Online, Invisible and Criminal
Total Page:16
File Type:pdf, Size:1020Kb
www.counter-fraud.com August/September 2015 Online, invisible and criminal Adaptability is the mark of humankind and nowhere more marked than in criminal behaviour evolving to and in an online world where restraints are more likely to be imposed by peers than traditional, real-world forces of law and order. Monty Raphael QC , Celia Marr and Kate Parker of Peters & Peters reboot thinking on cybercriminal motivations and profi les. Th e Metropolitan Police Service’s 2015 report on online theft and fraud concludes that law enforcement agencies “do not know enough about those committing online crime”. [1] Th e US has the same problem: “we don’t have enough information to make that really good profi le [on cybercriminals]. We’re at that anecdotal stage where we’ve collected some information, but I don’t think we have enough,” says Steve Branigan, founding member of the New York Electronic Crimes Task Force. [2] internet as an electronic crime scene, and looking for indicators of signature behaviours […] that allow us to paint a picture of An apparently lawless world of the individual who’s responsible”. [6] It must be borne in mind, opportunity however, that a century or more of criminological study has still Th ere are many reasons why information on cybercriminals not led to the discovery of reliable predictive factors. is scarce: only 11% of cyber-crimes are ever reported, and for those charged conviction rates are extremely low. [3] New weapons for veterans Indeed, part of the lure of cybercrime lies in its anonymity Cybercriminals divide into two categories: those with a criminal compared to “real world” crime. Data can be encrypted and record (Category One), and fi rst time off enders (Category Two). digital footprints wiped. Added to this is the perception that Recent research [7] suggests that 60% of cybercriminals fall into policing of cyberspace is weak. According to one “old style” the former category: “those who have criminal tendencies to criminal turned cybercriminal: “no-one really seems to be on begin with […] then learn about using computers [and] fi gure top of it. And to be honest [sic] [it] seems to be pretty much out how to apply [them] to their trade”. [8] For committed risk-free”. [4] Another reports, “it’s a known fact that people criminals, cybercrime is perceived as ‘low-risk, high reward’ who commit cybercrime are hard to track down. Th ere is less without requiring sophisticated computer literacy. [9] YouTube risk hacking a bank than walking in with a gun and robbing channels and online forums off er guidance on how to initiate it”, a perception which applies to white collar crime more hacking and Distributed Denial of Service (DDOS) attacks: generally. [5] As a result, the social profi le of cybercriminals is the recent Police and Crime Committee report concludes that diversifying, as increasing numbers of people are attracted to extending criminal activity into cyberspace requires “no more the perceived lawlessness of cyberspace. Whilst their goals may skill than to be able to log on”. [10] However, young people are be vastly dissimilar (overthrowing governments, defrauding digital natives. It is likely that, in future, those with criminal civilians, political activism, etc) they are united by their use impulses will be more inclined to turn to cybercrime earlier as of cyberspace as their method of achieving them. Th is shared their technological skills become sophisticated at a younger age attraction is worthy of further attention. Viewing any crime and they feel instinctively comfortable within an online space. from a criminological perspective may help understand why Keith Bristow, head of the National Crime Agency, predicts it has been committed, and how it can be prevented. In the that the next generation of criminals will operate more or less words of Professor Marcus Rogers, cyberforensics researcher at exclusively online rather than “smashing windows and grabbing Purdue University: “it’s about looking at the computer and the television sets”. [11] No doubt this transition will present Follow us on Twitter @fi nreguk and join discussions in our LinkedIn group a serious and growing challenge to law enforcement internet in its scope and intensity, was attributed to a agencies as the skills and expertise of the young continue 16-year old schoolboy. [20] Th ere was no tangible reward to outstrip our policing capacity. Resources will need to for this crime: no money was earned nor data harvested be enhanced and redistributed. Th e current police tactic (a currency as valuable as money on the internet). of targeting “potential young cybercriminals with home Hackers of this school fl ex their digital muscles simply visits [and] letters to parents” is unlikely to suffi ciently to see the global impact they make. counter the threat. [12] Twisted ethics Young guns A third type of hacker, perhaps not gifted with the Th e second category of cybercriminals arrive at the intelligence of the Manghams of this world, hacks “for the computer before they arrive at the crime. Again, reports lulz”. [21] Derp, a hack-to-order group, operates within show that these perpetrators subdivide into two categories: this category. In the words of a Derp hacker interviewed by those with a dishonest intent to pursue an ill-gotten - Th e Guardian : “we like to target games companies because often monetary - gain, and those who, in the experience of game players have a strong reaction. But mostly, we do Branigan, “get into computers fi rst and […] start hacking it because it’s fun”. [22] Derp hacks are not particularly [through] curiosity”. [13] Former Lulzsec hacker Ryan sophisticated: it responds to internet users who have Ackroyd describes his trajectory: “I wanted to learn how “call[ed] or text[ed] a request” (according to its Twitter computers worked. Th en it snowballed out of control. It page), and proceeds to execute a DDOS attack against started with cheating in online games […] Th e next thing the proposed victim until their social media account/ I know I’m breaking into services. It’s addictive”. [14] website/gaming platform drops offl ine at signifi cant According to the Deputy Mayor for Policing and Crime, reputational and/or fi nancial cost. [23] In the words of there are 28 organised cybercriminal groups in London journalist Simon Parkin, “it is the electronic equivalent who “specialise” in “banking and credit card fraud, account of graffi ti with a vaguely anti-establishment theme”. [24] takeover, phishing, identity theft and payment card crime”, Derp recently hit headlines for targeting online games all of which are “traditional” crimes within an online presenter James Varga: every time he live-streamed a space. [15] Th e second subgroup are more interesting, video of himself playing an online game, the gaming and are broadly defi ned by their thirst for recognition platform would be attacked by Derp and eventually crash. (if not actual identifi cation) and their disassociation from Media-savvy Varga recognised the publicity potential: he traditional criminality. made a deal with Derp that if he lost the game, it would Whilst the success of the committed cybercriminal publicly crash the site, but if he won, it would let him lies in their ability to fl y under the radar (the widely continue to the next level. But Derp went a stage further: publicised JPMorgan hack was enabled by malware that it discovered Varga’s home address and bombarded him lay undetected in the bank’s computer system for months, with pizza deliveries, eventually sending over the police gradually harvesting the data of 76 million clients), hacks on the pretext of “a hostage situation”. Followers of the that are ethically or politically motivated are often measured interchange reacted to this news with anger and, in turn, by the publicity they attract. [16] Hacks, like terrorist private details of the Derp ringleader were posted online, attacks, are “claimed” by particular “hactivist” groups in alongside those of his parents. Interestingly, the gaming order to further their cause. Hactivism is championed community felt that a line had been crossed when Derp’s by its perpetrators as a disrupting force against existing attacks transitioned into “real time” instead of when Derp power structures: “for the young and disillusioned, it’s an began illegally hacking (and retaliated with action which eff ective way to lash out at the system, be it video game was, itself, illegal). To those operating within the perceived companies employing unpopular business models, or lawlessness of cyberspace, there is clearly a hierarchy to governments that teenagers feel powerless to [infl uence] criminal activity and perhaps the emergence of an organic in any other way”. [17] “moral” code. It’s not (always) about money Online off ences, real world But for every political hack, there are those who hack consequences for the intellectual challenge alone or simply “because So what type of criminal behaviour is perceived they can”. [18] In 2011, 26-year old Glenn Mangham as “less criminal” when committed in cyberspace? infi ltrated Facebook from his parents’ home. His Gaming platforms can be fertile ground for developing motivation was not fi nancial but intellectual, and cybercriminals: behaviour which is obviously criminal if his “achievement” was recognised by Facebook, who committed offl ine can be easily redressed as “adventurous” have reportedly off ered him employment once his or “creative” in the context of an online game. As a prison sentence is served. [19] Similarly, the infamous consequence, “there are some sorts of criminality that Spamhaus attack, credited with nearly breaking the youngsters don’t think of as serious […] It would be 2 August/September 2015 www.counter-fraud.com hard to imagine a knock on the door from a policeman alike.