Cybercrime: Public and Private Entities Face Challenges in Addressing Cyber Threats
Released: 2007-07-23T00:00:00

Letter

Background

Over 150 million U.S. citizens are connected to the Internet. According to the FBI, the number of people with access to the Internet increased 182 percent between 2000 and 2005. In 2006, total nontravel-related spending on the Internet was estimated to be $102 billion by a private sector entity, a 24 percent increase over 2005. While the benefits of interconnectivity have been enormous, it has provided new horizons and techniques for crime.

Cybercrime: Comparison between Cybercrime and Traditional Criminal Techniques

Cybercrime refers to criminal activities that specifically target a computer or network for damage or infiltration. For example, it can be a crime to access (“hack into”) a computer without authorization or to distribute viruses. Cybercrime also includes the use of computers as tools to conduct criminal activity such as fraud, identity theft, and copyright infringement. Computers significantly multiply the criminal’s power and reach in committing such crimes. Figure 1 describes and compares cybercrime and traditional criminal techniques.

Cybercrime techniques have characteristics that can vastly enhance the reach and impact of criminal activity, such as the following: Criminals do not need to be physically close to their victims to commit a crime.

Technology allows criminal actions to easily cross multiple state and national borders.

Cybercrime can be carried out automatically, at high speed, and by attacking a vast number of victims at the same time.

Cybercriminals can more easily remain anonymous.

To help facilitate cybercrimes, criminals use several techniques listed in table 1.

Companies that process large volumes of Internet traffic, such as Postini, Symantec, and IBM analyze their traffic for patterns and trends and have found that the cybercrime techniques in table 1 are prevalent. Table 2 shows reported volumes of cybercrime techniques.

Framework for Addressing Cybercrime

Efforts to address cybercrime follow the same basic process as efforts to address traditional crime. As figure 2 shows, this basic process is one of protection, detection, investigation, and prosecution.

To protect networks and information against cybercrime, organizations and individuals implement cybersecurity techniques such as access controls (passwords) and firewalls. In addition, they use monitoring devices or intrusion detection systems to detect incidents that could potentially be criminal intrusions. As figure 2 shows, monitoring unusual activity allows organizations and individuals to make adjustments to improve protection. When a suspected cybercrime is detected, organizations and individuals must decide what action to pursue. Depending on the severity of the incident, the level of evidence, and their comfort with revealing the incident, they may or not report it to law enforcement.

Generally, investigations begin once an incident is reported to law enforcement. During the preliminary investigation, federal, state, or local law enforcement, along with their respective prosecutors, determine if a crime occurred and if a further investigation is warranted. Also, in some cases, private sector and academic analysts may provide expertise. Among the factors weighed by law enforcement authorities in determining whether to conduct an investigation is whether their agency has jurisdiction over the crime, the number and location of the victims, the expected location of the criminal, the amount of loss, and the agency’s investigative priorities and available resources. If it is determined that an investigation will not be pursued, law enforcement may provide advice to victims that may be used to improve their protective measures. When a criminal investigation is pursued, law enforcement investigators have the initial responsibility for leading the evidence-gathering effort and working with cyberforensic investigators and examiners with the technical expertise to analyze the evidence. In cases where evidence is not voluntarily provided, law enforcement can use various subpoena authorities to obtain information needed to perform the investigation.

A key component of cybercrime investigations is the gathering and examination of electronic evidence that can be useful for prosecution. Using cyberforensic tools and techniques, cybercrime investigators and examiners gather and analyze electronic evidence. If available, cyberforensic laboratories may be used to extract the electronic evidence and present it in a court-admissible format. The evidence could entail analysis of terabytes of information on multiple electronic devices, the electronic path taken by a fraudulent e-mail, pornographic images stored on a hard drive, or data stored on a mutilated but later reconstructed CD- ROM. The ability to gather electronic evidence and the assurance that cyberforensic procedures do not compromise the evidence gathered can be key to building a case and prosecuting cybercriminals.

Cybercrime investigations and evidence gathering can also be conducted while a crime is ongoing. If a crime is being investigated while it is still occurring, investigators may use sophisticated techniques to investigate criminal activity that include court-ordered wiretaps. In determining whether and how to gather evidence of information transmitted electronically, law enforcement may make an application to a court for a wiretap pursuant to the Wiretap Act. To obtain such orders, the application to the court must describe, among other things, the criminal activity and the identity of those involved, if known.

If sufficient evidence is gathered, it can lead to a prosecution. Federal and state prosecutors determine if a prosecution will be pursued based on a number of factors including jurisdiction over the crime, the type and seriousness of the offense, the sufficiency of the evidence, their prosecutorial priorities, and the location and number of the victims. Prosecuting attorneys will also consider the dollar loss and the number of incidents. Some federal prosecuting attorneys may not pursue cybercrime cases because they do not meet the minimum thresholds established for their districts. Thresholds are established by prosecuting attorneys to appropriately focus their limited resources on the most serious crimes that match their district’s priorities. For example, if fraud has been committed through the use of a computer, the amount of the dollar loss may need to reach a specific threshold amount for the U.S. Attorney to accept the case. When the U.S. Attorney does not accept a case for prosecution because it does not meet such a threshold, state authorities may decide to accept the case for prosecution.

In addition to criminal remedies, civil remedies are available to address cybercrime activity. The burden of proof in a civil case is not as high as in a criminal case. At the federal level, the FTC investigates activities that could be classified as cybercrime as part of its consumer protection mission and seeks civil injunctions and monetary remedies. In addition, many states have civil statutes that may be applied to cybercrime situations. In the State of Washington, for example, the Attorney General can apply the state’s consumer protection statute to cases of cyber- facilitated fraud. Pursuing the case in civil court, the state’s Attorney General can seek civil remedies such as the repayment of losses or penalties for wrongdoing or fraud, which could potentially deter future criminal attempts.

Governments Have Enacted Various Laws to Address Cybercrime

Federal and state governments and other nations have enacted laws that apply to cybercrime and the legal recourse or remedies available. In addition, there are international agreements to improve the laws across nations and international cooperation on addressing cybercrime.

Federal Laws

Federal statutes address specific types of cybercrime, while other federal statutes address both traditional crime and cybercrime. Table 3 describes key federal laws used to investigate and prosecute cybercrime activity.

Members of Congress have proposed new federal legislation to augment current cybercrime statutes. For example, in February 2007, the Internet Stopping Adults Facilitating the Exploitation of Today’s Youth Act (SAFETY) was introduced in the House Judiciary Committee as an anticybercrime bill. Among its various provisions addressing the exploitation of children, the SAFETY Act provides for the promulgation of regulations that would require Internet service providers to retain data such as a subscriber’s name and address, user identification, or telephone number to facilitate law enforcement investigations. Also in February 2007, the Securing Adolescents From Exploitation-Online (SAFE) Act of 2007 was introduced in the Senate Committee on the Judiciary. The SAFE Act would include explicit requirements for Internet service providers to report suspected child pornography violations. The House of Representatives passed the Securely Protect Yourself Against Cyber Trespass Act in June 2007. This bill, if signed into law, would prohibit the use of spyware that could take control of a computer or collect user information without permission. The bill would authorize stiff civil penalties against violators.

State and Local Laws

State and local governments have been enacting laws to serve law enforcement efforts in their individual jurisdictions and to enhance cybercrime prevention, investigation, and prosecution efforts. States have also enacted laws against particular types of cybercrime, including laws addressing spamming and spyware. For example, Virginia’s Anti-Spam Act outlaws the use of fraudulent means, such as using a false originating address, to send spam. Further, aggravating factors (such as sending 10,000 spam messages in a 24-hour period or generating more than $1,000 in revenue from a specific spam message) make the crime punishable as a felony under Virginia law. Also, California’s Consumer Protection Against Computer Spyware Act makes it illegal for anyone to install software on someone else’s computer and use it to deceptively modify settings, including a user’s home page, default search page, or bookmarks. It also outlaws the collection, through intentionally deceptive means, of personally identifiable information through keystroke-logging, tracking Web site visits, or extraction of such information from a user’s hard drive.

California has also enacted legislation requiring security measures and warnings for wireless network devices. In addition, Westchester County, New York, has taken action to improve the security of wireless networks. Its wireless security law requires that commercial businesses secure their wireless networks or face fines. The law also requires businesses providing wireless Internet access to put up signs advising users of the security risks. Westchester County’s enforcement efforts have brought fines against businesses exposing sensitive data over wireless networks.

Other Nations’ Laws

Cybercrime laws vary across the international community. Australia enacted its Cybercrime Act of 2001 to address this type of crime in a manner similar to the U.S. Computer Fraud and Abuse Act, discussed above. In addition, Japan enacted the Unauthorized Computer Access Law of 1999 to cover certain basic areas similar to those addressed by the U.S. federal cybercrime legislation. Countries such as Nigeria with minimal or less sophisticated cybercrime laws have been noted sources of Internet fraud and other cybercrime. In response, they have looked to the examples set by industrialized nations to create or enhance their cybercrime legal framework. A proposed cybercrime bill, the Computer Security and Critical Information Infrastructure Protection Bill, is currently before Nigeria’s General Assembly for consideration. The bill, if adopted, would mirror similar cybercrime legislation in industrialized nations like the United States, the United Kingdom, Australia, South Africa, and Canada.

Because political or natural boundaries are not an obstacle to conducting cybercrime, international agreements are essential to fighting cybercrime. For example, on November 23, 2001, the United States and 29 other countries signed the Council of Europe’s Convention on Cybercrime as a multilateral instrument to address the problems posed by criminal activity on computer networks. Nations supporting this convention agree to have criminal laws within their own nation to address cybercrime, such as hacking, spreading viruses or worms, and similar unauthorized access to, interference with, or damage to computer systems. It also enables international cooperation in combating crimes such as child sexual exploitation, organized crime, and terrorism through provisions to obtain and share electronic evidence. The U.S. Senate ratified this convention in August 2006. As the 16th of 43 countries to support the agreement, the United States agrees to cooperate in international cybercrime investigations. The governments of European countries such as Denmark, France, and Romania have ratified the convention. Other countries including Germany, Italy, and the United Kingdom have signed the convention although it has not been ratified by their governments. Non- European countries including Canada, Japan, and South Africa have also signed but not yet ratified the convention.

Cybercrime Has Significant Economic Impacts and Threatens U.S. National Security Interests, but Its Precise Magnitude Is Unknown

Cybercrime is a threat to U.S. national economic and security interests. Based on various studies and expert opinion, the direct economic impact from cybercrime is estimated to be in the billions of dollars. The overall loss projection due to computer crime was estimated to be $67.2 billion annually for U.S. organizations, according to a 2005 FBI survey. The estimated losses associated with particular crimes include $49.3 billion in 2006 for identity theft to about $1 billion annually due to phishing. In addition, there is concern about threats that nation-states and terrorists pose to our national security through attacks on our computer-reliant critical infrastructures and theft of our sensitive information. For example, according to the U.S.-China Economic and Security Review Commission report, Chinese strategists are writing about exploiting the vulnerabilities created by the U.S. military’s reliance on technologies and attacking key civilian targets. Also, according to FBI testimony, terrorist organizations have used cybercrime to raise money to fund their activities. However, despite the reported loss of money and information and known threats from our nation’s adversaries, there remains a lack of understanding about the true magnitude of cybercrime and its impact because it is not always detected or reported.

Economic Impacts of Cybercrime Are Significant

Based on various studies and expert opinion, the direct economic impact from cybercrime is billions of dollars annually. The overall loss projection due to computer crime was estimated to be $67.2 billion annually for U.S. organizations, according to a 2005 FBI survey. The estimated losses associated with particular crimes include $49.3 billion in 2006 for identity theft and $1 billion annually due to phishing. The studies and experts derive their projected losses based on direct and indirect costs that may include estimated cost of intellectual property stolen, recovery cost of repairing or replacing damaged networks and equipment, and intangible loss due to the opportunity loss from lack of customer confidence in the doing online commerce.

Table 4 shows the economic impact of cybercrime as reported by various studies and reports over the last several years.

Many of the surveys and studies, such as those from IC3 and Computer Security Institute/FBI, are performed at least annually. In addition, the DOJ’s Bureau of Justice Statistics has conducted a cybercrime survey of private sector entities to gain a more definitive understanding of cybercrime’s economic impact on the United States. As of May 2007, the response rate and results had not been reported.

Individual legal cases also illustrate the financial losses that victims incur due to cybercrime. Examples include the following: In February 2007, a defendant was convicted of aggravated identity theft, access device fraud, and conspiracy to commit bank fraud in the Eastern District of Virginia. The defendant, who went by the Internet nickname “John Dillinger,” was involved in extensive illegal online “carding” activities. He received e-mails or instant messages containing hundreds of stolen credit card numbers, usually obtained through phishing schemes or network intrusions, from “vendors” who were located in Russia and Romania. In his role as a “cashier” of these stolen credit card numbers, the defendant would then electronically encode these numbers to plastic bank cards, make ATM withdrawals, and return a portion to the vendors. Computers seized from the defendant revealed over 4,300 compromised account numbers and full identity information (i.e., name, address, date of birth, Social Security number, and mother’s maiden name) for over 1,600 individual victims.

In September 2005, a Massachusetts juvenile was convicted in connection with approximately $1 million in victim damages. Over a 15-month period, the juvenile hacked into Internet and telephone service providers, stole an individual’s personal information and posted it on the Internet, and made bomb threats to high schools in Florida and Massachusetts.

In October 2004, the Secret Service investigated and shut down an online organization that facilitated losses in excess of $4 million and trafficked in around 1.7 million stolen credit cards and stolen identity information and documents. This high-profile case, known as “Operation Firewall,” focused on a criminal organization of some 4,000 members whose Web site functioned as a hub for identity theft activity.

In July 2003, a man was convicted of causing an aggregate loss of approximately $25 million and hacking into computers in the United States. The defendant pleaded guilty in these proceedings and admitted to numerous charges of conspiracy, computer intrusion, computer fraud, credit card fraud, wire fraud, and extortion. Those charges stemmed from the activities of the defendant and others who operated from Russia and hacked into dozens of computers throughout the United States, stealing usernames, passwords, credit card information, and other financial data, and then extorting money from those victims with the threat of deleting their data and destroying their computer systems.

In May 2002, a New Jersey man was convicted of causing more than $80 million in damage by unleashing the “Melissa” computer virus in 1999 and disrupting personal computers and computer networks in business and government.

Cybercrime Is a Threat to National Security

There is continued concern about the threat that our adversaries pose to our national security through attacks on our computer-reliant critical infrastructures and theft of our sensitive information. Over the last several years, such risks have been described in a variety of reports and testimonies. Table 5 describes the concerns raised.

The risks posed by this increasing and evolving threat are demonstrated by actual and potential attacks and disruptions, such as those cited below.

DOD officials stated that its information network, representing approximately 20 percent of the entire Internet, receives approximately 6 million probes/scans a day. Further, representatives from DOD stated that between January 2005 and July 2006, the agency initiated 92 cybercrime cases, the majority of which involved intrusions or malicious activities directed against its information network.

In November 2006, the U.S.-China Economic and Security Review Commission reported that China is actively improving its nontraditional military capabilities. According to the study, Chinese military strategists write openly about exploiting the vulnerabilities created by the U.S. military’s reliance on advanced technologies and the extensive infrastructure used to conduct operations. Chinese military writings also refer to attacking key civilian targets such as financial systems. In addition, the report stated that Chinese intelligence services are capable of compromising the security of computer systems. The commission also provided instances of computer network penetrations coming from China. For example, in August and September 2006, attacks on computer systems of the Department of Commerce’s Bureau of Industry and Security forced the bureau to replace hundreds of computers and lock down Internet access for 1 month.

In August 2006, a California man was convicted for conspiracy to intentionally cause damage to a protected computer and commit computer fraud. Between 2004 and 2005, he created and operated a botnet that was configured to constantly scan for and infect new computers. For example, in 2 weeks in February of 2005, the defendant’s bots reported more than 2 million infections of more than 629,000 unique addresses (some infected repeatedly). It damaged hundreds of DOD computers worldwide. The DOD reported a total of $172,000 of damage due to a string of computer intrusions at numerous military installations in the United States (including Colorado, Florida, Hawaii, Maryland, South Carolina, and Texas) and around the world (including Germany and Italy). In addition, the botnet compromised computer systems at a Seattle hospital, including patient systems, and damaged more than 1,000 computers in a California school district over the course of several months in 2005. Officials from the California school district reported damages between $50,000 and $75,000 to repair its computers after the botnet struck in February 2005.

The Central Intelligence Agency has identified two known terrorist organizations with the capability and greatest likelihood to use cyber attacks against our infrastructures.

In March 2005, security consultants within the electric industry reported that hackers were targeting the U.S. electric power grid and had gained access to U.S. utilities’ electronic control systems. Computer security specialists reported that, in a few cases, these intrusions had “caused an impact.” While officials stated that hackers had not caused serious damage to the systems that feed the nation’s power grid, the constant threat of intrusion has heightened concerns that electric companies may not have adequately fortified their defenses against a potential catastrophic strike.

Terrorist organizations have used cyberspace and cybercrime to raise money in a number of ways, such as facilitating protection schemes, credit card fraud, and drug smuggling. For example, in a July 2002 testimony, FBI officials stated that Al Qaeda terrorist cells in Spain used stolen credit card information to make numerous purchases. In addition, Indonesian police officials believe the 2002 terrorist bombings in Bali were partially financed through online credit card fraud, according to press reports.

As larger amounts of money are transferred through computer systems, as more sensitive economic and commercial information is exchanged electronically, and as the nation’s defense and intelligence communities increasingly rely on commercially available information technology, the likelihood increases that information attacks will threaten vital national interests.

Precise Magnitude of Cybercrime Is Unknown

Despite the large reported impact of cybercrime, the true impact of cybercrime in the United States is unknown because cybercrimes are not always detected or reported. Organizations and individuals do not always detect cybercrimes. The effectiveness of the systems put in place to audit and monitor systems, including intrusion detection systems, intrusion protection systems, security event correlation tools, and computer forensics tools, have limitations that impact their ability to detect a crime occurring. For example, the effectiveness of intrusion detection systems is limited by their ability to capture accurate baselines or normal network or system activity. Also, these systems are prone to false positives and false negatives and are not as effective in protecting against unknown attacks. In addition, the effectiveness of security event correlation tools is limited by their ability to interface with numerous security products and the quality of the logs they rely upon.

When a cybercrime is detected, companies and individuals can choose not to report the crime. Companies and individuals weigh the cost and impact of the incident with the time and effort needed to support an investigation and prosecution. Cybercrime reporting is discussed further in our challenges section.

Numerous Public and Private Organizations Have Responsibilities to Protect Against, Detect, Investigate, and Prosecute Cybercrime

Federal agencies, state and local law enforcement, private industry, and academia have responsibilities, based on their primary missions or business interests, to protect against, detect, investigate, and prosecute cybercrime. Public and private sector entities are engaged in these efforts individually and through collaborative efforts.

Many Public Entities Have Responsibilities for Addressing Cybercrime

DOJ, DHS, and DOD and the FTC have key roles in addressing cybercrime within the federal government, along with the federal inspectors general. State and local law enforcement organizations also have key responsibilities in addressing cybercrime. Efforts range from fighting cybercrime by investigating and prosecuting it and improving the protection of systems through raising awareness and building relationships.

Key Department of Justice Organizations

The key agencies within DOJ that focus on enforcing cybercrime violations include the Criminal Division, U.S. Attorneys, and the FBI. Table 6 shows key DOJ organizations, suborganizations, and activities.

Three key agencies within DHS have a role in addressing cybercrime issues—the Secret Service, the Cyber Security and Communications Office’s National Cyber Security Division, and Immigration and Customs Enforcement. Table 7 shows key DHS organizations, suborganizations, and activities.

Within DOD, the Defense Criminal and Counterintelligence Investigation Organizations conduct all law enforcement investigations and the Defense Cyber Crime Center (DC3) can provide forensics support. Table 8 shows key organizations, suborganizations, and activities.

The FTC was created to prevent unfair methods of competition. Its mission expanded over time with additional legislation authorizing it to serve as a protective force for U.S. consumers. The agency has the authority to file civil enforcement actions either in federal district court or administratively. Remedies in these civil actions range from orders to stop the illegal conduct to requiring disgorgement of illegal proceeds or payment of restitution.

FTC’s Bureau of Consumer Protection investigates and enforces matters related to activities that may be classified as cybercrime. It has several divisions that focus primarily on different aspects of the FTC’s consumer protection mission. According to FTC staff, the Bureau of Consumer Protection is composed of six divisions, which target different substantive areas for enforcement and outreach purposes. The divisions routinely coordinate initiatives and share resources to most efficiently and effectively further the consumer protection mission. Its resources include headquarter staff and staff located at eight regional offices that investigate and bring a variety of consumer protection and competition cases and engage in outreach efforts. In addition, the Criminal Liaison Unit coordinates for all of the Bureau of Consumer Protection’s divisions with criminal law enforcement agencies across the U.S. to encourage the prosecution of criminal fraud.

Federal Inspectors General

Federal Inspectors General have a role in preventing, detecting, and investigating cybercrime within their respective agencies. Specifically, 14 of 19 Inspectors General that provided information to us stated that they handle cybercrime investigations affecting their respective agency within their own capabilities. For example, certain Inspectors General reported having significant efforts in addressing cybercrime, including those for the Departments of Education, Energy, and Transportation and the Environmental Protection Agency. Additionally, 11 of the 19 Inspectors General stated that they perform an education and awareness role within their respective agencies by conducting training, providing presentations, and performing activities mandated by the Federal Information Security Management Act.

State and Local Law Enforcement Organizations

State and local organizations address cybercrime through efforts to share information, improve expertise, and facilitate cybercrime prosecutions both nationally and locally. For example, on a national basis, SEARCH, an organization dedicated to improving state-level law enforcement, has three cybercrime focused programs related to providing high-tech crime training, technical assistance, and research on emerging technology nationwide. In addition, the National Association of Attorneys General has a cybercrime initiative benefiting state prosecutors. It also hosts a cybercrime conference that provides training in cybercrime investigative areas, legislation, case law, and public education tools. The association’s executive working group meets quarterly and shares information on criminal issues, including cybercrime.

State-level law enforcement entities have implemented initiatives to facilitate the investigation and prosecution of cybercrime in the states. For example, the Commonwealth of Virginia’s Office of the Attorney General has a Computer Crime unit dedicated to investigating criminal cases violating the Virginia Computer Crimes Act. In addition, Virginia’s Attorney General formed the Virginia Cyber Crime Strike Force that collaborates with the U.S. Attorneys’ Offices, the Virginia State Police, the FBI and Virginia’s Bedford County Sheriff’s Office to investigate and prosecute cybercrime. Other examples of state efforts are the (1) Washington Attorney General’s High Tech Crime Unit, which litigates cases of cyberfraud, and pursues civil remedies under the state’s broad consumer protection law and (2) Washington State Patrol Computer Crime unit that serves as a first responder to computer crimes affecting state-funded institutions such as state and local governments and public schools and universities.

Private-Sector Entities Focus on Protection and Detection Efforts

The private sector’s focus is on the development and implementation of technology systems to protect against computer intrusions, Internet fraud, and spam and, if a crime does occur, to detect it and gather admissible evidence for an investigation. The private entities that focus on these technological efforts include Internet service providers, security vendors, software developers, and computer forensics vendors: Internet service providers offer businesses and home users various levels of access to the Internet and other Internet-related services such as customer support and spam and virus protection. Providers also assist law enforcement by monitoring and providing information on selected Internet activities and provide technical expertise to assist with investigations. In addition, providers can pursue civil action against users to punish inappropriate behavior.

Security vendors such as e-mail security firms can screen electronic messages for harmful data and take action to prevent such data from reaching the intended target. Vendors also assist law enforcement by reporting instances of computer crime, providing technical assistance, and pursuing civil action against inappropriate behavior.

Software developers are improving the quality and security of operating system programs to detect and block malicious code.

Computer forensics vendors provide private companies with computer forensics investigative services to detect the theft of trade secrets and intellectual property, detect employee fraud, locate and recover previously inaccessible documents and files, provide reports on all user activity, and access password-protected files. In addition, computer forensic vendors develop tools used by law enforcement to investigate cybercrime. These tools allow for the analysis of digital media and the gathering of evidence that is admissible in court.

Numerous Public and Private Partnerships Work to Address Cybercrime

Numerous partnerships have been established between public sector entities, between public and private sector entities, and internationally to collaborate and implement effective cybercrime strategies. Each of their strategies includes information sharing activities and consumer awareness efforts. Table 9 gives brief descriptions of key partnerships, their purposes, and primary stakeholders.

Public and Private Sectors Face Challenges in Addressing Cybercrime

Numerous challenges impede the efforts of public and private entities to mitigate cybercrime (see table 10) including (1) reporting cybercrime, (2) ensuring adequate law enforcement analytical and technical capabilities, (3) working in a borderless environment with laws of multiple jurisdictions, and (4) implementing information security practices and raising awareness.

Reporting Cybercrime

Although surveys and studies show that the nation potentially loses both billions of dollars annually and sensitive information as a result of cybercrime, definitive data on the amount of cybercrime is not available. Understanding the impact of cybercrime in the United States is a challenge because reporting of cybercrime is limited.

When a cybercrime is detected, entities and individuals can choose to report it to law enforcement or not. They weigh the cost and impact of the incident with the time and effort needed to support an investigation and prosecution. In addition, our work and findings of the Congressional Research Service related to information sharing have shown that businesses do not always want to report problems because there is a perception that their information will be disclosed publicly, which could, in turn, cause harm to their business. Reasons for not reporting a crime to law enforcement include the following: Financial market impacts. The stock and credit markets and bond rating firms react negatively to security breach announcements, which could raise the cost of capital to reporting firms. Even firms that are privately held and are not active in public securities markets can be adversely affected if banks and other lenders judge them to be more risky than previously thought.

Reputation or confidence effects. Negative publicity damages a reporting firm’s reputation or brand, and could cause customers to lose confidence, giving commercial rivals a competitive advantage.

Litigation concerns. If an organization reports a security breach, investors, customers, or other stakeholders can use the courts to seek recovery of damages. If the organization has been open in the past about previous incidents, plaintiffs may allege a pattern of negligence.

Signal to attackers. A public announcement alerts hackers that an organization’s cyber-defenses are weak and can inspire further attacks.

Inability to share information. Some private-sector entities want to share information about an incident with law enforcement and other entities; however, once the information becomes part of an ongoing investigation, their ability to share information may be limited.

Job security. IT personnel fear for their jobs after an incident and seek to conceal the breach from senior management.

Lack of law enforcement action. According to private sector officials, law enforcement entities have failed to investigate cases reported to them, which is a disincentive for them reporting crimes in the future.

To improve the reporting of cybercrime, the numerous public/private partnerships (e.g., the National Cyber Forensics and Training Alliance, InfraGard, and the Electronic Crimes Task Forces), as well as the awareness and outreach efforts of law enforcement discussed earlier, are methods for building better relationships and understanding between the public and private sectors. These efforts may increase trust between the public and private sector and encourage better reporting of cybercrimes when they occur.

Ensuring Adequate Law Enforcement Analytical and Technical Capabilities

Efforts by law enforcement to investigate and prosecute cybercrime require individuals with specialized skills and tools. According to federal, state, and local law enforcement and private sector officials, it is a challenge to recruit such individuals from a limited pool of available talent, retain them in the face of competing offers, and train them to stay up to date with changing technology and increasingly sophisticated criminal techniques.

Obtaining and Retaining Investigators, Prosecutors, and Cyberforensics Examiners

Federal and state law enforcement organizations face challenges in having the appropriate number of skilled investigators, forensic examiners, and prosecutors. According to federal and state law enforcement officials, the pool of qualified candidates is limited because individuals involved in investigating or examining cybercrime are highly trained specialists requiring both law enforcement and technical skills, including knowledge of various IT hardware and software and forensic tools. According to Defense Cyber Crime Center officials, once an investigator or examiner specializes in cybercrime, it can take up to 12 months for those individuals to become proficient enough to fully manage their own investigations. Further, according to state officials, state and local law enforcement agencies do not have the resources needed to hire the investigators with adequate technical knowledge required to address cybercrime.

Law enforcement organizations also find it difficult to retain highly skilled cyberforensic investigators and examiners. According to federal and state officials, the private sector demands individuals with the same skills and successfully attracts them away from their government positions with much higher salaries and better benefits. For example, according to an Assistant U.S. Attorney, several cybercrime experts, including attorneys, federal and state law enforcement agents, and cyberforensic examiners, have left their government positions due to the higher salaries and benefits offered by the private sector.

The available pool of experienced federal cybercrime investigators is also impacted by FBI and Secret Service rotation policies. For example, according to FBI officials, new FBI agents, not initially assigned to one of the 15 largest field offices, are required to rotate to one of the these large offices after 3 years in order to have diversified experiences. According to FBI headquarters and field agents, when cybercrime investigators rotate out under this policy, they are not necessarily reassigned to cybercrime investigations in their new field office, and so their extensive cyber background is underutilized. In addition, the agents who rotate in to replace experienced cybercrime investigators may have little or no cybercrime experience or background. Further, according to FBI officials, the pool of experienced senior managers is impacted by the FBI’s current policy that senior field supervisory agents are limited to 5-year terms in their positions and then most move to seek further career advancement. This can include the movement of experienced cybercrime investigators out of senior cybercrime positions. Similarly, according to Secret Service officials, most Secret Service agents, including those with technical, cybercrime investigation expertise, rotate to a protective assignment, which focuses on the protection of the President, Vice President, and others and not on the investigation of cybercrime. In addition, officials stated that there is an investigative career track that allows agents to continue doing investigations, including those related to cybercrime; however, protective assignments are perceived as higher profile and could lead to greater career advancement. FBI and Secret Service officials acknowledged that the rotation policies have at times resulted in these agencies underutilizing staff with cyber expertise.

Keeping Up to Date with Current Technology and Criminal Techniques

The rapid evolution of technology and cybercrime techniques means that law enforcement agencies must continuously upgrade technical equipment and software tools. Such equipment and tools are expensive, and agencies’ need for them does not always fall into the typical federal replacement cycle. For example, in order for investigators to perform cyberforensic examinations and gather the evidence required to support a prosecution, the examiners and investigators must, in some cases, store and analyze huge amounts of digital data. According to federal law enforcement officials, the amount of data being collected is growing exponentially. However, according to law enforcement officials, state and local law enforcement agencies do not always have the resources to obtain the equipment necessary to analyze large amounts of data.

Law enforcement organizations also find that maintaining a current understanding of new criminal techniques and technologies can be difficult. For example, law enforcement agents are required to extract forensic data from IT devices that have only been on the market for months. They also must keep up with innovative criminal techniques and approaches. For example, techniques for assembling and controlling botnets are becoming increasingly sophisticated and difficult to trace, making it difficult to identify certain spamming and phishing schemes. In addition, criminals are increasing their use of encryption techniques. This requires law enforcement to continue to research and develop appropriate countermeasures. Training can help to keep investigators’ skills current, but relevant courses are limited, costly, and time-consuming, and take agents away from the cases that they are investigating.

Federal and state law enforcement organizations are taking steps to improve their analytic and technical capabilities. For example, the Secret Service has developed training programs for federal, state, and local law enforcement and DOD’s Defense Cyber Crime Center has a cyberforensic training program for DOD investigators and other law enforcement officials. Further, the FBI’s Cyber Action Teams rapidly provide technical expertise to cybercrime investigations worldwide, when needed. To overcome shortfalls in equipment and electronic storage, the FBI is sponsoring regional computer forensics laboratories to serve the needs of an entire region’s law enforcement. In addition, public/private partnerships, like the FBI’s Infragard and National Cyber Forensics Training Alliance and the Secret Service’s Electronic Crimes Task Forces, provide ways to share expertise between law enforcement, the private sector, and academia. Although it will continue to be a challenge to keep current with the rapid evolution of technology and cybercrime techniques, these DOD, FBI, and Secret Service efforts are positive steps to attempt to keep up with techniques and technology for investigations.

Working in a Borderless Environment with Laws of Multiple Jurisdictions

Law enforcement organizations face the challenge of investigating and prosecuting cybercrime that crosses national and state borders, and working with laws, legal procedures, and law enforcement entities from multiple jurisdictions. Working in this environment complicates most cyber investigations.

Private sector, individual, and law enforcement efforts are complicated by the borderless nature of cybercrime. As discussed earlier, cybercriminals are not hampered by physical proximity or regional, national, or international borders. Cybercriminals can be physically located in one nation or state, direct their crime through computers in multiple nations or states, and store evidence of the crime on computers in yet another nation or state. This makes it difficult to trace the cybercriminals to their physical location. In addition, cybercriminals can take steps to remain anonymous, making it difficult, if not impossible, to attribute a crime to them.

Similar to efforts addressing traditional crime, efforts to investigate and prosecute cybercrime are complicated by the multiplicity of laws and procedures that govern in the various nations and states where victims may be found, and the conflicting priorities and varying degrees of expertise of law enforcement authorities in those jurisdictions. Laws used to address cybercrime differ across states and nations. For example, not all U.S. states have antispam laws or antispyware laws. In addition, an act that is illegal in the United States may be legal in another nation or not directly addressed in the other nation’s laws. Developing countries, for example, may lack cybercrime laws and enforcement procedures.

Further, jurisdictional boundaries can limit the actions that federal, state, and local law enforcement can take to investigate cybercrime that crosses local, regional, and national borders. For example, state and local officials may be unable to pursue investigations outside of their jurisdiction, so when a cybercrime goes beyond their jurisdiction, they may need to rely upon officials of other jurisdictions to further investigate the crime. Additionally, extradition between states can be complicated depending on the laws of the state where the suspect is located and the knowledge of the states’ law enforcement and judiciary regarding cybercrime. In addition, the United States does not have extradition arrangements with all nations, which makes it impossible to extradite a cybercriminal from certain nations. Extradition from nations having an extradition agreement with the United States can be complicated or impossible if the nation’s laws do not make the action illegal or its magistrate is not knowledgeable about cybercrime. Also, state and local officials are unable to extradite persons from other nations without federal law enforcement assistance.

Conflicting priorities also complicate cybercrime investigations and prosecutions. Cybercrime can occur without physical proximity to the victim, and thus a cybercriminal can operate without victimizing a citizen in the jurisdiction or federal judicial district in which the crime originated. With no negative impact on the citizens in that district, there may be no incentive for the local citizens to press their law enforcement officers to investigate the crime. According to state officials, it is difficult to commit resources to crimes where the victims are outside their state or jurisdiction, although the suspected cybercriminal may be prosecuted in the jurisdiction where the victim is located.

Federal and state law enforcement organizations are taking steps to help them work in the borderless environment within which cybercriminals operate. For example, federal, state, and local law enforcement organizations participate in cybercrime task forces that combine a region’s law enforcement capabilities to investigate and prosecute cybercrime in the most advantageous way. To address transnational jurisdiction, investigation, and prosecution issues, DOJ and the State Department have established agreements with more than 40 nations through the G-8 High Tech Crime Working Group to address cybercrime cooperatively. The Council of Europe’s Cybercrime Convention is a similar international effort. These and other efforts are essential to addressing the transborder nature of cybercrime and enhancing the ability of law enforcement to capture, prosecute, and punish cybercriminals.

Implementing Information Security Practices and Raising Awareness

A major challenge in mitigating cybercrime is improving information security practices on the part of organizations and individual Internet users. Raising awareness about criminal behavior and the need to protect information and systems is a key activity in addressing cybercrime.

Protecting Information and Information Systems

Criminals often take advantage of poor computer security practices, which makes maintaining a strong information security posture vital to efforts to stop cybercrime. However, individuals allow easy access for criminals to their personal computers and electronic devices by not enabling security on those devices. Without adequate information security, critical systems and sensitive data are more susceptible to criminal access, theft, modification, and destruction. Further, our audits have shown that federal agencies do not adequately protect the information systems that the government relies upon to deliver services to its customers. In addition, over the last several years, we have identified the challenges associated with the federal government’s efforts to coordinate public and private sector efforts to protect the computer systems that support our nation’s critical infrastructures. As a result, federal information security has been on GAO’s list of high-risk areas since 1997 and cyber critical infrastructure protection since 2003. In addition, we have made numerous recommendations to enhance the security of federal information systems and cyber critical infrastructure protection efforts. Implementation of these recommendations is essential to protecting federal information systems.

Raising Awareness about Criminal Behavior

A major challenge is educating the public in how to recognize cybercrime when it is occurring. Criminals prey on people’s ignorance and susceptibility to ruses. For example, attackers create e-mail and Web sites that appear legitimate, often copying images and layouts of actual Web sites. Some cybercrime techniques also take advantage of combinations of vulnerabilities. For example, phishing entices users to provide the sensitive information desired. However, phishers also use technical methods to exploit software and system vulnerabilities to reinforce users’ perceptions that they are on a legitimate Web site.

Despite efforts by public and private entities to raise awareness about the importance of information security and the techniques used by criminals, users continue to not understand the need for protecting their personal information and to recognize unusual requests that could be criminal activity. The types of cybercrime that the media highlight, such as child pornography cases and major companies being hacked, do not tend to undermine people’s trust in the Internet. For example, there continue to be reports of people falling victim to well-known scams such as the Nigerian 4-1-9 fraud. In addition, even as awareness grows, practices are not easily changed. Further, the issues of adequate awareness apply to law enforcement. State and local law enforcement may not be aware of the cybercrime problem that could be impacting their citizens.

There are numerous steps being taken to improve security of information systems and raise user awareness. For example, as discussed earlier, information security vendors provide software and services; software developers are attempting to improve the quality and security of their products; public and private entities are working together to identify and mitigate risks, including criminal activities; and federal organizations, such as the FBI, the Secret Service, FTC, and DHS, sponsor programs and organizations to raise user awareness about securing their information and not becoming a victim of cybercrime. These are positive steps to improve security and raise awareness.

Conclusions

The actual and potential harms that result from cybercrime attacks in the United States are significant. Although the precise amount of economic loss due to cybercrime is unknown, its impact is likely billions of dollars. In addition, nation-state and terrorist adversaries are seeking ways to attack our nation’s critical infrastructures and steal our sensitive information.

While numerous public and private entities—federal agencies, state and local law enforcement, industry, and academia—have responsibilities to address these threats, they face challenges in protecting against, detecting, investigating, and prosecuting cybercrimes. These challenges include reporting cybercrime, ensuring adequate law enforcement analytical and technical capabilities, working in a borderless environment with laws of multiple jurisdictions, and implementing information security practices and raising awareness.

Public and private entities are working to address these challenges by expanding public/private partnerships to increase the trust between entities, to improve the quality and quantity of shared information, and to leverage resources and technologies across public and private boundaries. In addition, law enforcement organizations have formed task forces and international agreements to foster working in a borderless environment with laws from multiple jurisdictions. Continued expansion of these efforts is essential. Additionally, more can be done to assure an adequate pool of individuals with the skills needed to effectively combat cybercrime. Although law enforcement agencies must be sensitive to a number of organizational issues and objectives in their human capital programs, current staff rotation policies at key law enforcement agencies may negatively impact the agencies’ analytical and technical capabilities to combat cybercrime.

Recommendation for Executive Action

We recommend that the Attorney General direct the FBI Director and the Secretary of Homeland Security direct the Director of the Secret Service to assess the impact of the current rotation approach on their respective law enforcement analytical and technical capabilities to investigate and prosecute cybercrime and to modify their approaches, as appropriate.

Agency Comments and Our Evaluation

We received written comments on a draft of this report from the FBI (see app. II). In the response, the Deputy Assistant Director from the FBI’s Cyber Division stated that the FBI Director had approved rotational policies after careful consideration of the viable alternatives provided by analysis and study conducted by the Human Resources Division. Further, he stated that the FBI Director had endorsed the establishment of five distinct career paths for both new and veteran special agents, including a specific designation for cyber matters. According to the Assistant Director, this career path will ensure the FBI recruits, trains, and deploys special agents with the critical cyber skill set required to maintain the FBI on the cutting edge of computer technology and development, and positioned to counter the constantly evolving cyber threat. Despite these efforts to assess and expand analytical and technical capabilities, the current rotational policies may adversely affect the FBI’s use of staff with cyber expertise; therefore, it is important to continually reassess the rotational policies that impact the FBI’s ability to address the cyber threat.

In addition, we received written comments on a draft of this report from the Secret Service (see app. III). In the response, the Assistant Director, Office of Inspection, stated that agents who complete the Electronic Crimes Special Agent Program’s computer forensics training course are required to serve a minimum of four years in the program. In addition, he stated that the Secret Service is expanding its Electronic Crimes Special Agent Program and will have approximately 770 trained and active agents by the end of fiscal year 2007. He also stated that the rotation of the Electronic Crimes Special Agent Program agents does not have a detrimental impact on the agency’s cyber investigative capabilities because Secret Service field offices send additional agents through the program prior to a trained agent’s departure, and because the Electronic Crimes Task Forces allow the agency to draw on state and local law officials trained in cyber investigations and computer forensics. While we agree that expanding the Electronic Crimes Special Agent Program and leveraging the relationships and capabilities of the Electronic Crimes Task Forces is important to adequately addressing cybercrime, the current rotational policy may adversely affect the Secret Service’s use of staff with cyber expertise; therefore, it is important for the Secret Service to continually reassess the rotational policies that impact its ability to address the cyber threat.

DOD, DOJ, DHS, state and local government, and other officials also provided technical corrections that have been incorporated in this report as appropriate.

As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to interested congressional committees, the Attorney General, the Secretaries of Defense and Homeland Security, the Chairman of the Federal Trade Commission, and other interested parties. We also will make copies available to others upon request. In addition, this report will be available at no charge on GAO’s Web site at http://www.gao.gov.

If you or your staff has any questions about this report, please contact David Powner at (202) 512-9286, or pownerd@gao.gov; or Keith Rhodes at (202) 512-6412, or rhodesk@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Major contributors to this report are listed in appendix IV.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) determine the impact of cybercrime on our nation’s economy and security; (2) describe key federal entities, as well as nonfederal and private-sector entities, responsible for addressing cybercrime; and (3) determine challenges being faced in addressing cybercrime.

To determine the impact of cybercrime on the U.S. economy and security, we analyzed various government and private-sector reports, surveys, and statistics related to cybercrime and conducted interviews with experts from law enforcement, academia, and information technology and security companies to verify, clarify, and gain a greater understanding of cybercrime’s impact. Further, we interviewed officials and staff at key federal agencies, including the Departments of Defense, Justice, and Homeland Security; and the Federal Trade Commission; and obtained, through structured interview questions, information from 19 federal Office of Inspectors General about the number and frequency of cybercrimes experienced at their respective agencies and the subsequent cost associated with addressing these incidents, among other things.

To identify the key public and private-sector entities that work to mitigate and investigate computer crime and prosecute cyber criminals, we analyzed reports, surveys, and studies related to cybercrime. In addition, we held interviews with cybercrime experts from government and the private sector to identify entities and verify the entities identified as being important. To verify information and determine relevant activities, we performed document analysis, held site visits, conducted structured interviews, and received written responses to structured interview questions. The entities contacted during the course of our work include the following: Department of Justice: Computer Crime and Intellectual Property Section; Bureau of Justice Statistics; United States Attorneys, including the Pittsburgh and Seattle Computer Hacking and Intellectual Property units; FBI’s Cyber Division, including the Computer Intrusion Section and the Innocent Images National Initiative unit; FBI’s National Cyber Forensics and Training Alliance; FBI’s Cyber Initiative and Resource Fusion Unit; FBI’s Internet Crime Complaint Center; and FBI’s Pittsburgh and Seattle Field Office units.

Department of Homeland Security: Special Agent in Charge of the Secret Service’s Criminal Investigative Division; the National Cyber Security Division’s Deputy Director of the Law Enforcement and Intelligence Section and Deputy Director of the United States Computer Emergency Readiness Center.

Department of Defense: Defense Cyber Crime Center; Joint Task Force for Global Network Operations; Defense Criminal Investigative Service; Air Force Office of Special Investigation, Army Military Intelligence, and the Naval Criminal Investigative Service.

Federal Trade Commission: Officials from the Divisions of Advertising Practices, Enforcement, and Marketing Practices. In addition, members of the team attended sessions of a Federal Trade Commission sponsored conference that focused attention on cybercrime.

Office of Inspectors General: Department of Education’s Computer Crime Division/Office of Inspector General; written responses from structured interview questions from officials from the Inspectors General of the Small Business Administration, Department of Defense, Nuclear Regulatory Commission, Health and Human Services, National Science Foundation, Department of Veterans Affairs, General Services Administration, Department of Labor, Department of Transportation, Agency for International Development, Office of Personnel Management, Department of the Treasury, Department of Justice, Housing and Urban Development, Social Security Administration, Department of Energy, Department of the Interior.

Private Sector: Counterpane Internet Security; Cyber Security Industry Alliance; CypherTrust; Guidance Software; InfraGard; Information Technology-Information Sharing and Analysis Center; Microsoft; Postini; SEARCH; Symantec; and other cybercrime experts.

State and Local Entities: Office of the Attorney General of Washington; Washington State Highway Patrol’s Computer Crime Unit; Office of the Attorney General of Virginia—Computer Crime Unit; and the National Association of Attorneys General.

We also met with representatives from the State Department to discuss the department’s role in addressing cybercrime. However, after meeting with representatives from the department’s Bureau of Resource Management, Political-Military Affairs, International Narcotics and Law Enforcement, and others, we determined that the department’s cybercrime responsibilities were outside the scope of our engagement. In addition, State Department representatives stated that they work closely with the Department of Justice’s Computer Crime and Intellectual Property Section on cybercrime issues and that Justice officials would be a better source to determine the impact of cybercrime on the United States and international efforts to address cybercrime.

To determine the challenges being faced in addressing cybercrime, we gathered and analyzed relevant documents, interviewed key government and private-sector officials regarding challenges to fighting cybercrime, and conducted Internet and media research. Based on the information received and our knowledge of the issues, we determined the major challenges impeding efforts to address cybercrime.

To observe operations of cybercrime related entities and interview relevant federal, state, and local government and private-sector officials, we performed our work between June 2006 and May 2007 in the Washington, D.C., metropolitan area; Pittsburgh, Pennsylvania; Seattle, Washington; and Fairmont, West Virginia; in accordance with generally accepted government auditing standards.

Appendix II: Comments from the Federal Bureau of Investigation

Appendix III: Comments from the U.S. Secret Service

Appendix IV: GAO Contacts and Staff Acknowledgments

Staff Acknowledgments

In addition to the individuals named above, Barbara Collier, Neil Doherty, Michael Gilmore, Steve Gosewehr, Barbarol James, Kenneth A. Johnson, Kush K. Malhotra, Amos Tevelow, and Eric Winter made key contributions to this report.