Cyber Crime and Telecommunications Law
Total Page:16
File Type:pdf, Size:1020Kb
Rochester Institute of Technology RIT Scholar Works Theses 2010 Cyber crime and telecommunications law Robert Imhof Follow this and additional works at: https://scholarworks.rit.edu/theses Recommended Citation Imhof, Robert, "Cyber crime and telecommunications law" (2010). Thesis. Rochester Institute of Technology. Accessed from This Thesis is brought to you for free and open access by RIT Scholar Works. It has been accepted for inclusion in Theses by an authorized administrator of RIT Scholar Works. For more information, please contact [email protected]. ROCHESTER INSTITUTE OF TECHNOLOGY B. THOMAS GOLISANO COLLEGE OF COMPUTING AND INFORMATION SCIENCES CyberCyber CrimeCrime andand TelecommunicationsTelecommunications LawLaw Researched by Robert Imhof Thesis Committee: Charlie Border, Daryl Johnson, Tom Algoe Defense Approved on May 10th, 2010 TableTable ofof ContentsContents Introduction …................................................................................................................. 5 Literature Review ........................................................................................................... 8 Purpose Statement ........................................................................................................... 29 Methodology and Deliverables ....................................................................................... 29 Telecommunications Laws The Computer Fraud and Abuse Act .................................................................... 32 The Digital Millennium Copyright Act ................................................................ 38 The Wiretap Act .................................................................................................... 46 The Stored Communications Act .......................................................................... 50 Identity Theft and Aggravated Identity Theft ........................................................ 54 Access Device Fraud ............................................................................................. 56 CAN-SPAM Act ................................................................................................... 60 Wire Fraud ............................................................................................................ 62 Communications Interference .............................................................................. 63 Sociological Theories Differential Association ....................................................................................... 65 Anomie and Strain Theories ................................................................................ 71 Social Conflict Theory ......................................................................................... 77 Rational Choice Theory ........................................................................................ 82 Social Learning Theory ......................................................................................... 86 Social Control Theory ............................................................................................ 90 Control Balance Theory ......................................................................................... 94 Interviews Bradley Bartram .................................................................................................... 99 Michael McCartney ............................................................................................... 124 James Domres ........................................................................................................ 139 Martin Littlefield .................................................................................................... 152 Mark Musone ......................................................................................................... 163 2 Case Analysis United States vs. Jeanson James Ancheta .............................................................. 188 United States vs. Scott Levine ................................................................................ 192 United States vs. Paul G. Ashley, Jonathan David Hall, Joshua James Schichtel Richard Roby, Lee Graham Walker, and Jay Echouafni ........................................ 196 United States vs. Gary McKinnon .......................................................................... 201 United States vs. Kevin Mitnick ............................................................................. 205 Final Analysis ..................................................................................................................... 208 Works Cited ........................................................................................................................ 218 3 Special Thanks I would like to thank my committee: Charlie Border, Daryl Johnson, and Tom Algoe for all your help and inspiration. I would also like to thank my interviewees: Brad Bartram, Mike McCartney, James Domres, Martin Littlefield, and Mark Musone for your time and efforts in helping to make my research a success. I would also like to thank God and my parents for inspiring me to work hard and be the best I can be. I wouldn't have made it this far without your help. Subject Category: Information Security Key Words: Cyber Crime, Security, Sociology, Law, Hacker 4 Introduction As the world becomes more dependent on technology and interconnected networks it changes the dynamic of how the world works. Before extensive computer systems and digital networks both public and private enterprise alike kept much of their confidential information in physical form such as in documents filed in cabinets. It was during this time that organizations and government institutions had to concern themselves primarily with physical security and internal classification schemes to make sure that this information didn’t become available to those who didn’t have the rights and who could also cause substantial harm with the information in question. As our modern economy continues to shift towards a post-industrial economic base we begin to put much more emphasis on information and the providing of services. Much of this shift has lead to the increased dependency on digital systems to both store and process very large amounts of information. This shift has given rise to extremely large and important databases and storage area networks. Through the use of these technologies it allows an organization to store and process amounts of information that would have been seen as impractical just twenty years ago. This availability of information allows an enterprise to be more efficient and profitable because business analysis and intelligence personnel can now use tools and their own developed skills to pour quickly through information stored in storage area networks and data warehouses in order to find market trends and possible areas of future profitability. The public sectors uses technology in just as important, and possibly more important, ways compared to the private industry. Federal and state databases that contain information on criminal DNA, fingerprints, open cases, evidence, and criminal histories allow investigators to 5 pour through large amounts of information quickly and efficiently in order to solve their cases as soon as they can. All of this information from both private and public industry is a very attractive target for attackers. Because of the impressive amount of information that can be taken without even having to be physically on the scene makes for a target that is too enticing for some to ignore. The rate at which information systems are attacked and compromised skyrockets every year according to studies from both private interest groups such as the SANS Institute and through government agencies such as the FBI and their crime statistics. The way in which most organizations have dealt with this problem has been to simply spend and implement technology, such as firewalls and intrusion detection systems, to keep the attackers out of their systems. Although this is a necessary step in order to institute best practices and fall into regulatory compliance from government acts such as Sarbanes-Oxley and HIPAA, it really doesn’t do a good enough job. If all that it took to keep an information system safe from intruders was technology than the solution to this growing problem would be simple. However as evidenced by the rising success of electronic attackers it shows that this isn’t the case. What this research will do is to provide a more in-depth look at the attacker. This thesis does not propose or develop a new technology for combating the malicious user, rather it provides a look into who is actually looking to compromise the system. A famous quote by Sun Tzu is as follows: “If you know the enemy and know yourself, you need not fear the result of a hundred battles. If you know yourself but not the enemy, for every victory gained you will also suffer defeat” (Tzu, ch.III). This quote, although originally intended for use in military strategy, is also essential for the information security manager who is in charge of protecting their organizations vital 6 information assets. Many times people in these positions know the technology that they are in charge of, but rarely have a concept of who may attack their critical information assets. Many times people will look at these attackers and infer that financial gain was their primary motivation. But is that really what motivates people in most cases? This thesis aims to provide research