CyberCrime  
Alan Davidson 2006 

The revolution in information technologies has changed society fundamentally and will probably continue to do so in the foreseeable future. Many tasks have become easier to handle. Where originally only some specific sectors of society had rationalised their working procedures with the help of information technology, now hardly any sector of society has remained unaffected. Information technology has in one way or the other pervaded almost every aspect of human activities. 

A conspicuous feature of information technology is the impact it has had and will have on the evolution of telecommunications technology. Classical telephony, involving the transmission of human voice, has been overtaken by the exchange of vast amounts of data, comprising voice, text, music and static and moving pictures. This exchange no longer occurs only between human beings, but also between human beings and computers, and between computers themselves. Circuit-switched connections have been replaced by packet-switched networks. It is no longer relevant whether a direct connection can be established; it suffices that data is entered into a network with a destination address or made available for anyone who wants to access it. 

The pervasive use of electronic mail and the accessing through the Internet of numerous web sites are examples of these developments. They have changed our society profoundly. 

The ease of accessibility and searchability of information contained in computer systems, combined with the practically unlimited possibilities for its exchange and dissemination, regardless of geographical distances, has lead to an explosive growth in the amount of information available and the knowledge that can be drawn there from.

These developments have given rise to an unprecedented economic and social changes, but they also have a dark side: the emergence of new types of crime as well as the commission of traditional crimes by means of new technologies. Moreover, the consequences of criminal behaviour can be more far-reaching than before because they are not restricted by geographical limitations or national boundaries. The recent spread of detrimental computer viruses all over the world has provided proof of this reality. Technical measures to protect computer systems need to be implemented concomitantly with legal measures to prevent and deter criminal behaviour. 

The new technologies challenge existing legal concepts. Information and communications flow more easily around the world. Borders are no longer boundaries to this flow. Criminals are increasingly located in places other than where their acts produce their effects. However, domestic laws are generally confined to a specific territory. Thus solutions to the problems posed must be addressed by international law, necessitating the adoption of adequate international legal instruments. The present Convention aims to meet this challenge, with due respect to human rights in the new Information Society. 

Codes of Conduct 

In an environment of minimisation of regulation and of commercial self-awareness, many industries have opted to self-regulate. Industry Codes of Conduct have proved extremely valuable to many individuals. By participating in codes of conduct many industries have avoided draconian legislation and have rectified many undesirable aspects of their practices. Some industry codes include sanctions. Examples of industry codes include: 
 · the Asia Pacific Smart Cards Forum Code of Conduct; 
 · the Insurance Council of Australia Code of Conduct; and 
 · a Direct Marketing Model Code of Practice. 

Investigative powers 

The Cybercrime Act enhanced the criminal investigation powers under the Crimes Act 1914 and Customs Act 1901 relating to the search, seizure and copying of electronically stored data.  The large amount of data that can be stored on computers and the use of security measures, such as encryption and passwords present particular problems for investigators. The enhanced powers are designed to enable police to copy computer data and examine computer equipment and disks off-site and to require assistance from the computer owners. 

 A magistrate may order a person with knowledge of a computer system to provide information or assistance.  This power extends to the compulsory disclosure of passwords, keys, codes, cryptographic and steganographic methods used to protect information "as is necessary and reasonable" (ss 3E to 3S). 

The provisions permit both the Defence Signals Directorate and Australian Security Intelligence Organisation (ASIS) to hack legally. 

Some commentators have described the new investigative powers as draconian and dangerous.  Exaggerated criticism has been made of the provisions which make it offence to possess hacker toolkits, scanners and virus code, on the basis that these are tools of the trade for security vendors. 

Internet Gambling 

The Interactive Gambling Act 2001 (Cth) commenced in full in January 2002.  The regulation of gambling is typically a State and Territory matter.  However, the federal parliament has power in regard to Internet activities and other communications technologies. The Act is the government's response to the community's concern to the expanded activity of gambling through recent technologies. 

The Act prohibits the provision of interactive gambling to people located in Australia. The prohibition applies to casino-type gaming, betting on a sporting event after it has commenced and scratch lotteries online.  Offences apply to both Australian and overseas interactive gambling service providers.  Fines of up to $1.1 million per day apply. 

 The Act prohibits interactive gambling services from being provided in Australia and prohibits Australian-based interactive gambling services from being provided in designated countries.  A complaints-based system is established.  A person may complain to the Australian Broadcasting Authority (ABA) about prohibited Internet gambling content. If hosted in Australia and the ABA considers that the complaint is warranted it must refer the complaint to the Australian police force.  For content hosted outside Australia, the ABA must also notify internet service providers (ISPs) so that the ISPs can apply the industry standard, such as, updating internet content filtering software. 

 The Act encourages the development of an industry code by ISPs.  The ABA has a reserve power to make an industry standard if there is no industry code or if an industry code is deficient. Regulations may provide that civil proceedings do not lie against a person to recover money alleged to have been won or paid in connection with an illegal interactive gambling service.  The Act prohibits the advertising of interactive gambling services. 

 The Act provides for a general review before July 2003 on the impact of the Act.  The review is to take into account the growth of interactive gambling services, the social and commercial impact of interactive gambling services, and the effect of the exemptions relating to excluded wagering services, excluded gaming services, services that have a designated broadcasting or datacasting link, and excluded lottery services. 

 As 99.9 per cent of the gambling sites on the internet are based offshore, the impact of the Act on access to such sites will be minimal. 

Cyberstalking 

Various State legislation defines stalking as continued and intentional conduct directed at another person that would cause a reasonable apprehension of violence or detriment to the stalked person or another person. "Cyberstalking" or stalking online is not dealt with directly by legislation. However, elements of stalking can include use of the Internet, email or other electronic communications to harass or threaten another person. The behaviour includes posting improper messages on bulletin boards, forwarding viruses, threatening or offensive email, and electronic theft. 

 The Crimes Acts in most jurisdictions describe stalking in general terms, leaving it to the courts to consider specific instances such as harassment by electronic means.  In Victoria and the Northern Territory the offence of stalking specifically includes "telephoning, sending electronic messages to, or otherwise contacting, the victim or any other person".  In 1999 the Queensland Criminal Code was amended to extend stalking to conduct utilising the telephone, fax, mail, email or other technology.  In the Australian Capital Territory stalking includes where the offender "telephones, sends electronic messages to or otherwise contacts the stalked person; sends electronic messages about the stalked person to anybody else or makes electronic messages about the stalked person available to anybody else".  However, even if the stalker can be identified, the enforcement of such laws can be problematic as the offender may not be located within the jurisdiction. 

 Technical responses available for the consumer include the following: 

• Blocking and filtering software can delete email or chat-room messages. The criteria used can include the name of the author, certain offensive words and so on. 
• Sophisticated encryption programs can prevent messages being read by unauthorised people. 
• Digital signatures and certificates can be used to authenticate the author. 
• Using a gender-neutral name. 
• Changing passwords regularly. 

Congress passed the USA PATRIOT Act (the Act) in response to the terrorists’ attacks of September 11, 2001. The Act gives federal officials greater authority to track and intercept communications, both for law enforcement and foreign intelligence gathering purposes. It vests the Secretary of the Treasury with regulatory powers to combat corruption of U.S. financial institutions for foreign money laundering purposes. It seeks to further close our borders to foreign terrorists and to detain and remove those within our borders. It creates new crimes, new penalties, and new procedural efficiencies for use against domestic and international terrorists. Although it is not without safeguards, critics contend some of its provisions go too far. Although it grants many of the enhancements sought by the Department of Justice, others are concerned that it does not go far enough. 

The Act originated as H.R.2975 (the PATRIOT Act) in the House and S.1510 in the Senate (the USA Act). S.1510 passed the Senate on October 11, 2001, 147 Cong. Rec. S10604 (daily ed.). The House Judiciary Committee reported out an amended version of H.R. 2975 on the same day, H.R.Rep.No. 107-236. The House passed H.R. 2975 the following day after substituting the text of H.R. 3108, 147 Cong.Rec. H6775- 776 (daily ed. Oct. 12, 2001). The House version incorporated most of the money laundering provisions found in an earlier House bill, H.R. 3004, many of which had counterparts in S.1510 as approved by the Senate. The House subsequently passed a clean bill, H.R. 3162 ( under suspension of the rules), which resolved the differences between H.R. 2975 and S.1510, 147 Cong.Rec. H7224 (daily ed. Oct. 24, 2001). The Senate agreed to the changes, 147 Cong.Rec. S10969 (daily ed. Oct. 24, 2001), and H.R. 3162 was sent to the President who signed it on October 26, 2001. This is an abbreviated versions of The USA PATRIOT Act: A Legal Analysis, CRS Report RL31377, stripped of its citations and footnotes. 

Criminal Investigations: Tracking and Gathering Communications 
Federal communications privacy law features a three tiered system, erected for the dual purpose of protecting the confidentiality of private telephone, face-to-face, and computer communications while enabling authorities to identify and intercept criminal communications. Title III of the Omnibus Crime Control and Safe Streets Act of 1968 supplies the first level. It prohibits electronic eavesdropping on telephone conversations, face-to-face conversations, or computer and other forms of electronic communications in most instances. It does, however, give authorities a narrowly defined process for electronic surveillance to be used as a last resort in serious criminal cases. When approved by senior Justice Department officials, law enforcement officers may seek a court order authorizing them to secretly capture conversations concerning any of a statutory list of offenses (predicate offenses). Title III court orders come replete with instructions describing the permissible duration and scope of the surveillance as well as the conversations which may be seized and the efforts to be taken to minimize the seizure of innocent conversations. The court notifies the parties to any conversations seized under the order after the order expires. 

Below Title III, the next tier of privacy protection covers telephone records, e-mail held in third party storage, and the like, 18 U.S.C. 2701-2709 (Chapter 121). Here, the law permits law enforcement access, ordinarily pursuant to a warrant or court order or under a subpoena in some cases, but in connection with any criminal investigation and without the extraordinary levels of approval or constraint that mark a Title III interception. 

Least demanding and perhaps least intrusive of all is the procedure that governs court orders approving the government’s use of trap and trace devices and pen registers, a kind of secret “caller id.”, which identify the source and destination of calls made to and from a particular telephone, 18 U.S.C. 3121-3127 (Chapter 206). The orders are available based on the government's certification, rather than a finding of a court, that use of the device is likely to produce information relevant to the investigation of a crime, any crime. The devices record no more than identity of the participants in a telephone conversation, but neither the orders nor the results they produce need ever be revealed to the participants. 

The Act modifies the procedures at each of the three levels. It: 

• permits pen register and trap and trace orders for electronic communications (e.g., e-mail); 
• authorizes nationwide execution of court orders for pen registers, trap and trace devices, and access to stored e-mail or communication records; 
• treats stored voice mail like stored e-mail (rather than like telephone conversations);
• permits authorities to intercept communications to and from a trespasser within a computer system (with the permission of the system’s owner); 
• adds terrorist and computer crimes to Title III’s predicate offense list; 
• re-enforces protection for those who help execute Title III, ch. 121, and ch. 206 orders; 
• encourages cooperation between law enforcement and foreign intelligence investigators; 
• establishes a claim against the U.S. for certain communications privacy violations by government personnel; and 
• terminates the authority found in many of these provisions and several of the foreign intelligence amendments with a sunset provision (Dec. 31, 2005). 

The Act eases some of the restrictions on foreign intelligence gathering within the United States, and affords the U.S. intelligence community greater access to information unearthed during a criminal investigation, but it also establishes and expands safeguards against official abuse. More specifically, it: 

• · permits “roving” surveillance (court orders omitting the identification of the particular instrument, facilities, or place where the surveillance is to occur when the court finds the target is likely to thwart identification with particularity); 
• increases the number of judges on the Foreign Intelligence Surveillance Act (FISA) court from 7 to 11; 
• allows application for a FISA surveillance or search order when gathering foreign intelligence is a significant reason for the application rather than the reason; 
• authorizes pen register and trap & trace device orders for e-mail as well as telephone conversations; 
• sanctions court ordered access to any tangible item rather than only business records held by lodging, car rental, and locker rental businesses; 
• carries a sunset provision; 
• establishes a claim against the U.S. for certain communications privacy violations by government personnel; and 
• expands the prohibition against FISA orders based solely on an American’s exercise of his or her First Amendment rights. 

In federal law, money laundering is the flow of cash or other valuables derived from, or intended to facilitate, the commission of a criminal offense. It is the movement of the fruits and instruments of crime. Federal authorities attack money laundering through regulations, criminal sanctions, and forfeiture. The Act bolsters federal efforts in each area. 

Regulation: The Act expands the authority of the Secretary of the Treasury to regulate the activities of U.S. financial institutions, particularly their relations with foreign individuals and entities. He is to promulgate regulations: 

• under which securities brokers and dealers as well as commodity merchants, advisors and pool operators must file suspicious activity reports (SARs); 
• requiring businesses, which were only to report cash transactions involving more than $10,000 to the IRS, to file SARs as well; 
• imposing additional “special measures” and “due diligence” requirements to combat foreign money laundering; 
• prohibiting U.S. financial institutions from maintaining correspondent accounts for foreign shell banks; 
• preventing financial institutions from allowing their customers to conceal their financial activities by taking advantage of the institutions’ concentration account practices; 
• establishing minimum new customer identification standards and recordkeeping and recommending an effective means to verify the identity of foreign customers; 
• encouraging financial institutions and law enforcement agencies to share information concerning suspected money laundering and terrorist activities; and 
• requiring financial institutions to maintain anti-money laundering programs which must include at least a compliance officer; an employee training program; the development of internal policies, procedures and controls; and an independent audit feature. 

• outlaws laundering (in the U.S.) any of the proceeds from foreign crimes of violence or political corruption; 
• prohibits laundering the proceeds from cybercrime or supporting a terrorist organization; 
• increases the penalties for counterfeiting; 
• seeks to overcome a Supreme Court decision finding that the confiscation of over $300,000 (for attempt to leave the country without reporting it to customs) constituted an unconstitutionally excessive fine; 
• provides explicit authority to prosecute overseas fraud involving American credit cards; and 
• endeavors to permit prosecution of money laundering in the place where the predicate offense occurs. 

• establishes a mechanism to acquire long arm jurisdiction, for purposes of forfeiture proceedings, over individuals and entities; 
• allows confiscation of property located in this country for a wider range of crimes committed in violation of foreign law; 
• permits U.S. enforcement of foreign forfeiture orders; 
• calls for the seizure of correspondent accounts held in U.S. financial institutions for foreign banks who are in turn holding forfeitable assets overseas; and 
• denies corporate entities the right to contest a confiscation if their principal shareholder is a fugitive. 

The Act contains a number of provisions designed to prevent alien terrorists from entering the United States, particularly from Canada; to enable authorities to detain and deport alien terrorists and those who support them; and to provide humanitarian immigration relief for foreign victims of the attacks on September 11. 

Other Crimes, Penalties, & Procedures

New crimes: The Act creates new federal crimes for terrorist attacks on mass transportation facilities, for biological weapons offenses, for harboring terrorists, for affording terrorists material support, for misconduct associated with money laundering already mentioned, for conducting the affairs of an enterprise which affects interstate or foreign commerce through the patterned commission of terrorist offenses, and for fraudulent charitable solicitation. Although strictly speaking these are new federal crimes, they generally supplement existing law by filling gaps and increasing penalties. 

New Penalties: The Act increases the penalties for acts of terrorism and for crimes which terrorists might commit. More specifically it establishes an alternative maximum penalty for acts of terrorism, raises the penalties for conspiracy to commit certain terrorist offenses, envisions sentencing some terrorists to life-long parole, and increases the penalties for counterfeiting, cybercrime, and charity fraud. 

Other Procedural Adjustments: In other procedural adjustments designed to facilitate criminal investigations, the Act: 

• increases the rewards for information in terrorism cases; 
• expands the Posse Comitatus Act exceptions; 
• authorizes “sneak and peek” search warrants; 
• permits nationwide and perhaps worldwide execution of warrants in terrorism cases; 
• eases government access to confidential information; 
• allows the Attorney General to collect DNA samples from prisoners convicted of any federal crime of violence or terrorism; 
• lengthens the statute of limitations applicable to crimes of terrorism; 
• clarifies the application of federal criminal law on American installations and in residences of U.S. government personnel overseas; and 
• adjust federal victims’ compensation and assistance programs. 

 

__________________________________________________________________________________________

 Alan Davidson 
2006
(21) 

Return to Top