1. Forensic and Investigative Accounting
Chapter 15
Cybercrime Management:
Legal Issues
© 2017 CCH Incorporated and its affiliates. All rights reserved.
2700 Lake Cook Road
Riverwoods, IL 60015
CCHGroup.com

2. Forensic and Investigative Accounting
Net Frauds
Net frauds ensnare unsuspecting Internet users into giving up their resources to an online criminal.
Chapter 15
Forensic and Investigative Accounting

3. Unauthorized Access to Network Assets
Unauthorized access to steal proprietary information can be considered a distinct crime from fraud.
Chapter 15
Forensic and Investigative Accounting

4. Types of Unauthorized Access
Access via buggy software. (No updating)
Access via trusted server. (Zone transfers)
Backdoor entry. (Malware on a port)
Access via social engineering. (Talk the talk
Password hacks. (Reverse engineering)
Faked s (Spoofing)
Chapter 15
Forensic and Investigative Accounting

5. Forensic and Investigative Accounting
Nmap for Access
Nmap is a port scanning tool that can be used to gain unauthorized access to a webserver. It is freely available on the Internet, and it is used to scan ports to determine what software is used on those ports. It can identify the versions of most port software. Once the version is identified, it is possible to find an exploit and gain unauthorized access to the server.
Chapter 15
Forensic and Investigative Accounting

6. Forensic and Investigative Accounting
Intangible Assets
Information on the Internet and in computer databases represents intangible assets composed of bits and bytes.
The destruction of electronic representations or the erasure of data without physically damaging a tangible computer asset may not be considered a crime.
(continued on next slide)
Chapter 15
Forensic and Investigative Accounting

7. Forensic and Investigative Accounting
Intangible Assets
If data is accessed but not used for any purpose, then no crime may have been committed.
Statutes may not provide for the recognition of criminal trespass, a property crime, based on a virtual presence (and no physical presence).
Chapter 15
Forensic and Investigative Accounting

8. 1986 OECD Time Capsule Recommendations
The input, alteration, erasure and/or suppression of computer data and/or computer programmes made willfully with the intent to commit an illegal transfer of funds or of another thing of value;
The input, alteration, erasure and/or suppression of computer data and/or computer programmes made willfully with the intent to commit a forgery;
(continued on next slide)
Chapter 15
Forensic and Investigative Accounting

9. 1986 OECD Time Capsule Recommendations
The input, alteration, erasure and/or suppression of computer data and/or computer programmes, or other interference with computer systems, made willfully with the intent to hinder the functioning of a computer and/or telecommunication system;
The infringement of the exclusive right of the owner of a protected computer programme with the intent to exploit commercially the programme and put it on the market;
(continued on next slide)
Chapter 15
Forensic and Investigative Accounting

10. 1986 OECD Time Capsule Recommendations
The access to or the interception of a computer and/or telecommunication system made knowingly and without the authorization of the person responsible for the system, either (i) by infringement of security measures or (ii) for other dishonest or harmful intentions.
Chapter 15
Forensic and Investigative Accounting

11. Forensic and Investigative Accounting
Cybercrime or Not?
Spoofing.
Use of bots.
Chaffing.
Steganography.
Chapter 15
Forensic and Investigative Accounting

12. Forensic and Investigative Accounting
Encryption
Take plaintext and use an algorithm convert it to an unreadable file
The unreadable file can only be decrypted with a key or password
One of the best methods for protecting against unauthorized users gaining access to private files
Chapter 15
Forensic and Investigative Accounting

13. Forensic and Investigative Accounting
International Law
Although approximately 240 countries have IP domain registrations, the countries with cybercrime statutes are fewer.
Some countries have broad provisions for computer crimes, some have limited provisions, and still some have no provisions at all.
(continued on next slide)
Chapter 15
Forensic and Investigative Accounting

14. Forensic and Investigative Accounting
International Law
In 2001, the Council of Europe Convention on Cybercrime issued a model law for its member states including transactional cooperation recommendations.
The Council’s model law has 48 sections for incorporation into national laws on cybercrime.
At least 57 countries have ratified.
Chapter 15
Forensic and Investigative Accounting

15. Federal Statutes Related to Cybercrimes
18 U.S.C. 1029
Fraud and Related Activity in Connection with Access Devices
18 U.S.C. 1030
Fraud and Related Activity in Connection with Computers
18 U.S.C. 2701
Unlawful Access to Stored Communications
Chapter 15
Forensic and Investigative Accounting

16. Forensic and Investigative Accounting
USA Patriot Act of 2001
The USA Patriot Act has strengthened U.S. cyber laws and expanded cybercrime definitions.
Under the Act, an activity covered by the law is considered a crime if it causes a loss exceeding $5,000, impairment of medical records, harm to a person, or threat to public safety.
(continued on next slide)
Chapter 15
Forensic and Investigative Accounting

17. Forensic and Investigative Accounting
USA Patriot Act of 2001
Amendments made by the Act make it easier for an Internet service provider (ISP) to make disclosures about unlawful customer actions without the threat of civil liability to the ISP.
Another revision made by the Act provides that victims of hackers can request law enforcement help in monitoring trespassers on their computer systems.
Chapter 15
Forensic and Investigative Accounting

18. Unenacted Legislation: Cybersecurity Act of 2009
Still important because has set the stage for:
-- Allowing the President power to shut down the Internet in case of a national emergency.
-- Setting national standards for cybersecurity and qualifications for cybersecurity professionals.
Chapter 15
Forensic and Investigative Accounting

19. Cybersecurity Information Sharing Act of 2015
Allows companies to share information about cyberthreats with the government and others.
Creates a system for federal agencies to receive thread information from private companies.
Contains provisions to prevent the act of sharing data known to be identifiable and irrelevant to cybercrimes.
Chapter 15
Forensic and Investigative Accounting

20. Forensic and Investigative Accounting
State Legislation
Many of the states have separately enacted money laundering, identity theft, online gambling, cyberstalking and other Internet statutes in their codes.
Many statutes do not refer to “cybercrimes” as they were originally enacted when there was no Internet. Thus, legislative oversight in the acts tends to focus on “computer crimes,” “unlawful access,” or “property crimes.”
Chapter 15
Forensic and Investigative Accounting

21. Forensic and Investigative Accounting
Fighting Cybercrime
The following list describes the skill set needed to fight cybercrime:
Ability to build an Internet audit trail.
Skills needed to collect “usable” courtroom electronic evidence.
Ability to trace an unauthorized system user.
(continued on next slide)
Chapter 15
Forensic and Investigative Accounting

22. Forensic and Investigative Accounting
Fighting Cybercrime
Knowledge base to use in recommending or reviewing security policies.
Knowledge of the most recent computer fraud techniques.
Basic understanding of the information that can be collected from various computer logs.
Ability to place a valuation on incurred losses from attacks.
(continued on next slide)
Chapter 15
Forensic and Investigative Accounting

23. Forensic and Investigative Accounting
Fighting Cybercrime
Technical familiarity with the Internet, web servers, firewalls, attack methodologies, security procedures, and penetration testing.
Understanding of organizational and legal protocols in incident handling to prevent employee rights violations.
An established relationship with law enforcement agencies.
Chapter 15
Forensic and Investigative Accounting

24. Some KSAs for Fighting Cybercrime
Ability to build an Internet audit trail.
Skills needed to collect “usable” courtroom electronic evidence.
Knowledge base to use in recommending or reviewing Internet security policies.
Ability to place a valuation on any incurred losses from attacks.
Technical familiarity with the Internet, web servers, firewalls, and general attack methodologies
Chapter 15
Forensic and Investigative Accounting

25. Filing Reports of Cybercrimes
An investigator should know where, besides local law enforcement, such crimes can be reported. There are a number of websites that collect information about events that may be cybercrimes.
Chapter 15
Forensic and Investigative Accounting