The Role of Digital Devices in Cybercrime

Computer crime is an illegal offense that is committed where the computer or electronic data device is integral to the criminal act. In this context, “computer” has a broad definition and can mean personal computer, notebook, tablet, iPad, smartphone, or any other digital device that has software installed. Consider the Internet of Things (IoT): Even home appliances, HVAC controls, and other smart home devices have software and computer-like characteristics and can be operationalized for bad acts. The computer, no matter how it is defined, has several roles in high-tech crime, both as a tool and a target. According to Donn B. Parker, a cybercrime authority and author, the function of the computer in crime is fourfold, as an object, a subject, a tool, and a symbol.

• The Computer as an Object—Computers and network systems are themselves often objects or targets of crime, subject to physical sabotage, theft, or destruction of information.
• The Computer as a Subject—Computers can be the direct subjects of crime when technologists use the computer to commit a crime. This category includes virus attacks, illegal access, etc.
• The Computer as a Tool—Computers can be integral to the act, the concealment, and the conversion associated with a fraud or financial crime when the electronic device is used to commit a crime, whether embezzlement, theft of proprietary information, or hacking.
• The Computer as a Symbol—Computers lend fraudsters an air of credibility and are often used to deceive victims into investment, pyramid, and other “traditional” fraud schemes that have been adapted to the digital environment.

Some common examples of computer crimes include:

• Data alteration
• Unauthorized access and entry to systems and information
• Reading another’s e-mail without permission
• Data destruction and sabotage
• Internet consumer fraud
• Sale of proprietary data
• Desktop counterfeiting
• Data extortion
• Disclosure of confidential data
• Identity theft
• Electronic letter bombing
• Software piracy
• Voice mail fraud
• Cellular telephone fraud

Computer Fraud versus Computer Crime

Two terms that are commonly used interchangeably are computer fraud (and financial crimes) and computer crime, yet substantial differences exist between them. First, computer-based fraud and financial crimes are any defalcation, fraud, or financial crime accomplished by tampering with computer programs, data files, operations, equipment, or media, and resulting in losses sustained by the organization whose computer system was compromised. One of the distinguishing characteristics of computer-based fraud is that access occurs with the intent to execute a fraudulent scheme or financial criminal act.

Historically, in the early 1980s, law enforcement agencies faced the dawn of the computer age with growing concern about the lack of criminal laws available to fight emerging computer crimes. Although wire and mail fraud provisions of the federal criminal code were capable of addressing some aspects of computer-related criminal activity, neither entirely addressed the new computer-based crimes. In response, Congress included provisions in the Comprehensive Crime Control Act of 1984 to address unauthorized access and use of computers and computer networks.³ The Act made it a felony to access classified information in a computer without authorization and a misdemeanor to access financial records or credit histories stored in a financial institution or to trespass into a government computer. The 1984 Act was updated and improved in 1986 when Congress enacted the Computer Fraud and Abuse Act (CFAA). In the CFAA, Congress limited federal jurisdiction to cases with a compelling federal interest—that is, where computers of the federal government or certain financial institutions were involved, or where the crime itself is interstate in nature. Some of the other provisions included those:

• To penalize the theft of property via computer that occurs as a part of a scheme to defraud;
• To penalize those who intentionally alter, damage, or destroy data belonging to others; and
• To criminalize the trafficking of passwords and similar electronic access items.

These Acts have been regularly updated into the 2000s to ensure that the statutes continue to respond to current trends and techniques of computer-based criminal acts and give law enforcement the tools necessary to fight computer-based crimes, fraud, and financial crimes.⁴ Computer-based fraud statutes and laws have established two very important principles:

1. Most statutes explicitly define computer-based terminology that is to be used in a legal context when enforcing the statute. These statutes allow the prosecutor to avoid having to explain to the jury technical “computer jargon” and its inexact fit with common law enforcement terminology.
2. Most statutes create the illegal offense grounded in the proof of access associated with a particular intent to commit an illegal act. Thus, success in carrying out the act (e.g., stealing property (money) through a fraud act) does not have to be proven. For example, tracing cash flows (proceeds) can be difficult without paper records and unauthorized (illegal) computer access may be the only provable event.

In short, most jurisdictions have defined computer fraud as an “attempt crime.” By viewing the computer as a protected asset, the protection is independent of the actual loss to the owner as a result of the intrusion.

In contrast to computer fraud, computer crime is defined as an act where the computer hardware, software, or data is altered, destroyed, manipulated, or compromised due to acts that are not intended. Generally, computer crime differs from computer fraud in at least three major ways:

1. Employees who, as a part of their assigned duties and responsibilities, have access to the computer systems are deemed to have authorized access. As a result, those with authorized access cannot fall under statutes that address computer fraud (outlawing unauthorized access), even if their actions subsequent to access are judged illegal. Individuals with some authorized access but who exceeded that authorization can be prosecuted under computer-based fraud statutes. Thus, “without authorization” generally refers to intrusions by outsiders or those with no access, but some courts have also applied the term to intrusions by insiders who access computers other than the computer they are authorized to use, intrusions by insiders acting as agents for outsiders, and intrusions by insiders who violate clearly defined access policies.
2. The manipulation, alteration, or destruction of data (including computer software) is considered independent of computer-based fraudulent schemes.
3. Because data are intangible, the destruction or compromising of the integrity of computer data does not fall under vandalism statutes.

As a result of the preceding discussion, computer-based fraud and financial crimes are technically not “computer crimes” but often involve the use of computers as a means to break the law. In some cases, traditionally illegal acts can yield more ill-gotten gains by utilizing the speed, power, and global access of computers, other digital devices, and their users. A more apt term may be computer-assisted crimes. In such cases where traditional frauds and financial crimes are facilitated through the incorporation of electronic devices, existing criminal laws can be applied to the acts. The main benefit of the computer fraud and computer crime statutes, however, is derived when proving traditional crimes is difficult because the evidence of such acts have been destroyed electronically. In such cases, computer fraud and computer crime laws are invaluable as an alternative method of prosecution.

Losses or Other Damages Related to Computer Crimes

The most common types of losses associated with computer crimes are economic. Economic losses may include:

• Cost to respond to the damage caused by the perpetrator
• Damaged equipment
• Restoration of data or programs
• Wages of employees for remediation
• Lost sales and incremental profit
• Lost productivity
• Harm to reputation or goodwill
• Other reasonable costs associated with the act

Nevertheless, the economic losses generally do not include costs associated with assisting law enforcement. Of the various losses, the most common definition of economic loss is any reasonable cost to any victim, including the cost of responding to the illegal act, conducting a damage assessment, and restoring data, programs, systems, or information to its original condition and any revenue and incremental profits lost, incremental costs incurred, or other consequential damages incurred.

Costs to make a system better or more secure than it was prior to the intrusion may not qualify as “reasonable” in many cases. In general, the cost of installing completely new security measures “unrelated to preventing further damage resulting from [the offender’s] conduct” should not be included in the loss total. Thus, the types of losses considered by the courts “have generally been limited to those costs necessary to assess the damage caused to the plaintiff’s computer system or to restore the system.” Losses also include, for example, lost advertising revenue or lost sales and profits due to an electronic interference and the payroll of company employees who are unable to work due to a computer shutdown. Fraud and forensic accounting professionals need to think critically and creatively about what types of harm in a particular situation meet this standard, and work with victims to measure and document the losses. At least one court has held that damage to a company’s reputation and goodwill as a consequence of an intrusion might properly be considered a loss for purposes of alleging harm.

In addition, federal statutes also address four cases of “special losses”:

1. An actual or potential effect on medical care
2. Physical injury to a person
3. Threat to public health or safety
4. Damage to a computer related to the administration of justice, national defense, or national security.

The first special loss is related to the “modification or impairment, or potential modification or impairment, of the medical examination, diagnosis, treatment or care of one or more individuals.”⁵ This provision provides strong protection to the computer networks of hospitals, clinics, and other medical facilities because of the importance of those systems and the sensitive data that they contain. This type of special harm does not require the victim to show any financial loss. The evidence only has to show that at least one patient’s medical care was at least potentially affected as a consequence of the intrusion.

The second special loss occurs when the damage to a computer causes “physical injury to any person.”⁶ Computer networks control many vital systems in our society. Examples include traffic signals, air traffic control, and 911 emergency telephone services. The disruption of these computers could directly result in physical injury. Generally, so long as there is a reasonable connection between the damaged computer and the physical injury, the perpetrator can be held accountable for those physical injuries that result from their illegal actions associated with computer access or other computer crime.

The third special loss includes threats to public health or safety, a concept that closely aligns to physical harm discussed above. The key word is “threat” to public health or safety. In these cases, the prosecution is not required to demonstrate actual physical harm, only the threat to a person or persons. This aspect of loss addresses a wider array of government-type services such as electricity transmission, gas distribution, water purification, nuclear power, and transportation systems. Damage to the computers that operate and control these systems and associated safety mechanisms can create a threat to the safety of many persons. Such statutes have broad implications for perpetrators who disrupt services to the general public.

The final special loss category addresses computer compromises that affect “a computer system used by or for a government entity in furtherance of the administration of justice, national defense, or national security.”⁷ The “administration of justice” aspect includes courthouse computers and systems operated by federal, state, and local law enforcement, prosecutors, and probation officers. Similarly, computers used “in furtherance of national defense or national security” are generally operated by the armed services and the Department of Defense. Normally, the statute is broad enough so that computers owned and operated by a defense contractor, for example, could arguably involve national security implications.

International Aspects of Computer Crime

With the explosive growth of computer, digital, and mobile use around the globe and more people gaining access to and using the World Wide Web, technologically based frauds and financial crimes are increasingly likely to have international dimensions. In most cases, the legal environment for digitally based crimes is different in every country. Consequently, identifying, locating, and extraditing suspects from another country poses additional challenges. Finally, due to differing privacy rights of individuals in the various jurisdictions of the world, securing electronic evidence of digitally based frauds, financial crimes, and other criminal acts is very difficult. Essentially, jurisdictional complexities arise at every step in the process: prevention, deterrence, detection, and investigation. In the United States, the Department of Justice and the Federal Bureau of Investigation work with foreign governments through many channels to address global threats related to computer-based crimes. The FBI’s approach reflects the increase in cybercrime worldwide, as well as the networking of local criminals with those located around the globe. In 2016, complaints to the FBI’s Internet Crime Complaint Center increased by less than 5% to 298,728; however, losses associated with those crimes totaled more than $1.33 billion compared to $198.4 million in 2006.

Perhaps more importantly, criminals are following principles outlined in Freidman’s book, The World Is Flat. Increasingly, cybercriminals are extremely well-organized and have access to every corner of the globe. Members of cyber fraud networks share profits and carry out crimes utilizing the various specialties of the participants. For example, one member of a criminal consortium may send out millions of spam e-mails. The e-mail responses may be handled by another member, or even another criminal organization that specializes in electronically harvesting and exploiting credit card numbers. The proceeds from the crime may then be laundered by a third individual or organization that then distributes the “profits” according to previously outlined agreements. The perpetrators may never meet, physically see one another, or even speak on the phone. Despite the physical distance between them, the groups are highly organized and effective. In response to threats to U.S. citizens within its borders and territories, the FBI has agents in sixty countries investigating cybercrimes.

On November 23, 2001, in Budapest, Hungary, the United States, and twenty-nine other countries signed the Council of Europe Cybercrime Convention. The Cybercrime Convention is the first multilateral instrument designed to begin to address the problems posed by the spread of criminal activity on dispersed computer networks around the globe. The Convention requires the parties to establish laws against cybercrime, to ensure that law enforcement officials have procedural authority to examine and prosecute cybercrime offenses, and to provide international cooperation to other signatories in the their fight against computer-based criminals. On August 3, 2006, the United States Senate voted to ratify the Cybercrime Convention and on September 22, 2006, the President signed the United States instrument of ratification for the Council of Europe Convention on Cybercrime.

Insider Threats

One of the greatest threats to information systems, in terms of digital crime, comes from employees inside an organization. It is not uncommon for operators, media librarians, hardware technicians, and other staff members to find themselves in positions of high levels of access privilege in relation to the key functions and assets of their organizations. A consequence of this situation is the probability that such individuals have the opportunity to commit fraud—one of the three elements of the fraud triangle. When combined with pressure, such as a nonsharable financial need, and the ability to rationalize their actions, such opportunity can be costly for an organization. As such, computer operations should have, at a minimum and where appropriate, an effective separation of duties. Even separation of duties, however, will not prevent all electronically based frauds and crimes perpetrated from within. To address the possibility of collusive frauds, detection controls need to support and supplement prevention controls. In addition, an environment where deterrence is also emphasized (e.g., high ethical standards, an organizational commitment to prosecute fraudsters) also helps to minimize the risk of collusive fraud.

A further complication is the tendency on the part of management to tolerate less stringent supervisory controls over information system personnel. The premise is that the work is not only highly technical and specialized, but difficult to understand and control. As an example, systems software support is often entrusted to a single programmer who generates the version of the operating system in use, establishes password or other control lists, and determines the logging and accounting features to be used. In addition, such personnel are often permitted, and sometimes encouraged, to perform these duties during nonprime shift periods, when demands on computer time are light. As a result, many of the most critical software development and maintenance functions are performed in an unsupervised environment. It is also clear that operators, software librarians, and information system technicians often enjoy a degree of freedom quite different from that which would be considered normal in a more traditional employment area.

Insiders are typically aware of the “holes” in the system of internal controls in the digital environment and often exploit weaknesses “just to see if they can get away with it.” The most prevalent method of committing computer fraud is alteration or falsification of input transactions (and/or documents), including:

• Alteration of input
• Alteration of output
• Data file manipulation
• Communications systems disruptions
• Operating systems modifications
• Computer operations policy violations

The characteristics of the insider computer fraudster are very similar to those of the traditional fraudster: intelligent, hard-working, minimal absences (the appearance of dedication), bored with “the routine,” confident, and egotistical. Computer fraudsters often demonstrate greater loyalty to technology than to their employer. This technology loyalty can create an attitude that any behavior is acceptable if it is in the name of technology.

The following are indicators of insider computer fraud that suggest increased risk and require additional scrutiny:

• Access privileges beyond those required to perform assigned job functions
• Exception reports not reviewed and resolved
• Access logs not reviewed
• Production programs run at unusual hours
• Lack of separation of duties in the data center

Digital Device Hacking

Although the term “hacker” was originally used to describe a computer enthusiast, the term has now grown to mean someone seeking unauthorized access to computer systems and the information contained therein. Hackers can include employees, individuals operating alone, hacker gangs, and entrepreneurial hackers who seek financial reward for their illegal acts. Motives vary according to the targeted system, information desired, and the perpetrator. While hacking was once commonly thought of as a precocious teenager’s hobby, it has changed dramatically in the last twenty years to encompass a large and diverse group.

Hacking entails breaking into computer systems by determining the vulnerabilities of the hardware and software components. Then the hacker uses technology to systematically “guess” the authorized user’s access codes.

Hackers generally use various “rogue” software applications to penetrate a system. Sometimes they surreptitiously incorporate unsuspecting digital device owners into their schemes by installing programs that are downloaded via an e-mail or by visiting a website. These programs operate in the background of the infected digital device and can disable security settings and capture information that is then sent back to the hacker.

The most direct way of gaining access to a digital device is to use someone else’s user identification and password, or generate (without authorization) a system-acceptable user name and password. The user name and password combination is designed to keep digital devices safe from unauthorized use. Without inputting this security information, the device won’t operate. Most users choose passwords that follow predictable patterns. Digital device users often choose user names and passwords that are familiar and easy to remember. For example, a deep-sea fisherman might choose the word “marlin” as a password, or the man’s secretary, who received a mug about “soaring with the eagles and working with turkeys” from her boss last Christmas, might use “turkey” as her password.

If the hacker knows or can develop a profile about a target, his or her ability to crack a user name/password combination may be enhanced. Information about the target’s family, children’s names and birthdays, parents’ names, maiden names, anniversaries, and similar data are often used as passwords. User names are often some derivation or abbreviation of a person’s name or e-mail address. A simple lesson here: real-word passwords, even in variation, are not secure. The safest passwords are more than eight characters and combine letters, numbers, and nonalphanumeric characters, such as punctuation.

Viruses

Viruses are hidden software programs that use computer resources or other computer activities in such a way as to shut down the system or slow it down significantly. Viruses typically use the infected device’s resources to replicate itself and spread the infection to other software systems on a network or through the Internet via e-mail, text messages, or other electronic medium. Viruses range from those that are relatively harmless (displaying a message or greeting) to those that shut down entire networks for extended periods, ruin data, or destroy the ability of the digital device to function properly.

A virus attacks software. Many digital viruses can replicate themselves on other computers. This replication ability can affect large networks. In recent years, viruses have cost millions of dollars in staff and machine hours to remove these viruses and restore normal operations.

Viruses have also garnered significant media attention in recent years. The fear of being infected with a virus has even resulted in virus “scares” that are nothing more than hoaxes. Although it is fortunate when the threat is not real, these phony warnings cause harm of their own. They slow down transmission of information and have been known to cause overloads of organizational e-mail networks. Some of these fraudulent warnings urge recipients to “forward this to everyone you know.” Before forwarding a questionable warning, it is wise to consult a few of the authorities that track viruses.

Hardware, Software, and Data Security

Effective computer security ensures the availability of accurate and timely data provided at a cost, including security that meets traditional cost–benefit considerations. Such a position suggests that all threats are not eliminated, but that threats are managed in such a way that the hardware, software, and data have reasonable protection given the threats and costs associated with addressing those threats. In general, technology security includes protecting data and programs from unauthorized or accidental alteration or destruction. Furthermore, the data must be protected so as to maintain confidentiality, integrity, and availability. Hardware, software, and data must be secure from physical threats such as water, storm, and fire damage. Information technology departments must also have the ability to restore data center operations in the event that a disaster causes complete destruction.

The most effective components of internal security are education, reporting facilities, and vigorous disciplinary action against offenders, including prosecution of illegal acts. An enterprise-wide employee awareness program should be combined with formal training in the area of information security. For employees to fulfill their security responsibilities, they should know what information needs to be kept confidential, how to recognize threats to security, and how to use backups and other aids for their computers and other digital devices.

Passwords are the predominant form of authenticating valid users, though dual and secondary authentication through e-mail and mobile devices is becoming more common. Effective password administration is essential for maintaining security. Passwords should be of sufficient length (usually a minimum of eight characters) and a combination of letters, numbers, and other characters such as punctuation marks to avoid vulnerability to guessing. Group passwords and sharing of passwords should be prohibited to maintain individual accountability. Passwords of all terminated employees should be revoked immediately. Security administration often coordinates the notification of terminated employees with the personnel function. Employees who have changed job functions or transferred should have their old password canceled and a new one issued, if appropriate.

Securing a computer network by means of logical controls is a difficult but necessary requirement for ensuring the safety of an operating system from attacks by outsiders. Logical controls include management security policies, user authentication systems, data access controls, network firewalls, security awareness training, encryption algorithms, penetration testing, intrusion detection software, and incident response plans.

Network security also can be provided by a combination of design, hardware devices, and software. Data encryption is carried out by a combination of hardware and software. Encrypted data is scrambled by a formula using a unique key and can only be unscrambled with the same formula and key at the receiving end. The decision to use encryption should be made in light of the risks and after a cost–benefit analysis. Drawbacks to encryption are the cost of the hardware and software, the cost of the administration, and the inherent delays incurred by the extra steps required for processing.

Digital signatures are becoming more common, in part because Congress and many states have passed legislation to legitimize the electronic “signing” of documents. On October 1, 2000, the Electronic Signatures in Global and National Commerce Act (E-SIGN Act) became effective. This federal statute basically provides a mechanism whereby any document that is required to be signed can be signed “electronically.” The E-SIGN Act does not require a party to use or accept electronic signatures, electronic contracts, or electronic records, but rather seeks to facilitate the use of electronic signatures and documents by upholding their legality regardless of the type or method of execution selected by the parties. The E-SIGN Act is also technology-neutral and does not require a specific type or method that businesses and consumers must use or accept to conduct electronic transactions. The Act regulates any transactions involving interstate or foreign commerce. Many states, however, have enacted their own digital signature laws, which regulate purely intrastate transactions. Additionally, many state and federal agencies, including the Internal Revenue Service and the Securities and Exchange Commission, are encouraging the use of electronic filing and digital signatures as a means to speed up the collection and processing of information. Biological access verification, also known as biometrics, is now available. This verification technique includes fingerprints, palm prints, voice prints, signatures, retina scans, and facial recognition.

Profiling software authenticates users by monitoring their statistical characteristics, such as typing speed and keystroke touch. Smartcard access devices are similar to an ATM card; like ATM cards, they are susceptible to loss and forgery.

Protecting the network from external threats requires some additional considerations. The less an external perpetrator knows about the technology environment (e.g., type of hardware and software packages used), the harder it is to obtain fraudulent access. Part of the security policy should address how much and what kind of information regarding the technology of an organization should be made public.

Organizations should set appropriate safeguards when providing access to third parties. There is pressure to establish connectivity by marketing, purchasing, research, and other branches. Connectivity should be granted only after it has been established that the benefits outweigh the risks and costs.

Computer and digital device users should take measures to protect against viruses. Some precautions include the following:

• Do not use a thumb drive to boot your system
• If you must boot your system from a thumb drive, make sure it is properly labeled and continuously protected
• Do not install Shareware or other untested programs on your systems, but if you do, do not put them in the root directory
• In a network environment, do not place untested programs on the server
• If you are sharing information on external storage devices, ensure they only contain information and no executable files
• Use current antivirus software to detect potential viruses
• Backup all programs and files
• Write virus-free warranties and indemnities into your purchase orders and contracts
• Always write-protect your systems and program disks
• Teach device users about viruses so that they can recognize them
• Always use caution when opening email attachments and social media links

Electronic Commerce (E-Commerce)

E-commerce is generally thought to describe retailing, marketing, advertising, and interpersonal communications taking place on the Internet. Such electronic activity generally includes authentication for participant identification and some form of “electronic signature” to ensure that participants initiating transactions cannot deny that the transaction occurred. Efforts to secure e-commerce transactions are described below.

• Encryption. From an e-commerce security perspective, the solutions offered by conventional and public key encryption technologies are usually adequate to ensure that e-commerce transactions are as secure as the value of transactions requires. The vast majority of transmissions over the Internet and the World Wide Web, however, are not encrypted. If there is no need to hide the contents of a message or communication, there is little need to expend resources on the encryption of such traffic and the decryption at the other end. Encryption can be an expensive solution, whether in terms of actual monetary cost or the cost in increased computational load on the user’s machines. The needs of the organization to keep confidential transmissions secret should be weighed against the effort and cost of encryption.
• Smart Cards. A smart card is a credit card-sized plastic card embedded with an integrated circuit chip that makes it “smart.” This marriage between a convenient plastic card and a microprocessor allows an immense amount of information to be stored, accessed, and processed either online or offline. Smart cards can store several hundred times more data than a conventional card with a magnetic stripe. The information stored in the chip is transferred through an electronic module that interconnects with a terminal or a card reader. A contactless smart card has an antenna coil that communicates with a receiving antenna to transfer information. Depending on the type of embedded chip, smart cards can be either memory cards or processor cards.
• Memory Cards. Any plastic card is made “smart” by including an IC chip. But the chip may simply be a memory storage device. Memory cards can hold information thousands of times greater in amount than a magnetic stripe card. Nevertheless, their functions are limited to basic applications.
• Processor Cards. Smart cards with a full-fledged microprocessor on board can function as a processor device that offers multiple functions such as encryption, advanced security mechanisms, local data processing, complex calculation, and other interactive processes. Most stored-value cards integrated with identification, security, and information purposes are processor cards. Only processor cards are truly smart enough to offer the flexibility and multifunctionality desired in e-commerce.

Typical Internet Schemes

Earlier in the decade, the media often cautioned about the dangers of sending credit card numbers through the Internet. For good reason, many businesses and individuals had apprehensions concerning Internet commerce; the Internet is an impersonal form of communication. While much has been done to create and maintain trust, some precautions are appropriate before purchasing online items. As a result, conducting financial transactions on the Internet is usually as safe as making an order from a legitimate company for legitimate products and service via the telephone. Nevertheless, the careless and unsuspecting can become victims. In addition, scams and schemes similar to conventional frauds have found new and lucrative homes on the Internet, while new scams, such as modem hijacking, are an entirely new breed.

Combating Internet Fraud

Conducting business on the Internet is generally a safe proposition for legitimate persons doing business with legitimate product and service providers. Nevertheless, safety precautions are prudent:

1. Confidential information of any type (e.g., credit card numbers, Social Security numbers, etc.) should be encrypted. Most simplistically, encryption scrambles an outgoing electronic transmission and the recipient’s system provides inverse decryption, which restores the transmission to its original state. Encryption hardware and software utilize complex mathematical formulas. Encryption is used to prevent people who intercept data from harvesting valuable and confidential information.
2. The Internet is anonymous, with user names and passwords being the only identifiers. Internet websites set up for commerce install customer validation protocols. The validation is usually a user name or customer code combined with a password that becomes the customer’s identity for transaction authorization. A downside to this type of protocol is that most users develop such a large number of user names and passwords that most are written down and kept in easily accessible places such as a desk drawer or under the keyboard. In such cases, the benefits of the validation process have been eliminated.
3. Financial information, customer data, and other valuable databases should be stored in places other than a Web server. Internet websites can be hacked, and volumes of personal and financial data are often primary targets. Financial and other valuable information should be maintained on an internal system with processing interaction restrictions in place. The process protection should have additional safeguards to minimize the risk that a hacker who penetrates a website can harvest vast amounts of financial and customer information from internal systems.
4. Firewalls are software programs that attempt to prevent unauthorized access to an Internet site or e-mail transmission. Firewalls are designed to control interactions between network servers and the Internet. This technology monitors Internet traffic, inbound and outbound, with a goal of preventing questionable transmissions from accessing sensitive information databases. Firewalls do not offer “silver bullet” protection but they provide a layer of protection against Internet attacks or other types of security breaches.

Artificial Intelligence (AI)—Possible Contributions to Forensic Accounting, Antifraud, and Compliance Efforts

This chapter examines the role of technology, especially digital devices in bad acts. Over time, it’s also possible for technology to help organizations minimize risk, deter bad acts, detect invasions more quickly, and facilitate more effective and efficient examinations and other remediation. One of those technologies is AI—artificial intelligence. According to a 2017 ICAEW report,¹⁹ “Accountants have embraced waves of automation over many years to improve the efficiency and effectiveness of their work. But to date, technology has not been able to replace the need for expert knowledge and decision making. Indeed, previous generations of ‘intelligent’ systems have generally demonstrated the continuing power of human expertise and the limits of machines.” While AI has been a vision since the 1950s, “in the coming decades, intelligent systems will take over more and more decision-making tasks from humans.”

“While accountants have been using technology for many years to improve what they do and deliver more value to businesses, this is an opportunity to reimagine and radically improve the quality of business and investment decisions.” Artificial intelligence (AI) systems can be very powerful, are improving quickly, and can be extremely accurate, replacing and, in some cases, far superseding human efforts. As noted earlier with RPA, AI has downside risks as well, so it needs to be managed and monitored closely.

Human decision making is challenged by at least three major biases: availability and recency effects, confirmation bias, and anchoring conclusions to prior belief. Machine learning, a notion dear to AI systems, is that the system bases decisions grounded in the data. Perhaps more importantly, AI and machine learning have the ability to sort through complex data and ambiguous situations. By continuously examining outcomes compared to the underlying data that influence that outcome, AI systems continuously “learn” and improve decision making. While just becoming available to forensic accounting, fraud examination, and compliance issues, the future is likely to be interesting. Stay tuned!

In the late twentieth century, the emergence of transnational criminal organizations introduced a significant challenge for law enforcement worldwide. The challenges arose from many sources, including the anonymity of technology, the speed of information and money movement worldwide, jurisdictional issues, the challenges of effective and efficient law enforcement communication, as well as others. Complex criminal organizational structure offers the ability to utilize a large labor force, synchronize the labor force, and carry out large-scale criminal operations with multiple criminal enterprises. Such structures are also amenable to cyberspace. Essentially, organized cybercriminal organizations blend combinations of the tools and techniques discussed above with traditional fraud schemes and financial crimes in a large-scale, organized fashion. The organized cybercriminal is interested in operating in cyberspace the way traditional organized criminals, drug traffickers, and terrorists operate in the physical world. Large-scale, business-like applications of fraud and financial schemes in cyberspace yield large sums of cash to those who control the organized cybercriminal organization.

Organized cybercriminal enterprises profit from exploiting computer vulnerabilities. Hackers, who previously wreaked havoc for the fun of it or as a means of making political statements, are now organized, professional, and cash flow oriented, and some are associated with traditional organized crime groups. Cybercriminals include skilled programmers who design and operationalize sophisticated phishing attacks and other techniques to harvest consumer personal, financial, and log in information. As an example, cybercriminals have used “malware” to steal millions of credit and debit card numbers, Social Security numbers, and financial account user IDs and passwords; once this data is harvested, it can be used to commit identity theft and online fraud. Another example of potential damage by hackers occurs when distribution systems are compromised and freight deliveries are redirected to criminal-controlled warehouses. Organized cybercriminals have management structure, functional responsibility, and a support labor force that enables them to traffic in stolen information using many of the same business practices employed by corporate America.

Organized cybercriminal enterprises have created “botnets,” collections of tens of thousands of computers to launch Distributed Denial of Service (DDoS) attacks on enterprise websites, DNS servers, email systems, and VoIP services. Botnets can be used to extort companies, especially those dependent on e-commerce. Even if a legitimate business does not become a blackmail victim, it’s possible that if left unprotected, many of its own computers can become part of a botnet. Cybercriminals use the botnets to distribute spam, child pornography, and malware in mass quantity to accomplish their nefarious goals.

In a 2005 article called Shadowcrew: Web Mobs, Deborah Gage, the author, described the activities of Andrew Mantovani, David Appleyard, Brandon Monchamp, and more than a dozen other members of the Shadowcrew. The group auctions off stolen and counterfeit credit and identification cards, and according to Gage, business was booming. Shadowcrew has more than 4,000 members, and according to the U.S. Secret Service, ran a worldwide marketplace in which 1.5 million credit card numbers, 18 million email accounts, and scores of identification documents (e.g., passports, driver’s licenses, student IDs, etc.) were offered to the highest bidder.

According to the article, many of the credit card numbers sold on the site were subsequently used by Shadowcrew’s customers, who had no intention of paying for what they bought. The result was more than $4 million in losses suffered by card issuers and banks, says the Secret Service, which is charged by the U.S. government to investigate counterfeiting, credit card fraud, and some computer crimes.

Gage goes on to state that Shadowcrew is a Web mob: a highly organized group of criminals. Unlike the American Mafia or the Russian syndicates, however, these Web mobs work solely in the online world. Members know each other only by computer aliases, interact with each other through the Internet, and commit their crimes in the darkness of cyberspace. The electronic marketplaces they establish to trade their illicit wares can be set up and later disbanded with little more than keystrokes. “They basically can pop up anytime and anywhere,” says Secret Service Special Agent Larry Johnson. The Secret Service says they operate under names such as Carderplanet, Stealthdivision, and Darkprofits.

These cybermobs are designed to foster more crime and criminals on the Web. Much like La Cosa Nostra, members of Web mobs don’t have to break into a bank to rob it. Instead, they provide a framework and services for criminals to trade in their chosen stock—stolen credit cards and identity documents. And their efforts, including the “commerce” sites where they trade in stolen merchandise, will only accelerate what is already a thriving trade in numbers that are regarded on the Web as currency.

Several attributes of the Internet make it an attractive operational location for criminal enterprises. First, individuals and businesses have come to realize that information is power. Likewise, criminals have determined that they can profit by stealing and selling information. Others can then exploit the value of that private information for their own profit.

Second, cyberspace gives the criminal a worldwide reach. In the old days, organized crime might be restricted to a few city blocks, a city, a geographical region, etc. With the World Wide Web, criminals can be located anywhere and can exploit victims located anywhere in the world, provided that they are using the Internet and demonstrate the vulnerabilities exploited by these criminal groups. Thus, criminals with the proper skill set may be located in the former Soviet Union, Eastern Europe, South America, or other distant countries, and target victims through fraudulent or illegal Internet commerce in relatively wealthy countries in Europe, Canada, and the United States with little fear of retaliation by law enforcement.

Third, the World Wide Web is relatively anonymous. Persons online have no face; their existence is only a user name and password that may have no logical, physical, or legal connection to the digital identity. In addition, a cybercriminal can create any number of identities on the Web, none of which may be tied together or tied to the person’s real identity. Members of organized crime groups communicate using their various digital identities. They are also computer savvy enough to know to encrypt their digital transmissions and transactions, and often float their communications through networks of servers and anonymous “re-mailers” that conceal the IP address of their computers. They can also route traffic through proxy servers, making it almost impossible to trace electronic transmission to their source.

Fourth, beyond the difficulty of catching cybercriminals is successfully prosecuting them. Determining the proper jurisdiction is often a difficult task. Once jurisdictional issues are resolved, applying traditional laws to online activity presents further challenges. More problematic is the location of many cybercriminals. Many of these individuals locate in countries that do not cooperate with law enforcement officials in nations seeking extradition; the choice of locale by the cybercriminal is deliberate. Organized crime groups operating in places such as countries formerly part of the Soviet Union, Eastern Europe, South America, and Russia are virtually immune from prosecution.

Money Laundering in Cyberspace

Gains from criminal activity can be readily laundered through money transfers using a series of Internet bank accounts, wagering on Internet gaming sites, artificial purchases on auction sites, and the traditional organized crime practice of using legitimate businesses to hide illegal transactions. Since the beginning of criminal enterprise, the bad guys have used banks as a means to launder money gained through illegal activities. However, the creation of Internet banking makes following the money more difficult than ever.

The following example illustrates the practice of money laundering in cyberspace.

Alexandra is the head of an international identity theft operation, specializing in the mass sale of stolen Social Security numbers, with matching names and dates of birth. Having the big three pieces of identifying data makes her a triple threat.

Alexandra is known around the underworld as a ruthless and vicious operator and yet, she has a problem: she has tons of currency, the profits from her illegal activities that she cannot spend without attracting the attention of law enforcement. More problematic is that if the identity theft ring is busted and prosecuted, without some sort of money laundering operation, the funds can be tied directly to her. She has the ability to pay her employees, contractors, suppliers, and vendors through the organization’s bank accounts, but not herself.

Alexandra needs to get this currency from her organization’s offshore bank account into the legitimate U.S. economy so that she can safely draw on these ill-gotten gains without attracting attention. Alexandra is a true patriot—she has even gone so far as to faithfully and completely pay her U.S. income taxes. Maybe she’s not such a patriot—if she is ever caught, she can avoid being prosecuted for tax evasion.

To gain anonymity, Alexandra uses her money to buy e-currency, a relatively anonymous and unregulated currency she then moves in varying amounts, small and large, across a series of e-currency accounts and ultimately transfers the money into her own bank.²⁰ From there she loans money to herself in the United States and pays a consulting fee to an international company (controlled by her) for services rendered to her real estate company, where she receives cash distributions both as an employee and as an owner. Now she is free to use that money for loans, salary, and dividends as she chooses with little risk to her freedom.

Money laundering, which involves disguising the origins of illegally generated cash flow to give it the appearance of legitimate income, is enhanced on the Internet due to the near anonymity that can be achieved. Furthermore, Internet banks provide access to accounts anywhere in the world from anywhere. As a result, it is often not clear whether an account is accessed from a country other than the one where the money is held. In addition, monitoring the activity of individual account holders is nearly impossible.

In addition to financial institutions, other businesses, such as Internet-based gambling operations, can also be hijacked for money laundering purposes. Online casino operations further complicate the identification of transactions that might be illegal because the entire operation—including all gambling records—are housed in electronic formats and located offshore in jurisdictions where access is extremely limited. Criminals can facilitate money laundering by “gambling” dirty money at the cybercasinos, converting winnings into cybercash, and then requesting the remittance of seemingly clean money through various cyberpayment and other fund transfer systems. Transactions are quick and may be completed from a computer located anywhere—from the privacy of their own home to the local public library or cybercafé. The borderless nature of the Internet makes it possible for users to play at any casino around the world, often in jurisdictions with minimal or unenforced money laundering laws. Work completed by Forrester Research suggests that there are more than 1,400 Internet gambling sites, most of which are based outside of the United States.²¹

According to a 1996 study, global Internet money laundering accounted for about $500 billion annually.²² Given the exponential growth of the Internet, that number is likely far greater today. The working paper by Kellerman suggests four models for payment in cyberspace²³:

1. The Merchant Issuer Model—In this case, both the smartcard issuer and the seller of goods are the same person or entity. An example of this model would be the Creative Star fare card used by riders of the Hong Kong transit system.
2. The Bank Issuer Model—The merchant and the smartcard issuer are separate entities. Financial transactions are cleared through traditional financial systems such as the Banksys’ Proton card in Belgium.
3. Nonbank Issuer Model—Users buy electronic cash from issuers using traditional money and then spend their e-cash at participating merchants. The merchant then redeems cash from the issuer. An example of this is Cybercash’s electronic coin product.
4. Peer-to-Peer Model—Bank- or nonbank-issued electronic cash is transferable between users. The only point of contact between traditional payment systems and initial e-cash is the initial purchase of e-cash from the issuer and the redemption of electronic cash from individuals or merchants. An example would be the Mondex stored value card.

In response, worldwide efforts, often led by U.S. law enforcement, the International Monetary Fund (IMF), and the World Bank, have tried multiple approaches to combat money laundering in cyberspace, including those described below.²⁴

• Identify and Reduce the Ability to Make Anonymous Financial Transactions. Financial Sector Assessment Program (FSAP) is a joint IMF and World Bank effort introduced in May 1999 to increase efforts to promote the soundness of financial systems in member countries. Supported by experts from a range of national agencies and standard-setting bodies, FSAP seeks to identify the strengths and vulnerabilities of a country’s financial system, to determine how key sources of risk are managed, to ascertain developmental and technical assistance needs, and to help prioritize policy responses. Related specifically to cyber-based money laundering, FSAP provides assistance and training on how to identify and reduce new means of money laundering, cybercrime, and terrorist financing using transactions such as the Nonbank Issuer Model and the Peer-to Peer Model.
• Map Global Payment Systems. The goal of the “Global Payments Systems Mapping Project” is to develop a better understanding of the flow of money, which can, in turn, be converted into knowledge for helping nations craft monetary policies and financial risk assessment models.
• Facilitate International Information Sharing. Using the U.S. Financial Services Information Sharing and Analysis Center (ISAC) as a model, the goal is to provide real-time information sharing, alerts, notifications, Web-based education, and training on e-money laundering and other cybercrimes. In addition, the data could be used to operate a cyberthreat analysis center.
• Require All Financial Transactions to Include “Know Your Customers” Policies and Procedures. To increase transparency, authentication solutions, including the use of biometric and public key infrastructure (PKI), can be implemented for users who initiate large value transfers. Two-factor authentication could also be required for all financial transactions.
• Harmonize and Coordinate International Money Movement Regulations. The standardization of laws and regulations of money movement for all entities would mitigate the threat of nonregistered and informal money transmitters (e.g., e-gold) that are used to facilitate money laundering activities by organized criminal syndicates in cyberspace. Greater entry barriers, such as licensing and registration for all money movement entities, will hinder the effectiveness of money laundering techniques in cyberspace.

1. CT-1 So, Who’s Jerry. Tom is lying dead; he has an iron bar across his back and some food in front of him. How did he die?
2. CT-2 Dry, Dry, Dry. CT-2 Dry, Dry, Dry. A man went outside without an umbrella or a raincoat, yet did not get wet. How?

Short Answer Questions

Discussion Questions