national security is vitally dependent upon economic security. A country in the post Cold War period may be more under threat from economic espionage than nuclear assault. The use of ICTs by non-government organizations and international criminal organizations will therefore clearly have an increasingly important impact upon the functioning of law enforcement and security agencies in the information age.

The magnitude of the task was rudely brought home to the British secret intelligence service, MI6, on 12 May 1999 following the publication of over one hundred names of its agents on the Internet. One of its former agents, Richard Tomlinson, was said to be responsible for the disclosure due to his bitterness at the manner of his dismissal from and later treatment by the intelligence service. It began with an introduction stating that:

This attached list identifies the unprincipled and unscrupulous individuals involved with MI6 worldwide. The list was produced by an honest man who has since left MI6 because he felt that the behaviour of that organisation was unacceptable in a civilised society.

They are accountable to nobody for their law breaking activities. They are subordinated to the elite people of this country, for example the royal household and the establishment.

(The Guardian 15 May 1999)

Whilst many of the names included retired personnel and foreign office diplomats there were enough active agents, often operating in sensitive regions of the world, to place MI6 in a state of alarm. The British Foreign Secretary Robin Cook stated that ‘the release of any such list, however inaccurate it may be, is a deeply irresponsible and dangerous act’ (The Guardian 14 May 1999). A frenzied attempt was made by foreign office lawyers to contain the damage by having the list removed from websites. Within hours however the information had spread throughout the Internet, available on several websites worldwide, and the source of discussion on many chat groups.

This was not the first time that the names of secret agents had been made publicly available. Indeed during the Cold War period each side are believed to have had a pretty clear idea of their respective agents usually operating as diplomats. Yet it does represent a radical departure from the time when the British, or any other government could effectively control the publication of what it considered to be damaging information. As Stephen Dorril remarked of the affair ‘The gung-ho world of James Bond, if it ever existed, is receding. The modern spy is a glorified archivist who must depend on his ability to make sense of a blizzard of information in the public domain and whose triumphs will be analytical rather than amatory’ (S. Dorril 1999).

Finally, countermeasures to cybercrime also raise fundamental questions for the study of criminology, the law and policing policies. A number of writers and civil rights campaign organizations have been vociferous in their opposition to the technological means adopted to tackle such criminal behaviour which they claim is in danger of being used to increase surveillance and threaten our personal privacy (Davies 1996; Lyon 1994). Unsolicited digital data capture and matching are said to represent a fundamental challenge to our freedom from interference. The very measures instigated for our defence are said to be undermining our rights to free speech and privacy.

Crimes on the Net

A statement by Neil Gallagher, a Deputy Assistant Director for the FBI, to the US Congressional Joint Economic Committee suggested that ‘the World Wide Web has allowed for an endless barrage of frauds, scams, intrusions and piracy’ (Gallagher 1998). The kinds of crimes instigated on the Net are indeed many and varied. Some of the most common would include the following: computer network break-ins – Typically these involve hackers breaking into computer systems and networks to steal data or undertake acts of sabotage such as planting viruses or trojan horses. Some of the most significant threats to commercial enterprise come from industrial espionage which concerns the time-honoured tradition of spying upon one’s competitors. The arrival of ICTs provides new opportunities for hacking into and obtaining information for sale about product development, marketing strategies and other trade ‘secrets’. The expanding value of the technologies themselves also offers significant bounties for those able to capture intelligence as a result of software piracy.

With electronic commerce rapidly becoming a major factor in national economies it offers rich pickings for criminals prepared to undertake fraudulent activities. According to Gallagher, in the USA ‘the ten most frequent fraud reports involve undelivered Internet and online services; damaged, defective, misrepresented or undelivered merchandise; auction sales; pyramid schemes and multilevel marketing; misrepresented cyberspace business opportunities and franchises; work-at-home schemes; prizes and sweepstakes; credit card offers; books and other self-help guides; and magazine subscriptions’ (ibid.). Something like half a billion US dollars may be lost annually by consumers through credit card fraud alone.

Perhaps the source of most public concern over the use of the Internet is to be derived from its potential as a site for child pornography. The very flexibility of the network seems to provide a veritable Pandora’s box for controlling the illegal activities of paedophiles intent upon accessing images of children in indecent poses.

Computer systems are also susceptible to attack through the use of mail bombings, a process whereby software is designed to instruct a computer to repeatedly send e-mail to a specified electronic address. The effect of such a bombardment can be to flood the recipient’s personal account and thereby threaten to shut down the whole system. Furthermore other software programs known as password sniffers can undermine the security safeguards of whole computer networks. The identity and password of network users can be monitored and recorded to enable impersonators to access restricted files and documents. A related activity known as spoofing also enables illicit access by electronically disguising a computer to resemble another.

Who are the cybercriminals?

Understanding who the new cybercriminals are is not simply a matter of thinking about old crimes in new ways. Cybercriminals, like cybercrime itself, are marked by a fundamental transformation in the way we think about the issue of crime and criminality. Acts considered criminal that merely happen to involve ICTs are of less concern than those which are made possible solely by the use of ICTs. For example, the use of a computer to defraud someone is no different than the use of a telephone or a face-to-face conversation to defraud someone. What makes such crimes cybercrime is when the use of ICTs adds a significant element to the crime which would have been impossible without them. For example, using e-mail or the WWW to defraud hundreds of thousands of people, the use of the Net to spread information inexpensively, anonymously, or in great numbers all change the fundamental nature of the crime being committed, not merely the means by which it is done.

Just as crimes have changed with the growth of ICTs, so too have the categories of criminals who engage in such crimes. There are three basic categories in which we can categorize cybercriminals: hackers and phreaks, information merchants and mercenaries, and terrorists, extremists and deviants.

Hackers and phreaks

Computer hackers and phreaks (telephone hackers) use ICTs to illegally enter computer systems, for the purposes of exploration, information or curiosity. Their crimes, while illegal, are generally not intended to cause damage to data or to reap financial reward. Often hackers and phreaks will engage in pranks, such as rerouteing phone calls or rearranging web pages. While their actions may have financial consequences for individuals, corporations or industry, their primary goal is not to profit from their crimes. In many cases, hackers are out to find bugs or holes in systems, to gain a reputation for daring hacking exploits, or to embarrass industry figures or people in positions of power. A small subset of these hackers, referred to as ‘malicious hackers’ cause damage, delete or erase files, or make confidential information public. This group may also include hackers who use computer or telephone technology for minor fraud (using stolen credit card information to make purchases, referred to as ‘carding’), those who write computer viruses, or those who shut down Internet websites or Internet service providers (known as ‘denial of service’ attacks).

For the most part, these hackers are driven by a sense of curiosity and most of the damage done by this group is either unintended or incidental. Typical crimes include low-level fraud (usually related to attempts to gain access to computer systems by attaining password information), unauthorized access to computer systems and possession of unauthorized access devices such as passwords or access codes.

Information merchants and mercenaries

In contrast to hackers, information merchants and mercenaries trade in the commercial sale of information, engaging in crimes such as corporate espionage and sabotage, sale and theft of identity information, computer and network break-ins, and large-scale software piracy. While they may use similar tools and techniques as hackers, information merchants and mercenaries are primarily driven by profit. Those involved in attaining and selling information often are hired by competing corporations or are, themselves, former employees for the companies or agencies from which they gather information.

This group refers to anyone using ICTs primarily for the purposes of illegally reaping financial gain. This may involve illegal discovery or access to information, illegal transfer of funds, identity theft, or the buying or selling of illegally obtained information. Also falling into this category are those who use ICTs, such as cryptography, to hide or disguise illegal activity as well as those who exploit ICTs for illegal financial gain.

Terrorists, extremists and deviants

A third group of cybercriminals are those who use ICTs for illegal political or social activity. In distinction to the first two categories, these cybercriminals may use ICTs to engage in terrorism, electronic or otherwise, to promote hate or illegal activities, or to engage in illegal social behaviours such as the transmission of child pornography or engaging in paedophilia online. These groups and individuals often walk the fine line between freedom of expression and illegal activity.

What constitutes this group as cybercriminals is their primary reliance on ICTs to engage in illegal activity. This group includes those engaging in information warfare as well as those who use ICTs to organize illegal political activity or terrorism.

Who’s guarding the electronic guards?

All democratic societies require safeguards to ensure the legitimate use of policing methods and the occurrence of transparent deliberation over their future development. Effective law enforcement inevitably requires a balance to be struck between the appropriate intrusion into th...

Table of contents

• Cover Page
• Half Title page
• Title Page
• Copyright Page
• Dedication
• Contents
• List of illustrations
• Notes on contributors
• Preface
• 1 Introduction Cybercrime: law enforcement, security and surveillance in the information age
• Part I Perceptions of cybercriminals Hackers, insurgents and extremist groups
• Part II Privacy, surveillance and protection
• Part III Information warfare, critical national infrastructure and security
• Bibliography
• Index