Cybercrime Investigations

A Comprehensive Resource for Everyone

John Bandler, Antonia Merzon

• Publisher: CRC Press
• Year: 2020
• ISBN:
  9781000062267
• Edition: 1
• Topic: Informatica
• Subtopic: Sicurezza informatica

Cybercrime continues to skyrocket but we are not combatting it effectively yet. We need more cybercrime investigators from all backgrounds and working in every sector to conduct effective investigations. This book is a comprehensive resource for everyone who encounters and investigates cybercrime, no matter their title, including those working on behalf of law enforcement, private organizations, regulatory agencies, or individual victims. It provides helpful background material about cybercrime's technological and legal underpinnings, plus in-depth detail about the legal and practical aspects of conducting cybercrime investigations.

Key features of this book include:

• Understanding cybercrime, computers, forensics, and cybersecurity
• Law for the cybercrime investigator, including cybercrime offenses; cyber evidence-gathering; criminal, private and regulatory law, and nation-state implications
• Cybercrime investigation from three key perspectives: law enforcement, private sector, and regulatory
• Financial investigation
• Identification (attribution) of cyber-conduct
• Apprehension
• Litigation in the criminal and civil arenas.

This far-reaching book is an essential reference for prosecutors and law enforcement officers, agents and analysts; as well as for private sector lawyers, consultants, information security professionals, digital forensic examiners, and more. It also functions as an excellent course book for educators and trainers. We need more investigators who know how to fight cybercrime, and this book was written to achieve that goal.

Authored by two former cybercrime prosecutors with a diverse array of expertise in criminal justice and the private sector, this book is informative, practical, and readable, with innovative methods and fascinating anecdotes throughout.

Part I

Understanding Cybercrime, Computers, and Cybersecurity

1 Introduction

The Need for Good Cybercrime Investigators

This chapter (and book) is for:

• You
• Law enforcement of all types: police, investigators, agents, prosecutors, analysts
• Those in the private sector investigating or dealing with cybercrime
• Regulators
• The technically skilled and those who are not
• Beginning cyber investigators, intermediate, and even experienced looking for a comprehensive view
• Lawyers and non-lawyers.

At the start of each chapter, we will identify the type of cybercrime investigator for whom that chapter is primarily intended. Cybercrime investigators do not just have the title of “investigator”. They come from many jobs and backgrounds – lawyers and non-lawyers; technical experts and technical beginners; experienced traditional investigators who are learning about cybercrime, and investigators whose only experience is with cybercrime; law enforcement agents, industry regulators, and members of the private sector; and students and trainees just starting out. Given this diversity of backgrounds, we recognize that some readers might read the book straight through, and some might skip chapters because they are working on a time-sensitive matter, or because existing skill sets make certain chapters less critical. That said, we think you will get something out of every chapter.

1.1 Why This Book

Let us start with three fundamental truths about investigating cybercrime:

1. We all can investigate cybercrime. Cybercriminals are running amok online partly because of the misconception that only specialized investigators with vast technological resources can work these cases. Tech skills and gadgets are great to have, but they are, by no means, a requirement for handling a cyber investigation.
2. Cybercrime can be solved. Just because it is a cybercrime, doesn’t mean it is hard to solve. Cybercriminals – like every type of criminal – run the gamut, from low-level scammers to highly sophisticated organizations. They are not all tech-wizards. They are not all hard to find.
3. Even the most sophisticated cybercriminals can be caught.

Bottom line: the common preconception that cybercrime is too difficult to investigate is wrong. Every case can and should be investigated. Every investigator can take positive steps to solve a case. Instead of looking at a cyber incident and assuming there is not much that can be done, we can use these core truths about cybercrime to frame a plan of action.

Cybercrime is a relatively new phenomenon. Malicious actors no longer need to be in the immediate vicinity of their victims, but can attack and steal remotely, even from abroad. The reach of the Internet means cybercrime is a safety and security problem for every community, industry, business, and law enforcement agency – large or small.

Investigating cybercrime is an even newer endeavor than cybercrime itself, and because it involves technology, it can seem daunting to many investigators and victims. How do you start investigating when one of these incidents happens? How do you figure out who did it when the perpetrator is hiding online? What do you do with a crime that seems to lead across the country, let alone around the world?

When we first started working on cybercrime cases as prosecutors, we had the same questions. We did not come to this work from a tech background, and we often had minimal resources available. But through time, effort, and creativity we learned how to find the answers. We learned that cybercrime can be investigated, offenders can be found, and cases can be successfully prosecuted.

We wrote this book to share this knowledge with you, and to inspire more people to become cybercrime investigators – especially those who might think cybercrime is too challenging to take on.

We understand that, in some places, law enforcement and private security lack experience, training, and resources when it comes to cybercrime. That is another reason we wrote this book. We want to give any interested investigator the knowledge and tools to handle these cases. As cybercrime continues to grow, we need more investigators on the frontlines ready, willing and able to take it on. There are concrete steps that every investigator can take to tackle cybercrime. This book is designed to make these steps understandable and doable for investigators everywhere.

Why is it so important to bolster the investigative response to cybercrime? Let’s look at some of the major repercussions of cybercrime in today’s world.

• Profit and Losses. Cybercrime is immensely profitable for cybercriminals, but immensely costly to the rest of us. Each year, U.S. businesses and consumers lose billions of dollars through cybercrime while the criminal and private investigation of these events remains completely inadequate. It is astonishing to consider that billions of dollars can be stolen annually without proper investigation or redress.
• Terrorism and Espionage. The profitable and disruptive nature of cybercrime means it is an activity of interest for terrorists and nation-states seeking income, intelligence, or simply a new way to inflict harm. The Internet provides a gateway and a network for all manner of nefarious activity at the local, national, and international levels. Our will to investigate this activity must measure up to the threat it presents.
• New Ways to Move Money. Cybercriminals have developed innovative money laundering techniques to pay each other and disguise their illicit income. Virtual currencies and cryptocurrencies, international wire transfer schemes, money held and moved in stored-value cards (like gift cards), criminal proceeds funneled through multiplayer video games – these are some of the methods cybercriminals use, along with more traditional money laundering mechanisms. Once proven successful, these techniques are adopted not just by cyber thieves, but by other criminals looking to conduct illicit transactions, such as child pornographers, narcotics dealers, and terrorists.
• Stalking, Revenge, and Harassment. Stealing is not the only form of cybercrime – the Internet is used to commit a wide variety of crimes meant to harass, stalk, menace, or otherwise target specific individuals. The increasingly sophisticated methods used to conduct these crimes are capable of inflicting tremendous, ongoing harm to victims. The scenarios range from teen sexting to cyber-revenge acts directed at employers, intimate partners, and political figures – and often require a response from a combination of law enforcement and private sector investigators.
• Civil Liability and Regulation. The scourge of cybercrime has an enormous impact on both our civil law and regulatory systems. When cybercriminals steal funds or data, injured victims may use the civil legal system to seek redress, including for cybersecurity negligence. Government regulators create and enforce rules that deal with the real threats that cybercrime presents to sensitive data and online commerce.

This book discusses all of these topics, and many other pressing issues around cybercrime, in a manner designed to help every kind of investigator find useful information.

1.2 Who Investigates Cybercrime?

Cybercrime creates many types of victims, and its ripple effects have led to an intense focus on cybersecurity, information security, and privacy. As a result, cybercrime is investigated for a variety of reasons. To provide information in the most effective way throughout this book, we considered the needs and concerns of investigators representing these three important groups:

• Law Enforcement

Law enforcement, including police, federal law enforcement, and prosecutors, receive thousands of cybercrime reports every year from individual and corporate victims. When state and local police investigate cybercrimes, along with prosecutors, it is usually because they get the first calls when local residents are victimized. Traditionally, more complex cases are tackled by federal law enforcement agencies (such as the FBI, U.S. Secret Service, and Department of Homeland Security) and federal prosecutors. These agencies use monetary thresholds and other criteria to take on a select number of investigations. Some state Attorney General’s offices also handle “bigger” cybercrime cases. A few local District Attorneys’ (DA) offices handle significant cybercrime cases, as we did while working at the Manhattan DA’s office. But the truth is, the vast majority of cybercrimes go uninvestigated.

One of this book’s goals is to change the way investigators look at cyber cases. Historically, investigators have categorized cases too quickly as being “local” or “small”, only realizing, after some investigation, that they are really one piece of a larger scheme. Nowadays, all police agencies, whether an enormous department like the New York City Police Department, or a small-town force with fewer than 20 sworn officers, will be called upon to take a cybercrime complaint and conduct an initial investigation – actions that may lead to uncovering larger, additional crimes. Since these investigations normally require prosecutorial assistance, it is essential that prosecutors in local DAs’ offices also know how to investigate cybercrime. As we explain in this book, when a “small” case turns out to be part of a big scheme, there are many choices investigators can make about how to proceed – including identifying and collaborating with agencies that have the resources to assist with or take on a broader investigation. Of course, th...