THE CUTTING EDGE : An Overload of Computer Crime : Law: The quick arrests recently are apparently exceptions. A lack of resources continues to hobble federal investigators.
It took federal law enforcement officials all of eight days to arrest Gary Dale Hoke, the PairGain Technologies employee who in April put up a bogus Internet announcement that the Tustin-based developer of telecommunications technology was being acquired by an Israeli outfit for $1.35 billion.
The speed and efficiency of Hoke’s apprehension amounted to blinding speed in the world of securities fraud, where cases can take years to investigate and prosecute. That Hoke’s arrest followed the similarly speedy capture of David Smith, who officials allege was the author of the Melissa computer virus, appeared to indicate that law enforcement finally had turned the corner in the race to equal the technical prowess of computer miscreants.
That now appears to have been premature and wishful thinking. Both Hoke, who is scheduled to be sentenced today in federal court in Los Angeles in the largest case yet of Internet securities fraud, and Smith had left digital trails that made them easy to track, officials said.
In fact, federal law enforcement officials continue to be hobbled by a lack of human and technical resources and growing caseloads that show no signs of easing.
“Definitely law enforcement is getting better, particularly in areas where there are high-tech companies,” said Miguel Sanchez, chairman of the Forum of Incident Response and Security Teams, a coalition of government and private sector organizations. “They’re getting better, but there are also all too few of them.”
Indeed, as computers have become more pervasive, so has computer crime.
For example, intrusions of corporate computer systems by outsiders are on pace to more than double last year’s record, according to the Computer Emergency Response Team, a Pittsburgh-based clearinghouse for computer security violations. Already, 4,398 incidences have been reported this year, compared with 3,734 during all of last year, according to a survey by the FBI and the Computer Security Institute in San Francisco.
Last year, only 47 people were convicted of computer crimes under federal statutes, while 10 others were acquitted, said David Banisar, an editor with Criminal Justice Weekly, who analyzed data from the Transactional Records Access Clearinghouse of Syracuse University.
Those numbers deal only with cases that have been reported. The actual number of computer crimes is dramatically higher, experts say, but most companies do not report computer security breaches.
The Computer Security Institute and the FBI survey found that two-thirds of the companies that said they had computer intrusions did not report them to law enforcement. That figure was an improvement from previous years, when five out of six companies said they did not report such violations.
Because of such formidable numbers, Atty. Gen. Janet Reno last year launched the Computer Crime and Intellectual Property Section, which involves Justice Department attorneys working with government agencies, the private sector, universities and foreign governments, to better attack cybercrimes. In addition, agencies from the FBI to the Department of Defense to NASA are beefing up their staffs that investigate online activities. Experts from various agencies routinely hold training sessions to educate officers on computer crimes.
Still, the buildup may not be enough.
Currently, 209 FBI agents in 10 field offices, including Los Angeles, are dedicated to investigating computer crimes, but the bureau’s caseload quadrupled since 1996, going from 200 to more than 800 currently, said Michael Vatis, director of the FBI’s National Infrastructure Protection Center.
“There are more cases than we can handle right now, given our current resource levels, and that’s a problem,” Vatis said.
Local law enforcement is even less equipped to handle computer network intrusions.
“We’ll make the old college try and investigate,” said Sgt. Larry Balich, head of the computer crimes unit of the Los Angeles County Sheriff’s Department. “Internet crime to us really is a new game.”
The Sheriff’s Department will head a 12-agency Southern California high-tech crimes task force being established under a recent state initiative. The task force begins its pilot year Oct. 1, but it is unclear how large its staff will be.
Concern over bad publicity, fear that competitors will use information against them and a belief that law enforcement can’t help have led to historically low rates of reporting computer security breaches.
“That perception of law enforcement is gradually changing, but the question of whether they can handle the cases is an element that’s considered” before reporting an incident, said Patrice Rapalus, executive director of the Computer Security Institute.
Law enforcement officials said it’s easy to assign agents to investigate cybercrimes but that once those agents have been trained, the private sector lures them away. “Given the low pay scales, keeping agents for long periods of time is difficult,” Vatis said.
Supervisor agents at the FBI can make as much as $70,000 a year. Jumping to the private sector gets them an immediate $10,000 a year raise plus a signing bonus, those in the industry said. After a few years in private industry, they easily could earn more than $100,000.
Companies view computer crimes differently than other violations, making it less likely for them to report the intrusions. In a physical break-in, the lost property might be recovered if the villain is arrested, but in a digital crime the legal recourse from digital losses may not outweigh the bad publicity the company might incur.
Also, when a hacker breaks into a system and steals data, a copy of it usually remains on the company’s system so the “loss” is having the data in someone else’s hand. And if a hacker is preventing data from being accessed, the company often just wants the attack to stop.
Because large numbers of corporations do not report computer violations, law enforcement officers have a harder time learning how to prevent similar intrusions. Organizations spend time relearning investigative and prevention techniques because companies are wary of sharing information about how someone broke into their system.
In many cases, the lost data could leave the company open to industrial extortion and further theft of trade secrets.
“Companies oftentimes have no idea what they’re losing,” said Thomas Talleur, executive director of NASA’s Network and Advanced Technology Crimes division in the office of criminal investigations.
Talleur and other authorities conceded that “law enforcement is behind the times in general and there’s a lot of outcry on the part of law enforcement for more training and awareness activities.” But Talleur said that the tools exist to corral the problem.
“We instantaneously know who the offenders are that attack us and we are very fast in catching them,” said Talleur, whose office is responsible for investigating attacks on NASA systems.
Others, however, say that the bad guys are handily winning, with the technology available for criminals to hide their tracks being superior to the technology meant to trace them.
Dozens of efforts are underway, both in private companies and in academic labs, to improve anonymity in communication through improved encryption and other means, with full conferences dedicated to the issue. Relatively little research, however, is being done to advance the ability to track people over the Internet, the equivalent of tapping a telephone line.
“The tools to hide your tracks are better than the ones to find you,” said Eugene Spafford, director of the Center for Education and Research in Information Assurance and Security at Purdue University. “There is very little reason for anybody, with the exception of law enforcement, to do research into better investigative methods.”
Spafford blames the federal government’s hard-line policy against exporting encryption technology, which could be used by criminals to conceal information about their activities, as well as prevent law enforcement from intercepting their communications.
But William Boni, director of PricewaterhouseCoopers’ financial advisory services, said the reason for the dearth of research into tracing technologies is more about economics than politics.
“You and I as consumers see the benefit of surfing anonymously,” said Boni. “But who is the market for tracing tools? Law enforcement and investigative groups, and we’re not anywhere near as big of a market as consumers.”
The insufficient resources dedicated to law enforcement has led to an industry of firms providing detective services for corporations that have been victimized. All of the major accounting firms, for example, now offer such services to their clients and more than a dozen companies specialize in it.
“Corporations want to clean their own dirty laundry, and cops are so busy they can’t handle it anyway,” said Michael Anderson, president of New Technologies Inc. in Oregon.
