CSCD496 Computer Forensics

1. Lecture 13 Criminal Behavior Winter 2010 CSCD496Computer Forensics

2. Introduction • First, privacy case – current http://www.privacylives.com/update-on-pennsylvania-school-accused-of-misusing-webcams-on-student-laptops/2010/02/23/ • Next • Look at what motivates criminals to commit crimes • Example types of crimes using computers • Cyberstalking • Sex offenders • Computer Intruders

3. Crime and Technology • In relating technology to crime, the question becomes • Are there new types of crime and criminals emerging because of technology? What do you think?

4. Crime and Technology • Not necessarily true • Technology and Internet adds new dimensions to crime • But … crime already exists • Modus Operandi (MO)‏ • What does this mean? • Latin term that means method of operating • MO refers to how of committing a crime • Separate from motive as to why they commit crimes

5. MO • Criminal’s MO • Learned behaviors that can develop over time • Can be refined and improved as criminals become more experienced and confident • Can also become less competent and less skillful over time • Criminal can have a deteriorating mental state • Increase in mind-altering substances … perhaps

6. Time and Skills • May take years before someone becomes good at being a cyber criminal • Testimony by Kevin Mitnik describes himself as “self taught” http://www.fas.org/irp/congress/2000_hr/030200_mitnick.htm “I have 20 years experience circumventing information security measures, and can report that I have successfully compromised all systems that I targeted for unauthorized access save one. I have two years experience as a private investigator, and my responsibilities included locating people and their assets using social engineering techniques”

7. Internet Crime • Internet / Computers used for criminal activities • Victim selection, surveillance, contact, stalking and harassment • Theft of assets including bank accounts, intellectual property, resources • Destruction of assets including intellectual property, software and systems • Storing and dissemination of illicit materials

8. Motive • Motive - emotional, psychological or material need that impels and is satisfied by a behavior • Criminal motive is technology independent • Do you agree with this statement?

9. Motive • Turns out that ... • Needs that are satisfied by a criminal’s pattern of behavior • Separate from current technology!! • Same motives have existed throughout history in one form or another

10. Motive • However • Existing motives can be aided or even enhanced by technology • Following groups of criminals use technology to help them commit crimes • Intruders • Sex Offenders – child porn, other • Cyber Stalking

11. Intruders • People break into computers for many reasons • Steal resources • Malicious destruction • Grudge against an individual or company • Thrill • Can it be done?

12. Intruders • A past profile of these offenders • Male, between 12 and 28 • Antisocial and without strong ties to people in real world • Current knowledge about intruders (includes hackers) • Above characterization is too narrow • This group can contain people of any age or gender • Availability of tools has enabled almost anyone to become intruders

13. Intruders • Useful to consider nature and intent of crime • Computer intruders have been compared to arsonists • Both destroy evidence to cover their tracks • Often retaliate against some wrong or • Wield their power • Was destruction intended to inflict damage or was it a cover up act

14. Intruders • Look at what was targeted in the attack • Narrow target – damage is focused and specific • Have a grudge against a single individual • Example: Wiped out /home/jane • Broad target – inflict damage on entire group or organization

15. Intruders • Example – Broad target • Tim Lloyd, primary system administrator for Omega Engineering Corp. was fired for stealing expensive equipment • In retaliation, Lloyd executed a time bomb on Omega’s main server that deleted the company’s important data and programs • A high degree of skill was required to implement this targeted attack with the intent to destroy all of Omega’s important data and programs .... Also erased all related backup tapes • Experts spent years recovering pieces of information from servers, desktops, and even computers

16. Intruders • Besides knowing or inferring intent • Can figure out who had access • In previous case, digital evidence implicated Lloyd • He was the only one with access, motive and skill • Skill Level can Provide Clues • Suspect uses widely available software and chooses weak targets – no obvious reason • Likely low-skilled intruder • Large pool of potential intruders, not easily identified

17. Toolkits • Automate Intrusion • Makes it hard to identify intruders • Suspects become indistinguishable from each other • If every crime scene is identical, more difficult to link suspect to a crime • Sometimes intruder will customize a widely used toolkit • Add their own name to it or software

18. Sex Offenders • Sex offenders like the Internet – many reasons • Access to more victims • Access to victims all over the world • A lot of information exists about potential victims • Online dating services, Social Engineering Sites • Provide a lot of information – personals.yahoo.com • Pictures, age, geographical region

19. Sex Offenders • Internet allows • Perpetrators to groom victims - gain their trust • Grooming refers to ways that a sexual offender gains control over a victim • Exploit their weaknesses to gain trust or instill fear • Loneliness, self esteem, sexual curiosity, inexperience • Takes advantage of vulnerabilities to develop a bond • Use controls to bond sexually, manipulate victims and discourage them from going to authorities

20. Sex Offenders • Internet allows anonymity • Can pretend to be a different sex, older or younger • More attractive • Example: • 47 year old Ohio man posed as a 15 year old boy and convinced a 14 year old girl to send him sexually explicit photos and a videotape of herself performing sexual acts • Relationship continued for 18 months, since the girl was 12 years old • Man pled guilty to one charge of inducing a minor to produce child pornography

21. Sex Offenders • Common Sex offenses • Soliciting minors for sex • Making, possessing or distributing child pornography • Finding Evidence • Want to link evidence to the offender • Might be straightforward or not

22. Sex Offenders • Example • Yale geology professor, Anthony Lasaga admitted to possessing tens of thousands of images of children engaging in sexual acts • Many of these images were downloaded from the Internet onto a computer in the geology department and then viewed on Lasaga’s computer • A system administrator in geology department observed Lasaga accessing materials on server from his desktop and reported the incident to law enforcement. • Was necessary to secure the entire geology building and network for related evidence

23. Sex Offenders • Motive • Vary with type of pornography • Adult, child or other • How it is gathered or created • What is done with it once it is gathered • Altered, re-distributed • Motives don’t change because of the Internet • Pictures of victims long before Internet

24. Sex Offenders • Motive • Not always easy to determine the motive • Debate role of porn in sexual offenses • Porn has been argued to be a cause of crime • Example: Ted Bundy said he blamed porn for his behavior, Who Was Ted Bundy? • He claims to have become obsessed with porn and viewing it broke down his resistance to commit violent crimes against women • Before executed in 1989, he admitted to murdering 40 young women in almost a dozen states during his four-year reign of terror '70s

25. Stalking • Stalking behavior is characterized as obsession with a victim • Stalkers who use the Internet often try to conceal identity • Obsession with victim usually reveals identity eventually • Attempts to discourage them can incite them to violence which places victims at risk

26. Stalking • In 1990, 5 women murdered in California by stalkers • Enacted a law to deal with stalking • In 1998, California included electronic communication in their anti-stalking law • California law has strongly influenced all of the anti-stalking laws in the US

27. Stalking • Definition of Stalking • Any person who willfully, maliciously, and repeatedly follows or harasses another person and • Makes a credible threat with intent to place that person in reasonable fear of death or great bodily injury • Is guilty of the crime of stalking

28. Stalking • Definition of Stalking continued … • Harass means a knowing and willful course of conduct directed at a specific person • That seriously alarms, annoys, torments, or terrorizes the person and that serves no legitimate purpose • The course of conduct must be such • Would cause a reasonable person to suffer substantial emotional distress, and • Must actually cause substantial emotional distress to the person

29. Cyber Stalking • Persistence is one main concept when dealing with stalking • 1 e-mail is not considered harassment • Not a pattern of behavior • Cyber Stalking • Works the same as in the physical world • Telephone the victim, go to their house • Now use Internet or do a combination of physical and cyber stalking

30. Cyber Stalking • Example • Cynthia Armistead Smathers of Atlanta became target during an e-mail discussion, June 1996 • First she received nasty e-mails from account of Richard Hillyard of Norcross, GA • Then she received messages sent through an anonymous re-mailer • After Hillyard’s ISP cancelled his account, • Cynthia began getting messages from the Centers for Disease Control and Prevention in Atlanta where Hillyard worked

31. Cyber Stalking • Example • Then, she got 1000’s of e-mails from men who had said they had seen Cynthia’s posting of a nude woman, listing her e-mail and offering sex • Police said there was little they could do until she got an anonymous message from someone who said he had followed her and her 5 year old daughter from their post office box to her home

32. Cyber Stalking • Victims • Studies indicate that many stalkers had a prior acquaintance with their victims before stalking behavior began • However its not clear whether cyber stalking which is newer agrees with these studies • Stalkers on Internet have the opportunity to search for victims • ICQ, AOL profiles and lurk in IRC and AOL Chat rooms • Look for targets – vulnerable individuals easy to intimidate

33. Cyber Stalking • Stalker Behavior • Suggested that stalkers will stop harassing their victims once they cease getting the desired response • Not always the case • Some stalkers become violent when they don’t get what they want • Can lead to murder of victims – five women in California

34. Conclusion • Criminal Behavior • Criminals existed long before the Internet • From the time there was organized societies • Internet and computers doesn’t affect the motivation to commit crimes • Does make it easier to commit some crimes! • Cyber Stalking, Sex offenders and regular Criminals motivated by greed, power, revenge • Usual motivations for “normal” crime drives cyber criminal behavior • Need to know how and why these groups operate • Assists in investigations involving these types of crimes

35. Resources Digital Evidence and Computer Crime by Eoghan Casey Elsevier Academic Press, 2004 National Center for Victims of Crime, Safety http://www.ncvc.org McGrath, M.G. and Casey, E. (2002) “Forensic psychiatry and the Internet: Practical perspectives on sexual predators and obsessional harassers in cyberspace”, Journal of American Academy of Psychiatry and Law, 30, 81-94

36. End Next Assignment up