Slashdot Mirror
Carderprofit.cc Was FBI Carding Sting, Nets 26 Arrests
tsu doh nimh writes in with news of a major sting operation against carders. From the article: "The U.S. Justice Department today unveiled the results of a two-year international cybercrime sting that culminated in the arrest of 26 people accused of trafficking in hundreds of thousands of stolen credit and debit card accounts. Among those arrested was an alleged core member of 'UGNazi,' a malicious hacking group that has claimed responsibility for a flood of recent attacks on Internet businesses."
The trick: the FBI ran a carding forum as a honeypot.
FBI created some criminals.
HILARIOUS.. I mean it reminds me of the dick-tracy parody bugs bunny cartoon yeaaaaaars ago where the villains' hideout was marked by a blinking marquee and neon signs that said "secret hideout" or something. how dumb are the criminals that fall for this?
Why does Avast WebRep have 3 red bars for justice.gov?
The carders they busted are low-life amateurs, not serious criminals. I'm sure the FBI and friends will milk this for all it's worth, but it's the equivalent of nicking a couple of shoplifters while at the same time, Mexican drug lords are burning down the entire city.
Come and wake me up when they bag some REAL criminals, like the big Russian gangsters robbing SMEs out of hundreds of millions per annum.
The real criminals are untouched -- and untouchable.
A quick primer on entrapment:
If you are trolling Drug Dealer Drive for drugs and you happen to ask a undercover agent for drugs, you are guilty.
If a undercover agent posing as a drug dealer comes to you out of the blue and says that you need to buy his drugs so that he can help his sweet grandmother beat cancer, that's entrapment.
The difference is that in the first example, you were already out with the intention of doing something illegal. The second example you were approached by LEO and convinced to do something you normally wouldn't do.
IANAL and I'm sure each jurisdiction has it's own definition of entrapment but this is the jist.
We don't live in Shouldland.
Ok, this is a purely curiosity-based question, and I know there's lot of web security people roaming around here. How would you actually detect that a website like this is a honeypot?
I for one am happy that law enforcement is finally figuring out how to apply traditional police work to the internet successfully. It's the good old-fashioned sting made digital.
Of course the parent poster is right... I'd imagine any serious credit card thief would be operating through Tor, doing anonymous payment with something like Bitcoin, and not even fooling around with signing up on new sites of unknown/unverified origins.
But this is pretty typical for the FBI. They're as interested in the P.R. as anything else. They need to show they're making arrests and giving the news media something positive to print. It helps ensure their continued funding for the division handling these high-tech crimes and they probably also figure it's a deterrent to beginners, who could become tomorrow's elite card thieves otherwise.
Real criminals? If they were actually using credit card information to make illegal purchases, they ARE real criminals! Just because you don't have to mug someone to get his wallet doesn't matter. At least when you are mugged (assuming you don't have to go to the hospital) you know your personal information has been stolen. When your personal information is stolen via the computer, you often don't learn about it until the big bills start to pile up. Also, a mugger usually steals only hundreds (maybe thousands) a credit card thief usually starts at that point and goes up from there. In terms of money lost, we went the FBI to go after them and the thieves running the big banks and Wall Street. Let the local police deal with the muggers.
Here's what entrapment is, as explained by a lawyer, in an appropriately visual format to appease the attention span of most Slashdotters.
You do not have a moral or legal right to do absolutely anything you want.
Then it is not illegal.
It's called undercover police work, and undercover police work is perfectly legal, including the commission of various non-violent crimes required to maintain their cover.
The cops weren't out there having TVs shipped to their houses and not documenting them so the victims wouldn't be reimbursed. They were hosting a forum, and made it look like other similar on-line criminal hangouts. When real criminals arrived, they maintained the forum long enough to accumulate enough evidence (IDs of suspects, records of criminal activity), then rolled them up.
They did their jobs, successfully.
John
http://news.sky.com/story/952931/fraud-ring-in-hacking-attack-on-60-banks
who qualifies as a criminal, exactly, by your interesting standards
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
It's been long known that the best way to catch a criminal is to pretend to be one. (Some might argue that the government is already doing a damned good job of that.) Getting them to show their hand (having a cop as a witness to the crime) and/or confess their misdeeds voluntarily is pretty much the best way to get a conviction.
This is why you get undercover cops buying drugs, joining gangs, etc. Stings are perfectly legal, and, if they follow the rules as laid out by the courts, seem pretty reasonable. As long as the cops don't entice someone into committing a crime, they're clear. Pretending to be a fence and accepting stolen goods is not entrapment, but pretending to be a fence and telling someone to steal something to sell to you is. If "carderprofit.cc" merely accepted the trade of stolen card info, it's a sting. If they recruited people to target specific venues ("I hear ebay.ca's admin password is XXXX, why don't you nab us some of those cards?"), that's entrapment.
So, no, it's not illegal.
First, you messed up your link. Corrected.
Second, from the start of the article:
"When an Oregon college student, Mohamed Osman Mohamud, thought of using a car bomb to attack a festive Christmas-tree lighting ceremony in Portland, the F.B.I. provided a van loaded with six 55-gallon drums of "inert material," harmless blasting caps, a detonator cord and a gallon of diesel fuel to make the van smell flammable. An undercover F.B.I. agent even did the driving, with Mr. Mohamud in the passenger seat. To trigger the bomb the student punched a number into a cellphone and got no boom, only a bust."
Emphasis mine. This is not entrapment at all. The attack was his idea. The feds just helped him along to show he was willing to go through with it. It's no different than if somebody asked a bartender about a hitman to kill their spouse, and then the feds supplied them with one.
The Cromitie case is much more dubious, and if it's true he wasn't actively seeking to become a jihadist, I feel it is entrapment. But I also feel that way about cops dropping bills on the subway and arresting people who pick them up and keep them, or cops who leave unlocked vehicles with keys in the ignition in bad neighborhoods.
I wonder if their bail bondsmen took Visa or MasterCard?
John