PARTICIPANTS’ PAPERSRESOURCE MATERIAL SERIES No. 55

EFFECTIVE COUNTERMEASURES AGAINSTECONOMIC CRIME AND COMPUTER CRIME
Ramon Crespo Carrilho Machado*
I. ACTUAL SITUATION OF
ECONOMIC CRIME
Brazil is no exception to the late-century
economic crime sweeping the world. On
the contrary, it bears a long list of financial
scandals, strenuously prosecuted or stillunresolved serious cases and a widespreadsense of impunity. The existing set of laws
and regulations are under a continuous,
although slow, improvement process in an
attempt to fill legal gaps, stay abreast of
criminal innovations and fulfill
international agreements.
At the same time, criminal businessactivities constantly change their means ofaction, quickly adapting to the legal ande c o n o m i c c o n t e x t . S u r e l y, m o n e ylaundering constitutes one of the mostserious problems to study and control.
Money to be legalized come from countless
illicit sources; drugs and arms traffic,
corruption, import/export schemes,
financial system fraud, contraband andorganized crime, the most significant ofthem.
Economic crime seems to present atypology of special importance and frequent
occurrence in Brazil. It concerns large
corporations fraud, particularly banks andfinancial institutions. In the beginning ofmost cases, banks emerge as financiallytroubled institutions and later, afterinvestigation, turn out to include a
substantial criminal component. That was
the case of Banco Economico. Its financial
problems became public in December 1994
* Federal Criminal Expert, Federal Police
Department, Ministry of Justice, Brazil

148

and upon continuous demand for official
monetary assistance, Central Bank
intervention amounting to USD $3 billion
began only in August 1995. Later in thesame month, the National Monetary
Council approved PROER, which is atreasury fund that guarantees accountdeposits and finances to troubled banks for
restructuring. Banco Economico’s “goodpart” was sold to other banks while “therest” remained under Central Bank
administration, demanding USD $2.9
billion from PROER; due November 1996
and never paid.
As to the fraud, the police inquiry
process came across several illicit actions
entrusted to Banco Economico’s owners
who cooperated with the financial
insolvency. Among these actions weremoney transfers to foreign accounts, thetransfer of assets to associated companies
and to controlled off-shore companies,
simulated real state operations, bad loans,etc., which significantly reduced its asset
guarantees. A remarkable fact was that
the Central Bank noticed these frauds only
after the police inquiry.
A private bank called Banco Nacional
has an even more astonishing story. The
Central Bank intervention of it took placein November 1995, although there isevidence that inspectors knew about
misdeeds since September 1987. The
inquiry process conducted by the Federal
Police resulted in 700,000 pages,
distributed in 900 volumes. Forensic
computer experts went through 6,000
magnetic tapes containing 30,000 software
programs used by Banco Nacional. They

110TH INTERNATIONAL TRAINING COURSEPARTICIPANTS’ PAPERS
selected evidence from over 50,000 backup
magnetic tapes and developed over 100
data filtering programs in ‘Easytrieve’,‘Cobol’ and ‘Clipper’ computer languages.
One IBM 9672 mainframe and several
personal computers were used tomanipulate this material.
Accounting and computer forensic
examinations managed to prove that Banco
Nacional utilized up to 1,046 of its accounts
to grant phony credit amounting to USD$
16.9 billion over a period of seven years.
There was no real money involved in these
operations, but on manipulating
accounting computer programs, thosecredits incorporated positive results into
the audited balance sheets and made it lookfinancially sound. Banco Nacional
demanded USD $4.98 billion from PROER,
due November 1996 and still unpaid.
Again, its “good part” was sold to anotherbank.
Brazil’s land border with Paraguay has
also provided an opportunity for large scalemoney laundering after the Central Bank
imposed limitations on foreign residentbank accounts and financial operations in
1996. Some exempt status was granted toa few banks and exchange bureaus, toremain working under the old rules inconsideration of border intense commercial
transactions. This exception attracted anenormous amount of money laundering
operations to the border. Some of Banco
Nacional’s accounts analyzed during theinquiry process raised clues to the border
operations, and investigation began. The
present status of investigation points tooperations amounting to USD $10 billion,
under scrutiny through 152 police inquiry
processes, with 50 more being started
nationwide to identify these money sources.
The Central Bank revoked the special
status for that area and enhanced
inspections.

Another instance of illicit money transfer
being explored is related to “Annex IV”, aCentral Bank Ordinance that permits
foreign investment in Brazilian capital andstock markets through Foreign Investment
F u n d s . To g e t h e r w i t h l e g i t i m a t e
investment money, money previously sent
abroad as a result of corruption, tax
evasion, parallel accounting schemes, etc.,
has an excellent method of legally
returning to the country and leaving again
in the same way. Finance specialists
estimate that 50% of Brazilian foreign
reserve is funded in Annex IV investments.
The most recently noticed economic
crime typology, being followed closely by theCentral Bank and the Federal Police, isrelated to NGOs (Non Governmental
Organizations) and “Foreign Entities
Assistance Funds”. They are moving large
amounts of money into Brazil, justified as
relief assistance by NGOs and as social
investment by Foreign Entities.
One of the few statistical data studies
available on economic crime was developedby a Federal Public Prosecutor as a doctoral
thesis. It became a book titled “Criminal
Control on Crimes Against the National
Financial System” (Ela Viecko Volkmer deCastilho) published this year. It researched
all Central Bank communications to the
Public Prosecutors Office related to facts
defined as ‘economic crime’ by a 1986 law,which is the main legal provision defining
crimes against the national financial
system. This law places financial
institutions under Central Bank
inspection, thus greatly centralizing in it
all information. During the Central Bank’s
exercise of this attribute, identified
irregularities are addressed via an
administrative process. When illicit facts
come up, the Central Bank must refer thecase to Prosecutors Office, which candismiss it or request the Federal Police
institute a police inquiry process. Upon

149

RESOURCE MATERIAL SERIES No. 55
completion, police inquiries end up in theFederal Justice courts for trial. The
research period covered July 1986 (whenthe 1986 law was enacted) to July 1995 andconsiders a selection of 606 Central Bank
communications, as shown in Table 1.
TABLE 1NUMBER OF CENTRAL BANKCOMMUNICATIONS
Year
1987
1988
1989
1990
1991
1992
1993
1994
1995
Total

No.
0
8
14
25
87
117
131
125
99
606

fr %
0.00
1.32
2.31
4.13
14.35
19.31
21.62
20.63
16.33
100.00

Table 2 shows the information gathered
about the average time, in years, calculated
from the time the alleged criminal facts
occurred and the date they werecommunicated to the Prosecutors Office.
TABLE 2
ELAPSED TIME BETWEEN FACTAND COMMUNICATIONTime
No. of years
0 to less than 1
63
1 to less than 2
93
2 to less than 3
102
3 to less than 472
more than 4
33
Total
363
Average time = 2.2 years

fr %
17.36
25.62
28.10
19.83
9.09
100.00

Table 3 shows the elapsed time, inmonths, calculated from the date of theCentral Bank communication to theProsecutors Office, and the date that the150

police inquiry process was instituted.
TABLE 3
ELAPSED TIME BETWEENCOMMUNICATION AND
PROCESS INSTITUTIONTime
No. of years
0 to less than 1
63
1 to less than 246
2 to less than 3
43
3 to less than 425
more than 4
35
Total
212
Average time = 2.1 months

fr %
29.72
21.70
20.28
11.79
16.51
100.00

Table 4 shows the elapsed time, in years,
calculated from the date of the police
inquiry process being instituted and its
conclusion by the Federal Police.
TABLE 4
ELAPSED TIME BETWEENPROCESS INSTITUTION AND
CONCLUSIONTime
No. of years
0 to less than 1
2
1 to less than 2
14
2 to less than 3
26
3 to less than 4
14more than 4
4
Total
60
Average time = 2.5 years

fr %
3.33
23.33
43.34
23.33
6.67
100.00

Table 5 shows elapsed time, in years,
calculated from the date of the police
inquiry process being instituted andindictment by the Prosecutors Office, whichis the beginning of the judicial process.

110TH INTERNATIONAL TRAINING COURSEPARTICIPANTS’ PAPERSTABLE 5TABLE 7ELAPSED TIME BETWEENPROCESS INSTITUTION AND
INDICTMENTNUMBER OF ADJUDICATED CASESTime
No. of years
0 to less than 1
38
1 to less than 248
2 to less than 337
3 to less than 4
22
Total
145
Average time = 1.8 years

fr %
26.21
33.10
25.52
15.17
100.00Item
Dismissed sentence
Merit sentence
Total

No.
62
15
77

fr %
80.52
19.48
100.00

Table 8 shows the nature of meritsentences.
TABLE 8
NATURE OF MERIT SENTENCES

Table 6 shows the elapsed time, in years,
calculated from the date of indictment by
the Prosecutors Office and the sentencing
by a Federal Justice Court.
TABLE 6ELAPSED TIME BETWEEN
INDICTMENT AND SENTENCINGTime
No. of years
0 to less than 1
5
1 to less than 2
4
2 to less than 3
93 to less than 4
2
Total
20
Average time = 2,5 years

fr %
25.00
20.00
45.00
10.00
100.00Item
Acquittal sentence
Conviction sentence
Mixed sentence
Total

No.
10
3
2
15

fr %
12.98
3.90
2.60
100.00Additionally, table 9 shows the Federal
Police Department statistics about the total
number of police inquiry processes initiatedbased on the two main laws regulating
economic crime. They amount to 7,742
inquiry processes since 1986 (when the firstlaw was approved) up to the present day.
Only 2,893 of these cases are registered as
being concluded.

Table 7 shows the number of adjudicatedcases. The distinction between a dismissed
sentence and a merit sentence is as follows.
The first one is issued after the conclusionof the police inquiry or Prosecutors Officeapprasial, when there is no basis forreferral to a Federal Justice Court. The
latter, after the conclusion of instruction
in Federal Court, is provoked by referral.

151

RESOURCE MATERIAL SERIES No. 55
TABLE 9NATURE OF MERIT SENTENCES
Law 7.492/86 Law 8.137/90
Year
Started Concluded Started Concluded
1986
1987
6
1
1988
11
1
1989
46
7
1990
78
36
2
2
1991
154
35
60
17
1992
201
100
59
35
1993
481
235
280
114
1994
401
255
434
209
1995
369
190
518
288
1996
821
470
550
252
1997
629
228
851
257
1998
1,107
81
684
80
Subtotal 4,304 1,639 3,438 1,254
The research study and table dataeloquently demonstrate the application of
the economic crime law. The small numberof registered criminal offences bear no
proportional significance when comparedto the total criminality registered in official
statistics; estimated as one million Penal
Code offences per year in the country. Itshows the necessity to investigate thecurrent interpretation of the legal
provisions and to study the Central Bank,
Public Prosecutors Office, Federal Police
and Federal Justice system’s operation andprocedures.
II. PROBLEMS IN INVESTIGATION
AND PROSECUTION OF
ECONOMIC CRIME AND THEIRCOUNTERMEASURESThe economic crime research mentioned
before showed the Central Bank’s
predominant role in identifying illicit
procedures and reporting them to justiceauthorities. Legal power to inspect thefinancial system’s operating procedures

152

places the Central Bank under a judicial
duty to communicate crimes to the Public
Prosecutors Office. This communication is
not a requirement to start the police
inquiry process or criminal justice process,but it has conditioned other instances ofaction in practice.
The 1986 economic crime law predicts
the assistance of the Central Bank inprosecuting cases in the criminal process.
However, it is not rendering greater andbetter scrutiny of economic crime. As
became evident in the bank crash cases
cited in the previous section, Central Bank
monitoring has not prevented trouble infinancial institutions. Its inspecting
structure is oriented to law-abiding
auditing actions, instead of real financial
situations and assets quality evaluations.
Among other institutions withinspecting duties and illicit communication
obligations are the CVM (Securities
Exchange Commission), the Internal
Revenue Service (IRS) and somegovernment banks. Compared to thenumber of Central Bank communications,
CVM has communicated a total of 85 cases
to the Public Prosecutors Office, based on
the 1989 law defining responsibilities fordamages caused to investors on the
Exchange Market.
The Central Bank’s functions andautonomy are expected to undergo
significant changes as further regulations
are being debated in Congress. Its
autonomy, in relation to Executive power,
is intended to avert political influence inall areas. The same autonomy is desired
for CVM as well, including a greater rolein assisting prosecution.

110TH INTERNATIONAL TRAINING COURSEPARTICIPANTS’ PAPERS
III. CRIME PREVENTION
MEASURES TO CONTROLECONOMIC CRIME
The first step to preventive action on
economic crime is a sound, effective set oflaws. It is a prevalent belief that theresolution and significant change of serious
problems can only take place in a country
as a consequence of political motivation.
Observation of recent trends in Brazil leads
to the conclusion that important changes
are taking place.
Recent developments include the March
1998 Congress approval of Law 9.613/98,
incriminating money laundering activities.
This long-awaited law filled an important
gap in Brazilian criminal legislation, whileat the same time complying with several
international agreements, (among themthe 1991 Vienna Convention). It also
created COAF (Council to Control
Financial Activities) responsible formonitoring the activities of money
laundering suspects in financial andcommercial operations. COAF isempowered to apply administrative
penalties and request needed information.

A new anti-drug policy is to be developed
based on prevention and rehabilitation,
including better laws and regulations,particularly on the concept of preserving
national sovereignty and individual rights.
This new policy will also pursue
investigating the financial flow of drugs
and Brazil’s incorporation into FATF
(Financial Activities Task Force). The
Brazilian Federal Police Department also
has improved its structure, aiming tobecome a more effective and specialized
force against economic crime. A specificcommissioners division was created to thisend, namely DICOIE (Organized Crime
and Special Inquiries Division), under the
direct guidance of the General Director.
Finally, its crucial to optimize international
cooperation, especially with Interpol.
IV. ACTUAL SITUATION OFCOMPUTER CRIME

Along the same line, the constitution of
SGT-4 (Money Laundering Subcommitteeof the Mercosul Financial System
Commission) is intended to develop
strategies for the Mercosul countries. They
are presently evaluating the Brazilian
proposal for a minimum regulatory code.

The term “computer crime” is being
widely utilized and is well established anddefined. However, due to the fast pace oftechnological innovation, a comprehensive
approach must be adopted to efficiently
combat this type of crime. Based on thethe Brazilian Federal Police Department’s
experience relating to computer crime, aspecialized Computer Crime Investigative
Division was created as part of the National
Forensic Institute. In developing a
cognizance for, and extending this categoryof crime, it was first necessary to devise
three kinds of offences, as follows:

Another important initiative was thecreation of the National Anti-drug Bureau,
upon the recognition that Brazil has
become a corridor for drug export, and thebiggest manufacturer of chemical productsin Latin America. The estimatedconsumption of illegal drugs in the country
is USD $7.5 billion. Brazil has also become
more attractive for money laundering andcapital recycling, due to economic stability.

A. Computer Aided Activities
These are activities usually developed
without ‘computer demand’, but the use ofcomputers come from the assistance they
provide. It presents the possibility ofevidence retrieval when police action comes
across these types of devices. Some
examples are:• computer organizers used by drugtraffickers to store telephone numbers

153

RESOURCE MATERIAL SERIES No. 55
and addresses, and computers storing
information about their business;• parallel accounting control incomputers.

these institutions suffered a USD $800,000
loss through illicit Internet credit card
purchases between July 1997 and March
1998, which were not reported to police.

B. Technology as an Instrument
In this category, the presence ofcomputers in the process is required toperpetrate the offence. Without thecomputer, the fact of the crime would notoccur. This category is not intended toindicate the appearance of new criminal
facts, although this might be the case. It
is mainly for activities using computers as
a new tool to gain efficiency, lower costs andimprove crime member security. An
illustrative example is counterfeit money,
which migrated from labor intensive andcostly printing processes to the average costof a graphics workstation. Likewise, thisis also the case for economic crime.

Counterfeit money produced throughgraphics workstation resources, andprinted on laser and inkjet printers, has
increased dramatically since theintroduction of the ‘Real’ (Braziliancurrency denomination) in 1994, with
newly designed bills. The number of forgedcurrency bills made through this method
and seized by the Central Bank increased
as shown in table 10.

C. Virtual Crime
Labeled this way are those crimes
targeting computers and the reality (data)stored in them. The intention is to alter
the digital representation of goods andvalues in order to obtain unmerited
advantages. For this purpose, all it takes
is privileged access to computers,commanding transactions throughkeyboards, which is far more convienent
than handling pistols and machine guns
to demand and withdraw money from abank.
Offenders in these cases seem to be
motivated by the small probability ofphysical injury, together with the support
that a device which processes millions ofoperations per second can offer, to use these
operations to benefit them directly.
Its known that in Brazil, several credit
card companies have been victims of credit
card fraud; but they will not disclose thesefrauds throush fear of negative publicity
and breach of client confidence. One of154

TABLE 10
NUMBER OF SEIZEDCOUNTERFEIT MONEY BILLS
Year
1994
1995
1996
1997
1998
Total

Bills
1.046
9.168
75.283137.489
101.182
324.168

The enormous incidence of this type ofoffence compelled the Federal Police
Forensic Section to develop a computer
database intended to classify eachcounterfeit bill according to its:
• value• printing process: ink jet, laser, off-set,
copying machine• individualizing details: type of paper,
serial number, defects• origin: city where bill wasapprehended• date• inquiry process number• names involved
This database registers money forgery
occurrences in Sao Paulo since February
1996, storing information from 1,387 police

110TH INTERNATIONAL TRAINING COURSEPARTICIPANTS’ PAPERS
inquiry processes and totaling 4,177
currency bills classified to date.
A report containing matching
characteristics keyed by value, printing
process, details and name is then issued
and attached to the forensic analysis reportwhich is sent to the origin for further police
investigation. Another benefit of thisreport is the possibility of quickly
identifying and effectively charging thecriminals also responsible for counterfeit
money with similar characteristics foundin distant locations.
V. PROBLEMS IN COLLECTINGEVIDENCE OF COMPUTER CRIME
AND THEIR COUNTERMEASURES
Within evidence collection, a morepressing and crucial problem is posed bytracking and identifying offenders,
particularly when considering cases
originating in large networks such as theInternet. The actual stage of WWW
computer interconnection allows anyone,from the most remote location, to accessinformation in unsecured systems virtuallyunnoticed. Moreover, his/her system might
be used to store, diffuse and/or promote
such crimes as pornography, bomb
manufacturing, introducing computerviruses, etc.
Although most reported cases relate topornography involving children and teenagers, damage caused by hackers isfrequent, but seldom effectively prosecuted,
due to criminal classification uncertainty.
Questions to address in examinations of
this nature are:i) First, the existence of legal provisions
for the crime;ii) Correct identification of the criminal
acts authorship. Most of the time,computer activities registers (logs)
are obtained, but the possibility offorged computer access using third
parties accounts must be considered,as it is a common procedure inhackers attacks;iii) What can be considered as evidence?
For example, one Internet page
containing illicit material is initially
noticed (browser). Usually, there’s a
responsible person for each page on
the web, and he/she is identified byinquiring through the server operator(it must be remembered that servers
will not take responsibility for users
published material). To bettersupport prosecution, these pages areapprehended in the server’s system.
Couldn’t the hackers be those who
inserted the pages, considering theprevious item’s (2) rationale?
iv) One computer being “invaded” by ahacker theoretically situated in adifferent state poses the problem of
distance, in actions of search andapprehension.
In a recent and very much publicizedcase in Brazil, a TV presenter of a cultural
program which shows its e-mail address on
screen for viewers interaction, received 105
harassing messages from a“rapist@macho.com”. Police weresuccessful in identifying the author, amarried systems analyst, who disguised his
signature using software called
Unabomber. In addition, he had 430 moremessages in his HD sent to a newspaper
columnist. He was charged withharassment and convicted to a one-year
alternative sentence.
To track him, as has happened in othercases, police relied on the network service
provider’s cooperation. Obviously, thiscooperation can not always be expected, assome service providers are resistant todisclose client registers; posing the problem
of devising other effective means ofinvestigation and mandatory disclosure

155

RESOURCE MATERIAL SERIES No. 55
regulations.
A relevant case of child pornography wasinvestigated by Interpol in Brazil, basedon information received from counterpartsin other countries and child protectiongroups. Working with remote monitoring,
electronic surveillance and search
warrants, Interpol managed to identify andarrest the service operator, and one of its
users, in another state as responsible for
furnishing several images.
The creativity component found in thepractice of these particular offences is acontinuous challenge for forensic
specialists’ knowledge improvement. Someuseful technical concepts for evidencecollection are presented below, although it
is important to mention that it is difficult
to list a detailed set of proceedings andtechniques suited for all forensic
examinations.
A. Evidence Retrieval
The title expression has been used forsome time by special computer crime units
in international organizations; meaning awhole set of proceedings to be performedin the forensic examination of computermaterials. An elemental sequence in thisset of proceedings is as follows:i) Ambience Analysis: gathering all
information concerning work
environments, hardware andsoftware adopted, user activities,
data flow, connections configuration(e.g. isolated workstation, network
station, modem connections, etc.),
amongst others, is fundamental in
reducing the possibility of error in thenext steps;ii) Search: after taking cautionary
measures to preserve all the material(unchanged), useful data is searchedin the equipment support;iii) Translation: considering that any and156

every computer content is, in fact, a
digital representation of thecomprehensive information of humanbeings, translation processes are used
to both insert into and retrieve
information from computers, thus
making it possible to obtain originalunaltered information. It may look
simple but, considering thepossibility of a faulty translation,
methods and proceedings must be
defined to guarantee sufficient clarity
and accuracy;iv) Presentation: issuing a final report.
B. Search of Information
Special methods and tools are employed
to recover data, information, or remnantsof them, located in permanent memorycomputer media, such as hard and floppy
disks, magnetic tapes, CD-rom, opticaldisks, etc. The usual proceedings are:i) Searches adopting a user point ofview, oriented to understanding thework ambience of the equipment’suser, comprehending directory tree
verification, main software programs
and installed systems;i) Meticulous search of scattered data,such as text and images fragments,
deleted files and printing spools.
The above mentioned cautionary
measures in handling examining material
anticipate the following actions, taken inorder to preserve evidence integrity:i) Technical measures: boot control,
media mirroring etc;ii) P h y s i c a l C a r e : p a c k a g i n g ,transportation, magnetic fields etc.

110TH INTERNATIONAL TRAINING COURSEPARTICIPANTS’ PAPERS
VI. LEGAL FRAMEWORK AND
CRIME PREVENTION MEASURESTO CONTROL COMPUTER CRIME
The existing legal framework on
computer crime in Brazil still lacks aspecific and comprehensive law defining
principles, legal use of information, andrelated offences and punishments. Thereis a draft bill in Congress, which has notbeen submitted to debate yet, whose
proposals contain:• Principles to regulate computer
network services;• Rules for the use of computer andnetwork information;• Definition of computer offences andrespective punishments, ranging
from six months to six years
imprisonment and fine.

iv) Law 7.646 - 1987: software is definedas original intellectual property.
In some cases, certain laws are being
used with a broader interpretation of theirprovisions; to penalize computer-related
crime conduct lacking a specific legal basis.
According to one approach, “If computerequipment is considered someone’s else
property, actions of erasing or altering its
digital representations directly affects thecondition of its regular functionality. In
this way, the equipment can be properly
considered as an aggregate of its physicalparts (hardware), in association withessential instructions to achieve its
intended functionality (software), thus any
such damage could be charachterised as acrime.’’

Some existing laws provide partial
support to the prosecution of determined
offences. The relevant portions of theselaws are summarized below:i) Law 5.988 - 1973: when information
turns to be original material and isrelated to literary, artistic or scientificwork, its author has rights definedin this law;ii) Law 7.170 - 1983: considering a given
set of data as secret and of Brazilian
state interest, its diffusion(communication, delivery, consent tocommunication or delivery) to foreign
governments or groups, ororganizations or groups of illegal
existence, constitutes a crime against
national security, political and social
order;
iii) L a w 7 . 4 9 2 - 1 9 8 6 : t h e p l a i nunauthorized access to extraneous
data kept by financial institutions isalready typical conduct. Article 18
defines as a crime the breach offinancial institutions operationalsecrecy or rendered services;157