US Failing To Prosecute Online Criminals

Ashlynne9423 writes "A report by the Center for American Progress and the Center for Democracy and Technology has found there is too little action being taken against online criminals, despite rising consumer concern about online safety. The report found that state officials were spending only 40 per cent of case time investigating online fraudsters, preferring instead to concentrate on higher profile solicitation and pornography cases."

Comments

Well duh

[daveatneowindotnet]

It's easier to drop the hammer on college kids for downloading media online then it is to hunt down people exploiting masses of small phish. Besides IAAs have deeper pockets and are much more influencial than a amorphous blob of (unknown) online victims.

Well duh!

[IBBoard]

So that would be summarised as "Prosecutors go for cases that make them look good" and "Prosecutors avoid cases where the crime isn't as well understood"* then?

* because the general populace understand "he killed her" or "he was doing things he shouldn't to children" but tech-crime gets a glazed look from all the buzzwords.

Re:Well duh!

[falcon5768]

Doesn't even have to be tech crime. When it comes to money in general unless the person who was stole from is

1) High Profile

2) a large corporation

Then you have little hope of ever getting anything back. Prosecutors just dont care about anything that wont get them a DA job or better and even if thousands or hundreds of thousands are stolen, a kiddie porn or murder case trumps all even if the money stolen ruins the person just the same.

Re:Well duh!

[TheRaven64]

Sounds like the problem is the politicising of the judiciary. If you elect your public prosecutors (who decide who to prosecute) and judges (who decide which cases to hear) then obviously they will favour cases which are likely to get them the press they need to be re-elected.

Hmmmm....

[d3ac0n]

Second look at becoming an Online Criminal!

Seriously though, as a basically honest person and an IT geek I find it incredibly frustrating to hear stuff like this. It's bad enough that non-specialist IT folk (general net admins and support people) get paid fuck-all despite that they are the backbone of the IT world. But to find that with a minimal amount of study and a willingness to break multiple laws you can essentially double, triple or quadruple your income and NOBODY BOTHERS TO HUNT YOU DOWN FOR IT is incredibly depressing. More and more it seems, honesty is rewarded with a kick in the crotch, and being a societal leech is rewarded with cash payouts and bling.

Why am I an honest person again?

Go get them...

[gx5000]

I'd like to see a headline like "Malware Creators of XP AntiVirus 2008 Charged Today"...
When it's as straight forward as this, and they trick people to actualy get their useless software, (which doesn't protect you at all, it just infects other PC's), it's just plain evident that there's no one interested in going after criminals even in plain sight. **sigh**

Just makes Symantec Ghost and Acronis more important to use...

which would you prefer to do?

[petes_PoV]

preferring instead to concentrate on higher profile solicitation and pornography

Spend your day looking at smut or crawling through log files for dodgy transactions?

Re:which would you prefer to do?

[NotBornYesterday]

While I'm in favor of stamping out CP, I also realize that when LE crawls through smut in search of pedos, it pleases the "won't someone think of the children" crowd, which helps support the police by putting politicians in place who increase police spending. Chasing phishers is less appealing to the public, and doesn't gather the same level of votes for tax-n-spend politicians at the polls. I imagine that it is also much harder for police to do from their local jurisdiction, since those type cases can often involve actions in different towns, counties, states, and countries.

Re:which would you prefer to do?

[Iamthecheese]

God forbid that a government bureaucrat should do whats best for society, or that a politician should tell his voters, "This is the best priority for these things, and this is why". God forbid the press should actually investigate and make a decision based on something other than sensationalism. God forbid the public should be given information instead of manipulated through fear. They would be ice skating in hell through the year 3000.

Re:which would you prefer to do?

[TheCarp]

Thats because we really need to change name of our country so we can use the more appropriate three letter abbreviation: CYA.

Think TSA security. Why do we have a DHS? Its not because we know we need all this security. Very rational and well informed analysis has been done thats shown that we probably need NO increase in security at airports since 9/11.

What it comes down to is this: If you are a politician who has to be elected every 2-4 years or so, you know that if you oppose funding even the fakest of security measures (like creation of the DHS), and there is an attack, then you are going to have to "answer for" being the guy who opposed protection.

If you vote for it, you can fall back on "we did all we could". If you don't, then you are screwed because you "did nothing". Now... is a person who is in that situation of literally risking their jobs for not "looking tough" is the person who SHOULD be in charge of budget decisions?

Look at judges. In many places they are elected. So, if they let some guy off, and he goes out and rapes a child, guess who isn't getting re-elected?

Now... do you think that if you are standing in court, do you want to have your fate decided by a guy whose very job could be lost if he goes too easy on you? Of course, "man wrongly jailed" gets some ire up, but it seldom gets anyone, much less judges, tossed out in elections.

Never mind an innocent man, how about a guy who is guilty of making a stupid mistake that looks worst than it was (like someone who was caught taking a piss in an alleyway by a mother and her kid, and is then charged with exposing himself to a child)... seriously... do you expect a judge to risk his job going easy on you?

Its sad that we have made justice such a game. I know they say lovers of sausage and law should watch the creation of neither, but, man.... how can people know whats going on and still have ANY respect left for this system?

-Steve

Not just online...

[Firethorn]

If you look at law enforcement in general, and it's not just a US problem, petty crime has a pretty bad interest by police period.

If a citizen isn't essentially holding the criminal for police to arrive(like in the case of shoplifting), or the crime happens in front of the officer, if it's not violent they really don't do much.

So things like car theft, burglary of unoccupied homes, etc... All low priority. Heck, I've heard of burlary rings that don't even care of a house is alarmed - police response time is so slow that they have time to steal everything they want and leave before the police arrive. One was even spoofing the alarm people, delaying things even more.

This, of coures, irks the heck out of me because I hate to see crime pay, and effective law enforcement is a good way to ensure that it doesn't. Every crime that 'pays off' encourages them in the future.

Re:Not just online...

[Kjella]

If a citizen isn't essentially holding the criminal for police to arrive(like in the case of shoplifting), or the crime happens in front of the officer, if it's not violent they really don't do much.

So things like car theft, burglary of unoccupied homes, etc... All low priority.

Most of the time it would imply that noone saw the person(s) in question, often they don't know exactly when it was committed and even if you could put a suspect near the crime scene it's tough to prove it's your man. I'm sure we'd love to see CSI put on their ass but they're nowhere nearly as effective as on TV and extremely expensive. With alarms there's at least a chance there'll be a free police patrol nearby, adding some risk into it. Better locks might take them longer to get through, as would solid doors and windows, safes and so on. GPS trackers or similar for laptops, cars and so on helps some at least. Yes, I agree that sometimes the police doesn't follow up well enough where they do have leads but asking them to chase ghosts that are long gone won't really accomplish anything. Police have to deal with those that are easy to catch or important to catch, and there's just too many petty criminals to ever make them important.

Re:Not just online...

[Firethorn]

You're right, often there just isn't enough evidence. But when the person has the serial numbers of the stolen stuff, and it shows up in a local pawnshop, who HAS the ID of the seller, what's preventing them from following up at that point?

When the dude with the stolen laptop manages to track it down, going so far as to hand the police an ADDRESS.

Sure, there's lots of petty criminals. I figure that if we were more effective at catching them for a while, there'd quickly be a lot less of them.

Start with some known criminals

[Anonymous Coward]

Call me when Sony have been prosecuted for the crime of contravening the Computer Misuse Act in my country... and maybe then I'll care.

Re:Slashdot is just as bad ...

[HungryHobo]

They get eaten by grues.
Can anyone comment on "The Center for American Progress" and "The Center for Democracy and Technology" I've never heard of them before and they sound like the sort of names church groups give themselves when they want to sound credible.

It isn't about "high profile"

[Zelet]

It has nothing to do with what's "higher profile." It has everything to do with jurisdiction and resources. A state-level law enforcement agency doesn't have the resources to travel over seas to go after the Russian/Chinese hackers and fraudsters. Even if you consider the much smaller percentage of "home grown" fraud - in most cases the victim is in a different state than the fraudster. Most of the criminals will directly target victims as far away from them as geographically possible because they know local law enforcement is cash and time strapped. Lastly, the police prioritize crimes based on how it affects the victim. Physical/emotional harm will ALWAYS trump financial loss. No agency I know of goes after IP violations. The FBI only goes after large organized crime groups that use warez as their money machine.

Re:It isn't about "high profile"

[Rival]

There are a few other considerations to make:

First, most of our laws were written well before the advent of the internet, and determining how to apply them wisely in contexts that they were never designed for is difficult for even the best judicial minds.

Second, of those laws written with the internet in mind, nearly all were heavily influenced by politics and corporate interest, and are either ineffectual or biased.

Third, there is a difficult time applying the US Federal Rules of Evidence as regards expert testimony, because of the rapid pace of technology and the difficulty of finding consensus among experts in the pertinent fields. Worse, the definition of original data does not address the veracity of the source -- especially troubling given the ease by which electronic records can be modified or fabricated. (For a case in point, see the screenshots of file sharing programs provided by the RIAA.)

Given the current conditions of our laws as regard technology-based crimes, is it any wonder that state and federal prosecutors do not pursue more cases?

Cops do what we reward them for

[Anonymous Coward]

Somehow the cops get better publicity for arresting someone for child porn than they do for busting the SOB that stole your grandmother's life savings.

Some years ago, before all porn moved to the internet, someone dumped some porn videos in the river. That led the cops to arrest someone and seize all his tapes. The police chief made a big deal of it. He said we needed a pornography task force. He said he needed more officers. He said he needed a much bigger budget. The trouble was that the vast majority of the tapes weren't porn. The vast porn ring the police chief warned about didn't exist. What we had was a sleeze bag police chief trying to feather his own nest. Maybe they teach that kind of behavior in police chief school.

When I lived in a different city, I studied with a guy who was convicted of child pornography. The judge deeply regretted, in his sentencing remarks, that he couldn't send the guy to jail for longer. OK, the guy was a bit pathetic but he sure wasn't a hardened criminal. If he'd just kept his mouth shut, he would never have been convicted. He was a easy mark and the cops got lots of lovely publicity for busting him. (I'm not saying I would be happy to have this guy within a mile of my kids but he didn't deserve the punishment he got. What he needed was some elementary dental work and some social skills so he could pick up adult women. Paying a dentist and a social worker would have been way cheaper than throwing him in the clink for a bunch of years.)

Chasing real criminals who pose a real danger to society is difficult and doesn't produce much positive reinforcement for the police. If I were a police chief, I'm not sure I would think it was worth the effort.

Re:Here's part of it

[DavidTC]

They're pretty much limited to small time scammers who go around and personally scam people.

I'm less worried about those. While it is a cliche, it is true that it's much harder to con an honest man, and thus most of the face-to-face scammers come up with scams that would be illegal to participate in if they were legit. Or at least most 'long cons' are.

They do this because people are a lot more likely to be secretive, and a lot less likely to report the crime afterwards, if they believe their actions are illegal or at least somewhat gray.

The only online scam of this nature is the Nigerian advanced-fee fraud, and that's actually a face-to-face fraud that's happened to make its way online. And while it operates via spam, it actually operates rather different...they send out the spam in low enough volume that it's not noticeable as spam, so they can keep their return email open, and basically it's entirely personal past that point.

Most online scams, OTOH, are fake or forged storefronts that take your money or login for something that would be entirely legal, and just run with it. People who are victimized by them are honest people.

I've been waiting for a story like this...

[barnyjr]

I'm a cyber/white collar crimes detective for a medium-sized agency. There are so many problems with online crimes right now that I don't even know where to start. But one of the most important things is that people realize some of the problems we face...

1) I know it's popular (especially on slashdot) to bitch about how "Big Brother" is always trying to violate your civil rights for fun. But I will tell you that the red tape is one of the biggest factors in why a lot of online crimes don't get solved. For nearly every online crime, the first step is sending out subpoenas to every company involved. In a fraud case, this means: banks and the company where the order took place. Then once you get those returns, you have to subpoena the ISP to find out what the physical address is. All of these companies take anywhere from a week to 3 months to get you the information back.

2) Once you get all your basic background work on the case done, now you have to physically drive to the address where the activity took place. You want to know what happens to 90% of my cases at the point? Dead end. The idiot has an unsecured wireless router, which means that anyone could have perpetrated the crime. And of course, anyone that is dumb enough to leave their wireless network wide open isn't smart enough to have turned on logging in their router (which is off by default in almost all routers).

3) OK so now what. No we try to look at where the item was shipped, assuming it was an online purchase. Guess what? Nobody ships it to their home address. They ship it to a neighbors, or an abandoned house down the street, or one of the thousands of "work from home repackaging" businesses. OK, so do I go to a judge and try to get a search warrant to search a house where a package was delivered just on the off chance that they were stupid enough to use their real address? NO I can't! Judges want more hard evidence than that.

4) In non-purchase fraud cases (i.e. a person is transferring money around), we follow the money trail just like we do with any other financial crime. Guess where I dead-end here? Stored Value Cards. Get one from overseas, and now they don't have to comply with my subpoena. Dead in the water again.

OK so those are some of the issues in investigating online crimes, specifically fraud cases. Wanna know what the biggest issue is after all of that? I just spent about 30 man-hours investigating that $500 fraud case. I contact the victim to let them know what's going on. They've already been reimbursed by the bank simply by making their initial police report. The bank doesn't give a shit because $500 is nothing to them and they get to turn it in to insurance as a loss.

These are some of the reasons that online crimes aren't getting solved. For every one that I make an arrest on, I have 10 that I've dead-ended on. Unless the credit card companies and banks decide to take a stand and make their financial methods more secured, they're going to continue losing money. So the original story says that only 40% of time is being spend on fraud cases. Yeah that's probably about right. Kiddy porn and child solicitation cases may not seem as serious to some people, but they're so much more cut and dry. That's like saying that more robberies are solved than burglaries... they're 2 entirely different crimes with different sets of parameters.