1. Federal Identity Theft Investigations Richard W. Downing Assistant Deputy Chief Computer Crime and Intellectual Property Section U.S. Department of Justice

2. CCIPS Established in 1991 and now almost 40 attorneys Prosecute – –Computer intrusion and damage cases –Intellectual property cases Provide technical advice re: search and seizure of electronic evidence Legislation and Policy development Train prosecutors and investigators

3. What we can do for you– Advise on searching and seizing electronic evidence Assist in investigation and prosecution of hacking and IP crimes Research resources –Search & Seizure Manual (2002) –IP Manual (2006) –Network Crimes Manual (forthcoming) 24/7 duty line: (202) 514-1026

4. Agenda Investigation of a Major Database Theft Investigation of a Secondary Market for Identity Information Complications in Online Investigations Conclusion

5. Agenda Investigation of a Major Database Theft Investigation of a Secondary Market for Identity Information Complications in Online Investigations Conclusion

6. United States v. Scott Levine Victim: Axciom, Little Rock, AK Crime: Theft of over a BILLION customer records Trail led back to Snipermail, and its CEO: Scott Levine Various other employees pled and cooperated Convicted after lengthy trial Sentence: 96 months

7. Agenda Investigation of a Major Database Theft Investigation of a Secondary Market for Identity Information Complications in Online Investigations Conclusion

8. Carding Sites

9. Centers of Online Crime Financial Crime –Credit Card Fraud –Bank Fraud and Money Laundering –Identity Documents Computer Crime –Hacking Services (Intrusion, DDOS, etc.) –Custom Malware (Viruses, Trojans, etc.)

12. WHAT CAN YOU PURCHASE? Financial account information Credit Cards Passports Driver’s licenses Birth certificates Social Security cards Credit Reports Insurance cards Diplomas

13. Counterfeit Licenses and Credit Cards

14. Shadowcrew.com

15. Hierarchical Structure

16. Control over Shadowcrew USSS Newark FO Took Control of Site –Complete Monitoring of Content –Knowledge of Criminal Activity –Offering of Auxiliary Services Targeting of Highly Placed Members –Administrators –Reviewed Vendors –Other Key Criminals October 2004: Takedown

17. Takedown Summary (Nov 2004) Total Arrests: 28 –21 Arrests in USA –7 Foreign Arrests Total Search Warrants Executed: 27 More Than 100 Individual Computers Seized

18. Domestic Arrests (USA)

19. Foreign Targets/Arrests

21. Agenda Investigation of a Major Database Theft Investigation of a Secondary Market for Identity Information Complications in Online Investigations Conclusion

22. Hotmail SUBPOENA #1 IP Address Cable ISP SUBPOENA #2 Subscriber info and computer location Simple Example

23. Blocks in the Road Record Retention Open WiFi networks Foreign hosts

24. IP Address from Hotmail Hotmail WiFi CLIENTS 192.168.0.1 192.168.0.2 192.168.0.3 Broadband Modem 192.168.0.1 68.42.205.94 Subject’s House

25. Solution:  Use a Pen Trap order to get IP data  Start at physical location of the IP address  Follow the WiFi signal to subject’s location

26. Agenda Investigation of a Major Database Theft Investigation of a Secondary Market for Identity Information Complications in Online Investigations Conclusion

27. ID Theft is a exploding problem Federal investigators alone can’t handle the problem There is a need for more training President’s ID Theft Task Force Report (forthcoming)

28. Questions? Richard W. Downing Assistant Deputy Chief 202.514.1026 richard.downing@usdoj.gov