# Presentation: 712344

## Responding to Cybercrimein the Post-9/11 World 

- Scott Eltringham
- Computer Crime and Intellectual Property Section
- U.S. Department of Justice
- (202) 353-7848

**Notes:**
Author: Richard P. SalgadoComputer Crime and Intellectual Property SectionUnited States Department of Justice

This slide presentation and accompanying notes are intended to offer assistance to the audience and readers, but constitute neither authority nor legal advice.  The analysis and conclusions reflect current thinking on difficult areas of law, and do not represent the official position of the Department of Justice or any other agency.  The presentation and accompanying notes have no regulatory effect, confer no rights or remedies, and do not constitute legal advice by the Department of Justice or me.  Please consult your own counsel to secure legal advice.
 Government investigators, agents and prosecutors are always welcome to contact the Computer Crime and Intellectual Property Section directly both for general advice and specific case-related assistance.   During regular business hours, at least two section attorneys are on duty to answer questions and provide assistance to government investigators, agents and prosecutors on the topics covered in this presentation, as well as other matters that arise in computer crime and intellectual property cases.

## Crime on the Internet

- The Internet provides a target rich environment for criminals
- Attacks are easy, low risk, hard to trace technically, hard to prosecute, and can have a high payoff
- Sophisticated tools are readily available
- Access can be from anywhere and anonymous

## Computer Attacks

- Attacks on:
- _C_onfidentiality,
- _I_ntegrity or
- _A_vailability of  information or systems
- Theft of information, services, or damage

## Typical Criminal Cases

-  Fraud
- Credit Card Fraud
- Economic Espionage
- Large File Transfers
- Raiding of Employees/Technical Know-how
-   Hacking
- Denial of Service Attack
- “Cyber-vandalism”

## Impacts of 9-11

- Heightened awareness by businesses of the vulnerability of their information systems and physical plants.
- Companies need to revisit their security procedures in light of changed circumstances.
- Looming threat of CNA

## Topics Overview

-    What is Being Done
-    Why Statistics are Crucial

**Notes:**
We are going to address many topics today, including steps that management and first responders should consider in the course of responding to an attack, the legal rights and constraints of network operators to monitor traffic, access stored data on the system and respond to the attacker, the certain types of conduct on a network that are illegal, the rationale for and against reporting to law enforcement, the rules of sharing information with law enforcement, and many other related issues.  To give these topics a context and to better illustrate how they relate to one another, we will address these issues in the order they arise in responding to a network attack.

## The USA Patriot Act

- Provided new and clarified existing electronic evidence gathering authorities
- Why the “USA Patriot Act”?
- Senate:  Uniting and Strengthening America (Act)
- House:  Providing Appropriate Tools Required to Intercept and Obstruct Terrorism (Act)

**Notes:**
This presentation was prepared by Richard Downing and Mark Eckenwiler of the Computer Crime and Intellectual Property Section.  Feel free to call us if you have any questions or concerns regarding this presentation or the legislation itself (202.514.1026).  

Also, feel free to substitute your name on the title slide and the concluding slide.

## Overview

- The Pen Register and Trap and Trace Statute
- The Computer Trespasser Exception
- The Cable Act Fix
- Other Amendments to the Wiretap Statute and ECPA

**Notes:**
Simple overview of the topics.  This slide reappears before each section heading with the pertinent topic in red.

## The Pen/Trap Statute

- Old statute:  the term "pen register" means a** *****device***** **which records or decodes electronic or other impulses which identify the** *****numbers dialed***** **or otherwise transmitted on the** *****telephone line to which such device is attached *****(18 U.S.C. 3127(3))**
- New statute: Technology-neutral language

**Notes:**
The sections generally follow a format of explaining what the old law was and then what the new language is and its significance.

Here, the important fact is that parts of the old pen/trap statute were very technology-specific.  The definition of "pen register" is the best example of language that appears to refer to telephone (and not computer network) communications.  When Congress passed the pen/trap statute in 1986, it appeared to have telephones in mind.  

The language in other parts of the prior statute, such as the definition of "trap and trace device" was not nearly so technology specific. For years, prosecutors have relied on these other parts of the statute to obtain pen/trap orders for communications on computer networks, such as the Internet.

Despite this common usage, some magistrates and judges refused to sign such orders, and one ISP challenged a pen/trap order that sought to collect source and destination information relating to e-mails sent to a target's account.  Thus, the Department sought to amend the statute to clarify that it applied equally to communications on computer networks.

## The Pen/Trap Statute (cont.)

- New Language:  the term "pen register" means a device** *****or process**** *which records or decodes** ****dialing, routing, addressing, or signaling information*** *transmitted by an instrument or facility from which a wire or electronic communication is transmitted ...
- Technology-neutral adjustments made throughout

**Notes:**
In order to make the statute technology neutral, the USA Patriot Act amended the definition of "pen register".  In order to clarify that the order could be carried out by a software tool and not just a physical device, the words "or process" were added after the word "device."

Similarly, the statute no longer talks about "numbers dialed", but instead "dialing, routing, addressing, or signaling information."  "Dialing" and ”signaling" were in the existing statute (section 3121(c)).  The words "routing and addressing" were added to try to capture the concept of the non-content information in a computer network (such as the "to" and "from" information in an e-mail).

Although it has always been true that a pen/trap order could not collect the content of a communication (for that you need a Title III), Congress nevertheless made it crystal clear that pen/trap devices cannot collect content by making this exclusion explicit in the definitions of "pen register" and "trap and trace device".

The statute was amended in numerous other places to remove telephone-era language.  The goal was to make the statute apply to any communications medium used today or that might be developed in the years to come.

## Computer Trespasser Exception

- Old law: law enforcement often had to get a wiretap order in order to help victims monitor computer hackers
- This made no sense:  the wiretap statute protected hackers even where they had no reasonable expectation of privacy in their communications
-  New law:  new exception to Title III
- allows interception of “computer trespassers” - i.e. those without authorization to use a computer

**Notes:**
Under the old law, law enforcement often could not readily assist victims to monitor hackers who were using their systems without authorization.  The wiretap statute often required law enforcement to obtain a wiretap order.  

For example, it has become increasingly difficult to use the “consent” exception to the wiretap statute, for technical reasons relating to how hackers now commonly gain access to computer networks.  In addition, although the wiretap statute contains an exception where the monitoring is conducted by   computer owners, this exception may not allow the owner to have law enforcement investigators conduct the monitoring on the owner’s behalf.

This situation made no sense.  Hackers have no reasonable expectation of privacy in their communications to or through the computers into which they have hacked.  Yet even though the 4th Amendment does not restrict interception of these communications, the statutory protections of the wiretap statute arguably applied to them.

The USA Patriot Act amended the wiretap statute to correct this anomaly.  Law enforcement investigators can now assist victims of computer hacking to monitor “computer trespassers” on their computer systems.  “Computer trespassers” include those who use a protected computer without authorization.

## Other Amendments

-   Voice mail fix
-   Scope of subpoenas under 2703(c)
-   Voluntary disclosure of information by providers
-   Nationwide search warrants for e-mail
-   Voice wiretaps in hacker investigations

**Notes:**
Summary of the other amendments to Title III and ECPA.

## Why Do Statistics Matter?

-   Companies Often Reluctant to Report
-   Proof that they are far from unique would be very helpful

## Why Companies Don’t Report

- Loss of Control
- Direction of case:  LE can’t be fired
- Costs
- Publicity
- Lack of Confidence
- Unsure of LE interest
- Unsure of LE competence

## Should companies report to LE?

- YES!
- Federal agents have
- investigative skills
- forensic knowledge
- access to attachés in foreign countries
- established relationships with Internet players
- can aggregate your information with data from other cybercrime victims

## Other Surveys

-   CSI/FBI
- 503 respondents, a good start
- 90% had computer security breaches
- 80% had financial losses as a result
- only 34% reported to LE
-   PWC
- 44% of British businesses had suffered a “malicious security breach” in the last year

## Where To Get More Information

- Computer Crime Section:  (202) 353-1787
- My e-mail:  scott.eltringham@usdoj.gov
- Computer Crime Section’s page on the World Wide Web: