110TH
INTERNATIONAL
TRAINING
COURSEVISITING
EXPERTS’
PAPERSVISITING EXPERTS’ PAPERSCRIME IN CYBERSPACEPeter Grabosky*
I. INTRODUCTION
It has almost become trite to suggestthat we are entering an age as significant
and profound in its impact as was theIndustrial Revolution. The convergence ofcomputing and communications has
already affected most if not all of the major
institutions of society. It has createdunprecedented opportunities for education,
health services, recreation, and commerce.
Unfortunately, it has also createdunprecedented opportunities for crime.
Identifying these vulnerabilities, andmobilizing appropriate countermeasures,will be one of the great challenges of thenext century. As we will observe, thechallenge is so great that it defies thecapacity of law enforcement alone tocontrol. Consequently, new forms ofpolicing, involving the harnessing of nongovernment resources, will become
essential. Given the fact that cyberspace
knows no boundaries, and that computer
crime often transcends national frontiers,
effective countermeasures will also requirea degree of international co-operation
which is without precedent.
II. VARIETIES OF COMPUTERCRIME
The variety of criminal activity which
can be committed with or against
information systems is surprisingly
diverse. Some of these are not really new
in substance; only the medium is new.
Others represent new forms of illegality
altogether.

* Director of Research, Australian Institute of
Criminology, Australia

A. Theft of Information Services
Ever since the original ‘‘phreakers’’ of aquarter century ago attacked telephones y s t e m s o u t o f c u r i o s i t y,telecommunications services have been
vulnerable to theft. From those whose
motives were confined to simple mischief
making, to those who have made theft ofservices a way of life and major criminal
industry, those who steal services pose asignificant challenge to carriers, service
providers, and to the general public, who
often bear the financial burden of fraud.
The market for stolen communications
services is large. There are those who
simply seek to avoid or to obtain a discounton the cost of a telephone call. There areothers, such as illegal immigrants, who areunable to acquire legitimate information
services without disclosing their identity
and their status. There are others still who
appropriate information services to conduct
other illicit business with less risk ofdetection.
The means of stealing
telecommunications services are diverse,
and include the ‘‘cloning’’ of cellular phones,
counterfeiting of telephone cards, andunauthorised access to an organization’s
telephone switchboard. In one case,hackers were reported to have obtained
unauthorised access to the telephonefacilities of Scotland Yard, and made US$1
million in phone calls.
B. Communications in Furtheranceof Criminal Conspiracies
Modern information systems clearlyprovide an effective means by which
offenders can communicate in order to plan35

RESOURCE MATERIAL SERIES No. 55
and execute their activities. There isevidence of information systems being used
to facilitate organised drug trafficking,gambling, prostitution, money laundering,child pornography and trade in weapons(in those jurisdictions where such activities
are illegal). Although the use of
information facilities does not cause such
illegal conduct to occur, it certainly
enhances the speed and ease with which
individuals may act together to plan andto execute criminal activity.
C. Information Piracy/
Counterfeiting/Forgery
Each year, it has been estimated thatlosses of between US$15 and US$17 billion
are sustained by industry by reason of
copyright infringement. Arguably, thespeed and accuracy with which copies ofworks may now be made has been
dramatically enhanced by such modern
technology as online information networks.
Copyright infringement may occur quickly
and without difficulty, and may be carriedout by anyone capable of using the Internet.
The Software Publishers Association has
estimated that $7.4 billion worth ofsoftware was lost to piracy in 1993, with
$2 billion of that being stolen from theInternet.
As broadband services continue tobecome available with text, graphics, soundand video information being freely
accessible via cable modems, the potential
for copyright infringement involving suchworks will be enhanced enormously.
Already in the United States it is possible
to download compact disks and featurefilms from the Internet.
D. Dissemination of Offensive
Materials
Content considered by some to be
objectionable exists in abundance incyberspace. This includes, among muchelse, sexually explicit materials, racist

36

propaganda, and instructions for the
fabrication of incendiary and explosive
devices. Information systems can also be
used for harassing, threatening or
intrusive communications, from thetraditional obscene telephone call to its
contemporary manifestation in ‘‘cyberstalking’’, in which persistent messages aresent to an unwilling recipient. In one
recent case, a student composed a sadistic
fantasy and sent it out over the Internet.
He used the name of a fellow student as
the story’s victim, and was initially charged
with communicating a threat, although
this was later withdrawn.
The rich diversity in thresholds oftolerance around the world, combined withthe global reach of information, make thisa particularly difficult regulatory
challenge. What is offensive to authorities
in the People’s Republic of China, mightb e w e l c o m e i n o v e r s e a s Ti b e t a n
communities. Materials offensive toreligious leaders in Iran may fail to raise
an eyebrow elsewhere.
E. Electronic Money Laundering
For some time now, electronic funds
transfers have assisted in concealing andmoving the proceeds of crime. Emerging
technologies will greatly assist inconcealing the origin of ill-gotten gains.
Large financial institutions will no longer
be the only ones with the ability to achieve
electronic funds transfers transiting
numerous jurisdictions at the speed oflight. The development of informalbanking institutions and parallel banking
systems may permit central banksupervision to be bypassed, but can also
facilitate the evasion of cash transaction
reporting requirements in those nations
which have them.
Tr a d i t i o n a lunderground banks, which have flourishedin Asian countries for centuries, will enjoy
even greater capacity through the use of
information technology.

110TH INTERNATIONAL TRAINING COURSE
VISITING EXPERTS’ PAPERS
With the emergence and proliferation ofvarious technologies of electroniccommerce, one can easily envisage how
traditional countermeasures againstmoney laundering may soon be of limited
value. I may soon be able to sell you aquantity of heroin, in return for an
untraceable transfer of stored value to my‘‘smart-card’’, which I then download
anonymously to my account in a financial
institution situated in an overseas
jurisdiction which protects the privacy ofbanking clients. I can discreetly draw uponthese funds as and when I may require,
downloading them back to my stored value
card.
F. Electronic Vandalism andTerrorism
As never before, western industrial
society is dependent upon complex dataprocessing and information systems.
Damage to, or interference with, any ofthese systems can lead to catastrophic
consequences. A recent United States
government study estimated that some
250,000 separate attempts to penetrate
United States defence installations had
occurred during the previous year. Not allof these are attributable to harmlesscuriosity. Defence planners around theworld are investing substantially in
information warfare as a means of
disrupting the information technology
infrastructure of defence systems.
W h e t h e r m o t i v a t e d b y c u r i o s i t y,vindictiveness or greed, electronic
intruders cause inconvenience at best, andhave the potential for inflicting massive
harm.
G. Sales and Investment Fraud
The use of the telephone for fraudulent
sales pitches, deceptive charitable
solicitations, or bogus investment
overtures is a billion dollar a year industry
in the United States. The intensificationof commercial activity in the United Statesand globally, combined with emerging
communications technologies, would seemto heighten the risk of sales fraud. Alreadyevidence is emerging of fraudulent sales
and investment offers having beencommunicated over computer networks
and Bulletin Boards.
Furtherdevelopments in electronic marketing will
provide new opportunities for theunscrupulous and new risks for theunwitting.
H. Illegal Interception ofInformation
Developments in information provide
new opportunities for electronic
eavesdropping. From activities as timehonoured as surveillance of an unfaithful
spouse, to the newest forms of political andindustrial espionage, informationinterception has increasing applications.
Here again, technological developments
create new vulnerabilities. In New York,for example, two individuals recently useda sophisticated scanning device to pick upsome 80,000 cellular telephone numbers
from motorists who drove past their
Brooklyn apartment. Had the two not beenarrested, they could have used theinformation to create cloned mobile
telephones which could have resulted in up
to $100 million in illegal calls being made.
The electromagnetic signals emitted by acomputer may themselves be intercepted.
Cables may act as broadcast antennas.
Existing law does not prevent the remotemonitoring of computer radiation.
I. Electronic Funds Transfer Fraud
The proliferation of electronic funds
transfer systems will enhance the risk thatsuch transactions may be intercepted anddiverted. Existing systems such as
Automated Teller Machines, and Electronic
F u n d s Tr a n s f e r a t P o i n t o f S a l etechnologies have already been the targetsof fraudulent activity. The development of
stored value cards or smart cards, super37

RESOURCE MATERIAL SERIES No. 55
smart cards and optical memory cards will
no doubt invite some individuals to apply
their talents to the challenge of electronic
counterfeiting and overcoming security
access systems. Just as the simple
telephone card can be reprogrammed,
smart cards are vulnerable to reengineering. Credit card details can be
captured and used by unauthorised
persons. The transfer of funds from homebetween accounts and in payment oftransactions will also create vulnerabilities
in terms of theft and fraud and thewidescale development of electronic money
for use on the Internet will lead to further
opportunities for crime. What has for the
past quarter century been loosely describedas ‘’computer fraud’’ will have numerous
new manifestations.
The above forms of illegality are notnecessarily mutually exclusive, and need
not occur in isolation. Just as an armed
robber might steal an automobile tofacilitate a quick getaway, so too can one
steal information services and use them for
purposes of vandalism, fraud, or in
furtherance of a criminal conspiracy.
Communication of some forms ofprohibited material (such as that relating
to the manufacture of drugs or explosive
devices) may itself entail criminal
conspiracy. Even legitimate telemarketing
may be regarded as intrusive and offensive
to some recipients. Intrusions andinterceptions for the purposes of industrial
espionage may also be accompanied bytheft of intellectual property.
In addition, a number of themes run
through each of the forms of illegality
described above. Foremost of these are thetechnologies for concealing the content ofc o m m u n i c a t i o n s . Te c h n o l o g i e s o f
encryption can limit access by law
enforcement agents to communications
carried out in furtherance of a conspiracy,

38

or to the dissemination of objectionable
materials between consenting parties.
Also important are technologies forconcealing a communicator’s identity.
Electronic impersonation, colloquiallytermed ‘‘spoofing’’, can be used infurtherance of a variety of criminal
activities, including fraud, criminal
conspiracy, harassment, and vandalism.
Technologies of anonymity further
complicate the task of identifying a suspect.
III. THE TRANSNATIONALIMPLICATIONS OF CRIME IN
CYBERSPACEInternational crime of a moreconventional nature has proved to be a very
difficult challenge for law enforcement.
Computer and telecommunications related
crime poses even greater challenges. Theremay be a lack of agreement between
authorities in different jurisdictions about
whether or not the activity in question iscriminal at all, who has committed it,
whether in fact it has been committed, who
has been victimised because of it, whoshould investigate it, and who should
adjudicate and punish it. If an online
financial newsletter originating in the
Bahamas contains fraudulent speculation
about the prospects of a company whose
shares are traded on the Australian Stock
Exchange, where has the offence occurred?
Other issues which may complicate
investigation entail the logistics of searchand seizure during real time, the sheer
volume of material within which
incriminating evidence may be contained,
and the encryption of information, which
may render it entirely inaccessible, oraccessible only after a massive applicationof decryption technology.

110TH INTERNATIONAL TRAINING COURSE
VISITING EXPERTS’ PAPERS
IV. COUNTERMEASURESIt has long been recognized that thecriminal justice system is a very imperfectmeans of social control, and that effective
crime prevention requires the contributionof families, schools, and many otherinstitutions of civil society. This is no lessthe case with crime in cyberspace than it
is with crime in the streets.
It will be immediately apparent that thedetection, investigation and prosecution of
all of the above forms of criminality pose
formidable challenges. Crime in the digitalage can be committed by an individual in
one jurisdiction against a victim or victims
on the other side of the globe. The control
of cyber-crime lies beyond the capacity of
any one agency. What principles can we
articulate to assist us in controllingcomputer crime?
A. Emphasize Prevention
It is a great deal more difficult to pursue
an online offender to the ends of the earth
than to prevent the offence in the firstplace. The trite homily that “prevention isbetter than cure” is nowhere more
appropriate than in cyberspace. It applies
no less to high technology crime than it
does to residential burglary. Just as one
would be most unwise to leave one’s house
unlocked when heading off to work in themorning, so too is it foolish to leave one’s
information systems accessible tounauthorised persons.
B. Self Defence Should Be the First
Line of Defence
The first step in the prevention of online
crime is to raise awareness on the part ofprospective victims to the risks which they
face. Individuals and institutions should
be made aware of the potential
consequences of an attack on theirinformation assets, and of the basic
precautionary measures which they shouldtake. Those businesses who stand to gain
the most from electronic commerce havethe greatest interest in developing secure
payment systems. Technologies ofcomputer security, to be discussed below,
can provide significant protection against
various forms of computer crime. There
are other, ‘‘low technology’’ measures whichshould not be overlooked. Perhaps
foremost among these is staff selection.
Surveys of businesses reveal that one’s own
staff often pose a greater threat to one’s
information assets than do so called‘’outsiders’’. Disgruntled employees andformer employees constitute a significant
risk. Suffice to say that great care should
be taken when engaging and disengaging
staff.
C. Non-governmental Resources
Should Be Harnessed WheneverPossibleGiven the resource constraints whichmost governments face, it is desirable toenlist the assistance of private sector andcommunity interests in the prevention anddetection of computer-related crime.
Market forces will generate powerful
influences in furtherance of electronic
crime control. Given the immense fortunes
which stand to be made by those who
develop secure processes for electroniccommerce, they hardly need any promptingfrom government. In some sectors, there
are ample commercial incentives which canoperate in the furtherance of cyber-crime
prevention. Information security promises
to become one of the growth industries of
the coming century. Some of the newdevelopments in information security
which have begun to emerge include
technologies of authentication. The simple
password for access to a computer system,
vulnerable to theft or determination byother means, is being complemented or
succeeded altogether by biometricauthentication methods such as retinal
imaging and voice or finger printing.

39

RESOURCE MATERIAL SERIES No. 55
Detection of unauthorised access to or
use of computer systems can be facilitatedby such technologies as artificial
intelligence and neural networking, which
can identify anomalous patterns of use
according to time of day, and keystroke
patterns.
Issues of objectionable content can beaddressed at the individual level byblocking and filtering software, by which
parents or teachers can prevent children’saccess to certain types of sites. Selective
consumption of internet content can befurther assisted by classification schemes
such as the Platform for Internet Content
Selection.
The energies of private individuals canalso be enlisted in furtherance of security
and prosperity in cyberspace. A wide range
of websites, under governmental or nongovernmental auspices, invite private
citizens to report suspected illegal conduct
on the internet to authorities. Some suchas the Cyber Angels, invite disclosures ofall kinds, while others tend to specialize inparticular areas, such as fraud or childpornography. What might be described asan ‘‘Electronic Neighbourhood Watch’’enhances the capacitity to detect someforms of electronic illegality.
The are other areas in which the statemight arguably take a subordinate role tothe individual. Consider violations of
copyright or theft of intellectual property.
In situations where civil remedies might
be available to the victim, it is arguably
more appropriate for the individual tosecure their own rights than to rely upon
the state to act on one’s behalf. One could,of course, envisage circumstances where awider state role may be justified—for
example when the perpetrator in questionis engaged in other criminal activity, or
when the theft in question has wider
economic ramifications. But conferring

40

rights upon the individual and providing
the individual with the means of enforcing
these rights may be appropriate in somecircumstances.
In extreme cases, some would take thelaw into their own hands. The metaphorof cyberspace as a frontier is not entirely
inapposite. There are vigilantes incyberspace. In some instances, self-help
by victims of telecommunications related
crime may itself entail illegality. ‘‘Counterhacking’’ by private citizens or by
government agencies has been suggested
as one way of responding to illegal
intrusions. A group calling itself ‘Ethical
Hackers Against Pedophilia’ havethreatened to disable the computers of
those whom they find dealing in digitalchild pornography.
A radical response to the problem ofsoftware piracy is to make use of so-called
Logic Bombs which are installed into
programs. When activated through an actof unauthorised copying, the malicious code
would destroy the copied data and evendamage other software or hardware
belonging to the offender. The potential
for such practices to result in liability forcriminal damage, however, makes their use
problematic.
D. Enhancing the Capacity of Law
Enforcement
The continuing uptake of digitaltechnology around the world means that
law enforcement agencies will be required
to keep abreast of rapidly developing
technologies. This will entail training in
new investigative techniques. As newtechnologies are exploited by criminals, it
becomes even more important for law
enforcement not to be left behind. This isa significant challenge, given the emerging
trend for skilled investigators to be‘‘poached’’ by the private sector. The
collaboration of law enforcement with

110TH INTERNATIONAL TRAINING COURSE
VISITING EXPERTS’ PAPERS
specialized expertise residing in the private
sector will be a common feature in years tocome.
One may also expect to see the use of
fairly aggressive investigative methods incyberspace. Even the domestic policing of
telecommunications-related illegality may
require measures which go beyond
traditional law enforcement tactics. The
technologies of encryption and anonymity
noted above are invoked to justify
aggressive investigative methods such as
covert facilitation, more commonly referred
to as ‘‘stings’’. In mid-1995 for example,
the FBI charged an adult male whoarranged over the Internet to meet what
he thought was a 14 year old girl at a motel.
The Internet contact was in fact an FBI
agent. The accused was targeted becauseof his history of sex offences involving
minors. Similar tactics have been directed
at those who traffic in pornographic
material, as well as perpetrators oftelemarketing fraud. Law enforcement
officers can easily pose on-line asprospective consumers of pornography.
Laws will vary across jurisdictions withregard to the defence of entrapment, andthe extent to which an offence was
encouraged or suggested by police.
E. The Imperative of International
Cooperation
The global nature of cyberspacenecessitates the development of new
strategies to combat criminal activity
which can originate from the other side of
the world. At present, if I, in Australia,
were gullible enough to fall victim to a
fraudulent investment scheme originatingin Albania, I suspect that I could count onvery little help from authorities in either
jurisdiction. But transnational electronic
crime seems destined only to increase.

The basic approach to overcoming thetransnational issues of crime in cyberspacelies in developing cooperation between
nations. This is more easily said than done,
given the significant differences in legal
systems, values and priorities around theworld.
Enlisting the assistance of overseas
authorities is not an automatic process, andoften requires pre-existing agreements
relating to formal mutual assistance incriminal matters.1 Nevertheless, there are
numerous examples of successful
measures.
1. Unilateral Action
Some governments may take unilateral
action against their citizens or residents
who commit criminal offenses on foreignsoil. Two of the most familiar examples inAustralia are prosecutions for engaging insexual activity with children, and for war
crimes alleged to have been committed in
World War Two. However in many cases,
this may still require the co-operation of aforeign government in obtaining evidence
and possibly in extraditing the offender.
2. Bilateral Agreements
The mobility of criminal offenders in ashrinking world has increased the need forarrangements to facilitate theapprehension and repatriation of those who
seek to evade the law by fleeing to anotherjurisdiction. The most common mechanism
for this is extradition, which is done
pursuant to a treaty or other formal
1

Following recent amendments to the Mutual
Assistance in Criminal Matters Act 1987, Australia
may now grant assistance in criminal matters to
any country. Bilateral mutual assistance treaties
are currently in force with 18 nations. A further
four treaties have been signed, but are not yet inforce.

41

RESOURCE MATERIAL SERIES No. 55
arrangement between two nations. 2
Australia was the originator of 33 and therecipient of 37 extradition requests pendingat 30 June 1997.
Since 1985, Australia has adopted a ‘‘noevidence’’ approach as the preferred basis
for international extraditions. The earlier
approach required the production of a
prima facie brief against the person sought,
which effectively required foreign
jurisdictions to produce evidence whichaccorded with Australia’s technical rules ofadmissibility. This was particularly
difficult for civil law countries. The new
approach is reflected in most of Australia’s
modern extradition treaties and has
generally facilitated cooperation between
Australia and other jurisdictions.
Some jurisdictions seek to prosecuteoffences committed abroad by foreign
nationals against their own citizens. The
United States, for example, can seek
extradition of alleged terrorists who haveoffended against citizens of the UnitedStates while abroad. Extradition is by nomeans an automatic matter, as the recent
experience of Australian fugitive
Christopher Skase illustrates. Moreover,other impediments exist. Some nations
will not extradite their own citizens under
any circumstances. Australia, as a matterof policy, will not extradite a fugitive who2

By the end of 1997, Australia had signed bilateralextradition treaties with 32 countries. Twenty nineof these were in force. A further 64 jurisdictions
were covered by the London Extradition Scheme,
which provides for the rendition of fugitive
offenders among members of the Commonwealthof Nations. A special extradition relationship exists
with New Zealand. Australian extradition laws
have been applied to seven additional countries
without a treaty. Australia has succeeded to
extradition treaties entered by the United Kindom
with 21 countries in the late 19th and early 20th
centuries.

42

would face execution in the jurisdiction
seeking his or her return. Those
jurisdictions which do practice capital
punishment may waive the death penalty
in order to obtain the extradition of afugitive.
There are circumstances in which, as analternative to extradition, a nation may
prosecute a citizen for offences committed
in, and against the laws of, a foreign
jurisdiction. Australia, for example, mayprosecute Australian citizens for offences
committed on foreign soil, provided therelevant conduct would have been an
offence under Australian law had it
occurred within Australia. This process isonly available within Australia incircumstances where extradition has beenrefused on the sole ground that the person
was an Australian citizen at the time of theoffence, and only if the Commonwealth
Attorney-General is satisfied that therequesting State would have refused
extradition of its nationals incorresponding circumstances. There are norecorded cases of such prosecutions within
Australia.
In addition to extradition, a variety ofarrangements may be put in place tofacilitate cooperation between nations in
the location and collection of evidence infurtherance of criminal investigation.
Mutual assistance treaties, as they arecalled, provide a legal basis for authorities
in country ‘‘A’’ to obtain evidence forcriminal investigations at the request of
authorities from country ‘‘B’’. Instrumentsof this kind cover a range of assistanceincluding:• the identification and location of
persons;• the service of documents;• the obtaining of evidence, articles anddocuments;• the execution of search and seizure

110TH INTERNATIONAL TRAINING COURSE
VISITING EXPERTS’ PAPERS
requests; and• assistance in relation to proceeds ofcrime.
Australia was the originator of 162
mutual assistance requests, and therecipient of 130 requests by other nations,which were pending at 30 June 1997.
The Mutual Assistance in Criminal
Matters Act 1987 was amended in March
1997 to provide for ‘‘passive’’ application of
the Act to all foreign countries, rather thanrequiring the Act to be specifically applied
to particular countries by regulation. This
enables assistance to be requested andprovided much more expeditiously than
was previously the case.
In addition, the posting of law
enforcement personnel overseas canfacilitate the development of informal
networks which can help expedite responseto the various requests which may arise
from time to time. Formal agreements are
essential, but there is often no substitutefor interpersonal contact. The AustralianFederal Police has 29 liaison officers
stationed in 13 nations around the world.
In addition to serving Australia’s needs, the
AFP and Australian consular staff are able
to help overseas governmental authorities
check on the probity of prospective
investors from Australia. AFP liaison
officers may also assist their hosts in the
training of law enforcement personnel andin the exchange of intelligence.

V. CONCLUSION
It has become trite to suggest that theworld is a shrinking place. On the one
hand, this shrinking is highly beneficial.
People around the world now enjoy
economic, cultural and recreational
opportunities which were previously notaccessible. On the other hand, the rapid
mobility of people, money, information,ideas and commodities generally, hasprovided new opportunities for crime, andnew challenges for law enforcement
agencies. Linkages between events andinstitutions at home and abroad areinevitable, and will proliferate. This will
require unprecedented cooperation
between nations, and will undoubtebly
generate tensions arising from differencesin national values. Even within nations,
tensions between such values as privacy
and the imperatives of enforcement will behigh on the public agenda. New
organizational forms will emerge to combat
new manifestations of criminality. The
21st century will be nothing if notinteresting.

Steps taken following the G-8
Birmingham meeting in May 1998 fornations to designate liaison offices, which
will be on call on a 24 hour basis, illustrates
the need for prompt concerted responses
to the problem of transnational digital
crime.

43