Cybercrime Enforcement: Laws and Penalties in the U.S.

1. Lecture 14:Crime

2. Criminal Law • Even though there is a victim, the injury is to “society,” so the government prosecutes • Unauthorized access • Theft of services • Alteration/destruction of data • Trafficking in passwords • Computer fraud • Denial of service

3. Identity Theft • 18 U.S.C. 1028(a) prohibits “knowingly and without lawful authority” • producing a real or false identification document • transferring a stolen identification document • possessing five or more real or false identification documents with intent to use • transfers or uses a means of identification of another person with the intent to commit … any unlawful activity that constitutes a violation of Federal law, or … felony under … State or local law • Penalty: 15, 20 or 25 years

4. Computer Fraud and Abuse Act • Fraud in connection with access devices. 18 U.S.C. § 1029. • “access device” means any card, plate, code, account number, electronic serial number, mobile identification number, PIN, or other … identifier or other means of account access that can be used … to obtain money, goods, services, or any other thing of value, or … to initiate a transfer of funds • Prohibits use or trafficking in counterfeit access devices • Penalty: 10, 15 or 20 years • Attempt carries same punishment

5. Government Response • U.S. Government Identity Theft Site • FTC Identity Theft Site • Identity Theft and Fraud (Dep’t of Justice) • Identity Theft Resources (Privacy Rights Clearinghouse)

6. Extortion, 18 U.S.C. §875 • “Whoever, with intent to extort from any person, firm, association, or corporation, any money or other thing of value, transmits in interstate or foreign commerce any communication containing any threat to injure the property or reputation of the addressee or of another or the reputation of a deceased person or any threat to accuse the addressee or any other person of a crime, shall be fined under this title or imprisoned not more than two years, or both.”

7. Pornography • Federal statute, 18 U.S.C. §2252: Applies to any person who - (1) knowingly transports, ships, receives or distributes in interstate or foreign commerce by any means including by computer or mails, any visual depiction of a minor engaging in sexually explicit conduct. • U.S. v. Hockings, No. 97-50018 (9th Cir. 11/21/97): Computer graphic interchange files (GIFs) in binary format fall within the definition of "visual depictions" as contemplated by 18 U.S.C. §§ 2252(a)(1) and (4)(B). The fact that such files require the use of personal computer hardware and software to depict images of child pornography does not put them outside the statute, the court held, analogizing to an earlier case in which undeveloped film was also held to constitute a "visual depiction" under the statute.

8. Cyberstalking • “It is the intent of this act to clarify that electronic communications are included in the actions that can constitute the crimes of harassment and stalking.” • Cal. Penal Code 646.9. (a) Any person who willfully, maliciously, and repeatedly follows or harasses another person and who makes a credible threat with the intent to place that person in reasonable fear for his or her safety, or the safety of his or her immediate family, is guilty of the crime of stalking, punishable by imprisonment in a county jail for not more than one year or by a fine of not more than one thousand dollars ($1,000), or by both that fine and imprisonment.

9. Cyberstalking • Cal. Penal Code §653m. (a) Every person who, with intent to annoy, telephones or makes contact by means of an electronic communication device with another and addresses to or about the other person any obscene language or addresses to the other person any threat to inflict injury to the person or property of the person addressed or any member of his or her family, is guilty of a misdemeanor. Nothing in this subdivision shall apply to telephone calls or electronic contacts made in good faith.

10. Current Cases • State of Utah v. Amoroso, 1999 Utah App. LEXIS 213 (Ct. App. Ut. 3/4/99): Utah may criminally prosecute an Illinois corporation for liquor sales to Utah residents over the Internet. Court held that there was criminal personal jurisdiction in Utah since the conduct committed in Illinois caused an unlawful result in Utah. • FTC v. Craig Lee Hare (S.D. Fla. 4/98): Action for deceptive trade practices arising from on-line “auction” offering sale of computer products that were never delivered. Defendant barred for life from conducting Internet commerce, pleaded guilty to wire fraud and sentenced to six months home detention, three years probation and ordered to pay restitution of over $22,000.

11. Current Cases • U.S. v. Hoke, Magistrate No. 99-889M (C.D. Cal. 4/14/99): U.S. Attorney's Office sued Gary Hoke of North Carolina for disseminating misinformation on a counterfeit Bloomberg News Service Web page regarding an alleged merger between his employer PairGain Technology, Inc. and ECI Telecom, Ltd. Hoke was traced by IP addresses from Angelfire.com. Hoke pled guilty , sentenced to five months of home detention, five years probation, and restitution of $93,086.77.

12. Economic Espionage Act • Whoever, intending or knowing that the offense will benefit any foreign government, knowingly -(1) steals, or by fraud, artifice, or deception obtains a trade secret;(2) without authorization copies, downloads, replicates, transmits, or conveys a trade secret;(3) receives, buys, or possesses a trade secret, knowing the same to have been stolen • Penalty for organizations: $10 million fine

13. Theft of Trade Secrets, 18 U.S.C. §1832 • Whoever(1) steals, or without authorization appropriates, takes, carries away, or conceals, or by fraud, artifice, or deception obtains a trade secret;(2) without authorization copies, duplicates, downloads, destroys,replicates, transmits, communicates, or conveys a trade secret; or(3) receives, buys, or possesses a trade secret, knowing the same to have been stolen;commits an offense. • Penalty: forfeiture, fine, jail • For organizations, $5,000,000 fine

14. Denial of Access • “Whoever willfully, knowingly, and without authorization accesses ... any computer, computer system, or computer network; or whoever willfully, knowingly, and without authorization denies or causes the denial of computer system services to an authorized user of such computer system services ... commits [a felony].” Fla. Stat. §815.06 • “Whoever willfully, knowingly, and without authorization modifies or destroys data, programs, or supporting documentation residing or existing internal or external to a computer, computer system, or computer network commits [a felony]. Fla. Stat. §815.04

15. Criminal Jurisdiction • When can a state exercise criminal jurisdiction? • Conduct in the state that is an element of the offense • Conduct outside that is an attempt to commit inside • Conduct outside that is conspiracy to commit inside the state + an overt act in the state • Omission to perform a legal duty imposed by the state • Offense is based on a state statute that prohibits conduct outside the state that bears a reasonable relation to a legitimate interest of the state and the actor knows or should know that his conduct is likely to affect that interest. 18 Pa. C.S. § 102

16. Q A &