0% found this document useful (0 votes)

1K views518 pages

Untitled

Uploaded by

vu psy

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

0% found this document useful (0 votes)

1K views518 pages

Untitled

Uploaded by

vu psy

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

You are on page 1/ 518

Cybercrime

Cybercrime
An Encyclopedia of Digital Crime

NANCY E. MARION AND JASON TWEDE

All rights reserved. No part of this publication may be reproduced, stored in a

retrieval system, or transmitted, in any form or by any means, electronic, mechanical,
photocopying, recording, or otherwise, except for the inclusion of brief quotations in a
review, without prior permission in writing from the publisher.

Library of Congress Cataloging-in-Publication Data

Names: Marion, Nancy E., author. | Twede, Jason, author.
Title: Cybercrime : an encyclopedia of digital crime / Nancy E. Marion and
Jason Twede.
Description: First Edition. | Santa Barbara : ABC-CLIO, 2020. | Includes
bibliographical references and index.
Identifiers: LCCN 2019056395 (print) | LCCN 2019056396 (ebook) | ISBN
9781440857348 (hardcover) | ISBN 9781440857355 (ebook)
Subjects: LCSH: Computer crimes. | Computer crimes—Prevention.
Classification: LCC HV6773 .M372 2020 (print) | LCC HV6773 (ebook) | DDC
364.16/803—dc23
LC record available at https://lccn.loc.gov/2019056395
LC ebook record available at https://lccn.loc.gov/2019056396

ISBN: 978-1-4408-5734-8 (print)

978-1-4408-5735-5 (ebook)

24 23 22 21 20 1 2 3 4 5

This book is also available as an eBook.

ABC-CLIO
An Imprint of ABC-CLIO, LLC

ABC-CLIO, LLC
147 Castilian Drive
Santa Barbara, California 93117
www.abc-clio.com

This book is printed on acid-free paper

Manufactured in the United States of America

Contents

List of Entries vii

Introduction xi
Chronology xvii
A–Z Entries 1
Bibliography 459
Index 465
List of Entries

Abandonware Costs of Cybercrime

Abene, Mark Council of Europe Cybercrime Convention
Advanced Persistent Threats Cracker and Cracking
Advanced Research Projects Agency Craigslist Killers
Network Credit Card Fraud
Adware Cryptocurrency
Anonymous Cryptography
Ashley Madison Breach Cyberbullying
Assange, Julian Cybersecurity
Auernheimer, Andrew Alan Escher Cybersecurity Act of 2012
Awareness Cybersecurity and Infrastructure Security
Agency (CISA)
Backdoor Cybersecurity Enhancement Act of 2014
Banking Attacks Cybersecurity Workforce Assessment Act of
Biometrics 2015
Bitcoin Cybersquatting
Black-Hat Hackers Cyberstalking
Blankenship, Loyd Cyber-Surveillance Malware
Bots and Botnets Cyberterrorism
Bypass Cyberwarfare

Calce, Michael Dark Web

CAN-SPAM Act of 2003 Data Leakage
Capital One Breach Data Sovereignty
Carberp DEF CON
Center for Internet Security Denial-of-Service Attack (DoS)
Chaney, Christopher Department of Defense, Attacks on
Chaos Computer Club Digital Currency
Child Pornography Digital Millennium Copyright Act
China Digital Rights Management
Cleary, Ryan Digital Signatures
Code Red Distributed Denial-of-Service Attack (DDoS)
Comprehensive National Cybersecurity Domain Name System Cache Poisoning
Initiative Doxing
Computer Fraud and Abuse Act of 1986 Draper, John
Continuous Diagnostics and Mitigation Dread Pirate Roberts (Ulbricht, Ross;
(CDM) 1984–)
Copyright Infringement Dreamboard
Corporate Account Takeover Drink or Die
viii List of Entries

Drug Trafficking Lloyd, Timothy

Dumpster Diving Logic Bomb
LulzSec
Economy, Effects on
Einstein Malware
Electronic Frontier Foundation Manning, Chelsea
E-mail Bomb Masters of Deception
E-mail-related Crimes Melissa Worm
Encryption Mitnick, Kevin
End User License Agreement Money Laundering
Engressia, Josef Carl, Jr. Morris, Robert Tappan
Entertainment, Effects on Motives
Equifax Breach MPack
Ethics
European Cybercrime Center Nakamoto, Satoshi
Exploit Kit National Cyber Investigative Joint Task
Force
Federal Bureau of Investigation National Cybersecurity Alliance
Federal Information Security Management National Cybersecurity and Critical Infra-
Act of 2002 structure Protection Act of 2013
Financial Crimes National Institute of Standards and Tech-
Firewall nology Cybersecurity Framework
Florida Computer Crime Act of 1978 News Corp Hacking
414s Nimda
Fraud North Korea

Gambling Open-Source
GameOver Zeus Botnet Operation Apothecary
globalHell (gH) Operation Aurora
Operation Innocent Images
Hacker and Hacking Operation Marco Polo
Hacktivism Operation Olympic Games
Hate Crime Operation Phish Phry
Health Care, Effects on Operation Shrouded Horizon
Hijacking
Password
Identity Theft Payload
ILOVEYOU Virus Pen Register
Immigration and Customs Enforcement People’s Liberation Army Unit 61398
Insurance Personal Data Notification and Protection
International Issues Act of 2017
Interpol Personally Identifying Information
Pharming
Keystroke Monitoring Phishing
Phreaker
Legion of Doom Piggybacking
Legislation Pile, Christopher
Levin, Vladimir Plankton
Lizard Squad Pokémon Go
List of Entries ix

Political Uses Superzapping

Poulsen, Kevin Swartz, Aaron
President and Cybercrime Swatting
Pretty Good Privacy Symantec
Prevention Syrian Electronic Army
Prism
Privacy TeaMpoisoN
Profits from Cybercrime Tools
Public Domain Tor (The Onion Router)
Punishment Trojan Horse

Ransomware Uber Hack

Reputation, Effects on Union Dime Savings Bank Theft
Revenge Porn United Loan Gunmen
Rootkit United States Cyber Command
Russia Unlimited Operation
Russian Business Network U.S. Presidential Election Interference,
2016
Scavenging
Secret Service Vandalism
Sexting Victims of Cybercrime
Silk Road Virtual Private Network
Simulation Virus
Skimmer Vulnerability
Smart Card
Sniffer War Dialer
Snowden, Edward Wardriving
Social Engineering Welchia Worm
Social Media White-Hat Hackers
Sony Pictures Entertainment Hack WikiLeaks
Spam Women, Effects on
Spoofing Worm
Spyware
State Actor Youth and Cybercrime
Storm Botnet
Supervisory Control and Data Acquisition Zero-Day Attacks
Introduction

There is no single, conclusive definition of the term “cybercrime”; however, it has

become an umbrella term that refers to a wide range of offenses and behaviors.
Other terms that are also used are computer crime, computer-related crime, vir-
tual crime, digital crime, e-crime, high-tech crime, electronic crime, cyber-enabled
crime, or even online offending. In general, it refers to any criminal offenses that
are committed or aided by use of the internet. It is difficult to provide an exact
definition of cybercrime because it is always changing and evolving as technology
advances and becomes more sophisticated.
Some define cybercrime as any crime that involves a computer or a network.
Sometimes the computers are used to commit the crime, but other times they
are the target of the crime. According to the U.S. Department of Justice, the term
“cybercrime” refers to any illegal activity for which a computer is used as its pri-
mary means of commission, transmission, or storage.
Some definitions of the term make a distinction between cybercrime and
computer crimes. Those who make this difference describe cybercrime as those
offenses in which the offender obtains special of cyberspace and relies on that
knowledge to carry out a criminal offense. This would happen, for example, if
a person hacked into another person’s account and accessed private photos of
them and then uploaded the photos to social media. On the other hand, computer
crimes can be thought of as those times when an offender uses special knowledge
about computer technology to commit a crime. An example is when a person uses
a computer to download confidential information onto a zip drive and removes
it from that source. They are using a computer to commit a crime—but not the
internet. In short, one offender relies on the larger concept of cyberspace whereas
the other relies on the more hands-on offenses committed by the use of tangible
items (software or computer equipment) (Holt, Burruss, and Bossler, 2015, p. 7).
There are other distinctive definitions of specific cybercrimes. One of those is
a computer-assisted crime, such as child pornography. Here, the offender uses
the computer to commit the crime. They will use the computer to create the ille-
gal material (virtual pornography) and then to distribute it. A computer-focused
offense is one in which the computer is an essential part of the offense, such as hack-
ing into an account. This offense could not be carried out without the computer.
Wall (2001) recognizes four categories of cybercrime. The first is cybertres-
pass, which he defines as those times when an offender crosses the undefined or
invisible but often recognized lines of ownership in an online environment. This
occurs when hackers steal passwords and obtain access to resources for their own
xii Introduction

benefit. They have used the online environment (the internet) to steal something
that belongs to another person. The second category includes cyberdeception and
cybertheft. This involves the use of computers to steal money from bank accounts
or to illegally access intellectual property or copyrighted material (music, movies,
books, software) from another person. This is also referred to as piracy. Cyberde-
ception occurs through phishing, when a cybercriminal sends a sham e-mail to a
victim asking for bank account information. Because the e-mail appears to be real,
the victim provides the information. The stolen information can be used by the
offender to steal money, or it can be sold to other offenders.
The third category of cybercrime, according to Wall, is cyberpornography and
obscenity. Internet and computer technology allow pedophiles to create and trade
graphic pictures or meet victims. The final category of cybercrime is cyberviolence,
which is hurtful or dangerous behavior committed online. Computers give offend-
ers the ability to create and distribute threatening and hurtful information about
others. Examples of these offenses include cyberharassment, cyberstalking, and
cyberbullying.
It is difficult to list all of the cybercrimes that exist, as there are many different
kinds of cybercrimes. Many cybercrimes were considered to be criminal offenses
prior to the evolution of the internet (e.g., bullying, child pornography, or theft)
but have evolved into a cybercrime; others are new offenses that did not exist
before (e.g., hacking or sexting). Below is a partial list of offenses that are often
committed in cyberspace or by use of a computer.

(a) Ransomware: Malware used by offenders to lock digital files of another per-
son or company until money or other form of ransom is paid to the offender.
(b) Phishing: A way for criminals to obtain private information from a victim
by sending an e-mail that appears to be from a legitimate organization. The
e-mail often uses letterhead from the agency or a logo from the company to
make it look real. The message indicates that an account or password needs
to be updated. The victim is tricked into providing that information to the
offender, who then uses it to steal the victim’s money or sells the informa-
tion to another offender.
(c) Identity theft: A criminal obtains a victim’s personal information (possibly
through phishing) and uses that to commit theft or fraud offenses, open
fake credit card accounts, or get bank loans. They use a victim’s name, birth-
day, social security number, driver’s license number, or passport informa-
tion. A victim of identity theft can suffer extreme and long-lasting financial
harm. This offense is not punishable under the federal Identity Theft and
Assumption Deterrence Act of 1998, which “makes it a federal offense to
possess, transfer or use a means of identification of another person without
authorization with the intent to commit or aid in the commission of illegal
activity at the local, state or federal level.”
(d) Online child predators (child pornography): This offense has been defined
as “the sexual or sexualized physical abuse of children under 16 years
of age or who appear to be less than 16 that would offend a reasonable
Introduction xiii

adult” (Krone, 2004, p. 1). Images of child pornography show children

participating in sexual acts. Children who are forced into participating in
the acts suffer trauma and are often permanently injured, both physically
and emotionally. The production and consumption of child pornography
are both illegal acts, regardless of whether the computer is involved. The
internet allows people to access child pornography for free, but there are
multiple sites on the dark web that make these images readily available. It is
estimated that there are 20,000 images of child pornography added to the
internet each week (Pittaro, 2008). Because of the sheer amount of child
pornography available on the internet, law enforcement has a difficult time
tracking users. It is easy for offenders to skirt the law and get away with this
offense.
(e) Viruses: A form of malware, viruses are computer programs that a user
unknowingly uploads onto their computer when they open an infected
e-mail or attachment, or when they visit a particular website. The virus
is uploaded onto the computer, giving the offender access to the files on
that machine. The virus allows the offender to steal data, destroy data, or
access personal information. It will then replicate itself onto other comput-
ers through e-mails.
(f) Denial-of-service attacks (DoS attacks): These attacks are carried out by
cybercriminals who block or prevent a legitimate user from using a website.
Offenders are able to flood a computer network with enough traffic that the
site crashes, shutting it down to other users. This type of attack can result
in significant losses to the company as they must spend time and resources
to get their site working once again. A similar attack is a distributed denial-
of-service attack (DDoS) that occurs when a site is overwhelmed by botnets
(a group of infected computers and networks) that overwhelm a targeted
website with requests and render the site or servers unavailable to users.
(g) Malware: This term is a combination of the words “malicious” and “soft-
ware.” It refers to any software that has the intent of harming networks or
devices or giving an offender unauthorized access to computers or networks
belonging to another person or organization. It is usually uploaded onto a
victim’s computer or network without their knowledge and may remain
there for an extended time. Types of malware include viruses, spyware,
worms, ransomware, adware, and Trojan horses.
(h) Cyberbullying: This occurs when a person harasses or teases another person,
usually a teenager, through social media. It can be relentless and extremely
harmful, and it has led some victims to commit suicide. When this behavior
is directed toward an adult, it is called cyberharassment.
(i) Cyberterrorism: According to the FBI, cyberterrorism involves crimes of ter-
rorism that occur electronically or through the use of the internet. They can
be directed against individuals, businesses, agencies, and the government.
It can be acts on the internet that are meant to threaten or extort others,
often politically motivated. If an attack is carried out, it can cause disruption
of services that may be harmful or even cause death.
xiv Introduction

(j) Hacking: Illegally breaching security or gaining access to a computer system

by an offender who is called a hacker. Some hackers intend to do harm,
either by stealing money or information, whereas others hack into a system
as a way to uncover unknown weaknesses or vulnerabilities in software.
(k) Piracy: The unauthorized copy and distribution of movies, music, or other
copyrighted property without permission of the owner or creator. This can
happen when a person downloads a program, video game, or a song with-
out paying for it.
(l) Spyware: A type of malware that can be secretly installed in a victim’s com-
puter to allow an offender to steal a victim’s information. An offender is able
to steal passwords, e-mails, and credit card information without the victim
knowing.
(m) Nigerian e-mail schemes: These are also known as advance fee e-mail
schemes. Here, the victim receives an e-mail pleading for money to be sent
somewhere, with promises that more money will be provided in the future.
They often appear to be from an official or member of royalty who needs
help to leave their country. The offender will request the bank account
number where the promised money can be sent. The scams often originate
in Nigeria but are also called 419 scams after the Nigerian statute that bans
this kind of communication.
(n) Work-at-home schemes: These often involve job solicitations where the vic-
tim is given the chance to work at home completing menial tasks (stuffing
envelopes) and earn a significant income for only a few hours of work each
day. The victim is required to pay up-front for training materials or supplies,
but materials are never sent.
(o) Romance schemes: A victim meets their perfect romantic partner through
an online dating site. The offender will ask for money to travel and meet
their new soul mate, to pay get out of legal trouble, or to pay off debts. They
may initially ask for a small amount, but then it increases over time. Vic-
tims have paid tens of thousands of dollars before realizing their new mate
doesn’t exist.

However you define it, cybercrime costs billions of dollars to companies, gov-
ernments, and individuals in financial losses of information and trade secrets.
Losses are also due to repairs to systems that are damaged or harmed as the result
of a cyberattack. Individuals, governments, and agencies must also spend billions
in prevention of a possible attack.
Cybercrime poses a threat to our country’s national security and infrastructure.
Other governments and terrorist organizations have threatened to attack the infra-
structure of the United States (power grids and financial institutions). The U.S.
government spends billions of dollars each year to thwart possible attacks on its
agencies, as well as to keep citizens safe. It is an ongoing process that must evolve
as threats evolve.
Cybercrime is difficult to combat for many reasons. One is that cybercriminals
do not respect physical boundaries. The internet is a global phenomenon that
Introduction xv

crosses borders, and so is cybercrime. This makes it difficult for law enforcement to
track. It is difficult to know who the offender is or where that person is physically
located. Investigating cybercrime requires offices to have knowledge of technical
forensic methods, which few do. To effectively battle cybercriminals, there must be
cooperation on an international level. Interpol currently helps to fight cybercrime,
but more needs to be done. Because it is so tough to track, there is a relatively low
risk of detection and prosecution to offenders.
In the United States, the Federal Bureau of Investigation (FBI) is the primary
federal agency that has the responsibility to investigate any threat of, or actual
events of, cybercrime. They have a cyber division that coordinates the nation’s
attack on cybercrime. Each field office has a cyber squad comprising specially
trained agents who work to protect against crimes and also to react to attacks.
The FBI has formed cyber action teams that respond worldwide to an attack to
gather intelligence and work to identify the crime and criminals. The FBI has cre-
ated 93 computer crimes task forces that work with state and local experts in the
fight against cybercrime. They also partner with other federal agencies, including
the Department of Defense, Department of Homeland Security, and others. The
FBI’s Internet Crime Complaint Center gives the public a way to report acts of
cybercrime.
Cybercrimes such as these are often committed by criminals who are seeking
to profit from their crimes. They hack into an account to get money, or use ran-
somware for the same reason. Cybercrimes are committed by terrorists who are
seeking to intimidate others, or even to profit from their crimes. Hackers some-
times commit cybercrimes just for the challenge, or to see if they can break into a
system. The internet gives offenders the chance to harm many people at one time,
something that might not be possible without using a computer. There is a large
pool of victims available to the offender. It is also an inexpensive way to commit a
crime. In some cases, all it takes to scam a victim is to send an e-mail. There is a
large amount of malware that offenders can purchase that allows them to carry out
an attack even though they have no expertise in writing software.
Cybercrimes are growing as more people have access to computers and rely on
them for daily tasks such as shopping, banking, and communicating with each
other. The true range of cybercrime is unknown, as many people do not report
when they have been a victim, or they may not even know that they have been
attacked. Businesses may not want to make it known to their customers that they
have been the victim of a cybercrime and risk harming their reputation. Threats
to mobile devices are also on the rise as people use them as computers, keeping
personal information, contacts and calendars on them. Both individuals and com-
panies need to become more aware of how to protect themselves from cybercrime.
It can be as simple as purchasing programs that will protect against viruses and
malware—or using passwords that are difficult to hack. Teaching employees and
individuals to recognize fake e-mails is also critical, so they do not fall prey to
cybercriminals who only want to have access to bank accounts.

Nancy E. Marion
xvi Introduction

Further Reading
Clough, Jonathan. 2015. Principles of cybercrime. Cambridge, UK: Cambridge University
Press.
Federal Bureau of Investigation, Internet Crime Complaint Center (IC3). https://www.ic3
.gov
Finch, Emily. 2007. “The problem of stolen identity and the internet.” In Crime online,
edited by Yvonne Jewkes. Devon, UK: Willan Publishing, pp. 29–43.
Gillespie, Alisdair A. 2016. Cybercrime: Key issues and debates. New York: Routledge.
Holt, Thomas J., George W. Burruss, and Adam M. Bossler. 2015. Policing cybercrime and
cyberterror. Durham, NC: Carolina Academic Press.
Hutchings, Alice, and Yi Ting Chua. 2017. “Gendering cybercrime.” In Cybercrime through
an interdisciplinary lens, edited by Thomas J. Holt. New York: Routledge, pp. 167–188.
Krone, T. 2004. “A typology and online child pornography offending.” Trends and Issues in
Crime and Criminal Justice 279: 2–6.
Lininger, Rachael, and Russell Dean Vines. 2005. Phishing. Indianapolis, IN: Wiley
Publishing.
Pittaro, M. 2008. “Sexual addiction to the internet: From curiosity to compulsive behav-
ior.” In Crimes of the internet, edited by F. Schmalleger and M. Pittaro. Upper Saddle
River, NJ: Pearson Education, Inc., pp. 134–150.
Wall, D. S. 2001. “Cybercrimes and the internet.” In Crime and the internet, edited by
D. S. Wall. New York: Routledge, pp. 1–17.
Chronology

May 29, 1864 Dentist Messrs Gabriel sends an unsolicited telegraph for
his dentistry to British politicians, advertising his hours of
operation. This is seen as the first example of spam.
June 4, 1903 Nevil Maskelyne, a magician and inventor, disrupts the
public demonstration of Guglielmo Marconi’s wireless
telegraphy technology to the Royal Institution in London
by John Ambrose Fleming. Marconi claimed the wireless
telegraph technology was secure. Maskelyne was able to
break into the supposedly secure system and sent trolling
Morse Code messages over the line during the presentation.
This is viewed as the first instance of hacking.
July 26, 1908 The FBI (originally known as just the Bureau of
Investigation) is created.
April 5, 1955 The minutes of a meeting of the Tech Model Railroad Club
at the Massachusetts Institute of Technology (MIT) use
the term “hacking” in reference to those experimenting or
otherwise goofing around with technology. This is the first
known recorded instance of the term “hacking” being used
in this fashion.
1957 Josef Engressia (also known as Joybubbles), a seven-year-old
boy who is blind, discovers that if he whistles a specific
note (the fourth E above middle C), he is able to access the
telephone system of AT&T. This discovery paves the way
for phreaking.
November 20, The Tech, the student newspaper at the Massachusetts
1963 Institute of Technology (MIT), uses the term “hacker” in
reference to students who were disrupting phone services
at the school and avoiding long-distance phone charges, in
some instances routing charges to a third party. This is the
first known recorded instance of the term “hacker” being
used pejoratively to refer to those who use technology in an
unauthorized manner with apparent malicious intent.
xviii Chronology

November 15, Josef Engressia (also known as Joybubbles) is suspended

1968 from the University of South Florida for obtaining free
phone calls for classmates by whistling a specific tone at
different intervals into the phone. The suspension was later
rescinded, and he was placed on probation at the school.
October 1, 1971 Esquire magazine publishes an article about blue box phone
phreaking. The article features John Draper (also known
as Captain Crunch) and Josef Engressia (also known as
Joybubbles). Draper is only referred to by his alias in the
article.
1971 The Creeper virus spreads through ARPANET, the precursor
of the internet. The Creeper virus is generally regarded as
the first computer virus.
June, 1974 The term “Trojan horse” is first used in a vulnerability
analysis report published by the U.S. Air Force.
May 1, 1978 Gary Thuerk sends several hundred unsolicited
advertisements to recipients via ARPANET, a computer
network used by the U.S. military that predated the
internet. This is regarded as the first instance of modern
spam.
1978 The Florida legislature passes the Florida Computer Crime
Act, one of the first laws to establish parameters that
defined computer crimes.
1979 Kevin Mitnick hacks into his first computer system, the Ark.
1981 Ian Murphy, AKA Captain Zap, is able to break into the
computer system of AT&T and change the internal clock.
This allows callers to receive the “late-night” discount rate
in the middle of the day. Murphy becomes the first person
ever convicted of a computer crime.
1981 The movie Sneakers is released, based on Captain Zap’s
hacking experiences.
1981 The Chaos Computer Club forms in Germany.
1982 The hacking group 414s is formed in Milwaukee,
Wisconsin, naming themselves after the city’s telephone area
code. The members are able to access the nuclear weapons
laboratory of the Los Alamos National Laboratory and the
Sloan-Kettering Cancer Center in New York, among other
high-profile sites.
1983 The movie War Games is released. The movie introduces
the concept of hacking and shows the public the potential
dangers of hacking.
Chronology xix

1983 Members of a hacking group, the 414s, break into 60

computer systems at various institutions, including Sloan-
Kettering Cancer Center and the Los Alamos National
Laboratory. The incident made people aware of the dangers
of hacking. The U.S. House of Representatives holds
hearings on computer security and passed several new laws
to deter hacking.
February 1983 The group KILOBAUD is formed, motivating other groups
to form.
1984 The hacking group Legions of Doom is formed by a hacker
known as Lex Luthor.
1984 Cult of the Dead Cow forms in Lubbock, Texas.
1984 The hacker magazine 2600 is published for the first time.
It is known for articles that describe tips on hacking and
phone phreaking.
1984 The Chaos Computer Club organizes the Chaos
Communication Congress, an annual hacker conference.
1985 First issue of Phrack is published. It becomes the magazine
for underground hackers.
1986 The U.S. Congress passes the Federal Computer Fraud
and Abuse Act that makes it a crime to break into federal
computers.
1986 Pakistani Brain, the oldest known and recognized virus, is
discovered to infect IBM Computers.
1986 The hacker known as “The Mentor” is arrested and
composes the Hacker’s Manifesto in the magazine Phrak.
1987 The Jerusalem Virus that infected on Friday the 13th is
discovered. It was one of the first file-infecting viruses.
1987 The Christmas Tree EXEC “worm” causes major disruption
to the VNET, BITNET, and EARN networks.
1988 Robert Morris, a Graduate Student at Cornell University,
releases the Morris worm, the first internet worm that
spreads to 6,000 networked computers, shutting down the
internet. He is later convicted and sentenced to three years
of probation and fined $10,000.
1988 The First National Bank of Chicago is the victim of a
hacking that resulted in the theft of $70 million.
1988 The Computer Emergency Response Team (CERT) is
created by DARPA to focus on network security issues.
1988 Kevin Mitnick is sentenced to a year in jail for hacking the
network of the Digital Equipment Company.
xx Chronology

1989 The hacking magazine Phrak publishes a confidential

document from Bell South that was obtained illegally by
hackers.
1990 Hacker Kevin Poulsen is arrested after gaining access to
the telephone lines for a radio station in Los Angeles so he
could win a Porsche and other prizes.
1990 The war between rival hacking groups, Legion of Doom
(LOD) and Masters of Deception (MOD), begins.
1990 Operation Sundevil is completed by the Secret Service as
agents arrest hackers, including prominent members of the
Legion of Doom. The offices of Steve Jackson Games are
also part of the raid. The role-playing sourcebook GURPS
Cyberpunk is seized by law enforcement because, as they
describe, the book is a handbook for computer crime.
Hackers begin to inform on each other as a way to receive
lighter sentences.
1990 Birth of spam.
1990 The Electronic Frontier is founded.
1991 The virus called “Michelangelo” appears in computers. The
malware attacks PCs and is programmed to destroy hard
drives on Michelangelo’s birthday, March 6.
1991 Kevin Poulsen, also known as Dark Dante, is captured
by the FBI. He pleads guilty to charges of mail, wire, and
computer fraud and is sentenced to a term of 51 months in
prison and is also required to pay a fine of $56,000.
1991 Dark Avenger writes and releases MtE, malware that allows
other viruses to morph into an estimated four billion forms.
This makes both detection of the virus and its deletion more
difficult.
June 5, 1991 Philip Zimmermann releases Pretty Good Privacy (e-mail
encryption software). It is released as freeware.
1992 Dark Avenger writes and launches a virus called
Commander Bomber that is especially harmful because
it remains undetected in a computer’s memory and can
change form. Other malware released this year were
SatanBug and Monkey.
1992 The movie Sneakers is released. The primary characters in
the film are security experts who are tricked into stealing a
universal decoder to unlock encryption systems.
June 1993 First DEF CON hacker convention meets in Las Vegas,
Nevada. This becomes a yearly event attended by thousands
of people from around the world.
Chronology xxi

1993 The term “spam” is first associated with unsolicited

electronic communications. This was in response to
hundreds of copies of the same message being accidentally
posted to a website.
1994 The FBI launches Operation Innocent Images. FBI agents
pose undercover to investigate child pornographers and
pedophiles.
1994 Russian computer hacker Vladimir Levin, 30 years old, is
able to gain access into the computer system of Citibank.
He then transfers $10 million of other people’s money into
his personal account. Levin is later arrested in London and
charged with criminal offenses in the United States. He is
convicted and sentenced to three years in prison. Most of
the transferred money is eventually recovered.
1994 Mark Abene, also called “Phiber Optik,” is sent to jail for
tampering with telephone lines. Before being sent to prison,
he is a member of the hacker gang Masters of Deception.
Abene is later named one of New York City’s smartest
people.
1995 Hacker Kevin Mitnick is arrested and charged by the FBI
with stealing 20,000 credit card numbers.
1995 The movies THe Net and Hackers are released. THe Net is
about a computer analyst who is able to access classified
documents and becomes involved in a conspiracy. Hackers
is about high school students who become hackers.
1996 Computer malware called Concept is released. It was spread
through emails and affected both Macs and PCs.
1996 Hackers are able to access and alter the web sites belonging
to the U.S. Department of Justice, the CIA, and the U.S. Air
Force. This brings attention to the need for tighter security
for the internet.
1996 U.S. Congress passes the Computer Fraud and Abuse Act.
The law bans the dissemination of malware and trafficking
in computer passwords.
January 11, 1996 The investigation by the U.S. government into Philip
Zimmermann is closed without criminal charges being filed.
The government is investigating whether Zimmermann’s
distribution of encryption software Pretty Good Privacy
violated the law by being available in foreign countries.
1997 Six Degrees, the first social media platform, is launched.
1997 A 15-year-old boy living in Croatia is able to access the
computer system of the U.S. Air Force base in Guam.
xxii Chronology

1997 The interest group Recording Industry Association of

America begins to crack down on the practice of file sharing
and peer-to-peer networks.
October 28, 1998 The U.S. Digital Millennium Copyright Act is passed by the
U.S. Congress.
1998 Members of a LOpht, a “hacker think tank,” answers
questions in front of the U.S. Congress. They were invited
to speak in front of the Government Affairs Committee
about the need for stronger security for government sites.
1998 The hacking group Cult of the Dead Cow (cDc) develops a
Trojan horse they called Back Orifice.
1998 The websites of the U.S. military and Department of
Defense continues to be hacked. The New York Times is also
accessed by cyberoffenders.
1998 The National Infrastructure Protection Center is established
by Attorney General Janet Reno. The organization is given
the task of fighting cybercrime and possible sabotage of U.S.
businesses.
1998 A reporter for the Cincinnati Enquirer, Michael Gallagher,
is able to access the voice mail system at Chiquita Fruits.
Officials at the newspaper opt to publish illegal activities
carried out by employees of Chiquita.
1998 A cybercriminal uses social engineering to convince a staff
member at AOL to provide access to the ACLU’s website.
The offender wipes out all of the information on the site.
1999 President Bill Clinton announces that he will allocate
$1.46 billion to improve the nation’s cybersecurity. He
proposes an “intrusion detection” system to discover
cyberattacks.
1999 The hacking group Cult of the Dead Cow, cDc, releases the
second version of Back Orifice, BO2k. This version is more
powerful than the first and becomes popular among hackers.
1999 Hackers in Serbia and Kosovo attack each other through the
government’s websites.
1999 Two hackers from China access financial records for a bank
and transfer about $87,000 into their accounts. They are
later found guilty and sentenced to death.
1999 A number of well-known viruses are released this year. One is
the Melissa virus, which modifies a victim’s documents and/
or sent out confidential information, causing over $80 million
in damages. Another virus is Chernobyl, which can remain
undetected but, when activated, will erase data on a user’s
Chronology xxiii

hard drive. The virus Thursday applies itself on a specific

date chosen by the offender. When activated, this virus
releases all files. Bubble Boy is spread through e-mail
script, so it does not require a user to open an infected
attachment.
1999 The site for the U.S. White House is vandalized. Those
accessing the site see “Hacker wuz Here” in red graffiti.
1999 A black-hat hacking group called “phreak.nl” is able to
damage many high-profile websites such as NASA and the
National Defense University. The members explain that the
hacking was part of a game called “Hack the Planet.”
1999 Hacker Kevin Mitnick is found guilty and sentenced to
spend five years in prison. He had already spent four years
in custody prior to the trial, including eight months in
solitary confinement because officials thought he could
cause great harm to the nation by his hacking activities.
1999 Members of a hacking group called Level Seven Crew access
the website belonging to the U.S. Embassy in China and
place antigovernment statements on the site.
1999 Hacker Michael Calce, who went by the moniker Mafia Boy,
carries out attacks on Yahoo, Amazon, Dell, eBay, and CNN,
causing $1.7 billion in damages.
March 26, 1999 The Melissa virus is released by David Lee Smith.
It is one of the first viruses to utilize mass e-mailing to
spread.
April 1, 1999 David Lee Smith is arrested for releasing the Melissa virus.
November 29, The Anticybersquatting Consumer Protection Act takes
1999 effect in the United States.
May 8, 2000 The Internet Crime Complaint Center (originally known as
the Internet Fraud Complaint Center) is founded.
May 9, 2000 Timothy Lloyd is convicted for using malware to destroy
the manufacturing abilities of his former employer, Omega
Engineering Corporation. He uses a logic bomb to carry out
the crime.
2000 The Center for Internet Security is formed.
2000 The ILOVEYOU virus infects millions of computers around
the world quickly. It originates in the Philippines.
2000 Computer hacker Jonathan James is the first juvenile
sentenced to serve time in a facility for hacking.
December 3, 2001 In the wake of 9/11, the FBI announces the creation of a
cyber division.
xxiv Chronology

2001 The “Anna Kournikova” virus is launched. The e-mail

tempts people to open an attachment that has pictures of
the tennis player. When people open the attachment to view
the photos, the virus is attached.
2001 The Code Red worm is launched and infected thousands of
computers around the world.
February 26, Timothy Lloyd is sentenced to 41 months in prison for
2002 using malware to destroy the manufacturing abilities of his
former employer, Omega Engineering Corporation. His
conviction is set aside by the trial judge, though he was
ultimately reinstated by an appellate court.
September 20, The initial version of Tor (The Onion Router) is launched.
2002
2002 Bill Gates announces that he is increasing security for
Microsoft products.
2003 The hacking group Anonymous is formed.
2003 A piece of federal legislation, called the CAN-SPAM Act,
is passed by the U.S. Congress. The bill put limits on how
much unsolicited spam e-mail can be sent.
2003 Einstein is created by the Department of Homeland Security
to detect cyberattacks.
August 11, 2003 Blaster worm is released.
August 18, 2003 Welchia worm is released to combat the Blaster worm.
February 6, 2004 The first Safer Internet is celebrated. Fourteen countries are
involved in the celebration.
2006 Wikileaks is founded.
October 3, 2006 The first International Day against DRM is sponsored by the
Defective by Design organization.
2006 Operation Olympic Games/Stuxnet is announced.
2007 A spear phishing attack launched against the U.S. Secretary
of Defense allows cybercriminals to have access to sensitive
information. Officials decide to make significant changes to
secure their information.
2007 An “advanced persistent threat” attack, called Ghost Net,
is launched. Some allege the attack is carried out by the
People’s Republic of China.
January 21, 2008 The hacking group Anonymous launches Project Chanology
(or Operation Chanology), a protest movement against the
Church of Scientology. A few days later, on January 24,
members of Anonymous take the website Scientology.org
offline.
Chronology xxv

2008 Hackers from China report that they have accessed some of
the world’s most sensitive sites, including the Pentagon.
2008 The computer worm Koobface is detected.
2009 Bitcoin is created by Satoshi Nakamoto. Nakamoto sends
the first Bitcoins to Hal Finney.
2009 Phillip Markoff carries out the Craigslist killings, in which
he kills women he meets through the website.
2009 Over 100 people are charged in the United States and
around the globe in an investigation into cybercrimes
through Operation Phish Phry.
2009 Operation Aurora is launched to investigate cyberattacks
that are carried out to access sensitive and personal data.
January 25, 2010 Brian Mettenbrink, an engineering student and supporter of
Anonymous, pleads guilty to downloading LOIC to attack
Scientology. He is sentenced to one year in prison.
April 5, 2010 Wikileaks releases footage of U.S. military helicopters killing
several people in Iraq. Among those killed are journalists.
May 22, 2010 The first commercial Bitcoin takes place. Laszlo Hanyecz
of Florida pays 10,000 Bitcoins to an individual from the
United Kingdom for two pizzas from Papa John’s.
July 6, 2010 Private Chelsea Manning is charged with disclosing video
footage of U.S. military helicopters killing people in Iraq,
including journalists.
September 17, Anonymous attacks Aiplex Software after it admits to
2010 launching an attack on the Pirate Bay. Anonymous also
launches attacks on the Motion Picture Association of
America, Recording Industry Association of America, and
law firms that oppose internet piracy.
2010 The banking Trojan Carberp appears.
2010 Stuxnet worm, a cyberattack on Iran’s nuclear facilities
allegedly conducted by the U.S. and Israel, appears on the
internet.
December 2, 2010 PayPal announces that it will no longer fund WikiLeaks.
December 8, 2010 Julian Assange surrenders to law enforcement in the U.K. in
regard to a warrant for criminal charges out of Sweden.
December 8–9, Anonymous attacks PayPal for its opposition to WikiLeaks
2010 in Operation Avenge Assange, bringing down the site.
December 16, Julian Assange is given bail in the United Kingdom in the
2010 amount of £240,000. Supporters of Assange are able to
gather the full amount of bail, and Assange is released from
custody while his extradition case is pending.
xxvi Chronology

2010 Hacking group Goatse Security hacks into the computer

system belonging to AT&T and then uploads the names and
e-mail addresses of 114,000 iPad users.
2010 A form of malware called “Carberp” attacks online banking
and social media sites. Cybercriminals use it to steal
millions of dollars from banks in Russia.
2010 Sam Yin, a computer expert for Gucci, is fired from his job
and then accesses the company’s computer system to shut it
down for a day. After pleading guilty, he is sentenced to two
to six years in prison.
February 2011 Silk Road founded.
February 6, 2011 Anonymous allegedly steals thousands of corporate e-mails
from Aaron Burr’s e-mail account. They also take over his
Twitter account and deface his company’s website.
February 24, Anonymous conducts a live hack of a website of the
2011 Westboro Baptist Church.
April 1, 2011 Anonymous members initiate a DDoS attack on Sony
websites and Sony PlayStation, to the dismay of gamers.
April 7, 2011 Anonymous stops the attack on SONY because they do
not want to further disrupt the PlayStation network, but it
remains offline for the next few weeks.
April 23, 2011 One of the last known communications of Satoshi
Nakamoto—the creator of Bitcoin—is made to Bitcoin
developer Mike Hearn via e-mail. Nakamoto says, “I’ve
moved on to other things. It’s in good hands. . . .”
May 25, 2011 China announces the creation of a cyberdefense squad with
the People’s Liberation Army.
July 19, 2011 British police arrest a 16-year-old whom they claim is a
hacker with LulzSec known as Tflow.
July 27, 2011 Police arrest Jake Davis, whom they claim is Topiary in
LulzSec.
September 2, Police in Britain arrest Ryan Ackroyd, 24 years old, who was
2011 Kayla in LulzSec.
2011 The hacker group Lulz Security is formed by breaking away
from Anonymous.
2011 The website for the Bank of America is hacked and
information from an estimated 85,000 credit card numbers
and accounts are reportedly stolen.
2011 A hacking attack takes the PlayStation Network offline and
compromises credit card information and other personally
identifying information of 77 million customers.
Chronology xxvii

2011 The YouTube channel presenting Sesame Street, an

educational show for children, was hacked so that the
station showed pornographic images for almost 22 minutes.
2011 Christopher Chaney is arrested for hacking into the
e-mail accounts of celebrities, stealing photos and other
information and posting them online.
2011 Brian Rafferty and Richard Beasley kill men who applied for
a job posted on Craigslist.
June 19, 2012 Assange takes up residency at the Ecuadoran embassy.
August 16, 2012 Ecuador grants asylum to Assange amid concerns that his
extradition may result in the infringement of his human
rights.
November 2012 Andrew Auernheimer is found guilty of one count of
identity theft fraud and one count of conspiracy to access a
computer without authorization.
2012 Iranian hackers retaliate against Stuxnet by releasing
Shamoon, a virus that damages 35,000 Saudi AramCo
computers and stops the company for a week.
2012 Marriott is hacked by a New Age ideologist who was
resisting against the New World Order where he said that
corporations are controlling the world.
2012 The social networking website LinkedIn is hacked, and
passwords for nearly 6.5 million user accounts are stolen.
2012 Ryan Cleary, a member of LulzSec, is arrested for hacking
activities. He is able to access the websites of the CIA, the
Pentagon, SONY, Nintendo, the Westboro Baptist Church,
and many other companies. He is later sentenced to serve
32 months in prison.
2012 The U.S. Congress passes the Cybersecurity Act of 2012 to
enhance the security of the nation’s cyberstructure.
June 2013 Banking Trojan Carberp is leaked, leading to fears of
copycat offenses.
August 21, 2013 Chelsea Manning is sentenced for her convictions on
criminal charges stemming from her release of information
to WikiLeaks regarding the U.S. wars in Iraq and
Afghanistan. She receives a sentence of 35 years in prison.
October 2013 Silk Road shut down by the FBI.
2013 North Korea allegedly disrupts the financial institutions in
South Korea using a program called “DarkSeoul.”
2013 Twelve-year-old Rebecca Sedwick commits suicide after
being bullied on social media.
xxviii Chronology

2013 The European Cybercrime Center, or EC3, is formed

by Europol to increase law enforcement response to
cybercrime.
2013 The National Cybersecurity and Critical Infrastructure
Protection Act is passed by U.S. Congress and signed
into law.
2013 Sunil Tripathi, a student at Brown University, is wrongly
doxed as one of the suspects in the Boston Marathon
bombing.
February 25, Mt. Gox goes dark and declares bankruptcy shortly
2014 thereafter.
April 2014 Andrew Auernheimer is released from prison after serving
only 13 months.
May 19, 2014 The United States indicts five members of the People’s
Liberation Army Unit 61398—the cyberattack unit of the
Chinese military. This is the first time in the United States
that criminal charges are filed against state actors from
another country for cybercrime.
June 14, 2014 Tesla Motors releases its electric vehicle patents into the
public domain.
2014 The Bitcoin exchange Mt. Gox files for bankruptcy after
$460 million was apparently stolen by hackers due to
“weaknesses in their system,” and another $27.4 million
goes missing from its bank accounts.
2014 Sony Pictures is hacked by a group called the Guardians of
Peace.
2014 The computer system for the U.S. White House is hacked.
2014 The Cybersecurity Enhancement Act is passed by the U.S.
Congress. The law creates a partnership between public and
private agencies to increase cyber safety.
July 19, 2015 The Impact Team begins to publish sensitive information
from Ashley Madison, a website that offers hookup services
to members.
2015 The Ashley Madison website that encourages sexual
affairs by married individuals is hacked and the names of
customers are made public.
2015 Hackers gain access to the U.S. Office of Personnel
Management and view the personal records of 21.5 million
people, including their social security numbers, dates
of birth, addresses, fingerprints, and security clearance
information. The majority of the victims are employees of
the U.S. government.
Chronology xxix

2015 A law called the Cybersecurity Workforce Assessment Act

of 2015 is passed by the U.S. Congress. The goal of the
legislation is to provide education and training to employees
at the Department of Homeland Security to improve the
cybersecurity. Another goal is to increase collaboration
between federal agencies.
February 16, The FBI files a motion to compel Apple to assist them
2016 in bypassing the security measures on an Apple phone
belonging to one of the suspects in the San Bernardino
shooting.
March 28, 2016 The FBI asks that their motion to compel Apple be vacated
as the FBI is able to bypass the security measures on the
phone using a third party.
July 6, 2016 Pokémon Go—a game playable on mobile phones that
has players travel to physical locations to capture virtual
creatures known as Pokémon—is released in the United
States. The use of GPS by the game allows some criminals to
lay in wait at key physical locations and steal mobile phones
from victims who visit those locations.
December 2016 The first issue of Ledger—the first peer-reviewed academic
journal devoted to the field of cryptocurrencies—is
published.
2016 Wikileaks publishes documents leaked from the Democratic
National Committee.
January 17, 2017 President Barack Obama commutes the sentence of Chelsea
Manning, who had been sentenced to 35 years in federal
prison.
May 17, 2017 Chelsea Manning is released from custody at Fort
Leavenworth, Kansas.
2017 White supremacists march in Charlottesville, Virginia.
Several participants are doxed.
2017 CNN discovers the identity of a Reddit user who originally
created a meme of Donald Trump beating up a person
whose head had been replaced by the CNN logo. Though
CNN does not publish the user’s personal information,
CNN appears to threaten to release such information if the
user posts any offensive content in the future.
2017 The hacker group “The Dark Overlord” attempts to extort
officials at entertainment company Netflix and threaten to
post unreleased episodes of the Netflix show Orange Is the
New Black online. Netflix does not give in to the demand
and the episodes were posted.
xxx Chronology

May 12, 2017 The ransomware “WannaCry” is released, infecting an

estimated 230,000 computers around the world.
2017 The Equifax Breach is reported. The names, addresses,
birthdays, social security numbers, and other personal
information of 143 million Americans are possibly stolen by
cyber criminals.
2017 The Personal Data Notification and Protection Act of 2017
is passed by the U.S. Congress. It requires businesses and
organizations to notify customers or clients if their personal
information is hacked.
May 8, 2017 Apple removes digital rights management from its song
library on iTunes.
2017 Equifax breach occurs.
2017 Deloitte breach occurs.
April 11, 2019 Julian Assange is arrested in the United Kingdom for
skipping bail on an extradition hearing for rape charges out
of Sweden.
May 23, 2019 The United States returns a superseding indictment on
Julian Assange for his involvement, along with Chelsea
Manning, in disclosing classified documents from the U.S.
military regarding the wars in Iraq and Afghanistan.
A
A B A N D O N WA R E
Abandonware is software with intellectual property rights that have supposedly
been abandoned by the owner of those rights. It differs from freeware and share-
ware in that the intellectual property rights are not explicitly waived. In fact, with
abandonware, those rights are not necessarily waived at all. Rather, those rights are
simply (for the time being) not enforced by the rights holder.
A piece of software is generally deemed to be abandonware if the software is
several years old, is no longer commercially available, and is no longer supported
by the rights holder (Khong, 2005). However, this is not a valid assessment of the
software’s legal status. There is no legal recognition of abandonware. In the United
States, rights holders do not lose their rights through inaction. Indeed, there are
reasons why rights holders may not support a piece of software, yet would still
be interested in preventing unauthorized use of their abandoned software. Rights
holders may abandon a piece of software if they have developed an updated ver-
sion of that software (Khong, 2005). In such an instance, the unauthorized use of
the older version of the software arguably lessens the profitability of the updated
version of the software because those unauthorized users are less likely to purchase
the updated software. Enforcing their rights makes economic sense. Also, a rights
holder may temporarily make a piece of software unavailable for strategic commer-
cial purposes, the belief being that if a product is continuously available, the value
of that product drops (Khong, 2005). Unauthorized use of the software during this
period of unavailability clearly thwarts the economic goals of the rights holder, and
enforcement makes sense in this instance as well.
There are instances where a rights holder may truly abandon a piece of software
and have no intent to enforce those rights, such as where it is no longer economi-
cally viable to market and support a piece of software (Khong, 2005). In those
instances, there may be no repercussion for someone who infringes on those rights
(e.g., downloading the software without permission). However, this does not mean
that the action is legal. Indeed, anyone who downloads abandonware without the
permission of the rights holder runs the risk that the rights holder might ultimately
decide to enforce their rights, and those who have violated those rights could face
legal repercussion (Register of Copyrights, 2015, pp. 34–35).
Although unauthorized use of abandonware is not legal per se, in some instances
it might be considered an orphaned work. An orphaned work is one where the
rights holder is impossible to locate—not merely commercially unavailable and
unsupported. Any copyrightable work—not just software—with a rights holder
2 Abene, Mark

who is not locatable could be an orphaned work. Thus, pictures and documents
can also be orphaned works—both physical copies and digital copies. Deciding
how to handle orphaned works has become a pressing issue for governments in
the digital age.
The European Union allows certain institutions—such as libraries, museums,
or public broadcasting organizations—to reproduce and make available orphaned
works if that institution conducts a thorough search and cannot locate the rights
holder of a work. Canada permits citizens to apply for a conditional, nonexclusive
license to use an orphaned work. This also requires the applicant to show they
could not locate the rights holder after a thorough search. Japan has a system
similar to Canada’s, but it also requires applicants to deposit money that would
ultimately go to the rights holder should they ever be located (Register of Copy-
rights, 2015).
Presently, the United States does not have comprehensive legislation concern-
ing orphaned works. There is a provision of the Music Modernization Act (signed
into law on October 11, 2018) that permits citizens to apply for the right to use
orphaned works in limited circumstances. Specifically, use is only permitted for
sound recordings made before 1972—and when prospective users of the sound
recordings file notice with the copyright office that they intend to use the sound
recording for noncommercial purposes. Before prospective users are legally permit-
ted to use the sound recordings, they must wait 90 days to allow the rights holders
to come forward and establish that they are the owners of the sound recordings.
The instances in which the use of orphaned works are legally permitted are
severely limited. The likelihood of the use of abandonware by citizens being per-
mitted under these laws is low. Regulations appear to be aimed at allowing the use
of orphaned works for the public good (such as permitting libraries to archive the
works for public search) and noncommercial use. This would, for example, cer-
tainly exclude a citizen from downloading a free copy of an old video game that is
no longer commercially available or supported by the company that produced it.

Lawyer Media. He began working as a consultant on cybersecurity issues. Abene

and other former members of LOD created the security consulting firm Crossbar
Security, with Abene serving as company president. He also worked with Major
League Baseball to write encryption routines for their streaming service, MLBtv.
Abene has appeared in many major news and media outlets, including the New
York Times, Washington Post, Harper’s, Time Magazine, and CNN. His exploits were
detailed in the book Masters of Deception—The Gang That Ruled Cyberspace (1995).
He often speaks at hacker conferences and security conferences, and he also often
speaks to different groups about the need for increased computer security.

Most experts agree that it is extremely challenging for a company or organiza-

tion to protect against an APT attack. There are thousands of variations of threats
and attacks, so it is difficult to defend against all possibilities. Most offenders are
extremely skilled, so they are able to hide their attacks from the victim. There are
typically no warning signs or signals that an event is taking place, so they are dif-
ficult to detect. One suggestion to detect an APT is to look for an increase in the
number of people who log onto the system at night. This is because most employ-
ees or others associated with a company do not tend to log on after business hours.
Another suggestion is to install virus detection software on an organization’s com-
puter system or to use a firewall to protect it from attacks. It is also critical to train
employees to not grant access to unknown people or to open attachments from
unknown people. Employees should be urged to use better, more complex pass-
words. Other suggestions are to patch any vulnerabilities in the system as soon as
they are identified and filter employee e-mails to prevent phishing attacks.

ASHLEY MADISON BREACH

Ashley Madison is a website that assists users who seek to arrange extramarital
affairs with other users. In July 2015, a group called “The Impact Team” hacked the
website, threatening to make public the private information of many members if the
website was not removed. When the website remained active, the group revealed
members’ identification, including their real names, addresses, transaction records,
and sexual preferences. The group released information associated with a seven-
year span, causing great embarrassment for many users. At the time, the website
had about 32 million users. In addition, the information about the website’s parent
company’s financial information and salary information was also made public.
The parent company of Ashley Madison, Avid Life Media, had a policy of not
deleting the personal information of its members for the Ashley Madison site or
another similar site, Established Men. When the threat to expose the membership
was first made, the company claimed that they had secured their sites so that no
names could be released. When the hackers released that information, the com-
pany decided to cooperate with law enforcement to investigate the attack. They
offered $500,000 (Canadian, or $378,000 U.S.) for information that would lead to
the arrest of the person/people behind the breach.
The hackers reportedly chose Ashley Madison because they disagreed with the
site’s goal of arranging extramarital affairs between married individuals. They also
were upset by Avid Life’s business practices, specifically the requirement that peo-
ple were asked to pay a $19 fee to have their private data deleted if they changed
their mind about having an affair. In many cases, even though the member paid
the fee to remove their data, it remained active. The hackers claim that Avid Life
made $1.7 million each year from clients who sought to delete their information.
At first, the hackers posted the information on the dark web but then listed it
on the open web, where they turned it into a searchable document. Websites were
created that anyone could use to investigate whether their spouses or friends had
paid for a membership on the site. There was also a map created to show where
the users lived. Many of the users were linked to governments in Canada and the
United States, including the military. Under the Code of Military Justice, adultery
is an offense that can lead to imprisonment and a dishonorable discharge. For
some users for countries such as Afghanistan, Iran, and Saudi Arabia, a homo-
sexual affair is punishable by death. About 86 percent of the users were men. Some
of the members used fake names and e-mails, whereas others used the name of a
real person, maybe setting up a fake account as a prank. Many of the users were
blackmailed, receiving threats that messages would be sent to family and friends if
they did not send money (typically in Bitcoins) to keep it quiet.
14 A s h le y M a d i s o n B r ea c h

Several well-known figures were caught up in the breach, including conserva-

tive activist and television reality personality Josh Duggar of 19 Kids and Counting
(2008–2015). Dr. Walker Palmer, who made headlines in July 2015 for killing
“Cecil the Lion” in Hwange National Park, in Zimbabwe, was also identified among
the site’s users. Joshua Cline, former aide to Michigan Republican State Representa-
tives Todd Courser and Cindy Gamrat, was also outed as a user on Ashley Madi-
son. Earlier that year, Cline blew the whistle on Courser and Gamrat’s extramarital
affair. Courser resigned his seat in September 2015, and the Michigan House of
Representatives expelled Gamrat that same month.
On August 21, 2015, two law firms in Canada filed a $578 million class-action
lawsuit against Avid Dating Life Inc. and Avid Life Media Inc., representing Cana-
dian citizens who were members of Ashley Madison. The members claimed the
company did not protect the users’ privacy, as required under Canadian law. They
were particularly upset that they paid the fees to have their personal information
deleted, which did not happen. The company pointed to a statement on the web-
site that claims that the service is a “100% discrete service.” But it also states, “We
cannot ensure the security or privacy of information through the Internet.”
The release of the information from the website was linked to two suicides,
one of whom was a priest from Louisiana. Avid Life Media chief executive officer
Noel Biderman resigned on August 28, 2015. The original company, Avid Life, was
rebranded as Ruby. It was found that Ruby created false profiles of women on the
site as a way to lure men into joining.
U.S. law enforcement, the U.S. Federal Trade Commission (FTC), and officials
in Canada and Australia investigated the hacking. The company was found guilty
of lax security and deceptive practices. In December 2016, the U.S. FTC fined the
company $24 million. However, because of their inability to pay the full amount,
the company only paid a fine of $1.66 million. The customers whose data was
made public did not receive any financial payment, but many have joined in class-
action lawsuits against the company.
The website is still available. Since September 2015, the company claims to be
willing to fully delete people’s data if they choose. The company claimed that it has
updated its security.

Indeed, despite being confined in the Ecuadorian embassy in London since

2012, Assange has remained involved in the affairs of WikiLeaks. One notable
example is his involvement in WikiLeaks’s publishing of numerous e-mails of the
Democratic National Committee during the 2016 U.S. presidential election. There
have been claims that the e-mails originated from Russia. Assange has denied that
Russia was the source of the e-mails but—in following with WikiLeaks’s practice—
has not disclosed who the source was. Assange also offered assistance to Edward
Snowden, a National Security Agency (NSA) contractor who leaked numerous NSA
documents in 2013. Though Snowden did not leak the NSA documents through
WikiLeaks, Assange made arrangements for Snowden to also seek Ecuadorean
asylum. While Snowden’s passage to Ecuador was ultimately blocked, he was
able to make it to Russia with the assistance of Assange’s associate Sarah Harrison
(Burrough and Ellison, 2014).

See also: Hacker and Hacking; Manning, Chelsea; Snowden, Edward; WikiLeaks

Further Reading
BBC News. 2017. “Julian Assange: Sweden drops rape investigation.” BBC News, May 19,
2017. https://www.bbc.com/news/world-europe-39973864
BBC News. 2018. “Julian Assange in the Ecuadorian embassy: Timeline.” BBC News, Octo-
ber 19, 2018. https://www.bbc.com/news/world-europe-11949341
Burrough, Bryan and Sarah Ellison. 2014. “The Snowden saga: A shadowland of secrets
and light.” Vanity Fair, May 2014. https://www.vanityfair.com/news/politics/2014/05
/edward-snowden-politics-interview
CBS News. 2019. “Ecuador’s leader says Julian Assange turned London embassy into a
‘center of spying.’” CBS News, April 15, 2019. https://www.cbsnews.com/news/julian
-assange-wikileaks-ecuador-embassy-center-spying-lenin-moreno-04-15-2019/
Chappell, Bill. 2019. “Sweden reopens inquiry into Julian Assange over rape allegations.”
NPR, May 13, 2019. https://www.npr.org/2019/05/13/722765304/sweden-reopens
-inquiry-into-assange-over-rape-allegations
Davies, Nick. 2010. “10 days in Sweden: The full allegations against Julian Assange.” The
Guardian, December 17, 2010. https://www.theguardian.com/media/2010/dec/17
/julian-assange-sweden
Greenfield, Patrick. 2018. “Julian Assange to regain internet access at embassy base—
Reports.” The Guardian, October 14, 2018. https://www.theguardian.com/media/2018
/oct/14/julian-assange-to-regain-internet-access-in-embassy-base
Khatchadourian, Raffi. 2010. “No secrets: Julian Assange’s mission for total transparency.”
The New Yorker 86, 16: 40.
Khomami, Nadia. 2018. “Judge refuses to withdraw Julian Assange arrest warrant.” The
Guardian, February 13, 2018. https://www.theguardian.com/media/2018/feb/13/judge
-refuses-to-withdraw-julian-assange-arrest-warrant
Kwek, Glenda. 2010. “Magnet for trouble: How Assange went from simple island life to
high-tech public enemy number one.” The Sydney Morning Herald, December 8, 2010.
https://www.smh.com.au/technology/magnet-for-trouble-how-assange-went-from
-simple-island-life-to-hightech-public-enemy-number-one-20101208-18pb3.html
Meek, James Gordon and Ali Dukakis. 2018. “Assange in ‘solitary confinement’ at embassy,
fears possible extradition to US, lawyer says.” ABC News, August 3, 2018. https://abcnews
18 A u e r n h e i me r , A n d r e w A la n E s c h e r

.go.com/Politics/assange-solitary-confinement-embassy-fears-extradition-us-lawyer
/story?id=57018760
Sharman, Jon. 2019. “Julian Assange: Wikileaks founder drops appeal against prison
term for breaching bail.” Independent, July 18, 2019. https://www.independent.co.uk
/news/uk/crime/julian-assange-prison-appeal-breach-bail-belmarsh-sweden-wikileaks
-a9011131.html
United States Department of Justice. 2019. “WikiLeaks Founder Julian Assange charged
in 18-count superseding indictment.” United States Department of Justice, May 23,
2019. https://www.justice.gov/opa/pr/wikileaks-founder-julian-assange-charged-18
-count-superseding-indictment
Weiss, Baruch. 2010. “Why prosecuting WikiLeaks’ Julian Assange won’t be easy.” The
Washington Post, December 5, 2010. http://www.washingtonpost.com/wp-dyn/content
/article/2010/12/03/AR2010120303267.html
WikiLeaks. 2010. “Collateral murder.” WikiLeaks. https://collateralmurder.wikileaks.org/en
/index.html
Zapotosky, Matt and Devlin Barrett. 2018. “Julian Assange has been charged, prosecutors
reveal inadvertently in court filing.” The Washington Post, November 15, 2018. h ttps://
www.washingtonpost.com/world/national-security/julian-assange-has-been-charged
-prosecutors-reveal-in-inadvertent-court-filing/2018/11/15/9902e6ba-98bd-48df
-b447-3e2a4638f05a_story.html?utm_term=.ef8637965bc8

AUERNHEIMER, ANDREW ALAN ESCHER(1985–)

Andrew Auernheimer, also known as Weev, is known for being a black-hat hacker
and internet troll, a behavior he carries out to “(see) people suffer ironic punish-
ments” (Kunzelman, 2017). Auernheimer has also been associated with a hacking
group known for attacking universities and has become recognized for using rac-
ist and anti-Semitic rhetoric. In 2009, he participated in an attack on Amazon in
which books on LGBTQ issues were reclassified as pornography.
In 2010, Auernheimer was part of a group called Goatse Security that hacked into
the computer systems of AT&T. He then uploaded the e-mail addresses of 114,000
iPad users that included the addresses of well-known celebrities, including Michael
Bloomberg, the mayor of New York; Diane Sawyer, a journalist with ABC News;
Rahm Emanuel, the former White House Chief of Staff and mayor of Chicago from
2011 to 2019; and many military members, including Colonel William Eldredge
from the Air force. Other passwords were those that belonged to employees of
National Aeronautics and Space Administration (NASA), the Defense Department,
the Justice Department, and the U.S. Department of Homeland Security (DHS).
In explaining his actions, Auernheimer said that companies should do the
right thing and let people know if there is a security problem with the company
(Worthen and Spencer, 2010). He said that he was able to access the company’s
information with little skill because the security was so lax. He gave AT&T’s data to
the press as a way to inform customers of the negligence with which the company
treats personal data (Rensin, 2014). He sought to publicize flaws in companies so
they will be encouraged to fix them and keep people’s data secure. He claimed that
he hacked into the company’s site as a way to help AT&T increase its security.
A u e r n h e i me r , A n d r e w A la n E s c h e r 19

In 2010, Auernheimer was investigated and arrested on drug charges. He was

charged with possession of cocaine, LSD, and ecstasy. During the process, he criti-
cized the search of his home. The charges were dropped in January 2011. But at
that time, he was arrested and charged with one count of conspiracy to access a
computer without authorization and one count of fraud. Because he did not have
a job, Auernheimer was denied bail. He was transferred to the Federal Center in
Oklahoma and released on $50,000 bail in February 2011.
In July of 2011, Auernheimer was indicted on one count of conspiracy to gain
unauthorized access to computers and one count of identity theft. He was found
guilty of these charges in November 2012 and then sentenced to spend 41 months
in federal prison, with an additional three years of supervised release. He was also
ordered to pay $73,000 in restitution to AT&T. He was sent to a low-security fed-
eral correctional institution in Allenwood, Pennsylvania, where he spent time in
solitary but also participated in a hunger strike.
Auernheimer appealed his conviction, and in April 2014, the Third Circuit
Appeals Court decided to overrule the conviction based on the fact that the venue
was improper. He was charged in New Jersey but his crimes occurred in Arkan-
sas. Auernheimer was released from prison in April 2014 after serving only 13
months. Upon his release, he asked that the government compensate him for the
time he spent in prison. He demanded 28,296 Bitcoins (about $13.2 million),
which was one Bitcoin for each hour he served. He refused to accept U.S. currency
because it is the preferred currency of “criminal organizations” including the FBI,
the Bureau of Alcohol, Tobacco, Firearms, and Explosives (ATF), and the Federal
Reserve (Musil, 2014).
Auernheimer serves as the webmaster for The Daily Stormer, a neo-Nazi journal
that appears on the dark web because Google refuses to host the site. In that jour-
nal, he wrote that he was treated harshly because the judge in his case was African-
American. He also ranted about the evilness of Jews and left a lewd message on the
answering machine of a Jewish woman in Montana. In an article in October, 2014,
Auernheimer described himself as a white nationalist. Moreover, Auernheimer is
banned from Twitter because of the racial tone of his tweets in that media.
In 2014, Auernheimer moved to Lebanon to avoid any further punishment
from the U.S. government. In October 2015, he was working to publish the names
of the government employees whose names appeared on client lists of the Ashely
Madison website, a site that endorses extramarital affairs.
In 2016, Auernheimer programmed thousands of printers at universities to print
thousands of anti-Semitic flyers with swastikas, addressed to “white men.” Under
the Junk Fax Prevention Act of 2005, it is illegal for people to send unsolicited ads
to a fax machine without an established business relationship with the recipient,
and the recipient must have provide their fax number to the sender voluntarily. He
could be fined $500 per flier.

See also: Ashley Madison Breach; Black-Hat Hackers; Cyberbullying; Dark Web;
Hacker and Hacking
20 Awa r e n e s s

Further Reading
Gutman, Rachel. 2018. “Who is Weev, and why did he derail a journalist’s career?” The
Atlantic, February 14, 2018. https://www.theatlantic.com/technology/archive/2018/02
/who-is-weev/553295/
Hayden, Michael Edison. 2018. “Neo-Nazi who calls for ‘slaughter’ of Jewish children is
of Jewish descent, his mom says.” Newsweek, January 3, 2018. https://www.newsweek
.com/neo-nazi-andrew-weev-auernheimer-daily-stormer-jewish-descent-768805
Kunzelman, Michael. 2017. “Notorious troll calls the online tactics ‘a national sport.’” AP
News, March 29, 2017. http://apnews.com/04c73bb948ce4182845a6d27e0a9c3e1.
Musil, Steven. 2014. “AT&T hacker ‘Weev’ sends feds ‘invoice’ for time in prison.” cnet,
May 20, 2014. https://www.cnet.com/news/at-t-hacker-weev-sends-bitcoin-invoice-to
-feds-for-time-in-prison/
Rensin, Emmett. 2014. “This infamous hacker went to prison for trolling AT&T. Now
he wants to troll Wall Street.” New Republic, April 22, 2014. https://newrepublic.com
/article/117477/andrew-weev-auernheimers-tro-llc-could-send-him-back-prison
Worthen, Ben, and E. Ante Spencer. 2010. “Computer experts face backlash.” Wall Street
Journal, June 14, 2010. https://www.wsj.com/articles/SB10001424052748703885104
575303032919382858

AWA R E N E S S
Cybercrime awareness refers to not only to one’s knowledge of what cybercrime is
but also to one’s knowledge of how cybercrimes are carried out. As cybercriminals
are always evolving in the ways they commit cybercrime, so too must individuals
be on top of these evolutions to be truly aware of cybercrime and the risks it poses.
Helping everyone become aware of cybercrime is important for government and
businesses. While a business or government agency can employ individuals whose
specific job is cybersecurity, none of that matters if individual employees compro-
mise confidential information because they are unaware of the methods being used
against them. Accordingly, businesses and governments may take steps to make
their employees (and others) aware of cybercrime risks.
In the United States, the DHS includes tips for protection against cybercrime on its
website (Department of Homeland Security, 2018). These tips include choosing a pass-
word that will not be easily guessed, keeping software on a computer and other devices
updated, and securing Wi-Fi networks. Tips are even provided for handling emerg-
ing technologies. For example, smart home technology is becoming more popular,
allowing people to access door locks, security cameras, garage doors, lights, and other
aspects of their home via cellphone. If cybercriminals are able to hack into the smart
home application a homeowner is using, they could gain entrance into that home.
The DHS recommends several tips for individuals using smart home technology,
including regularly reviewing the mobile applications used (including ones to run
a smart home) and deleting those that cannot be verified as reputable and those
the owner does not regularly use. DHS also suggests disabling features on cell
phones that geo-tag (i.e., let others know the phone’s current location using GPS
technology to find and broadcast that location). People may use this feature to let
friends and family know where they are, but if a cybercriminal were to gain access
Awa r e n e s s 21

to that information in conjunction with hacking into a smart home account, not
only could the cybercriminal break into that person’s house, but they would know
the best time to do it based on the homeowner’s location.
While not necessarily a crime in every state, cyberbullying is often included in
the general discussion of cybercrime awareness. The dangers posed by cyberbul-
lying differ from those posed by cybercrime in general. Much of the danger posed
by cybercrime is financial loss. While there are hundreds of thousands of individu-
als who fall victim to cybercrimes each year (see Federal Bureau of Investigation,
2018), businesses are regularly and repeatedly attacked by cybercriminals. It is
estimated that the average American business is attacked 4 million times per year,
with businesses specifically involved in financial services being attacked 1 billion
times per year (Mirchandani, 2018). The danger posed by cyberbullying is not so
much financial loss as it is psychological harm. The predominant targets of cyber-
bullying differ from cybercrime in general as well. It appears that minors, in par-
ticular, tend to be the victims of cyberbullying. It was estimated in 2013 that just
under 7 percent of people between the ages of 12 and 18 had been cyberbullied
at some point (United States Department of Education, 2015). The United States
government provides tips for parents to protect their children against cyberbul-
lying (see Stopbullying.gov., 2019). Recommendations include monitoring chil-
dren’s internet activity and establishing rules governing children’s internet usage.
In attempts to regularly raise awareness of cybercrime, both the United States
and the European Union have designated October as Cybercrime Awareness Month.
Additionally, Safer Internet Day is celebrated in over 140 countries—including the
United States, the United Kingdom, China, and Russia. It was first celebrated on
February 6, 2004, and is currently celebrated on the Tuesday of the second week in
February (the second day of the second week in the second month). The purpose
of Safer Internet Day is to increase awareness of safety concerns that exist on the
internet, including cyberbullying and other cybercrimes.

gathered. The offender is able to continue to steal money or gather knowledge

sometimes for a lengthy period of time before it stops.

Attack Examples
There are many examples of cyberattacks on banks and other financial institutions.
One occurred in September 2012, in retaliation for a YouTube film that some felt
was offensive to Islam. A group named Izz ad-Din al-Qassam Cyber Fighters used
DDoS attacks to freeze the websites of multiple financial companies such as the
Bank of America, JP Morgan Chase, PNC, and Wells Fargo. The attacks were some
of the largest DDoS attacks in the industry. The actual intent of the protesters was
to eliminate the online presence of the different institutions as opposed to stealing
funds.
Another attack in 2015–2016 resulted in the theft of an estimated $81 mil-
lion dollars from banking institutions in the SWIFT banking network around the
world, including Bangladesh, Vietnam, New York, and Ecuador. The attacks were
carried out by a hacking group called APT 38, which is thought to be connected to
North Korea. The attackers looked for vulnerabilities in the networks of banks that
they then used to have access to the bank’s credentials. A message was sent to other
banks asking to transfer funds. It is estimated that millions of dollars were stolen
from accounts. This is thought to be the first time a state actor was responsible for
an attack on a financial institution.
The Carberp Trojan, a form of malware designed to steal personal information
from victims, also appeared in 2013–2015. By using this malware, offenders were
able to steal personal information and funds from customers. It was estimated that
offenders stole a billion dollars (or more) from victims.
The victims of a different incident in 2016 included five Russian banks that suf-
fered DDoS attacks over a two-day period. One of the bank sites received 660,000
requests for information per second, which quickly overloaded its systems (Khan-
delwal, 2016).
The hacking group Anonymous launched a DDoS attack on banks around the
world in May 2016 in an event named Operation Icarus. On May 4, members
warned banks such as the U.S. Federal Reserve, the Bank of England, the IMF, and
the World Bank that “one of the most massive attacks ever seen in the history of
Anonymous” was going to be launched. Their intent was not to steal money but
rather to “not let the banks win.” The attack shut down the bank websites for about
a day (Ashok, 2016).
Member institutions in the Lloyds Banking Group experienced DDoS attacks on
their accounts for 48 hours in 2017. The criminals demanded a large ransom to
be paid in Bitcoin in order to stop the attack. In the end no accounts were actually
attacked, and Lloyds did not pay the ransom.

Banking Security
Those who work in the banking industry must always be on the lookout for cyber-
criminals who seek to infiltrate their networks. Banks have increasingly become
Ba n k i n g At ta c k s 27

more aware of the dangers of cybersecurity and the need for countermeasures to
combat it. Banks are increasing their security and are detecting attacks much ear-
lier than in years past, often hiring better IT employees who understand risks. It
seems that banks tend to respond more quickly to attacks when compared to other
organizations. One survey showed that 88 percent of banks detected a cyberattack
in under two hours (as compared to 77 percent of other companies); 72 percent
of banks are able to respond to an attack in under two hours (as compared to 68
percent of other companies) (Crosman, 2015).
Banks need to take preventive measures to protect their customers and their
organizations. Most banks have installed cybersecurity measures—but to varying
degrees. It is difficult and expensive to maintain a secure system. They must be
continually changing to address changing threats. Smaller agencies do not have
plans in place as do larger ones. Banks need to know if there are any vulnerabilities
in their systems. They need to install and continually updates malware protection.
They can also increase the use of encrypted data if it is sent from one place to
another. Some financial institutions do not effectively encrypt their financial data
(Cybersecurity, 2016).
Preventive measures should also be taken by the customer. Individuals need
to be careful not to respond to e-mails that requests bank account information or
passwords. If an e-mail is questionable, the individual should call the bank (not
using the contact provided in the e-mail) to ensure it is legitimate. People should
also be wary of giving out their information over the phone if they receive a call
purporting to be from a bank. If a person calls and appears to be a member of
the staff from a bank, it may not be real. Customers should also be encouraged to
change their password often, and use secure passwords.

Bitcoin, as well as other cryptocurrencies, are prohibited in several countries.

In some countries, this ban is explicit, such as in Bolivia, Egypt, and the United
Arab Emirates. In others countries, such as in China, Iran, and Columbia, there
is not an out-and-out ban on citizens utilizing cryptocurrencies, but financial
institutions within the country are barred from using them, essentially amount-
ing to a ban (see Law Library of Congress, 2018). Cryptocurrencies are, how-
ever, currently legal in the United States. Indeed, the first commercial Bitcoin
transaction took place in the United States from the United Kingdom. On May
22, 2010, Laszlo Hanyecz, who lived in Florida, offered to pay 10,000 Bitcoins
to anyone on an online forum who would buy him pizza. Another forum user
in the United Kingdom accepted the offer and ordered two pizzas for Hanyecz
from a Papa John’s in Hanyecz’s area (Bort, 2014). Presently, several businesses
in the United States accept Bitcoin, including Microsoft, Subway, and Expedia
(Chokun, 2018).
While the use of Bitcoin is legal in the United States, there are ways Bitcoins are
used to facilitate criminal acts. Because Bitcoin cannot be directly traced back to
an individual, it can be used to pay for illegal goods or services. One study esti-
mated that half of the transactions conducted using Bitcoin involve illegal activity
and that a quarter of all Bitcoin users have used it for illegal purposes (Foley et al.,
2018).
The process of mining Bitcoin has also come under fire because it requires an
extensive amount of electricity. Not only are transactions in the blockchain verified
by multiple users, but the process of deciphering the cryptography involved with
a transaction draw a fair amount of power. Because so much electricity is required
to maintain a blockchain, it is argued that Bitcoin and other cryptocurrencies are
not feasible as a replacement for traditional currency (Shin, 2018). It is not just
the cost of electricity use associated with transaction verification that makes it
unfeasible—the environmental impact of such heavy use of electricity is substan-
tial. It is estimated that the electricity used to mine Bitcoin is similar to the amounts
used by some countries, such as Hungary, New Zealand, Peru, and Switzerland
(Hern, 2018; Shin, 2018). Generating that much electricity is estimated to produce
20 megatons of CO2 emissions annually (Hern, 2018).
This problem could be compounded if Bitcoin or another cryptocurrency were to
replace traditional currency. The mining of Bitcoin is a competitive process, where
those who are able to mine faster are more likely to reap the financial benefits of
mining. Those with more processing power have an edge, but that will cost more
electricity. At a certain point, it no longer becomes economically advantageous
to increase processing power because the cost of the electricity usage required to
utilize it offsets the profits to be made. If Bitcoin were the traditional currency,
however, the value of Bitcoin would likely go up. This, in turn, would increase the
amount of electricity one could use to mine Bitcoin and still have it be profitable
(Hern, 2018). This would result in even more CO2 emissions.

BOTS AND BOTNETS

A bot is a type of software that can carry out tasks when commanded, or that can
cause a computer to perform a task the user is not aware of. The word “bot” comes
from the word robot, and it implies that a computer has become a robot—it has
been programmed by someone other than the owner to do something. Some bots
are useful, for example, a shopbot is a program that reviews retail sites and locates
the store where the item is for sale at the cheapest price. Another example is a
“knowbot” that collects information by visiting other sites to gather information.
However, bots can also be very damaging. A harmful bot can be uploaded to a
computer to carry out a malicious act. Some may allow a hacker to remotely take
control of a computer so it does things for the hacker. It may force a computer to
send large numbers of spam e-mails to a website as part of a DoS attack, forcing
the site to slow down or be shut down. It may infect the machine with other mal-
ware that allow criminals to steal personal information or data so they can steal
the computer owner’s identity. Offenders may seek to gain unauthorized access to
a system in order to steal business secrets. It can also send out spyware that will
collect information about the user’s activities and send that to the hacker. Once
infected with a bot, the machine is referred to as a “zombie.”
All computers are at risk of becoming bots, including those owned by individu-
als, companies, organizations, governments. They can even affect personal devices
and smartphones. This means that millions of unsuspecting users are at risk of
becoming victims.
Often, hackers will attempt to network huge numbers of infected computers
(a few hundred or even thousands of infected machines) at one time. This way, the
hacker will have control of multiple machines at one time, allowing the hacker to
carry out large-scale attacks. It is more effective to steal large amounts of data when
36 Bots and Botnets

many machines are under a hacker’s control. When a large amount of zombie com-
puters are commanded at once, the network is known as a “botnet.” This comes
from the words “robots” and “networks.” Sometimes a botnet is called a “zombie
army.” The person who is in control of the botnet is referred to as a “bot herder”
or “bot master.”
Once the hacker creates a botnet, it can be rented to others or loaned out to
others who want to control the computers for some reason. The price the hacker
charges will depend on the number of computers that make up the botnet or the
amount of time the offender needs to use the botnet.
One famous botnet attack was named Zeus and was detected in 2009. This
software relied on a form of malware called a Trojan horse to seek out vulnerable
computers and infect them to create thousands of zombie computers. Once the
botnet was formed, it was used to attack banking and other financial organiza-
tions to allow the hackers to steal financial information from both individuals and
companies. The bot was sent through a phishing e-mail and asked victims for their
personal information. When a victim opened the e-mail, the machine they were
using was then infected with the malware. In more recent years, the bot has been
used as a way to spread ransomware that locks a victim’s computer until a ransom
fee is paid. This botnet later became known as the Gameover Zeus, which relied on
peer-to-peer networks to disseminate itself. Although the creator of the malware
claims to have retired the program, many experts believe it is still active.
Another famous botnet, Srizbi, began to emerge in 2007. Srizbi sent e-mails to
a large number of voters as a way to convince them to vote for Republican presi-
dential candidate Ron Paul in 2008. Because of that, the botnet was often referred
to as the Ron Paul spam botnet.
In 2016, a botnet referred to as Mirai attacked Dyn, a company that helps pro-
vide support for the internet. This malware attacked internet routers and cameras,
using default usernames and passwords that are set by manufacturers to install
malware. The attack was then executed out by a botnet of zombie computers that
were programmed to carry out a DDoS attack, overwhelming the company and
causing the internet to shut down for a short time for millions of users around the
world.
Most computer owners do not realize that their computer has been infected
with a bot and are unaware that anything is wrong. The owner is still able to use
the computer, and it seems to be working fine, except it may be operating a little
slower than before. Most botnets have a small “footprint” so that they use sys-
tem resources but are difficult to recognize. This means that the malware is not
detected by the owner for a long period, giving the offender the potential to cause
a great deal of damage to a system or steal a large amount of data.
When a hacker seeks to infect computers to make bots and botnets, they cre-
ate a malware that is able to scan the internet to find vulnerable computers. Many
computers and systems are not adequately protected against malware, so they are
easy to locate and infect. It only takes a few minutes for a computer or smartphone
to become infected. The malware will attempt to infect the largest number of com-
puters possible.
B y pa s s 37

To prevent a computer from becoming a bot, it is important to keep updated

security antivirus programs updated. It is also important for a user to refrain from
opening attachments unless the sender is a recognized entity. Users should also
change default usernames and passwords on new devices. Once a vulnerability is
identified, it should be patched as quickly as possible.

CENTER FOR INTERNET SECURITY

The Center for Internet Security (CIS) is a 501(c)(3) nonprofit organization formed
in October 2000 to “identify, develop, validate, promote, and sustain best practice
solutions for cyber defense and build and lead communities to enable an environ-
ment of trust in cyberspace.” The CIS is headquartered in East Greenbush, New
York, and has corporations, government agencies, and academic institutions as
its members. The organization works with these agencies to increase their online
security practices.
The organization is part of the Multi-State Information Sharing and Analysis
Center (MS-ISAC). This organization works alongside the Office of Cybersecurity
and Communications (part of the DHS) to monitor emerging cyber threats and
then informs its members (often local and state governments) about those threats.
All 50 states are part of MS-ISAC, as are the District of Columbia and territorial
and tribal governments. If a threat is credible, they work alongside the government
agency to establish efforts aimed at mitigating any possible effects. The mission of
the MS-ISAC is “to improve the overall cybersecurity posture of the nation’s state,
local, tribal and territorial governments through focused cyber threat prevention,
protection, response, and recovery.”
Any government agency can become a member of MS-ISAC. It is free for those
who work in the federal, state, local, tribal, or territorial government. It is also free
for those who work in public K–12 schools and schools of higher education. All
members have access to the Security Operations Center, which provides warnings
for new attacks or compromises on IP domains. If an attack does occur, the Center
provides assistance with incident response and forensics services. They also pro-
vide tabletop exercises to help agencies prepare for a possible attack.
Officials at the Center for Internet Security provide tips on how to keep an
organization’s data secure, such as keeping an inventory of both authorized and
unauthorized devices, which can be used to steal data from an organization (or can
be lost/stolen themselves). They also suggest controlling administrative privileges
(so that fewer people have access to privileged information), establishing malware
defenses, and developing methods for data recovery in case data is lost. CIS also
provides over 100 guidelines that can be used to safeguard an organization’s net-
works against threats. These consist of best practices that can be used by an orga-
nization to assess and improve their computer security. They also provide ways to
increase security.
By the end of the third quarter of the 2017 fiscal year, MS-ISAC had identified
97 data breaches, which they identified as being a 141 percent increase as com-
pared to the total number of breaches that were identified in 2016. Given that
number, the organization predicted that 2017 would have more data breaches than
ever before.

CHAOS COMPUTER CLUB

The Chaos Computer Club (CCC) is Europe’s largest group of computer hackers.
Based in Berlin, Germany, its general mission is to expose flaws in computer secu-
rity. In addition, the members have other goals. One is to strive for an increased
level of transparency in government actions and support a higher level of freedom
of information. The members also believe that computers should be more available
to the general public. To this end, the members often criticize any legislation that
seeks to place limits on the internet. At the same time, the CCC understands that
the privacy of those who use the internet must be a top priority.
Computer enthusiasts Wau Holland and Steffen Wenery, from Germany,
founded the organization in 1981. Holland proposed that there was a direct link
between computers and politics. Holland found himself on the “left” of the political
C h a o s C o mp u t e r Cl u b 49

spectrum, with some more radical political thoughts and orientations about gov-
ernment and society. He had the idea that if more people had access to comput-
ers, they would be able to liberate themselves from the big businesses that often
oppressed citizens. Based on this belief, he deemed his computer hacking should
have a political purpose.
The members of the CCC decided that they would hack into different busi-
nesses, not only to expose existing security flaws in their computer systems but
also to embarrass their political enemies. Immediately after a successful hack, the
members would inform law enforcement and the media about their actions. They
did this to bring attention to their activities and maximize their actions’ impact.
One of the CCC’s first successful hacking events, and the first online bank rob-
bery, occurred in 1984 when the group hacked into Deutsche Bundespost, a postal
and telecommunications organization in Hamburg, Germany. Prior to the hacking,
CCC members informed officials at the company about a system weakness they
detected in their computer network, but officials chose to ignore the warnings. In
response, CCC members hacked into the system using a password belonging to a
savings bank and stole 134,000 Deutsch marks by exploiting security flaws. This
allowed the CCC members to transfer a large sum of money into their personal
bank accounts. While the members eventually returned all of the money, they were
able to expose a major security flaw in the organization that put their customers’
financial standing at risk. At the same time, the organization made a major political
statement about the lack of government action to increase cybersecurity, and the
dangers that could result from that inaction.
Each year, the CCC hosts the Chaos Communication Congress, an annual event
that brings together people interested in computer security and privacy issues as
well as political issues. The conference has been organized since 1984. Thousands
of people attend each year so they can collaborate on projects, listen to speakers,
and gain hands-on experience with the newest technology. Each conference has
a theme, including “We Come in Peace,” “Behind Enemy Lines,” “Who Can You
Trust?” or “Nothing to Hide!” In 2007, Julian Assange, the founder of WikiLeaks,
attended the conference to discuss his WikiLeaks project.
Members of the CCC have sometimes been associated with controversial behav-
iors. One person who has been affiliated with the group, Karl Koch, allegedly stole
secrets and software from the U.S. military and nuclear establishments during the
Cold War between the United States and the Soviet Union, and then sold them
to the Russian KGB, the government agency responsible for the nation’s security
at the time. He then sold his story to the media. In May, 1989, his burned body
was found by in Germany. Officials labeled his death a suicide, but others are
convinced that he was killed in order to prevent him from revealing other secrets.
In 2013, the CCC claimed that they cracked the fingerprint sensor on the Apple
iPhone 5S only two days after the product released. They asserted that members of
their biometric hacking team lifted a fingerprint of a user from a glass surface and
then used that to create a fake fingerprint that was used to unlock a phone. Those
responsible used this to point to the dangers of relying on biometrics to control
access to technology or data.
50 C h i l d P o r n o g r ap h y

The CCC members were also able to hack the iris-recognition element in Sam-
sung’s Galaxy S8 smartphone about a month after it was introduced for sale. This
time, CCC members used an artificial eye that was made by use of a printer and
contact lens. Once again, members sought to highlight the dangers of relying on
biometrics as security.
In 2016, members of the CCC demanded an official pardon of Chelsea Manning,
who was caught selling classified and sensitive military documents to WikiLeaks.
The group made her an honorary member of the CCC.

See also: Anonymous; Assange, Julian; Biometrics; Black-Hat Hackers; Hacker and
Hacking; White-Hat Hackers

Further Reading
Arthur, Charles. 2013. “iPhone 5S fingerprint sensor hacked by Germany’s Chaos Computer
Club.” The Guardian, September 23, 2013. https://www.theguardian.com/technology
/2013/sep/22/apple-iphone-fingerprint-scanner-hacked
Baich, John. 2008. “The history of the Chaos Computer Club.” Wired, July 7, 2008. h ttps://
www.wired.com/2008/07/the-history-of-3/
Chaos Computer Club. https://www.ccc.de/en/
Hern, Alex. 2017. “Samsung Galaxy S8 iris scanner fooled by German hackers.” The Guard-
ian, May 23, 2017. https://www.theguardian.com/technology/2017/may/23/samsung
-galaxy-s8-iris-scanner-german-hackers-biometric-security
Williams, Elliot. 2018. “Great people and culture at 34th Chaos Communication Con-
gress.” Hackaday, January 2, 2018. https://hackaday.com/2018/01/02/34c3-at-last
-normal-people/

CHILD PORNOGRAPHY
Federal law in the United States defines child pornography as “any visual depic-
tion of sexually explicit conduct involving a minor.” Online child pornography can
involve images of children that include explicit sexual acts (as opposed to innocent
pictures taken by a parent). The images are used for sexual gratification by the
viewer. The meaning or classification of what constitutes child pornography differs
between countries and even within countries. It is very much defined by societal
mores and values that vary from place to place. In the United States, laws have
made it illegal to possess, distribute, or produce internet child pornography. In
other countries, it is readily available and easily accessible. For example, a person
in Japan is legally permitted to possess the material if they do not have the intent to
distribute it. Personal use of child pornography is also legally permitted in Russia,
Thailand, and Korea (Akdeniz, 2008).

Laws That Regulate Child Pornography

Most laws pertaining to child pornography describe images of children in sexual poses
and acts, but such images may also, in some circumstances, be considered “artistic”
works, or even “fantasy.” A photo must be sexually suggestive to be considered child
C h i l d P o r n o g r ap h y 51

pornography. If the images can be categorized as artwork, it may be protected by the

U.S. Constitution’s First Amendment provisions regarding freedom of expression.
However, images of child pornography are not protected by the First Amendment.
By most laws, both the production and consumption of child pornography is ille-
gal. If a person is found to be in possession of child pornography, that person may
be labeled as a sex offender by legal authorities and may be forced to register as a sex
offender even if there was no physical contact with the victim. An adult who takes
a sexually explicit photo of a minor and uploads it to social medial may have com-
mitted a federal crime banning child pornography, depending on the circumstances.
There are many federal laws that have provisions to protect children from being
sexually exploited and to deter offenders. Some of those include the Protection
of Children Against Sexual Exploitation Act (1977), the Child Sexual Abuse and
Pornography Act (1986), the Child Protection and Obscenity Enforcement Act
(1988), the Child Protection Restoration and Penalties Enforcement Act (1990),
and the Child Protection Act (1993).
More recently, two laws have been passed by the U.S. Congress to protect chil-
dren. The first of these, the Child Pornography Protection Act (1996), banned
“virtual” pornography that is created through digital technology and appears to be
of a minor, or “conveys the impression that material contains the picture of a child
engaged in sexual activities.” However, in 2002, the United States Supreme Court
struck down the law by ruling in the case Ashcroft v. Free Speech Coalition that the
provisions of the law were too broad and violated the First Amendment.
Second, Congress passed the Child Obscenity and Pornography Prevention Act
(2002). The provisions of this law tries to sidestep the constitutionally treacherous
question of virtual child pornography by focusing on the intent of the participants.
It outlaws any solicitation to buy or sell child pornography (or anything repre-
sented as child pornography).
The Prosecutorial Remedies and Tools against the Exploitation of Children
Today Act (PROTECT Act), passed in 2003, was another attempt to deal with
virtual child pornography. It would make it illegal to use pornographic images
that appear to be indistinguishable from actual children. However, pornographers
would be able to defend themselves in court by proving that no actual children
were used in making the images, but the burden of proof is essentially shifted
from the prosecution to the defense. Another provision would make it illegal to
use internet domain names that mislead children into visiting pornographic sites.

Child Pornography on the Internet

Child pornography is big business. Images are publicly available on the internet
and often traded and acquired on the dark web. There are thousands of websites
that offer images of child pornography. The child pornography industry generates
an estimated $3 billion each year (Rogers and Seigfried-Spellar, 2011).
The internet makes the distribution of child pornography easier than in the
past. It makes the solicitation of young children by pedophiles almost effortless.
The internet allows an offender to have contact with a larger pool of potential
52 C h i l d P o r n o g r ap h y

victims and does not limit them to a particular geographic area. The victim can
be located anywhere around the world. An offender who uses the internet to meet
a child is not forced to approach the child in person. Through the internet, the
offender is provided with previously nonexistent anonymity that allows them to
approach a potential victim more easily and also access images more readily.
An offender may seek to make contact with a young child, which they can do
through a chat room or social media site. Once an offender makes contact, they
will go through a process of making the victim feel comfortable with the offender
in a process called “grooming.” An offender will groom a young person for just
days or for many months, depending on the child. They may create fake identities
and pose a teenagers to befriend a child, usually a vulnerable child who is unhappy
or needy. The offender can establish a connection with the child with the long-term
intention of sexual abuse or creating a sexual relationship.
Offenders may ask the child to pose for pictures or make pornographic mate-
rials and then send the images through the internet. They can also arrange to
meet the child to participate in sexual behavior with them. Some offenders are not
interested in meeting the children in face-to-face meetings but prefer to remain
anonymous and trade images.
The internet also provides offenders with a place to communicate with others
who have an interest in child pornography. They are able to “talk” to others and
share pictures and tips. When pedophiles find others who are like them, they are
likely to view their behaviors as “normal.” This may lower inhibitions to act on
their impulses (Rogers and Seigfried-Spellar, 2011).
Many experts are also concerned about the availability of online pornographic
material to young people. It is estimated that about 90 percent of minors aged
8–16 have viewed pornography online, with the average age of first exposure being
around 11 years old (Rogers and Seigfried-Spellar, 2011).
In some states in the United States, officials have started to charge minors with
committing criminal offenses if they send or post nude photos of themselves (self-
ies) on the internet, even if they do so willingly. Some have been prosecuted under
child pornography statutes. This means that a high school student who decides to
send a selfie that is sexual in nature to their significant other could be charged with
violating laws related to child pornography.
Additionally, the person who received the picture may also be charged. If the
photo is shared with other people, those who receive it could also be charged.
Many states are bringing these charges for many reasons, one of which is to protect
the child from those images having a permanent presence on the internet. On a
broader scale, deterring the posting of nude pictures is also an attempt to reduce
the amount of child pornography available on the internet for others to view or
even manipulate.

Combating Pedophile Information Networks in Europe

The University College Cork in Cork, Ireland, founded the Combating Pedophile
Information Networks in Europe (COPINE), housed within the Department of
C h i l d P o r n o g r ap h y 53

Applied Psychology in 1997. The analysts gathered over 80,000 images of children
in sexual situations that were readily available on the internet. After reviewing the
images for the severity of abuse in the images, they created a typology of 10 levels
of severity. One of the findings was that the age of the children involved in child
pornography was become younger over time. This raised the concern that, because
the children are so young, they are not able to express to others what is happen-
ing to them or even understand that what they are experiencing is wrong. The
researchers also found an increase in pictures that seemed to be created in a family
setting, such as in a family room located in a home or even where the offender is a
family member. They termed this “domestic” pornography.
Another finding from COPINE was that over half of the victims in the porno-
graphic images depicted young women, but there was a trend toward more young
men in the images. Finally, they noted changes over time in the racial makeup
of the pictures. Specifically, white children were more likely to be the subject of
pictures that depict violent acts, whereas Asian children were more likely to be in
posed pictures. Overall, there were few children of African-American descent in
any of the images (Jewkes and Andrews, 2007).
In 2005, research about child pornography through this organization was trans-
ferred to INTERPOL, the International Police Organization, which represents 194
countries. This allows for a more extensive collection of information about child
pornography.

Law Enforcement’s Battle against Child Pornography

Most law enforcement agencies on the state and local levels have specialized units
or task forces that are responsible for investigating allegations surrounding the use
of technology to harm children. In order to locate offenders, police officers often go
to online chat rooms or social media sites and pretend to be minors in sting opera-
tions. They may agree to meet the offender in a real location, where the offender
is arrested or taken into custody. This technique requires police officers to have a
certain level of competence with technology.
Law enforcement officials face other obstacles when investigating online child
pornography. One is the question of jurisdiction. While the materials are available
online, the sites may be hosted in another country where the officers are not per-
mitted to act. Because of jurisdictional limitations, law enforcement may be aware
of offenders but unable to act. In some areas, there may be a limited number of
laws that give law enforcement the authority to arrest an offender. In some places,
social and cultural norms may be more permissive of child pornography, and the
legal definitions of offenses may not encourage law enforcement to crack down.
Beyond this, some departments may not have financial resources to fight child
pornography to the extent they may want. Because such a huge volume of pornog-
raphy is available online, it becomes an almost impossible task to eliminate it or
even limit its availability.

and Industry Corporation—a state-owned corporation—allegedly sold biometric

hardware to Taiwan that included undisclosed backdoors that China could exploit
to track who was leaving and entering Taiwan. In 2018, China allegedly installed
spyware on the computer network it provided to the African Union—a claim that
China denied (Center for Strategic and International Studies, 2019).
It appears that China has also been active in business espionage since that time.
China has policies in place that emphasize the acquisition of foreign intellectual
property, such as technology. These policies often act to put Chinese entities in an
advantageous position to steal intellectual property from foreign businesses operat-
ing in China (Commission on the Theft of American Intellectual Property, 2017).
Efforts to steal foreign technological intellectual property appear to be ongoing as
well. In 2018, the United States, Australia, Canada, New Zealand, and the United
Kingdom accused China of conducting cyberespionage operations that targeted
intellectual property of companies in twelve different countries. This operation had
been carried out over twelve years (Center for Strategic and International Studies,
2019). It appears that the companies most vulnerable to these cyber espionage
attacks from China are technology companies that are at the forefront of techno-
logical advancement (Commission on the Theft of American Intellectual Property,
2017). Chinese cyberattacks are not necessarily sophisticated. James Comey, for-
mer director of the FBI, said this about cyberattacks from the Chinese:

I liken them a bit to a drunk burglar. They’re kicking in the front door, knocking
over the vase, while they’re walking out with your television set. They’re just prolific.
Their strategy seems to be: “We’ll just be everywhere all the time. And there’s no way
they can stop us.” (Osborne, 2014)

China has been on the receiving end of cyberattacks as well. From 2006 to early
2019, China was the victim of approximately 25 cyberattacks (Center for Strategic
and International Studies, 2019). In 2011, China created a cyber defense squad
within the People’s Liberation Army to protect against cyberattacks (Beech, 2011).
There has been some indication that China is moving toward more firm regulation
of cybercrime, both domestically and internationally. In 2016, Meng Hongwei was
appointed president of Interpol, an international law enforcement organization.
Meng Hongwei was also the deputy head of the Ministry of Public Security in
China. In his capacity as president of Interpol, Meng expressed the need for inter-
national cooperation in combating cybercrime, noting that individual countries
would not be able to address cybercrime alone (Meng, 2017). Meng’s speech was
seen by some as an indication that China was moving toward more comprehen-
sive regulation of cybercrime (Waterman, 2017). However, Meng was arrested by
China in 2018 for bribery. There is some speculation that the arrest was made for
political purposes. In a statement made by China’s Ministry of Public Security, it
was said that Meng’s “insistence on doing things in his own way” was why he was
under investigation (Chi-yuk and Ho, 2018). It has been suggested that this focus
on Meng’s individual willfulness may be an indication that Meng did not adhere
to Communist Party lines, which may have landed him in trouble (Chi-yuk and
China 57

Ho, 2018). Meng’s wife believes her husband’s arrest was spurred on by rivals in
the Ministry of Public Security (Graham-Harrison, 2018). Whatever the exact rea-
son, it is now unclear whether Meng’s statements reflect the intentions of China is
regards to a unified effort to combat cybercrime internationally.

1. To establish a front line of defense against today’s immediate threats

2. To defend against the full spectrum of threats
3. To strengthen the future cybersecurity environment

The plan that emerged is the Comprehensive National Cybersecurity Initiative.

The plan revolved around 12 initiatives:

1. Manage the Federal Enterprise Network as a single network enterprise with

Trusted Internet Connections: The Trusted Internet Connections is a plan
to consolidate the external access points to the Internet. This will result in
increased security.
2. Deploy an intrusion detection system of sensors across the Federal enter-
prise: This will help to identify an unauthorized user if they attempt to gain
access to a federal computer network. This is part of Einstein 2, a program
used by the U.S. federal government that monitors computer traffic and is
used to detect malicious activity.
3. Pursue deployment of systems to prevent intrusion across Federal agencies:
Einstein will be used to identify malicious programs as a way to increase
the security of networks. It can detected cyber threats and respond to them
before they cause harm.
4. Coordinate and redirect efforts for research and development: It is hoped
that this will allow for more coordination of research activities to reduce
redundancies in research efforts, making for more cost-efficient research.
5. Connect cyber-ops centers as a way to increase communication: By promot-
ing interagency collaboration, centers can easily share data on possible mali-
cious activities directed toward federal agencies and stop an attack before it
is launched.
6. Develop and carry out a governmentwide cyber-counterintelligence plan: A
plan is needed to coordinate all activities carried out by federal agencies as
they attempt to detect, deter and mitigate cyber threats to the United States.
This needs to include increased cyberintelligence education and awareness
plans.
62 C o mp r e h e n s i v e Nat i o n al C y b e r s e c u r i t y I n i t i at i v e

7. Increase the security of classified networks. These networks hold highly sen-
sitive information on diplomatic issues, law enforcement cases, homeland
security operations, and other critical concerns. These need to be protected
from successful penetration by cybercriminals.
8. Expand cybereducation: It is essential to give people the knowledge and
skills to carry out the new technology to prevent cybercrimes from occurring.
There is a demand for cybersecurity experts to teach these skills as existing
programs lack unity and focus. The country needs to develop a workforce
that is technologically skilled and cyber-savvy.
9. Define and develop “leap-ahead” technology and programs: It is important to
develop cybersecurity technology that is beyond current systems. This way,
it can be deployed 5 to 10 years in the future.
10. Define and develop enduring deterrence strategies and programs: Planners
must consider long-range solutions for cybersecurity, not simply traditional
approaches.
11. Develop a multipronged approach for global supply chain risk management:
Cybercriminals have increased opportunities for harming the United States
by affecting the supply chain as a way to gain unauthorized access to data.
New policies must reflect the global marketplace and complex relationships
that now exist.
12. Define the federal role in extending cybersecurity into critical infrastructure
domains: Many critical infrastructure are operated by private individuals
who rely on efficient operation of systems that are vulnerable to cyberat-
tacks. There must be an ongoing relationship between the federal govern-
ment and the operators of critical infrastructure to share information and
prevent crime.

The Utah Data Center, a shorter name for the Intelligence Community Compre-
hensive National Cybersecurity Initiative Data Center, was built to support the Com-
prehensive National Cybersecurity Initiative. The Center, completed in 2014, serves
as a storage facility for data collected under the initiative, including information on
e-mails, phone calls, and data related to internet searches by U.S. citizens, among
other things. The facility is a highly secure complex that is geared toward providing
technical assistance to employees in the Department of Homeland Security (DHS).
They are also responsible for gathering intelligence pertaining to cyberthreats.
The NSA is responsible for overseeing the data collection and storage there. This
has been considered controversial by those who claim that the NSA has data-mined
individuals’ online behaviors and “overcollected” personal information. They point
out that data collection and surveillance of individuals became easier after the 9/11
terrorist attacks, which, some people argue, has been unconstitutional and illegal.
On the other hand, supporters argue that the data collection can help to prevent
future acts of terrorism, including cybercrimes.

COMPUTER FRAUD AND ABUSE ACT OF 1986

In 1986, Congress amended the Computer Fraud and Abuse Act (CFAA) (18 U.S.C.
§ 1030), originally passed in 1984, making it the primary federal-level statute on
computer crime, particularly for hacking-related offenses. The new law prohibits
the selling or renting of malware programs that allows an offender to gain access
into other systems. It also criminalizes trafficking in passwords for those comput-
ers that are identified as “protected computers.” If an offender chooses to carry out
an attack on another computer and causes significant damage, they can be crimi-
nally prosecuted. In general, the legislation aimed to deter malicious hacking and
unauthorized access to computer systems. The law was written to protect national
security, financial and commercial information, medical records, and interstate
communication against mischievous attacks.
In the mid-1970s, as computers and the internet were developing and becom-
ing more widely used, members of Congress first began to recognize the potential
for criminal acts committed through this new medium. In 1977, some members of
Congress proposed the Federal Computer Systems Protection Act, one of the first
bills proposed in Congress to create new laws on cybercrime. This bill did not have
enough support by the members and did not pass.
By the mid-1980s, the threat of cybercrime was more obvious, and Congress gar-
nered enough support to pass legislation on cybercrime. In 1984, they passed the
Counterfeit Access Device Act as well as the Computer Fraud and Abuse Act. These
laws were very narrow scope and lacked detail and clarity, leaving many people con-
fused. In an effort to pass a more useful law, Congress amended the original Com-
puter Fraud and Abuse Act in 1986. The original bill was then amended in 1989,
1994, 1996, and 2001 (in the USA PATRIOT Act), 2002, and then again in 2008.
64 C o mp u t e r F r a u d a n d A b u s e A c t o f 1 9 8 6

The updated version of the Computer Fraud and Abuse Act remains the pri-
mary federal-level statute on computer crime in the United States. The law bans
the dissemination of malware and the trafficking in computer passwords for “pro-
tected computers.” According to the legislation, a “protected computer” is one that
is used by a financial institution or by employees of the U.S. government. It can
also refer to computers that are used in interstate or foreign commerce.
Under the law, if a person is able to access restricted information by hacking
into a computer, by otherwise accessing a computer without authorization, or by
exceeding their authorized access, and that information could be used to injure
the United States, or if it communicated or delivered to a person not authorized to
receive it, they may be guilty of a felony criminal offense. In short, if a person gath-
ers restricted information without permission, or exceeds granted authorization,
and then uses that information in a way that can harm the United States, they have
committed a criminal offense.
In other provisions, the law bans the use of DoS attacks that cause a loss of
$1,000 or more to a business or agency, called a malicious damage violation. A
person can also be convicted if they damage a computer or information, traffic or
sell passwords, or threaten to damage a protected computer.
Importantly, the CFAA allows for civil remedies so that a person who suffers
a loss as the result of hacking or a DoS attack will be able to bring a civil action
against the offender as a way to receive compensation.
The first person to be criminally charged under the law was Robert Morris Jr.,
a graduate student at Cornell University who, in 1988, released the Morris worm
into cyberspace. The malware replicated itself in networks more quickly than he
had anticipated, causing many machines around the country to crash. The worm
caused a great deal of damage to computers. Morris was convicted in December
1990 for unauthorized access to federal computers and for causing damage.
About the same time (in 1988), Robert Riggs obtained unauthorized access to
Bell South’s computer system and downloaded information regarding an enhanced
911 system for emergency services. Riggs then sent the information to Craig Nei-
dorf, who in turn published it in a newsletter called Phrack, a magazine read by
computer hackers. In 1990, both Riggs and Neidorf were charged under the CFAA.
Riggs was eventually convicted criminally for hacking into Bell South, and the
charges against Neidorf were dropped after the trial judge declared a mistrial.
The CFAA was also used to charge Lori Drew, a 49-year-old woman who in
2006 created a fake MySpace account as a way to cyberbully her daughter’s friend,
13-year-old Megan Meier. Drew pretended to be a young male and established a
friendship with Megan. After months of sending positive messages, Drew began
to send hurtful messages that said, “You are a bad person and everybody hates
you. . . .The world would be a better place without you” (Wolff, 2016). Megan took
her own life due to the harassment. Prosecutors charged Drew under the CFAA as
having “unauthorized access” to MySpace’s computers.
Prosecutors relied on the CFAA to charge members of the hacking group
Anonymous with crimes after they disrupted the PayPal website in 2010. Officials
charged one member, Aaron Swartz, with 11 crimes, as defined by the CFAA, after
C o mp u t e r F r a u d a n d A b u s e A c t o f 1 9 8 6 65

he used a laptop issued by the Massachusetts Institute of Technology to down-

load millions of scholarly articles from JSTOR. After the charges were filed against
Swartz, he took his own life.
The law has been amended multiple times since the original law was passed. In
1994, new amendments allowed victims of computer hacking crimes to bring civil
actions as well as criminal charges against an offender. This means that a victim
of a computer crime is able to sue an offender for any damage to a computer that
results from the unauthorized access. This provision is used frequently by busi-
nesses against employees who steal secrets. Another amendment in 1996 changed
the law to replace “federal interest computer” with “protected computer.”
More extensive changes were made in 2001 in the USA PATRIOT Act. One of
those changes defined more clearly what was meant by “loss.” This was defined as
“any reasonable cost to any victim, including the cost of responding to an offense,
conducting a damage assessment, and restoring the data, program, system or infor-
mation to its condition prior to the offense, and any revenue lost, cost incurred,
or other consequential damages incurred because of interruption of service.” This
can include things such as lost employee wages, lost sales, or other costs incurred
because of the crime.
In 2013, after Swartz’s death, members of Congress proposed Aaron’s Law, a
bipartisan proposal to further amend the original CFAA (HR 2454). The new pro-
visions were introduced by Representatives Zoe Lofgren (D-CA) and Jim Sensen-
brenner (R-WI) and Senator Ron Wyden (D-Oregon). They made the proposal
after complaints that the law was too ambiguous when it came to the definition
of “without authorization.” Additionally, the law did not define “exceeds autho-
rized access.” Aaron’s Law removed provisions that made breaches of terms of
service and user agreements from the law. It also defined “unauthorized access”
to be “circumventing one or more technological measures that exclude or prevent
unauthorized individuals from obtaining or altering” information on a protected
computer. Despite the bipartisan support, Aaron’s Law did not have enough sup-
port to pass.
There are six sections to the CFAA. In Section 1, activities that are used by a
hacker to gain unauthorized access to information on national defense, foreign
relations, and atomic energy are criminalized. If found guilty of these acts, an
offender could be sentenced to a fine and/or up to 10 years imprisonment if it were
a first offense, or incarceration of up to 20 years for subsequent offenses. Section 2
focuses on hacking of records held by a financial institution, credit card issuer, or
consumer-reporting agency. Offenders found guilty of these offenses could be sen-
tenced to a monetary fine and and/or up to one year in prison for a first offense. If
the offense was reoccurring, the offender could be sentenced to term in prison of
up to 10 years.
Section 3 bans any interference with government operations by obtaining
unauthorized access to government-owned computers or computers that are used
by government officials. The penalties set by Congress for violation of this included
a monetary fine with a possible prison term of up to one year for a first offense, or
up to 10 years for subsequent offenses. More offenses were described in Section
66 C o mp u t e r F r a u d a n d A b u s e A c t o f 1 9 8 6

4. Here, Congress focused on hacking in which offenders are able to obtain unau
thorized access to a federal interest computer to commit fraud or theft. These
offenses could be punished by a fine and/or up to five years imprisonment for a
first offense, or a maximum of 10 years in prison for subsequent offenses.
There are two parts to Section 5. In the first one, Congress wrote “Whoever . . .
through means of a computer used in interstate commerce or communications,
knowingly causes the transmission of a program, information, code, or command
to a computer or computer system if the person causing the transmission intends
that such a transmission will damage, or cause damage to, a computer, computer
system, network, information, data, or program; or withhold or deny, or cause
the withholding or denial, of the use of a computer, computer services, system or
network, information, data, or program,” provided the access is unauthorized and
causes loss or damage of $1,000 or more over a one-year period or “modifies or
impairs, or potentially modifies or impairs, the medical examination, medical diag-
nosis, medical treatment, or medical care of one or more individuals.” A person
convicted under this portion of the statute faced a possible fine and/or up to five
years imprisonment for a first offense and up to 10 years for subsequent offenses.
In the second part, the law defined it a crime for a person who, “…through means
of a computer used in interstate commerce or communications, knowingly causes
the transmission of a program, information, code, or command to a computer or
computer system with reckless disregard of a substantial and unjustifiable risk that
the transmission will damage, or cause damage to, a computer, computer system,
network, information, data, or program; or withhold or deny, or cause the with-
holding or denial, of the use of a computer, computer services, system or network,
information, data or program” provided the access is unauthorized and causes loss
or damage of $1,000 or more over a one year period or “modifies or impairs, or
potentially modifies or impairs, the medical examination, medical diagnosis, medi-
cal treatment, or medical care of one or more individuals.” A person found guilty
of this could be sentenced to a fine and/or up to one year in prison.
Finally, Section 6 made it a crime to traffic in passwords that affect interstate
commerce or involve the password of a computer that is used by or for the U.S.
government. The penalty associated with this offense was defined as a fine and/or
up to one year imprisonment for a first offense and up to 10 years for subsequent
offenses (Casey, 2004, p. 64).
The CFAA has been criticized over the years for being poorly written and
unclear. Many point to the lack of definition of key terms including “unauthor-
ized.” Under the law, a person can be prosecuted for violating the “terms of service”
policies that are found on almost every piece of software that users upload onto
their computers. Prosecutors who charge offenders with crimes based on this law
are sometimes criticized because of these possible flaws.

See also: Anonymous; Cyberbullying; 414s; Morris, Robert Tappan; Swartz, Aaron;
Worm

Further Reading
Casey, Eoghan. 2004. Digital evidence and computer crime. Boston, MA: Elsevier.
C o n t i n u o u s D i a g n o s t i c s a n d M i t i g at i o n ( CD M ) 67

Kerr, Orin S. 2010. “Vagueness challenges to the Computer Fraud and Abuse Act.” Min-
nesota Law Review 5, pp. 1561–1587.
Wolff, Josephine. 2016. “The hacking law that can’t hack it.” Slate Magazine, September 27,
2016. http://www.slate.com/articles/technology/future_tense/2016/09/the_computer
_fraud_and_abuse_act_turns_30_years_old.html
Wu, Tim. 2013. “Fixing the worst law in technology.” The New Yorker, March 18, 2013.
http://www.newyorker.com/news-desk/fixing-the-worst-law-in-technology

CONTINUOUS DIAGNOSTICS AND

M I T I G AT I O N ( C D M )
Continuous Diagnostics and Mitigation (CDM) is a program created by Congress
to increase the security of the computer networks and systems belonging to agen-
cies and departments of the U.S. federal government. The CDM program provides
federal agencies with the means to identify cybersecurity risks on an ongoing basis;
to prioritize those security risks based on the severity of the potential impacts; and
then assist cybersecurity personnel in those agencies to mitigate the most signifi-
cant problems first, then follow through with secondary problems. The program
is overseen and implemented by the U.S. DHS. CDM is part of the federal govern-
ment’s ongoing efforts to protect the government’s computer systems by providing
federal agencies with additional training, knowledge, and tools needed to identify
possible cybersecurity risks and then mitigate problems. In short, it is a way to
strengthen the cybersecurity of the federal government.
The key objectives of the program are to reduce the threats to agencies, stream-
line reporting of potential threats, and improve the response capabilities of the
federal government. Phase1 of the program, called “What Is on the Network,”
requires the management and control of devices and software linked to a com-
puter network. Phase 2 is entitled “Who Is on the Network.” The goal of this
phase is to collect data on every user who is connected to an agency’s network,
which will provide an overall view of the entire user population. Phase 3, or “What
Is Happening on the Network,” looks at data that is being sent into and out of
the agency, as well as user behavior and activities. And then in Phase 4, “How Is
Data Protected?,” officials will help to identify cybersecurity risks on a continuing
basis, prioritize the risks based upon the severity of potential impacts, and miti-
gate problems.
The CDM program allows departments and agencies to carry out automated,
ongoing, risk-based assessments of their cybersecurity. The CDM program allows
for an expansion of continuous diagnostics by increasing the capacity of network
sensors, increasing the collection of data from those sensors, and using that data to
prioritize risk alerts. CDM offers agencies and departments a plethora of tools that
can be updated as threats change.
A second goal of the CDM is to provide cost-efficient means to purchase resources
to implement the cybersecurity program. To do this, the DHS and the General Ser-
vices Administration in 2013 created a blanket purchase agreement (BPA) called
the CDM Tools/Continuous Monitoring as a Service (CMaaS) BPAs. The purchase
agreement allowed agencies to purchase continuous monitoring tools and services
68 C o n t i n u o u s D i a g n o s t i c s a n d M i t i g at i o n ( CD M )

at a reduced cost. These tools enable the agencies to identify cyberthreats and then
mitigate the impact of those threats.
Participating agencies install sensors that perform ongoing, automated searches
for flaws in internet security. Results from the sensors are channeled into an agency
dashboard that produces a customized report used to alert network managers to
any critical online risks. These alerts allow agencies to efficiently allocate resources
based on the severity of the risk. Progress reports track results, which can be used
to compare security postures among agency networks. Within minutes, summary
information is relayed to a federal dashboard and informs other agencies about
any cybersecurity risks across the federal government. Mitigation mechanisms can
then be implemented.
Those overseeing the program have designed it to ensure the privacy of any
personal information. Any data that is transferred from the systems of CDM agen-
cies to DHS does not include any personally identifying information (PII). It also
does not include any information regarding computers in specific departments or
agencies.
Another essential element of the CDM program is communication. The sharing
of information is critical for successful security measures. Ongoing and ad hoc
communications are both required as part of the CDM. Along with communica-
tion, the need for effective management cannot be overstated. There is a need for
all agencies to have a common understanding of the basic concepts and principles
that comprise CDM.
The federal government awards financial grants to help participating agencies
and departments purchase needed tools. In July 2018, for example, the govern-
ment awarded CGI Federal Inc. a six-year, $530-million contract to provide tools
that will help agencies monitor cybersecurity risks. The company was founded
in 1976 and works in conjunction with federal agencies to provide solutions for
defense, civilian, health care, and intelligence.
Federal agencies and departments that elect to participate in the CDM program
may save their department money by doing so. Many of the costs associated with
the program will be paid by DHS, thereby reducing budget outlays for individual
agencies.

Delaney, David G. 2013–2014. “Cybersecurity and the administrative national security

state: Framing the issues for federal legislation.” Journal of Legislation, 40, pp. 251–279.
Office of Management and Budget (OMB). 2013. “Memorandum 14-03, enhancing the
security of federal information and information systems,” November 18, 2013. https://
obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2014/m-14-03
.pdf

COPYRIGHT INFRINGEMENT
Copyright is the exclusive right to print, publish, sell, or distribute a creative work,
ranging from books to physical products to software and music. Copyright infringe-
ment (often referred to as piracy) occurs when a person uses a creative work that
has been protected by copyright laws without the permission of the author or
creator. When it comes to the internet, a copyright provides legal protection to
the owner of a creative work should that creative work be illegally downloaded.
When a person downloads music or books without paying for them, the author
or creator does not receive the royalty, leading to financial loss. For example, in
the early 2000s, peer-to-peer (P2P) file-sharing networks emerged, facilitating the
illegal downloading and sharing of copyrighted works.
A related concept is intellectual property theft. Intellectual property refers to
intangible property in which someone has an ownership right. In the United States,
this not only includes copyrighted material but also patents and trademarks. Pat-
ents are designs to create a unique physical item or plans for a unique process of
doing something. An example of a patent would be the designs for the manufac-
ture of an iPhone. Trademarks are the distinctive logos and other design elements
used by a business to identify itself. An example of a trademark would be Apple’s
logo, which is an apple with a bite taken out of it. As with copyrights, laws are in
place to protect the owner of a patent or trademark should their intellectual prop-
erty be used in an unauthorized fashion.
There are many reasons people would want to download music and movies
from the internet. Most probably do so because it is free. Others may download
items because they find that the product is not available in another format (i.e., it
may be out of print or has been banned). In some cases, the individual may want to
use the product immediately instead of purchasing it and waiting for the product
to be shipped or going to a store to purchase the item. In some cases, the person
may be able to get it on the internet before it is released to the public.
A recent trend is to download copyrighted material from a social media site such
as YouTube and then upload it onto another site such as Facebook, without the
permission of the creator. When this is done, it is called “freebooting.”
IP theft and copyright violations have become extremely common on the inter-
net, simply because it is easy to share files via social media or e-mails. It is simple
to share files with other people. At the same time, it is difficult to track the offend-
ers who are downloading the material. The problems are made worse by P2P sites.
These allow files to be downloaded from the hard drives of other users. Once an
item is on one user’s network, anyone on that network will then have access to
70 C o p y r i g h t I n f r i n g eme n t

those files. Common P2P sites include Grokster, eMule, BitTorrent, Ares, Lime-
ware, Morpheus, iTunes, Napster, Spotify, and SoulSeek. These sites help users
share music, movies, software, or other items over the internet for free.
There are risks to file sharing. In some cases, the networks allow other members
to have access to all files on another person’s hard drive, including any private
files. These networks also open up the opportunity for viruses and other malware
to be installed in other computers. The malware may be attached to files that are
downloaded by an unsuspecting user, and it may harm the computer or even the
network. Software that is downloaded illegally is often of a lower quality than the
real software. It often does not include many of the essential features of the original
product, and the use will not have any documentation that is provided when the
product is sold legally. In some cases, illegal software does not work effectively.
There has been a backlash against P2P sites. In 2000, the rock music group
Metallica filed a lawsuit against Napster in the Northern District of California for
providing a site where people could download music without paying for it. The
judge in the case ordered Napster to remove all of Metallica’s songs from its site. In
2005, MGM Studios filed a lawsuit against the P2P providers Grokster and Stream-
Cast (MGM Studios v. Grokster, 544 US 903 (2005)). The Supreme Court noted that
these services appeared to be marketing themselves as the replacements of Napster
following its shutdown after the ruling from the district court in Northern Cali-
fornia. The Supreme Court decided in favor of MGM, deciding that Grokster and
StreamCast were providing illegal access to copyrighted materials.
As a way to prevent the theft of products and violation of copyright, some orga-
nizations look to see if a purchaser is complying with the software agreements and
not downloading a product too often or sharing it with others.
It is difficult to place a value on the economic impact of copyright infringement
and IP theft. These crimes are difficult to trace, and it is hard to put an estimate on
the amount of illegally shared files. However, experts claim that copyright infringe-
ment costs billions of dollars each year to businesses from people who do not pay
for the products. Additionally, the copyright holders also lose billions of dollars of
profit each year.
IP theft and copyright violations are illegal under both federal and state law. In
the United States, Congress has passed a series of laws to deter copyright infringe-
ment and IP theft. One of those is the No Electronic Theft Act, passed by Con-
gress in 1997. This law set maximum penalties of up to five years in prison and
a fine of up to $250,000. Congress also passed the Digital Millennium Copyright
Act in 1998 that makes it a crime to disseminate any devices or services that are
meant to evade methods that protect copyrighted materials. In 2008, Congress
followed these laws with one entitled the Prioritizing Resources and Organization
for Intellectual Property (PRO-IP) Act. In this law, Congress increased the civil
penalties that could be applied in the case of infringement of copyright laws. It also
increased the government’s power to seize property from offenders.
Under these and other laws, a person who is found guilty of violating copyright
laws may be prosecuted under either system. They can also be prosecuted civilly
or criminally. If found to be criminally responsible, an offender may be sentenced
C o r p o r at e A c c o u n t Ta k e o v e r 71

to jail time and subject to fines. If found guilty of civil offenses, the victim could
sue for monetary damages.
Other agencies are also fighting to protect copyrighted materials. The FBI cre-
ated the National Intellectual Property Rights Coordination Center as a way to
help fight intellectual property theft. The Center is overseen by the Department of
Homeland Security, but it also works in conjunction with various law enforcement
agencies, including Interpol and Europol, to fight against copyright infringement
offenses.

See also: Digital Rights Management; Economy, Effects on; Entertainment, Effects on

Further Reading
Balganesh, Shyamkrishna. 2013. “Copyright infringement markets.” Columbia Law Review
113, 8 (December): 2277–2332.
Jost, Kenneth. 2000. “Copyright and the internet: Should consumers download music and
movies for free?” CQ Researcher, 10 (September 29, 2000): 769–792. http://library
.cqpress.com/
Lemley, Mark A. and Reese, R. Anthony. 2004. “Reducing digital copyright infringement
without restricting innovation.” Stanford Law Review, 56, 6 (May): 1345–1434.
Staff Reporter. 2004. “Google is accused of copyright infringement.” Wall Street Journal,
November 22, 2004. https://www.wsj.com/articles/SB110109619963380645

C O R P O R AT E A C C O U N T TA K E O V E R
A corporate account takeover (CATO) is a type of electronic crime that is similar
to identity theft for businesses. In these events, cybercriminals gain access and
control over a business’s bank accounts and finances and steal the login credentials
and passwords of the company’s officials, employees, or customers often through
phishing activities or social engineering. To do this, the criminals may send an
e-mail to employees that appears to be from a bank or other official business.
If the employee opens the e-mail, malware is downloaded onto the employee’s
computer, which allows the criminal to track the employee’s login information
and passwords. The employee unknowingly provides sensitive information to the
criminals. Some malware sends a message to the offender that the employee has
logged on to the website; the offender is able to send a message to the user that the
system is down or not responding. During the time the employee believes that the
system is down, the offender is able to make transactions in the employer’s name.
In some cases, the offenders may target senior executives as a way to gain access to
the files and accounts.
Once the thieves have access to the accounts, they are able to carry out unau-
thorized transactions in which they can steal money from the organization, result-
ing in substantial financial loss that may not be fully recovered. The criminals
may also create fake employees, placing them on the payroll. They may also steal
information pertaining to customers, or otherwise perform acts that harm the com-
pany’s reputation. A CATO attack can be devastating to the victimized business.
72 C o s t s o f C y b e r c r i me

This type of offense is a growing problem. Companies of all sizes have been
affected, but they are especially dangerous for small businesses. Criminals target
small businesses because they are less likely to have multiple security layers to
protect their networks and accounts. Financial institutions are also at high risk
of a CATO attack because of the large amounts of money that offenders can steal.
To protect themselves, cybersecurity experts advise, the owners of small compa-
nies should become more aware of ways to prevent these attacks and to mitigate the
damages if an attack occurs. The owners should understand that it is important for
businesses to make their employees aware of the dangers of opening e-mail attach-
ments from unknown sources and know how to recognize e-mails that appear to be
real. Businesses should provide training on internet safety to employees on a regu-
lar basis so they remain knowledgeable about threats and how to prevent them.
Businesses should also create relationships with banking institutions to help
the bank identify attempts at unauthorized access or large money transfers. They
can help to identify suspicious activity quickly. Banks can provide training and
education programs for employees. Banks and other financial institutions often
work alongside the U.S. Secret Service and the U.S. Federal Trade Commission
(FTC) to prevent CATO attacks or mitigate the effects. Company officials should
also employ software programs that secure their computers and networks, such as
spam filters and antivirus software. Security updates should be installed as needed,
and employees should use strong passwords that are difficult to steal.

COUNCIL OF EUROPE CYBERCRIME

CONVENTION
In response to concerns over the development and expansion of criminal offenses
related to computers and the internet, the Council of Europe (CoE) created the
Cybercrime Convention in November 2001, sometimes referred to as the Budapest
Convention. The treaty is the first binding international agreement that focuses on
investigating crimes committed through the internet and punishing offenders. The
aim of the treaty is to have synchronized or harmonized international laws against
cybercrime that will also improve investigative abilities of law enforcement agen-
cies through increase international cooperation, with international investigations
and prosecution of cyber criminals. In short, the main goal of the treaty’s creators
was to establish a “common criminal policy” to attack computer-related crimes.
C o u n c i l o f E u r o pe C y b e r c r i me C o n v e n t i o n 77

As new criminal offenses related to computers and the internet developed, it

quickly became apparent that a global approach to solving cybercrime would be
needed if there was to be an effective war on cybercrime. Cybercriminals did not
respect national boundaries, and cybercrime did not affect victims in only one
jurisdiction. Instead, cybercrime was a worldwide phenomenon that required an
international response from law enforcement agencies. A country-by-country or
state-by-state response to cybercriminals simply would not be an effective attack
on cybercriminals.
Initial discussions about a possible treaty concerning cybercrime began in 1997
after a series of harmful computer viruses spread to computers around the world
and few offenders were ever prosecuted for their actions, if they were even identi-
fied. That year, the CoE appointed a Committee of Experts on Crime in Cyberspace
that was responsible for identifying new crimes, jurisdictional rights, and criminal
liabilities associated with the internet. Canada, Japan, South Africa, and the United
States were also invited to participate in the discussions as observer nations.
If states sign and ratify the treaty, they are not obligated to accept all provisions
of the treaty. Instead, they can pick and choose what provisions they choose to
enforce. However, if a country signs on to the treaty, they agree to certain things.
They agree to define or create laws and sanctions within their criminal codes for
four categories of computer-related crimes: fraud and forgery, child pornography,
copyright infringements, and security breaches (including hacking and the dis-
semination of malware that compromises the integrity of a network or data). The
country also agrees to create laws that outline their jurisdiction over these offenses
if the crimes are committed within their country’s boundaries, or if they occur on
registered ships and aircraft, or by their citizens when they are staying abroad.
Countries agree to establish specific procedures for detecting, investigating and
prosecuting those who intentionally commit cybercrimes by collecting and pre-
serving of evidence. By signing, countries also agree to create a system for interna-
tional cooperation for extraditing offenders.
The organization adopted the Cybercrime Convention in November 2001.
Twenty-six member states signed the convention in Budapest, Hungary (thus the
reference to the Budapest Convention). As of April 2018, 57 states have ratified the
document while others have signed but not ratified the document. Both member
states and nonmember states have been asked to participate. To date, only two mem-
ber states oppose the convention and have refused to sign it: Russia and San Marino.
Two nonmember countries signed on to the treaty but did not formally ratify it
(Canada and South Africa). Two other nonmember states have ratified the treaty (the
United States and Australia). Six member states have signed but not ratified.
If a country agrees to participate in the treaty, it agrees to provide international
cooperation to other countries when computer-related crimes occur. It must
provide a contact that will assist another country if it needs help investigating a
computer crime. The treaty provides police agencies with expanded powers to
investigate cybercrimes when the offense crosses national borders.
The treaty is divided into four chapters. Each of the chapters comprises articles,
or provisions, that describe a particular element. In all, there are 48 articles in
78 C o u n c i l o f E u r o pe C y b e r c r i me C o n v e n t i o n

the treaty. The first chapter defines relevant terms related to cybercrime. The first
section of Chapter 2 outlines four broad categories of cyberoffenses. They are: (1)
offenses against the confidentiality, integrity, and availability of computer data and
systems; (2) computer-related offenses; (3) content-related offenses (i.e. child por-
nography); and (4) Offenses relating to copyright infringement. The second section
of Chapter 2 looks more at the procedural aspects of the law, particularly because
countries vary a great deal with regards to how the laws will be implemented and
by whom. On the whole, this chapter is an attempt by the authors to make sense
of the laws on cybercrime and make them more consistent among participating
countries so that cybercrimes can be investigated and prosecuted more effectively.
Chapter 3 of the treaty highlights international cooperation among the interna-
tional community, describing jurisdictional boundaries. The chapter also focuses
extensively on extradition and mutual assistance. Chapter 4 addresses procedural
matters and methods for settling disputes.
Of the 48 articles that the treaty comprises, 33 require nations who ratify it to
adopt or create some kind of legislation that will create a new criminal offense.
In most countries that already have some kind of laws banning cybercrime, this
is relatively easy to do. In those countries that have done little to regulate cyber-
crime, it will be a more difficult task. This is also a difficult task in some countries
because of cultural differences. Another problem is the period of time from when
the Convention was first passed to the present. Many of the technologies that were
commonly used when the document was originally drafted are now out of date and
not relevant. Instead, they have been replaced with new technology that may not
be addressed in the treaty (Brenner, 2007).
Some supporters posit that the treaty will deter cybercriminals because offend-
ers will be more likely to be caught and punished if they commit crimes that harm
businesses or individuals—it will no longer be easy to hide in another jurisdiction
after committing a crime. They agree that if sanctions are used more regularly
against offenders, some offenders may not commit an offense. They may also be
deterred if there is little opportunity for an offender to operate out of a coun-
try where there are lax policies and where they know they won’t be caught or
punished.
Most participants agree that the convention will only work if all countries
adopted the treaty and implement it. There must be cooperation and participation
from law enforcement around the world. This is especially true of those countries
where there is currently only limited enforcement of laws and cybercriminals are
able to operate with little government intervention.
There are opponents to the treaty, or some who are hesitant to support it. Many
opponents have expressed their concerns about the impact of the treaty on privacy
rights of individuals and their civil liberties. They argue that the increased surveil-
lance powers given to law enforcement is too great. They point out that under
the treaty, law enforcement will be able to search individuals and their property
in situations that are currently banned in the United States. It will also allow law
enforcement to send personal data to another country where they may not support
the civil rights of their citizens.
Cracker and Cracking 79

The treaty was amended in March 2006, when the Additional Protocol to the
Convention on Cybercrime was passed. States that have ratified this agree to pass
laws to make it illegal to disseminate racist and xenophobic material through the
internet.

CRACKER AND CRACKING

“Cracker” is a term that refers to a person who breaks into a computer system or
breaches computer security in an attempt to commit criminal or harmful acts such
as stealing data. They may disable features such as copy protection so they can
copy software. In some cases, the cracker will break into a system for profit or to
steal data such as credit card numbers. While they have malicious intent, crackers
usually cause less harm than hackers because they are not professionals and do not
have much knowledge about computers. They are sometimes referred to as “black-
hat” hackers, who intend to commit harm.
Crackers are usually successful because they are persistent. They will try many
different ways to find and exploit a weakness in a computer system’s computer
code. They will sometimes attempt to trick people into giving them passwords or
other personal information. They may pretend to be an employee in the agency, or
send an e-mail that appears to be an official communication from a bank or an IT
department. Another technique used by crackers is to look for a “backdoor” to find
a way into a program, and then exploit the back door.
A cracker can be distinguished from a hacker, who is a person who breaks into
a computer system to learn more about the system or network. Those who iden-
tify as being crackers usually want to know how it works, and generally have an
advanced knowledge of computers. Often a hacker is a professional who has per-
mission to break into a system to look for vulnerabilities so they can be patched.
They are often hired by companies to identify flaws in a security system in an
attempt to fix them. Hackers do not respect crackers.
80 C r a i g s l i s t K i lle r s

One of the most famous crackers was David Mitnick, who started hacking into
computer systems at the age of 12 in order to get a bus pass in Los Angeles. Mitnick
became a “phone phreaker” who broke into the computers of Digital Equipment
Corporation and Pacific Bell. He was apprehended and charged with multiple
offenses, including multiple counts of unauthorized access to a federal computer,
wire fraud, possessing unauthorized access devices, interception of wire or elec-
tronic communications, unauthorized access to a federal computer, and causing
damage to a computer. He served about five years in prison for these offenses.
While some people will argue there is a difference between the terms “cracker”
and “cracking,” most people use the terms interchangeably and do not distinguish
between them.

See also: Backdoor; Black-Hat Hackers; Hacker and Hacking; Mitnick, Kevin

Further Reading
Dittrich, David, and Kenneth Einar Himma. 2006. “Hackers, crackers and computer crimi-
nals.” In Handbook of information security, edited by Hossein Bidgoli. New York: John
Wiley and Sons, pp. 154–171.
Dogaru, Olguta. 2012. “Criminological characteristics of computer crime.” Journal of Crim-
inal Investigation 5, 1: 92–98.
Richet, Jean-Loup. 2013. “From young hackers to crackers.” International Journal of Tech-
nology and Human Interaction 9, 3: 53–62.
Smith, Alan D and William T. Rupp. 2002. “Issues in cybersecurity; Understanding the
potential risks associated with hackers/crackers.” Information Management & Computer
Security 10, 4: 178–183.

CRAIGSLIST KILLERS
Since the development of Craigslist, an internet site for classified ads, criminals
have taken advantage of the site to make contact with other users, sometimes
resulting in death. The term often used when a victim and offender meet online
and arrange a meeting through an online ad or chatroom is “internet homicide.”
There have been multiple murders that have resulted from contacts made through
Craigslist.
Craigslist is an internet website on which people can post classified ads. Indi-
viduals can place ads for jobs, housing, items they have for sale, or just about
anything else. The site was founded in 1995 and has been beneficial for thousands
of people, but it has also been linked to hundreds of rapes, murders, and robber-
ies. A study by Advanced Interactive Media Group found that over 100 murders,
rapes, and robberies have been committed through Craigslist meetings (Dewey,
2016). In these cases, offenders arrange meetings with victims using the pretense
of buying or selling an item or discussing a possible job opportunity.
One of the first murders associated with Craigslist occurred in Minnesota in
October 2007. College student Michael Jon Anderson, 19, met Katherine Ann
Olson, 24, through Craigslist. Katherine wanted to earn money to pay for graduate
C r a i g s l i s t K i lle r s 81

school, and she responded to an ad placed by a woman named Amy to babysit her
daughter. Katherine made a comment to her roommate that Amy seemed odd on
the phone, but she decided to go anyway. When Katherine showed up at Amy’s
apartment to babysit, Amy was not there. Instead, she was met by Anderson, who
shot Katherine in the back of her head. In the end, Anderson was found guilty of
first-degree murder. He was given a life sentence without parole on April 1, 2009.
A more well-known crime spree that involved Craigslist was carried out by
Philip Markoff in April, 2000. This turned out to be one of the most notorious
Craigslist crimes. Markoff’s offenses began on April 10, when he bound and gagged
a masseuse/escort named Trisha Leffler. Leffler had advertised her services on
Craigslist. Markoff arranged to meet Leffler at the Westin Copley Place in Boston,
Massachusetts. During their meeting, he robbed her at gunpoint. A few days later
on April 14, Julissa Brisman was found dead in the same hotel. She had placed an
ad on Craigslist in the Exotic Services section describing her services as a “mas-
seuse.” She had been beaten and shot three times. On April 16, erotic dancer
Corinne Stout became a victim of an attempted robbery at a Holiday Inn Express
in Warwick, Rhode Island. Markoff had a weapon and was attacking Stout when
he was interrupted by the victim’s husband. He pointed the gun at the pair but ran
off before using it.
It wasn’t long before law enforcement charged Markoff with the crimes. Officials
discovered that he was a second-year medical student who allegedly arranged to
meet the victims through ads on Craigslist. Law enforcement officials in Massachu-
setts arrested Markoff on April 20, and he was arraigned the next day in the Boston
court system, pleading not guilty to charges relating to the murder of Brisman.
On March 4, officials in Rhode Island issued a warrant for his arrest. When police
arrested Markoff, they searched his apartment and found a semiautomatic weapon,
duct tape, wrist restraints, and other items that were used in the crimes.
A grand jury indicted Markoff in June, 2009 for first-degree murder, armed
robbery, and other criminal charges. While held in jail before the trial, Markoff
attempted suicide multiple times. Markoff took his own life on August 5, 2010,
while in jail. In 2011, the Lifetime television network released a movie based on
Markoff’s alleged crimes, titled The Craigslist Killer.
Another event related to Craigslist occurred in Ohio in November, 2011. Six-
teen-year-old Brian Rafferty and 52-year-old Richard Beasley placed an ad on
Craigslist expressing their interest in hiring a farm assistant who would care for
cattle on a 688-acre property for $300 a week. Over 100 people expressed an
interest in the position. The first person to respond to the ad was David Pauley,
from Norfolk, Virginia. When Pauley traveled to Ohio to interview for the position,
Rafferty and Beasley shot and killed him.
Later that year, Rafferty and Beasley lured another victim to Ohio through Craig-
slist. The men placed another ad in which the pair sought a farm assistant, to
which Scott Davis, of South Carolina, responded. Davis met Rafferty and Beasley
on November 6, and they all walked a short distance through a wooded area.
However, Rafferty then pointed a gun at Davis. When Davis fled, Rafferty shot him
82 C r a i g s l i s t K i lle r s

in the arm. Rafferty hid in the woods for seven hours, eventually approaching a
nearby house for help. The homeowner called 911 and the local police.
On November 13, Rafferty and Beasley picked up their third victim, Timothy
Kern, 47, at a pizza shop near Massillon, Ohio. Kern, a father of two young boys,
had recently lost his job and was seeking employment. Beasley shot Kern five
times, killing him. By then, Rafferty’s family had reported him missing, and along
with the information from Davis, the local sheriff’s office began to investigate pos-
sible wrongdoing. They worked jointly with the FBI and were able to link Beasley
and Rafferty with the crimes. Authorities arrested Beasley and Rafferty on Novem-
ber 16.
Rafferty was charged with one count of attempted murder and one count of
complicity to attempted murder. He was tried as an adult and sentenced to serve
a life sentence without parole. Beasley was convicted for killing Pauley and Kern,
and a third man named Ralph Geiger whom Beasley killed for the purpose of steal-
ing his identity. He was also found guilty for the attempted murder of Scott Davis.
One final example of a Craigslist murder took place in March 2009 when
16-year-old John Katehis murdered popular ABC radio news reporter George
Weber, 47, in New York. Katehis placed an ad on Craigslist in which he advertised
his sexual services. At the same time, Weber posted that he was looking for sexual
services. Katehis stabbed Weber 50 times, claiming self-defense because Weber
attacked him first. Katehis was arrested and confessed to the crime. He was found
guilty of murder and sentenced to serve 25 years to life in prison.
Craigslist has been criticized for providing a forum for criminal activity. How-
ever, officials at Craigslist deny any responsibility for any of these crimes.

CREDIT CARD FRAUD

The term “credit card fraud” refers to any theft or fraud committed with or by using
a stolen credit card or debit card to make unauthorized purchases or withdraw
funds from another person’s account. Cybercriminals steal personal and financial
data from another person and then use that for illegal activities. They can make
CNP (card not present) purchases that are carried out without the physical card,
which can be made when a person uses the card numbers and information but
does not show the actual card. These are purchases made via an online website,
over the phone, or through the mail. The offender will often purchase high-end
products such as technology and then resell the product to make a significant
profit. Some offenders use the stolen information to make a fake card, which is
used to make purchases in stores or other outlets. Often, the stolen credit card
information is sold on the internet to other criminals. Credit card fraud can result
in great financial loss for both the credit card company and for the individuals
whose information is stolen.
It has been estimated that around 0.1 percent of all credit card transactions
are fraudulent (Bennett, 2015). Many breaches have been attributed to criminal
organizations who steal the information and then sell it on the dark web. The
information from a good credit card can sell for an average of $21 (Taylor, 2016).
One criminal organization, called FIN6, has developed a reputation for its ability
to steal credit card information and then sell it on the dark web. They do not use
the card information to make illegal purchases but instead sell the information
to others. This group is known for its ability to get the stolen information on the
market quickly, before it can be reported as stolen. They do this because current
card information is worth more than card information that has been available for a
longer period of time (Schwartz, 2016).
There have been many well-publicized incidents of credit card fraud. In 2013,
the retail store Target’s system was breached, and the data of 40 million customers
was stolen, including names, credit card numbers, expiration dates, and security
codes. That same year, payment card data that had been stored on company com-
puters was stolen from Neiman Marcus. In 2014, an attack on Home Depot led to
the possible theft of card information from 56 million customers. In May 2016,
criminals stole data from the South African Standard Bank Group and used that
information to create fake credit cards. The criminals made about 1,600 cards and
used them to withdraw $13 million in cash from cash machines located through-
out Japan. They withdrew about $913 in each withdrawal, the maximum amount
allowed per each transaction. In all, they made 14,000 transactions.
Credit card fraud is difficult to stop. Often, the card holder is unaware that their
card has been stolen and used fraudulently, giving thieves time to make purchases.
It is also difficult to identify the offender and recover any stolen goods or funds.
Many offenders work in countries where the laws don’t cover these acts or where
law enforcement does not enforce the laws vigorously. The offenders also move
around a lot so it is difficult to locate them. In all, credit card fraud is a relatively
easy crime to carry out, and there is a low chance of being convicted for it.
84 C r e d i t Ca r d F r a u d

There are many methods that offenders use to commit credit card fraud. Offend-
ers can commit credit card fraud through the use of malware (malicious software)
such as worms, viruses, or Trojans. A criminal will install malware onto a compa-
ny’s website so that when the victim uses the website, the malware is unknowingly
downloaded onto the user’s computer. The malware allows the offender to have
access to the victim’s personal information on that computer, including the victim’s
e-mails, bank accounts, and even passwords.
For example, a criminal may install a keylogger that will track every keystroke a
victim makes on the keyboard. From this, the offender can access credit card and
account information directly from a victim’s computer. Or an offender may use a
phishing attack whereby a victim will receive an e-mail that appears to be from a
legitimate company or organization that is seeking the victim’s personal informa-
tion. The e-mail may appear to be from a bank, indicating that there is a problem
with an account. The victim is tricked into providing details that the criminal can
use to steal money. In some cases, there is an attachment to the e-mail, and when
the victim clicks on the attachment, malware is installed on the computer that
allows the offender access to information. This type of social engineering allows an
offender to steal the card information through contact with the individual.
Credit card numbers have also been stolen in person, such as restaurant employ-
ees copying the numbers on a card or even using carbon paper to steal the informa-
tion, a practice called “manual credit card imprints.” There have also been cases in
which a merchant or seller has worked with offenders to steal credit card informa-
tion from a customer.
Other offenders have used card skimming devices to acquire the numbers. These
can be placed on any payment device, but they are often found on gas pumps, in
ATMs, or in restaurants and bars. Skimmers are small devices that are attached to
a card swipe device. When a customer swipes their card, the device stores the card
numbers and information. If the device is on the swipe device for an extended
time, it can steal the numbers off of hundreds of cards. A similar technique is a
keypad overlay, which is placed on a keypad. When the keypad is used by a victim,
the information is wirelessly transmitted to the offender.
Criminals sometimes steal cards when they are sent to a customer through the
mail. In this case, the legitimate card holder never receives the card, so he or she
is unaware that the card has been stolen and does not report the theft. A similar
technique is application fraud, whereby a criminal applies for a credit card using
another person’s name and information that they are able to steal from other infor-
mation or from online sources.
Once the information from a credit card is stolen, the offender is able to carry out
an “account takeover.” This occurs when an offender uses the stolen card informa-
tion to report that the card has been stolen and then requests a change of address.
A new card will come in the mail and can be used by the offender for fraudulent
purchases. Thus the offender takes over the account and makes transactions on it
without the permission of the owner.
In an attempt to stop the theft of credit card numbers, most credit card compa-
nies are now placing an EMV chip on cards instead of raised numbers, which are
Cryptocurrency 85

much easier to steal. Cardholders can also make efforts to protect themselves from
the theft of card data, such as checking accounts regularly for suspicious activity,
reporting lost or stolen cards, updating virus protection software, and avoiding
opening any e-mails from suspicious sources. Merchants can also take action to
reduce the opportunity for credit card fraud. They can issue receipts that do not
print the credit card numbers on them. They can also request identification from
people who are using credit cards to make purchases and install updated antivirus
programs to ensure their systems do not have malware on them.
A new proposal to combat credit card fraud is a virtual credit card. The card
functions as a traditional card in that the numbers on a card are linked to an
account. However, the card can only be used once, either at a merchant or online,
after which time the card will expire. In some cases, a customer can have a differ-
ent credit card number for every retailer. This will limit the possible damage if the
data is stolen.

Musa, Sarhan M. 2018. Network security and cryptography: A self-teaching introduction.

Dulles, VA: Mercury Learning and Information.
Nakamoto, Satoshi. 2008. “Bitcoin: A peer-to-peer electronic cash system.” Bitcoin.org.
https://bitcoin.org/bitcoin.pdf
Peterson, Andrea. 2014. “Hal Finney received the first Bitcoin transaction. Here’s how
he describes it.” The Washington Post, January 3, 2014. https://www.washingtonpost
.com/news/ the-switch/wp/2014/01/03/hal-finney-received-the-first-bitcoin-transac
tion-heres-how-he-describes-it/?utm_term=.82ddd0bb27d8
Stallings, William. 2011. Cryptography and network security: Principles and practice, 5th Edi-
tion. Boston: Prentice Hall.

C Y B E R B U L LY I N G
Cyberbullying can be defined in multiple ways, such as “actions using information
and communication technology to harm another person” (Bauman, 2011, p. 4).
Another similar definition explains bullying as being when a person is “tormented,
threatened, harassed, humiliated, embarrassed or otherwise targeted” (Stop cyber-
bullying, n.d.). In 2014, experts working with the Centers for Disease Control
and Prevention, along with officials at the U.S. Department of Education, came
up with a uniform definition of bullying: “Bullying is any unwanted aggressive
behavior(s) by another youth or group of youths who are not siblings or current
dating partners that involves an observed or perceived power imbalance and is
repeated multiple times or is highly likely to be repeated.” In short, cyberbullying
is the use of technology or electronic devices to post messages or comments that
are abusive or harassing or may cause the victim to feel ashamed or embarrassed.
It may include embarrassing pictures or personal information or rumors that are
defamatory. The hurtful behavior is intentional and repeated. It is also typically
directed toward a person who is not able to, or lacks the power to, defend them-
selves (Patchin, 2017b).
Cyberbullying is not a single incident of an offensive comment. It is recurring
negative comments and attacks that are aimed at one individual. These attacks can
be very harmful to the victim, especially if they continue for a long period of time.
Victims will often feel traumatized, and experience distress and anxiety. Some may
also stop attending school (Patchin, 2017a). Cyberbullying can cause not only
embarrassment to the victim but also, in some cases, physical harm. There have
been many cases of people dying by suicide due to the effects of cyberbullying.
Those who cyberbully another person may threaten to harm the victim, a family
member, or friend.
The impact of cyberbullying can be grim. In 2002, Gyslain Raza, a teenage boy
from Quebec, Canada, made a video of himself using a golf club to imitate the light-
saber action sequences seen in the Star Wars film franchise. Other students found
the video in his high school’s video studio and uploaded it to the internet without
Raza’s knowledge. The video was viewed over 900 million times and spawned a
number of spoofs. Raza dropped out of school and had to receive therapy. He sued
the four students who posted the original video. The case was settled out of court.
90 C y b e r b u ll y i n g

On September 9, 2013, 12-year-old Rebecca Sedwick killed herself by jumping

off a silo. She had been bullied by other girls through social media postings and
even moved to a different school but could not get away from the harassment,
much of which was on social media. Two other girls, ages 12 and 14, were eventu-
ally arrested and charged with felony aggravated stalking for their behavior toward
Rebecca.
Megan Meier’s story was much the same. Megan, who was 13 and lived in Mis-
souri, had been bullied for years in her school. Megan met a young man named
Josh Evans on the social media site MySpace. The pair had pleasant conversations
for about six months, and Megan thought Josh liked her. After that, Josh began
writing negative messages to Megan, such as, “The world would be a better place
without you” (Maag, 2007). Other people also began to post negative messages
about Megan online. Even though Megan’s mother told her to sign off, Megan
chose to remain online and continue to read the messages. After reading the nega-
tive comments, Megan hanged herself in her closet.
In the end, there was no person named Josh. Lori Drew, the mother of Megan’s
classmate and former friend, wrote the comments that claimed to be from “Josh.”
Megan and Drew’s daughter had a fight, and Drew formed a relationship with Megan
under the false pretenses of being a teenage boy, as a way to find out what people
were saying about her daughter. Drew also sought to embarrass Megan. After their
conversations were becoming, as Drew described, tedious, she sought to end it
and began writing negative comments. Drew was prosecuted under the Computer
Fraud Act of 1986 that was intended to be used on hackers. She was convicted of
three misdemeanor offenses, but the judge dismissed all charges against her. The
events led members of Congress to propose the Megan Meier Cyberbullying Pre-
vention Act in 2008 that would have made it a crime to coerce, intimidate, harass,
or cause substantial emotional distress to a person (Hinduja and Patchin, 2013,
p. 17). However, the proposed bill did not have enough support to pass.
Cyberbullying can take place in chat rooms, blogs, e-mails, texts, social net-
works (Twitter, MySpace, Instagram, Snapchat, or Facebook), YouTube, or any
other online communication platform. It has even occurred on online gaming sites
where players have online roles. Cyberbullying must involve at least one minor.
If it involves only adults, it is considered to be cyberharassment or cyberstalking.
Bullying is an act that has existed for many years. Teasing between children or
even adults is not a new phenomenon. However, it used to be a physical behavior
and not concealed. If a person was bullied, the offender was known to them. Bul-
lying behaviors today are an extension of traditional types of bullying. Comments
made on social media are widely distributed. The number of people who can read
the comments or who are exposed to them is huge. Many people make comments
whether they know the victim or not. Moreover, those comments may remain
anonymous, so they are sometimes very offensive, cruel, or hurtful.
According to the National Crime Victimization Survey, in 2015 about
20.8 percent of students admitted they were the victims of bullying. Much of
today’s cyberbullying behavior takes place in schools and among teenagers. In fact,
most cyberbullying occurs in ninth and tenth grade (Englander, 2013). It is not
C y b e r b u ll y i n g 91

uncommon as early as elementary school. School officials are usually trained to

recognize bullying behavior, but it is difficult to stop. Even though teachers are
trained, it can be difficult to remove messages from the internet once they have
been posted and sent to others. It is also difficult to prevent further postings. There
are multiple places where people can post comments, including the internet, social
media, and phones, among others.
There are some other related terms to cyberbullying. In “flaming,” or online
fighting, people send angry messages, often obscene, to one another. These insult-
ing interactions are often personal attacks and are often filled with untruths. They
can be frustrating, annoying, and hurtful to everyone involved.
Another term is “masquerading,” which occurs when a person pretends to be
another person and sends messages or posts items that appear to come from the
person. The postings may be false or embarrassing (whether true or false). A simi-
lar term is “outing,” which is when confidential information is posted that can be
embarrassing or hurtful. It is usually done to “out” a person by telling an embar-
rassing secret or posting embarrassing pictures. A more recent behavior, called
“catfishing,” occurs when a person presents false information to create a relation-
ship with another person.
Trolling is a third related term. Trolling refers to the process of deliberately and
secretly making people mad on the internet. This can be done by making ran-
dom unsolicited and/or controversial comments or posts that serve to make oth-
ers angry, possibly provoking an argument or fight. These are people who seek to
cause trouble for no apparent reason. Those who seek to troll a victim will often
make comments about YouTube videos, about blogs, or in forums. They also often
make comments on social media sites. They may post misinformation or make a
sarcastic remark simply to get a rise out of another user or start a fight. Some say
that trolling is just pranks that are meant to simply poke fun at others, but others
say that trolling amounts to online harassment by people who like to cause trouble.
A person who is found guilty of cyberbullying can be charged with harassment.
New statutes have made cyberharassment a crime, but in some jurisdictions, cyber-
bullying behavior is a form of bullying in general. Many states have passed some
form of legislation to deter cyberbullying, many of which require local schools to
create antibullying policies. The effect of these policies may be limited, however,
because much of the cyberbullying occurs during nonschool hours.

CYBERSECURITY ACT OF 2012

Senator Joe Lieberman (I-CT) introduced the Cybersecurity Act of 2012 (SB 2105)
in February 2012, along with four cosponsors: Susan Collins (R-ME), Dianne
Feinstein (D-CA), John Rockefeller (D-WV), and Sheldon Whitehouse (D-RI). The
general purpose of the law was to enhance the cybersecurity of the nation’s infra-
structure as it pertains to national security, its economic security, or the nation’s
health and safety. The bill’s supporters sought to increase security practices that
would be cost-effective and efficient while at the same time protecting civil liberties
of citizens and their right to privacy.
Cybersecurity Act of 2012 95

Under the proposed bill, the secretary of Homeland Security was given
the responsibility to designate structures in the United States as a component
of the nation’s critical infrastructure. In order to be included, the structure would
have to meet two requirements. First, the structure must be one that if it were
incapacitated or disrupted, there would be a debilitating effect on national secur-
ity, the nation’s economic security, or the health or safety of the public. Second, the
structure had to be dependent on information in order to operate. The secretary
could also take other factors into consideration when designating structures as
critical infrastructure, such as any interdependencies with other critical infrastruc-
ture components or the size of the structure.
Provisions in the proposed law encouraged all stakeholders to regularly dis-
cuss ways to increase national security through something called the Critical Infra-
structure Partnership Advisory Council. This would include representatives from
sector-specific agencies that oversee the country’s critical infrastructure, agencies
that regulate the critical infrastructure, those with specific expertise on services
provided by the critical infrastructure, as well as those in the private sector who
own or operate the critical infrastructure. Increased communication and exchange
of information was highly encouraged. The proposed law defined “covered criti-
cal infrastructure” as any critical infrastructure that would be protected under the
new law.
In addition to defining critical infrastructure, the secretary of Homeland Secu
rity was also given the task of establishing risk-based tiers that defined some infra-
structure as more critical than others. These critical components would receive
more protection than others. The tiers would have been based on the vulnerabil-
ity to an attack, the ability of the infrastructure to survive a cyberattack, and the
consequences if the infrastructure was attacked. This list would be reviewed and
updated as necessary.
Under Section 4 of the proposed law, the secretary of Homeland Security was
required to establish a process that would be used to identify cybersecurity risks
that could be mitigated as a way to protect the nation’s infrastructure. The secre-
tary was to work with other agencies, state and local governments, and the private
sector to develop these standards. In Section 5 of the proposed law, the owners or
operators of critical infrastructure were asked to create plans to increase cybersecu-
rity. They would also certify that the plans were being implemented.
Evaluations were part of Section 6 of the law. Here, the secretary was required
to determine if the owners and operators of critical infrastructure were carrying
out mitigation efforts. The secretary was to select an accreditor (evaluator) who
would evaluate the critical infrastructure, monitor and inspect the operations of
the infrastructure, and ensure that the infrastructure is complying with their miti-
gation plans.
All owners or operators of a critical infrastructure would be required to report
any incident of concern to the secretary of Homeland Security. The secretary would
then have been required to develop a plan to disseminate that information to the
attorney general, who would promptly investigate it. However, under Section 7,
the information is protected from public disclosure and exempted from publication
96 Cybersecurity Act of 2012

under the Freedom of Information Act of 1967. Further, any security information
could not be disclosed to the public. One exception to this provision allows for
information to be shared with other government agencies to mitigate any further
cybersecurity threats, or to assist other federal government agencies to carry out
their functions. This provision was included to prevent others from exploiting any
identified vulnerabilities.
Other provisions in the law would add other elements to protect the coun-
try’s infrastructure. One provision amended the Homeland Security Act of 2002 to
establish a National Center for Cybersecurity and Communications. The duties of
the Center would be to manage efforts to secure, protect, and ensure the resiliency
of the federal information infrastructure. Another provision required the secretary
of Homeland Security to implement outreach and awareness programs on cyberse-
curity and to create a program to identify, develop, and recruit talented individuals
to work in cybersecurity.
Agencies other than DHS would have been given additional responsibilities
under the law. For example, the director of the National Science Foundation (NSF)
was given the task of establishing a program that would increase innovation in
cybersecurity research. They were also tasked with recruiting and developing pro-
fessionals to work in the field of cybersecurity. Another agency, the Director of the
Office of Personnel Management (OPM), was given the responsibility to assess the
readiness of the federal agencies to meet cybersecurity needs. Along with this, they
were to create an awareness and education curriculum for all federal employees
and contractors about the need for cybersecurity.
A third agency that would have had additional tasks was the Department of
Education. Officials here would have had to develop model curriculum for ele-
mentary students to increase their awareness of cybersecurity issues. Finally, the
director of the Office of Science and Technology Policy was required to develop a
national cybersecurity research and development plan that would have advanced
the development of new technologies to protect the country’s infrastructure against
any threats of cybercrime. The bill received a lot of attention, but it did not have
enough support to become law. The Senate vote on the bill was 52-46, preventing
it from moving to the House of Representatives.

See also: CAN-SPAM Act of 2003; Computer Fraud and Abuse Act of 1986; Cyber-
security Enhancement Act of 2014; Cybersecurity Workforce Assessment Act of
2015

Further Reading
McCain, John, Kay Bailey Hutchison, and Saxby Chambliss. 2012. “No cybersecurity exec-
utive order, please.” Wall Street Journal, September 13, 2012. https://www.wsj.com
/articles/SB10000872396390444017504577647131630683076
S. 2105 (112th Congress): “Cybersecurity Act of 2012.” govtrack. https://www.govtrack.us
/congress/bills/112/s2105
“Section by section, cybersecurity regulatory framework for covered critical infrastruc-
ture.” https://obamawhitehouse.archives.gov/sites/default/files/omb/legislative/letters
C y b e r s e c u r i t y a n d I n f r a s t r u c t u r e Se c u r i t y A g e n c y ( CIS A ) 97

/cybersecurity-regulatory-framework-for-covered-critical-infrastructure-act-section
-by-section-analysis.pdf
Shackelford, Scott J. 2011–2012. “In Search of Cyber Peace: A Response to the Cybersecu-
rity Act of 2012.” Stanford Law Review Online 64: 106–111.

CYBERSECURITY AND INFRASTRUCTURE

SECURITY AGENCY (CISA)
On November 16, 2018, President Donald Trump signed the Cybersecurity and
Infrastructure Security Agency Act that established the Cybersecurity and Infra-
structure Security Agency (CISA). The new agency oversees the nation’s computer
systems and acts as the country’s risk advisor. It coordinates with businesses and
other partners to protect computer networks against potential threats. It is respon-
sible for ensuring that the country’s computers secure and resilient in an attack
should occur. The agency’s mission statement is “Defend Today, Secure Tomorrow.”
CISA provides information to agencies, businesses, and other stakeholders
regarding cybersecurity. The agency’s priorities include protection of the federal
computer network, comprehensive protection of all computers, increasing the resil-
ience of computer infrastructure, and increased emergency communications. The
agency was assigned to provide information and alert agencies about any current
threats that may impact systems. This includes information on possible patches, if
needed, to help prevent the progression of an attack. Information will also be pro-
vided to the public so they are made aware of potential malware that could affect
their computers. If needed, CISA will carry out detailed analysis reports on inci-
dents. All information will be shared with all interested parties in a timely fashion.
Additionally, CISA serves as the federal government’s agency to receive and pro-
cess information on all cyber threats to the United States, including all federal and
nonfederal agencies. Any information about a cyberincident will be exempt from
public disclosure and will be protected from use in any potential civil litigation.
Included within CISA is the National Cybersecurity and Communications Integra-
tion Center (NCCIC). This organization comprises of the U.S. Computer Emergency
Readiness Team (US-CERT) and the Industrial Control Systems Cyber Emergency
Response Team (ICS-CERT). The U.S. Computer Emergency Readiness, or U.S.
CERT, was created in 2003 after Congress passed the Federal Computer Incident
Response Center (FedCIRC). The agency was given the responsibility of analyzing
and reducing cyberthreats across the United States. It provides information about
security threats to stakeholders along with suggestions for avoiding them. Officials
often work with experts from around the world to prevent cyberattacks. They pro-
vide cybersecurity protection to federal agencies as well as to state, local, tribal, and
territorial governments. They are also tasked with responding to any incidents that
may occur. ICS-CERT seeks to reduce the risk of a cyberevent within all critical
infrastructure sectors. They work in conjunction with local law enforcement officials
and private owners and operators on security issues and efforts for mitigation.

CYBERSECURITY ENHANCEMENT ACT OF 2014

Senator John D. Rockefeller IV (D-WV) introduced the Cybersecurity Enhance-
ment Act of 2014 to the Senate in July 2014. The law was intended to create a
continuing, voluntary partnership between public and private agencies and indi-
viduals as a way to improve the nation’s cybersecurity. There were also provisions
in the law geared toward strengthening research and development in the cyberse-
curity area. Other areas of the bill were included to establish programs workforce
development programs, education programs, and public awareness. The Senate
and House of Representatives passed the bill on December 11, 2014. President
Barack Obama signed the bill into law on December 18, 2014.
Title 1, Public-Private Collaboration on Cybersecurity aimed to facilitate the
development of a voluntary federal plan to reduce the risks of cybercrime to criti-
cal infrastructure. The secretary of commerce was directed to oversee the develop-
ment of the cybersecurity research and development strategic plan that was to set
standards that would reduce risks of cybercrime to critical infrastructure across the
country. The program was to be industry-led so that the plans would be workable
and supported by all involved.
Under the law, the secretary, industry representatives, and private-sector per-
sonnel (critical infrastructure owners and operators) were to meet on a regular
basis to help identify, assess, and manage cyber risks. Upon doing that, the par-
ticipants were asked to identify possible impacts of the proposed measures on
business owners’ needs to keep much of the information involved confidential.
Representatives from businesses were concerned about the possibility that they
would be forced into making their business secrets public or releasing confidential
security measures used in their facilities. For them, the law required that the group
C y b e r s e c u r i t y E n h a n c eme n t A c t o f 2 0 1 4 99

consider different methods to mitigate the potential impact that the new policies
would have on these organizations.
At the same time, as the law noted, it was important to maintain the civil lib-
erties and privacy of individuals, whether they be clients, customers, owners, or
employees. The ultimate goal was to identify a prioritized, and flexible set of stan-
dards that were cost-effective and would be voluntarily adopted and supported by
all involved.
Title 2, Cybersecurity Research and Development, stipulated that once the over-
all plan was developed, the heads of federal agencies and departments, along with
owners and operators of critical infrastructure, would meet every four years to
update it. This would keep it relevant to any new technology. The research and
development strategy included 10 federal agencies, including the Department of
Defense, the NASA, the Department of Energy, and the Environmental Protection
Agency (EPA), among others.
Title 3, Education and Workforce Development, supported internships or
other work experience in the federal government through scholarships. The
director of the National Science Foundation, along with the director of the
Office of Personnel Management and the Secretary of Homeland Security,
were charged with overseeing the Federal Cyber Scholarship for Service Pro-
gram. This was to provide scholarships to college students who are interested
in careers in cybersecurity. This would help to train the next generation of
information technology professionals. The law mandated that any student who
received the scholarship would be required to work in the period equal to the
length of the scholarship.
In Title 4, Congress created the National Cybersecurity Awareness and Educa-
tion Program. The director of the National Institute of Standards and Technology
was asked to coordinate a national cybersecurity awareness and education pro-
gram for the public that would increase the general awareness of cybersecurity,
online safety, and cyberethics.
The final part of the law, Title 5, was labeled Advancement of Cybersecurity
Technical Standards. Here, it was required that there be coordination with all fed-
eral agencies and that they be included in the development of international stan-
dards related to cybersecurity.

See also: CAN-SPAM Act of 2003; Cybersecurity Act of 2012; Cybersecurity Work-
force Assessment Act of 2015

Further Reading
Benzel, T. 2015. “A strategic plan for cybersecurity research and development.” IEEE Secur-
ity & Privacy 13. https://ieeexplore.ieee.org/abstract/document/7180232/
Rodin, Deborah Norris. 2014–2015. “The cybersecurity partnership: A proposal for cyber-
threat information sharing between contractors and the federal government.” Public
Contract Law Journal 44: 505.
S.1353—Cybersecurity enhancement act of 2014. Congress.gov. https://www.congress.gov
/bill/113th-congress/senate-bill/1353
100 C y b e r s e c u r i t y W o r k f o r c e A s s e s s me n t A c t o f 2 0 1 5

CYBERSECURITY WORKFORCE ASSESSMENT

ACT OF 2015
As part of the Consolidated Appropriations Act of 2016, the Cybersecurity Work-
force Assessment Act aimed to protect the nation’s information technology sys-
tems and networks and protect sensitive data. This would also help to protect the
financial, health care, transportation, and energy grids for the nation. It was also
meant to attract a diverse pool of applicants to fill cybersecurity-related openings.
President Barack Obama signed the bill into law on December 18, 2015.
The law had two goals: to increase and improve the workforce in federal cyber-
security positions in the DHS by providing education and training to employees
who require it and to increase collaboration between federal agencies, the Office of
Personnel Management, and the National Initiative for Cybersecurity Education in
order to reduce cybercrime.
To improve the federal workforce in cybersecurity, the law directs the secre-
tary of Homeland Security to carry out a review of the cybersecurity workforce
in the department within 180 days of the bill’s passage. The assessment includes
the readiness and capacity of the DHS workforce to meet its cybersecurity mis-
sion; the location of cybersecurity workforce positions within DHS; which tasks
are performed by permanent full-time employees, by independent contractors, or
by individuals who are employed by other federal agencies; which positions are
vacant; the percentage of individuals within each specialty area who have received
essential training necessary so they can perform their jobs effectively; and, in cases
where training was not received, what challenges were encountered regarding the
training.
Once this is done, the secretary is to develop and then implement a strategy to
maintain a workforce that is trained, ready, and capable of preventing cybercrime.
Moreover, every three years, the secretary must update the strategy to include a
plan to recruit qualified personnel, a 10-year projection of the cybersecurity work-
force needs of DHS, and a list of potential obstacles to reaching that goal. The proj-
ect should also include an indication of any gaps that may exist in the workforce at
DHS and a plan to fill that gap.
The law provides for scholarships and tuition waivers for many employees seek-
ing additional education or training needed to more effectively perform their jobs.
The agency also works with colleges and universities who offer a cybersecurity cur-
riculum to support employee education and training. The law also allowed DHS
to recruit additional employees as needed, hire new employees who have cyber
skills, and retain those employees who already have the skills needed to perform
the tasks. The law also enables DHS to hire new employees as needed to address
new cybercrimes as they evolve.
To reach the second goal of increasing collaboration between agencies, the law
mandates that the agencies involved come up with a better way to share infor-
mation about cybersecurity with private-sector agencies and federal government
agencies. This way, information on possible cybersecurity threats can be more eas-
ily shared with other agencies. The law also establishes a system for government
C y b e r s q u at t i n g 101

agencies and private agencies to monitor particular information systems to stop

cyberattacks. This can be done with the help of the National Cybersecurity and
Communications Integration Center, which is part of the Department of Home-
land Security, which will serve as a clearinghouse for information. Any private
agencies that choose to share information will not be forced into providing any
information that may result in the loss of trade secrets. They will also be protected
from any liability.
The law will be effective for 10 years after its effective date unless Congress opts
to change it or pass another piece of legislation.

A practice similar to cybersquatting is typosquatting. Typosquatting is the act

of purchasing a domain name with a spelling that is slightly off from a popular
domain name. An example of typosquatting is the case Lamparello v. Falwell, 420
F.3d 309 (2005). In that case, Christopher Lamparello, after hearing Reverend
Jerry Falwell share views on homosexuals that Lamparello found objectionable,
registered the site www.fallwell.com, a domain name that included one more “L”
than Falwell’s www.falwell.com. Lamparello used his site to combat what he saw
as falsehoods that Falwell was teaching about LGBTQ persons. The court ruled in
Lamparello’s favor as he did not appear to be using the site to elicit money from
Falwell.
In another case, a Canadian teenager named Mike Rowe registered the domain
name mikerowesoft.com, a play on his name. Lawyers for Microsoft in Canada
contacted Rowe and informed him they believed his website infringed on Micro-
soft’s trademark. The matter was ultimately settled out of court with Rowe receiv-
ing, among other things, an Xbox (Kotadia, 2004).
While typosquatting can be used in the same way as cybersquatting to elicit
money from the individual or corporation whose domain name is being mimicked,
it can also be used as a means of driving more unintentional web traffic to a site.
This practice, per se, does not appear to be illegal in the United States.

magazines, expensive goods, or excessive amounts of a product. These can be

delivered to a victim’s place of employment, bringing further embarrassment.
In the past, traditional or offline stalking required the victim and offender to
be in the same geographical area. Today, a cyberstalker can be physically located
anywhere, and they do not need to confront the victim. This means that the social
barriers to harassing another person no longer exist. Moreover, a cyberstalker may
never be identified, and most know they will not be caught and punished. This all
makes it easier for an offender to stalk another.
Victims of cyberstalking don’t always know the offenders. Men are more often
the stalkers, and women are more often the victims (Kremling and Parker, 2018).
The U.S. Department of Justice reports that 850,000 American adults, most of
whom are women, are the victims of cyberstalking. In addition, the Pew Research
Center indicates that 40 percent of adult internet users have experienced harass-
ment online (Sweeney, 2014). The stalkers are often motivated by jealousy or
revenge. An offender can also encourage other people to harass the victim, either in
addition to his or her postings or in place of them. In some cases, the cyberstalker
may arrange to meet the victim, sometimes leading to physical assault.
One organization that has the goal of reducing cases of online stalking is WHOA,
or Working to Halt Online Abuse. They and other experts have suggested a num-
ber of ways to prevent cyberstalking. Some of the ideas are listed below:

1. Be sure to log out of your computer when you are done using it. This
way no one will be able to use your account to send e-mails under your
name or steal information that you may have left on the computer. Simi-
larly, use passwords on cell phones so no one else has access to steal your
information.
2. Be very clear to a potential stalker that their communication is unwanted.
After that, have no further contact or communication with that person.
3. Use strong passwords, and don’t give them out to anyone. Be sure to change
passwords often.
4. Communicate online only with people that you know and trust. If you
must communicate with strangers, set up an anonymous account for that.
5. Be careful of posting upcoming events you are attending, or even your cal-
endar, on social media. A stalker could use this information to show up at
events or track your comings and goings.
6. Be careful what private information is posted on social networks. Be sure
to use privacy settings and limit who can view your information. Never
provide any private information online. Remove any personal information
that may currently exist and do not replace it.
7. Report any cyberstalking behavior to the police or to your internet service
provider (ISP). If there are any hard copies of messages or communications,
keep those in case you will need them as evidence.
8. Don’t use a public Wi-Fi spot for personal e-mails or messages.
9. Maintain a current virus protection software on all computers or devices.
10. Don’t upload photos that can show your location or places.
106 C y b e r s tal k i n g

On the federal level, there is limited protection for victims. The Violence against
Women Act (2000) included cyberstalking as part of the federal stalking stat-
ute. Another piece of legislation designed to protect victims of cyberstalking is
the Combat Online Predators Act, authored by House member Brian Fitzpatrick
(R-PA), a former FBI special agent and federal prosecutor. The purpose of the pro-
posal was to increase criminal penalties for up to five years for behaviors related
to the stalking of minors. The bill passed the House of Representatives but went
no further. The proposal was in response to the cyberstalking of a female teen
by a friend’s 51-year-old father on social media. The father plead guilty to a mis-
demeanor stalking charge, and the judge in the case sentenced him to a term of
probation and counseling. Three years later, in 2016, the same man contacted the
female again. This time, he was arrested and sentenced to prison for a term of 18
months to seven years. The bill was proposed in 2017, but it did not have the sup-
port to be passed into law.
Some states have laws that ban harassing another person through electronic
means, and others have included it in their general laws against stalking. Most
of the state laws are vague and sometimes not effective in protecting victims. For
example, California passed the first cyberstalking legislation in 1999, and the first
person charged was Gary Dellapenta. This offender posted ads and responded
to e-mails about rape fantasies using a woman’s name. Men responding to the
ads showed up at her apartment. Dellapenta was convicted and sentenced to six
years in prison. In New York, Ian Barber posted nude pictures of his ex-girlfriend
on Twitter and sent the pictures to her sister and employer; he was charged with
three offenses, including aggravated harassment in the second degree. However,
the charges were eventually dropped by prosecutors because the offender, Barber,
did not send the pictures directly to the victim, an element required under the state
law. In New Jersey, it is a criminal invasion of privacy to disclose sexual images
without a person’s consent.
A related term is flaming, which occurs when insults are exchanged in a chat
room or other social media public setting. Examples of this can include rumors,
lies, or other falsehoods, or even abusive or embarrassing posts.

refers to the financial institutions, water systems, communication systems and

power grids that are essential to any community, city, state or nation. Examples
include acts in which governments use the computer to spy on military commu-
nications of another nation; disrupt a website and services that result in inconve
nience to customers, including situations could lead to death; and prevent people
from accessing a website belonging to an organization or group that they disagree
with. An example of this is the Stuxnet virus that was used by the United States to
disrupt nuclear operations in Iran.
As with any act of cybercrime, an act of cyberterrorism is sometimes difficult
to trace. These acts can be carried out anonymously and from far away from the
site of the attack. An incident directed toward the United States. could be based
in a country far away, even on the other side of the world. Moreover, an attacker
may place false clues within the attack so the blame is placed elsewhere. Because
of this, it is sometimes difficult to know the exact source of the attack or where to
place blame.
Terrorists often rely on technology for a variety of acts. First, they use the
internet to recruit new members and then encourage their members to carry out
attacks. They use the internet to communicate with members. They raise funds to
subsidize events. They can then use the internet to organize those attacks. They are
able to circulate orders and coordinate supplies. Second, they use the internet for
propaganda. They can attempt to attack the morale of the enemy and alter the per-
ception of their organization by outsiders. Third, terrorists use the internet to build
relationships with other groups so they can support one another in their actions.
Fourth, terrorists use the internet to gather information and train members. This is
made much easier through the use of videos posted online (Bocij, 2006).
The term “cyberterrorism” is also used to reference hacking campaigns with
political or ideological motivations. One early case of cyberterrorism occurred in
2003 when Rajib Mitra hacked into a police emergency radio system. U.S. authori-
ties labeled this an attack on the critical infrastructure of the country. Mitra was
charged under the federal Computer Fraud and Abuse Act, convicted, and then
sentenced to 96 months in prison. In 2004, David Jeansonne sent a malicious
e-mail attachment to users of the MSN TV site so their computers dialed 911. He
was charged with cyberterrorism under the USA PATRIOT ACT.
In October 2015, officials from the U.S. Justice Department charged a Malaysian,
Ardit Ferizi, after he hacked into a server of an online retail company and stole per-
sonal data of U.S. service members (names, e-mails, passwords, and phone num-
bers). He then gave the information to members of the ISIS so they could carry
out attacks on them. ISIS then threatened the victims with the following message:
“We are in your e-mails and computer systems, watching and recording your every
move, we have your names and addresses, we are in your e-mails and social media
accounts, we are extracting confidential data and passing on your personal infor-
mation to the soldiers of the [caliphate], who soon with the permission of Allah
will strike at your necks in your own lands” (Davidson, 2016). He was charged
with cyberterrorism, specifically, four counts of hacking into the company’s server
with the intent to assist the activities of the ISIS, extortion, and identity theft.
112 Cyberterrorism

One hacking group that has attempted to identify and attack terrorist organiza-
tions is the Ghost Security Group (GSG), also called Ghost Sec. This is a vigilante
computer hacking group that was originally created to not only target ISIS websites
but also target the online activities of all extremist groups. The members describe
themselves as a counterterrorism organization that uses the internet to “attack” ter-
rorism. Their goal is to stop acts of terrorism and save innocent lives. They may be
an offshoot of the hacking group Anonymous.
The members allegedly became more active after the shooting at Charlie Hebdo
in 2015. The members monitor and collect data on the activities of terrorist groups
and reports those activities, along with any threats, to law enforcement around the
globe. The group claims that they have shut down hundreds of ISIS-affiliated web-
sites and thousands of social media accounts in over a dozen different countries,
including the United States, Germany, Italy, and Britain. They also have been able
to infiltrate jihadi networks and provide enough information to law enforcement to
prevent possible terrorist attacks. They have attacked sites used by ISIS to recruit
new members. Some have reported that the GSG helped in stopping a planned
terrorist plot in Tunisia and a plot to attack New York City in 2015. The members
allegedly continue to scan the internet for newly emerging groups.
Chances are that events labeled as cyberterrorism will continue to rise as more
governments, militaries, and civilians rely on computers to store data or to com-
municate. The opportunities for cyberattacks increases each day. At the same time,
some people claim the fear of cyberterrorism held by the government and the public
is exaggerated, largely because of movies that depict hackers who start a nuclear war
or disable infrastructure. However, the majority of critical infrastructure is privately
owned and not connected to the internet. While outsiders can hack these systems, it
is difficult, and hacking into these systems does not provide offenders with the impact
they seek (Gillespie, 2016). The effects of a cyberattack would be far less than what
some people have described. Moreover, the majority of cyberterrorists are not able to
carry out a major attack and cause a substantial impact because they do not have the
technical skills that are needed to carry out such an attack. Instead, they would be
forced to hire someone outside of their organization who would be willing to carry
out the crime. To date, no one has died from a cyberattack. The actual risk of an attack
on the country’s critical infrastructure is far less than what has been described.

See also: Anonymous; Computer Fraud and Abuse Act of 1986; Operation Olym-
pic Games

Further Reading
Akhgar, Babak, Andrew Staniforth, and Francesca Bosco. 2014. Cyber crime and cyber ter-
rorism investigator’s handbook. Waltham, MA: Elsevier.
Berinato, S. 2002. “The truth about cyberterrorism.” CIO Magazine, March 15, 2002. h ttp://
www.cio.com/archive/031502/truth.html.
Bocij, Paul. 2006. The dark side of the internet: Protecting yourself and your family from online
criminals. Westport, CT: Praeger.
Brenner, S. W. 2008. Cyberthreats: The emerging fault lines of the nation state. New York:
Oxford University Press.
C y b e r wa r fa r e 113

Charlton, Corey. 2017, February 15. “Keyboard warriors: Inside the “Ghost Security
Group” hackers waging war on ISIS who claim to have foiled terror plots in Britain
and over a dozen countries.” The Sun, February 15, 2017. https://www.thesun.co.uk
/news/2869317/ghost-security-hackers-isis-foiled-terror-plots-britain/
Council of Europe. 2007. Cyberterrorism: The use of the internet for terrorist purposes. Stras-
bourg Cedex, France: Council of Europe Publishing.
Davidson, Joe. 2016. “ISIS threatens feds, military after theft of personal data.” The Wash-
ington Post, January 31, 2016. https://www.washingtonpost.com/news/federal-eye
/wp/2016/01/31/isis-threatens-feds-military-after-theft-of-personal-data/?utm_term
=.0136baeb6e55
Denning, Dorothy E. 2000. “CYBERTERRORISM: Testimony before the Special Over-
sight Panel on Terrorism, Committee on Armed Services, U.S. House of Represen
tatives.” May 23, 2000. http://faculty.nps.edu/dedennin/publications/Testimony
-Cyberterrorism2000.htm
Ghost Security Group Website. https://ghostsecuritygroup.com/
Gillespie, Alisdair A. 2016. Cybercrime: Key issues and debates. New York: Routledge.
Holt, Thomas J., George W. Burruss, and Adam M. Bossler. 2015. Policing cybercrime and
cyberterror. Durham, NC: Carolina Academic Press.
Paganini, Pierluigi. 2016. “The Ferizi case: The first man charged with cyber terrorism.”
Infosec Institute, March 9, 2016. http://resources.infosecinstitute.com/the-ferizi-case
-the-first-man-charged-with-cyber-terrorism/
Singer, Peter W. 2012. “The cyber terror bogeyman.” Brookings, November 1, 2012. https://
www.brookings.edu/articles/the-cyber-terror-bogeym

C Y B E R WA R FA R E
Cyberwarfare is a term that is not really well defined. The U.S. Department of
Defense defines it as “the art and science of fighting; of defeating an opponent
without spilling their blood” (Carr, 2010, p. 2). Experts at the Rand Corpora-
tion present a different definition. They say that cyberwarfare “involves the actions
by a nation-state or international organization to attack and attempt to damage
another nation’s computers or information networks through, for example, com-
puter viruses or denial-of-service attacks” (Rand, n.d.). Each cyberattack can be
very different, depending on the skill of the hackers or their ultimate goal. An
attack may be very harmful or relatively less so. The severity of an attack will differ
and depend on the number of people that were affected and the damage caused.
The immediacy of the attack (how long it lasted, or its duration) will also help to
determine the severity as will the directness (the harm caused).
Cyberwarfare can be thought of as “virtual conflict” that involves the use and
targeting of computers and the networks for war—or attacking another nation
through the internet. It can be thought of as a politically motivated attack on anoth-
er’s computer systems, used to disable critical infrastructure systems (power, water,
electricity), disrupt government, or steal data. It occurs when different nations,
international organizations, or terrorist organizations break into the computers or
networks in another country in order to cause damage, or to steal defense secrets
or industrial technology. They can also go after information on business secrets like
114 C y b e r wa r fa r e

possible mergers or acquisitions. Those with more information are at an advan-

tage. This warfare usually involves states—it is not usually done by individuals or
groups.
Government websites have been prime targets for cyberwarfare. In 2008, Russia
carried out a cyberattack on the website of the Georgian government. On July 4
weekend and the week after, in 2009, a DDoS attack was carried out on websites
of the U.S. government, namely, the Federal Trade Commission (FTC) and Depart-
ment of Treasury as well as commercial sites in the United States and South Korea.
The attack took down the sites for several days. Eventually, the South Korean
government blamed the Democratic People’s Republic of Korea, but officials in
the United States did not announce any formal opinion on the incident. Then in
April 2009, a cyberattack compromised the security surrounding the Joint Strike
Fighter project from the Pentagon, and several terabytes of data were stolen. Offi-
cials believed the hackers were from the People’s Republic of China.
Then in December 2015, a cyberattack on the power grid for Ukraine affected
80,000 people who were without power for six hours. The governments of Georgia
and Russia had been in a conflict after Russia seized the Crimea. Throughout the
conflict, both countries used cyberwarfare.
Cyberwarfare does not require a strong military or a lot of money to launch an
attack. Instead, it can be carried out by any country that has the right tools. This
can be done through viruses or DoS attacks that shut down computers and net-
works. It can also be done by sabotaging systems to disrupt military and banking
systems. So in a way, it allows a poor nation to be on a more equal footing as a more
wealthy country. It used to be that stronger nations had more power, and they were
strongest in world politics largely because of their military strength. But with the
advent of cyberwarfare, small countries and nation-states can garner attention and
affect politics when they were unable to in the past. The small nations that once
lacked power have become serious threats to the powerful nation-states. They are
able to collect information about military actions; can launch cyberattacks that will
cripple computers; can block communications; all they need is access to a com-
puter and the skill to hack into these systems.
Even though cyberwarfare is carried out online, it still can be a great threat to
international peace and security, so countries seek to deter or prevent such attacks.
The ability of a government to prevent an attack is not easy, but at the same time,
the need to protect data belonging to the government, businesses, and individu-
als is critical. Methods must be updated and developed to protect against attacks.
Even in those cases where law enforcement or the military identifies an attacker,
the government of that country may not do anything about it. There is no inter-
national law that prescribes the rules for cyberwar: there are rules for war but not
for cyberwarfare.
After an attack occurs, it is sometimes difficult to determine who or what coun-
try was responsible. There is often a lack of proof as to who did it. The offender
will rarely admit to carrying out the attack, but the government, agency or busi-
ness that is the victim may not want to publicize that they were the victim of an
attack. They may not want to show their weakness or vulnerability to others or to
C y b e r wa r fa r e 115

customers. They also may not want to cause fear in its citizens. Thus, many attack-
ers get away with these crimes.

Data leakage is frequently the result of a disgruntled employee who releases

information. In some situations, an employee has been offered money to provide
confidential information to an outsider. This may happen if the business has a
weak security system and an employee is able to access files beyond their autho-
rization, or for a longer time than is needed. Employees have taken hard copies
of files from an office setting or have taken pictures and removed information. In
some cases, employees have been able to download information onto an external
storage disk (a thumb drive or zip drive) and remove it from an office. There have
also been cases where an office laptop computer with data has been stolen, or
external storage drives have been lost or stolen.
There are many examples of data leakage. One of those is the breach of data from
the retail giant, Target that occurred in December 2013. Hackers were able to access
the names, mailing addresses, phone numbers, e-mails, and credit card information for
40 million Target customers, which is thought to have been sold on the black market.
Target profits dropped almost 50 percent in the period immediately after the attack.
Another example is the events surrounding Chelsea Manning, who stole thousands of
classified and unclassified documents from military databases, and released them to
WikiLeaks, which made them available online. While the data leakage from Target was
the result of hacking, the data leakage by Manning was the result of a whistleblower.
Data leakage can be very damaging to individuals and organizations. For indi-
viduals, their private information is made public, leading to financial loss or loss
of privacy. In a business setting, data leakage can result in lost productivity as
employees need to spend time to discover how the information was accessed, then
fix the leak or the problem. A data leakage can harm the reputation of a business,
sometimes making customers unwilling to continue to frequent the business.
It is essential that organizations and businesses strive to prevent data leakage.
To do this, companies need to upload antivirus products that prevent the installa-
tion of malware or detect malware if it is uploaded. Companies need to train their
employees to recognize fake e-mails that could contain malware. All employees
should be required to create and use secure passwords that are complicated, and
they should then be prohibited from giving that password to anyone. Agencies
should use encrypted platforms if sharing data to ensure that if a file is accessed by
an unauthorized user, he or she will be unable to understand the data. Companies
should upload software that scans outgoing e-mails and other messages to uncover
the presence of data so that it is not released by mistake.

See also: Hacker and Hacking; Malware; Social Engineering; Sony Pictures Enter-
tainment Hack

Further Reading
Dezenhall, Eric. 2015. “A look back at the Target breach.” Huffington Post, April 6, 2015.
https://www.huffingtonpost.com/eric-dezenhall/a-look-back-at-the-target_b_7000
816.html
Huth, Carly L., David W. Chadwick, William R. Claycomb, and Ilsun You. 2013.
“Guest editorial: A brief overview of data leakage and insider threats.” Information
Data S o v e r e i g n t y 121

Systems Frontiers 15, 1: 1–4. https://link.springer.com/article/10.1007%2Fs10796-013

-9419-8
Shabtai, Asaf, Yuval Elovici, and Lior Rokach. 2012. A survey of data leakage detection and
prevention solutions. New York: Springer.
Van, Jon. 2008. “Firm’s software helps stop data leaks.” Chicago Tribune, May 26, 2008.
h ttp://a rticles . c hicagotribune . c om / 2 008 - 0 5 - 2 6 / b usiness / 0 805240033 _ 1 _ data
-leakage-encrypted-data-in-short-bursts

D ATA S O V E R E I G N T Y
Data sovereignty refers to the idea that any data that has been stored in a binary
digital format is subject to the laws and regulations of the country where that data
is stored. In short, the computer data is controlled by the country in which it is
located. This means that data that is located in one country cannot be subpoenaed
by the government of another country. Some countries have gone so far as to pass
laws that require that data and information remain in that country, largely a result
of cloud computing and storage methods that make data easily transferrable. Gov-
ernments are nervous about the ability of other countries or individuals to access
their information or the information of their citizens.
Data sovereignty also refers to an individual person’s right to control access
to, and any disclosure of, their own personal information. This is violated when
another person or when a government accesses that data. At that point, it becomes
an issue of the power of the government to use their power of surveillance for
security versus a person’s rights to privacy.
The concept of data sovereignty became more widely debated in 2013 after a
U.S. federal magistrate ordered that Microsoft provide the Department of Justice
with information regarding a drug-related criminal case. The records were held in
Dublin, Ireland. Officials at Microsoft would not provide the information, relying
on laws from the European Union intended to protect the privacy of individuals.
The case went to the court system, and the lower courts decided that compa-
nies within the United States must give private information to the government if
there is a valid search warrant. Microsoft appealed that decision, and the Second
Circuit appeals court sided with Microsoft in Microsoft v. United States, declaring
that Microsoft was not required to provide information to the Department of Jus-
tice. They declared that search warrants issued in the United States do not apply
to customer data that is stored abroad. The government appealed, and the case
was heard by U.S. Supreme Court (this time as United States v. Microsoft), but was
rendered moot in 2018 by legislation passed by Congress in the CLOUD Act, or
Clarifying Lawful Overseas Use of Data.
Data sovereignty became a major issue again in 2013 when Edward Snowden, an
employee at the National Security Agency, revealed classified documents describ-
ing extensive government surveillance programs on private individuals. Many
people around the world began to question the rights of governments to collect
personal data on citizens, particularly if there is no security threat posed. The law
goes into effect on January 1, 2020.
122 Data S o v e r e i g n t y

There are currently no laws in the United States to protect the privacy of con-
sumer data. Some states have passed laws, such as the California Consumer Privacy
Act passed in 2018. This was a bill that gave citizens the right to tell a business
not to share their personal information with other businesses; to limit what infor-
mation is collected about yourself; and makes businesses responsible for leaking
that data.
In 2016, the Parliament of the European Union passed a new law called the
General Data Protection Regulation (GDPR). The law is comprised of 11 chapters
and 91 articles and is intended to protect the privacy of data owned by all EU citi-
zens, regardless of the location of the data or the company. If the company provides
goods or services to EU citizens, they are subject to the law.
The law gives individuals more control over their personal data. If a company
wants to gather personal information on an individual who lives in the EU, they
must first ask permission before collecting that information and receive that per-
son’s consent. Any data that is collected must be maintained in a way that makes
the data anonymous. If the data is breached, a customer must be informed of that
breach within 72 hours of discovery. They must be provided with details of the
breach. All companies must have a data protection officer to ensure compliance
with the regulations. Companies must institute data protection measures to help
protect against a breach. Any individual may ask a company to delete their per-
sonal information at any time.
The law assigned high fines on violations of the law. Any company that violates
the law can be fined up to 4 percent of the profit, or 20 million Euro.

or passport, will be unlikely to be forged or altered. Legally, digital signatures are

accepted the same as handwritten signatures and imply consent by the signer. In
short, digital signatures ensure both the authentication and integrity of the digital
record because it makes it impossible to forge or alter the document without oth-
ers knowing.
A digital signature is a type of electronic signature that involves the use of a
mathematical algorithm that generates two long numbers, referred to as keys. The
public key infrastructure, or PKI, helps to create the two keys. One of the numbers
(keys) is public, and the other remains private. When a person signs electronically,
the signature uses the private key. The algorithm encrypts the data, called hash,
which becomes the digital signature. When the recipient receives the hash (the
encrypted document), they also receive the public key, which is used to decrypt
the document. If the decrypted hash matches the second, public key, it indicates
that the data has not been tampered with since it was signed by the sender. If
the data is altered, the document cannot be decoded, and the digital signature is
no longer valid. Many different companies have developed software that provides
the technology for people who wish to use digital signature to send documents
electronically.
If a person uses a digital signature on a document, it makes it very difficult for
them to deny that they sent it. It also verifies that the recipient received it in the
original format that was sent to them. Since they are also time-stamped, the date
and time of signing is also documented.
Even with the process of digital signatures, there is still concern about the safety
and legitimacy of the process. In 2000, the U.S. Congress passed the Electronic Sig-
natures in Global and National Commerce Act, otherwise known as ESIGN (Public
Law 106–229, 15 U.S.C. 96). This new law was an attempt to simplify and encour-
age the use of electronic or digital signatures in interstate and international com-
merce. The law mandated that an electronic signature is legal. It prohibits a person
from denying the legality of a contract or transaction on the basis that the signature
or document is in electronic form. In essence, the law made electronic signatures
the equivalent to a personal signature. Digital signatures were the focus of addi-
tional federal attention in 2010 when Congress worked with the leaders of major
companies to pass a resolution to recognizing June 30 as “National ESIGN Day.”
In 1998, President Bill Clinton recognized the importance of digital signatures
in foreign commerce. In a joint statement about electronic commerce with Japan,
he noted that it was important for governments to support the development of a
global framework to recognize and facilitate electronic transactions. He suggested
that countries develop a legal framework for developing regulations on digital
signatures. In doing so, he proposed including members of the private sector in
constructing the rules, that electronic signatures be legally recognized as the equiv-
alent to handwritten ones, and that those involved in a transaction be allowed to
determine the most appropriate method to authenticate the documents and signa-
tures (Clinton, 1998).

DOMAIN NAME SYSTEM CACHE POISONING

DNS cache poisoning is a type of cyberattack in which a cybercriminal sends a
fake address for an internet domain into a DNS response system, where it is stored
in the cache. If the server accepts the fake record, incorrect information is stored
in the cache. This means that the DNS system has become “poisoned.” Any future
user requesting the IP address will be redirected and sent to the fake IP address
that is controlled by the offender. The fake websites that users are sent to will
appear to be the actual website but are actually fake ones set up by the offender to
steal the victim’s personal information.
A DNS associates domain names with IP addresses. They help to transmit e-mails
and URLs that are read and understood by people and converted into data that can
be read by computers. Over time a DNS will create a cache, or a collection of data
that allows a person requesting data in the future to retrieve that information more
quickly. A DNS server will cache information from other DNS servers; this way, it
can use information that has already been gathered rather than gather it all over
again. It makes the system more efficient. A cybercriminal relies on a vulnerability
140 Doxing

that may exist in the DNS software to attack a system. The offender may send a
fake address for an internet domain into a DNS response to a system, where it is
stored in the cache. If the server accepts the fake record, incorrect information is
stored in the cache. This means that the DNS cache has become poisoned.
For example, a user may type into a search “nytimes.com” and end up at a site
that appears to be the New York Times but is actually a fake site controlled by a
cybercriminal. The victim may log into the site with their name and password, or
even credit card information, but that information is being viewed by the offender.
A spoofing attack can also be directed at an e-mail system. In these attacks, an
offender uses a fake record for an e-mail server that will redirect corporate e-mail
to a fake e-mail address (Halley, 2008). This allows the offender to have access to
all employee e-mails, including personal and corporate secrets.
These types of cyberattacks do not require sophisticated techniques, but they are
very difficult to detect. They can be very damaging. They can often easily spread
from one DNS server to another without the owner’s knowledge. They have also
been used to spread malware, including worms and viruses, to other systems. In
some attacks, hundreds of people have ended up at a fake site.
Once discovered, the corrupted or poisoned cache must be cleaned so that
future users will not be sent to the wrong site. It has been suggested that compa-
nies and organizations clear their caches often as a way to prevent a DNS cache
poisoning attack.

to the actions of Cheryl Abbate, a graduate student in philosophy at the uni-

versity. During a Theory of Ethics course that Abbate was teaching in 2014, she
apparently put a list of topics on the board—among which was gay rights—and
told the class there was no need to discuss the listed topics, as everyone appar-
ently agreed on them. A student approached Abbate after class and expressed
their opinion that gay rights should have been a topic open for discussion. Abbate
chastised the student, telling them they did not “have a right in [that] class to
make homophobic comments.” Abbate then informed the student they could
drop the class.
Following this incident, McAdams posted about it on his blog, providing
Abbate’s name and a link to her personal website, which contained her contact
information. In his blog post, McAdams criticized Abbate for using “a tactic typi-
cal among liberals,” to wit, “[o]pinions with which they disagree are not merely
wrong, and are not to be argued against on their merits, but are deemed ‘offensive’
and need to be shut up.” Abbate filed a complaint against McAdams with the uni-
versity. Abbate felt that McAdams was a “homophobic idiot” who was “insert[ing]
his ugly face into [her] class business to try to scare her into silence.”
After Abbate filed a complaint, the story began to get national attention. Abbate
subsequently received several offensive and harassing communications. Marquette
University suspended McAdams for a time. As a condition for returning to his
professorial duties, the university required McAdams to write a letter to the univer-
sity president’s office expressing remorse for the harm he caused Abbate by pub-
licly criticizing her and doxing her. He refused and instead filed a lawsuit against
the university for breach of contract. The Wisconsin Supreme Court ultimately
ordered the university to reinstate McAdams. In its ruling the court criticized Mar-
quette University for “subject[ing] a tenured professor to discipline for writing
something that triggered an adverse response from third parties over whom he
has no control.” As can be seen, the doxing itself it not necessarily what is harm-
ful. Rather, it is what others do with the information—such as sending harassing
e-mails—that can be harmful.
Consequences may extend beyond harassing communications. In 2008,
WikiLeaks released the names and addresses of members of the British National
Party, a far-right political party. The occupations of party members were released as
well. This resulted in at least one party member being terminated from their place
of employment (Chivers, 2017). In 2014, Zoe Quinn—an independent video game
developer—had personal information unearthed by hackers following claims by
her ex-boyfriend (Eron Gjoni) that she had sex with a video game journalist to
improve the review of her game Depression Quest. This event marked the beginning
of what is known as Gamergate—an unorganized movement whose purpose is not
clearly defined but appears generally to push back against progressivism in video
games. As a result of being doxed, Quinn received death threats and rape threats
(Quinn, 2017). Other women, such as critic Anita Sarkeesian and game devel-
oper Brianna Wu, also were doxed as part of Gamergate. They also received death
threats and rape threats. For all three women, these threats grew so severe that at
some point, they had to flee their homes (McDonald, 2014).
142 Doxing

Doxing can be additionally harmful when it misidentifies someone. This hap-

pened to Sunil Tripathi, a student at Brown University who went missing in 2013.
Tripathi’s family circulated his name and picture on social media in attempts to find
him. Soon after, the Boston Marathon bombing occurred on April 15, 2013. Social
media users suggested that Tripathi looked like one of the bombers. After this,
his family received angry e-mails about Tripathi’s supposed involvement, accusing
them of harboring their fugitive brother and son. It was ultimately determined that
Tripathi had not been involved. It was later discovered he had committed suicide
(Lee, 2015). Nonetheless, harm had been inflicted on the family, and that harm
could have escalated into something much worse—such as charges being brought
against Tripathi and his family—had the actual suspects not been apprehended.
Doxing is increasingly becoming a political tool. Those who make statements or
subscribe to views that are opposed by others face the threat of having their iden-
tity made public by those who oppose those statements or views. This appears to
be what went on in the case of McAdams v. Marquette University, discussed above.
McAdams did not approve of the views expressed by Abbate in her class (believing
them to have a liberal bias), so he posted her contact information on his blog. This
also happened with the protests in Charlottesville, Virginia, in 2017. Numerous
white supremacists marched in town, holding torches. A number of those white
supremacists were doxed. There are those who oppose the views held by white
supremacist groups and feel that doxing is a valid way of holding those who have
those views accountable to the public (Bowles, 2017).
By and large, doxing is not a crime. There are some limited instances in which it
might be criminal. For example, it is a federal crime to make public the restricted
personal information of certain people, such as jurors, witnesses, and officers of
the court. Generally, if a criminal action is going to be pursued for doxing at all,
it would have to be done under a state statute for harassing or something similar.
Even then, there are rights citizens in the United States have under the Free Speech
Clause of the First Amendment of the U.S. Constitution that would have to be
considered and might ultimately prevent a prosecution from being successful. In
the case of John McAdams, the Wisconsin Supreme Court ultimately held that his
publishing of the graduate student’s name and contact information was protected
by the First Amendment. In short, it is difficult to hold those who dox legally
responsible for the harm generated by their actions (Binder, 2018).
While it may be difficult to hold those who dox legally responsible, there are
mechanisms online that may deter doxing. Some social media sites prohibit dox-
ing in their terms of service. For example, Reddit prohibits the posting of personal
information, including information that might be public. It does have an exception
to this rule with regard to public figures (Reddit, 2018). Twitter does prohibit the
posting of private information, but it does not prohibit the posting of public infor-
mation (Twitter, 2018). Because social media companies are not state actors, they
are not prohibited from blocking certain speech from their sites. Thus, there is no
First Amendment violation if they prohibit doxing on their sites.
Although doxing primarily occurs on the internet, there are examples of doxing
that occurred before the advent of the internet. Baseball umpire Don Denkinger’s
Doxing 143

home address and phone number were broadcast by two disc jockeys from
St. Louis after the St. Louis Cardinals lost in the World Series in 1985. Cardinals
fans blamed the loss on Denkinger due to a missed call. Denkinger and his family
received various threats, including one to burn down their home (Greene, 2015).
In another incident, far-right activists in the United Kingdom posted the phone
number of race relations campaigner Lord Herman Ouseley in public restrooms in
London. He received numerous phone calls late at night as a result (Ellis, 2017).
There have been instances when news outlets have either doxed an individual
or threatened to do so. It has led some to question why doxing is viewed differently
when done by a news outlet as compared to a private individual and whether the
two should be viewed differently (Ellis, 2017). One incident of doxing by a news
outlet was carried out by the Phoenix New Times, a newspaper out of Phoenix, Ari-
zona. The newspaper ran an article that published the home address of Sherriff Joe
Arpaio, whom the newspaper has various disagreements with (Dougherty, 2004).
In a 2017 incident, CNN was able to identify a Reddit user who had posted a GIF
of Donald Trump beating someone who had a CNN logo in place of their head.
The Reddit user’s post history on the site included racist content. CNN did not
post the user’s personal information, in part because the user issued an apology
for his racist post upon discovering that CNN knew his identity. However, CNN
threatened to release the user’s information should he ever post offensive content
in the future (Kaczynski, 2017).

See also: Cyberbullying; Hacker and Hacking; Hacktivism; Privacy; Revenge Porn;
Social Media; State Actor; Swatting; WikiLeaks

Further Reading
Binder, Nellie Veronika. 2018. “From the message board to the front door: Addressing the
offline consequences of race- and gender-based doxxing and swatting.” Suffolk Univer-
sity Law Review 55: 55–75.
Bowles, Nellie. 2017. “How ‘doxxing’ became a mainstream tool in the culture wars.” The
New York Times, August 30, 2017. https://www.nytimes.com/2017/08/30/technology
/doxxing-protests.html
Chivers, Tom. 2017. “Wikileaks’ 11 greatest stories.” The Telegraph, March 8, 2017. https://
www.telegraph.co.uk/news/0/wikileaks-greatest-ever-stories-scandals/
Dougherty, John. 2004. “Stick it to ’em.” Phoenix New Times, July 8, 2004. https://www
.phoenixnewtimes.com/news/stick-it-to-em-6428128
Ellis, Emma Grey. 2017. “Don’t let the alt-right fool you: Journalism isn’t doxing.” Wired,
July 7, 2017. https://www.wired.com/story/journalism-isnt-doxing-alt-right/
Greene, Dan. 2015. “After the call.” Sports Illustrated. https://www.si.com/longform/2015
/1985/world-series-cardinals-royals/index.html
Kaczynski, Andrew. 2017. “How CNN found the Reddit user behind the Trump wrestling
GIF.” CNN, July 7, 2017. https://www.cnn.com/2017/07/04/politics/kfile-reddit-user
-trump-tweet/index.html
Lee, Traci G. 2015. “The real story of Sunil Tripathi, the Boston bomber who wasn’t.”
NBC News, June 22, 2015. https://www.nbcnews.com/news/asian-america/wrongly
-accused-boston-bombing-sunil-tripathys-story-now-being-told-n373141
144 D r ape r , J o h n

DRAPER, JOHN(1943–)
Otherwise known as Cap’n Crunch, Draper was an original “phone phreak,” an
individual who studied telecommunications systems and public telephone net-
works, particularly audio frequencies (the clicks and beeps) that are used to pro-
vide services to customers, to understand how they worked and how they could
be manipulated. Phone phreaks were able to make free phone calls and conference
calls to each other as they shared what they knew. Eventually, many phone phreaks
were arrested, and some were sent to jail, including Draper.
Draper’s father was in the air force, and his family moved often. As a young boy,
John searched for various electronic parts on the military bases where his father
was stationed so he could build a radio station in his bedroom. When he was old
enough, Draper joined the air force and became a radar technician. While stationed
in Maine, he studied the phone system on the base and learned how to make free
phone calls through a switchboard. When discharged from the military, Draper
met others who were fascinated by the inner workings of telephones, including Joe
Engressia. These individuals became known as “phone phreakers.” Joe realized that
he could bypass the long-distance system set up by Bell Telephone by whistling the
correct tone. When he told Draper of his discovery, Draper soon realized that the
toy whistle inside a box of Cap’n Crunch cereal made the same tone. When he blew
the whistle, he could call anywhere for free. He once claimed that he was able to get
President Richard Nixon on the phone to report a shortage of toilet paper.
In 1971, Esquire magazine published an article about phone phreaking that
identified Draper and other phone phreaks. The author of the article, Ron Rosen-
baum, explained that the phone phreakers, including Draper, were able to override
the phone system and make telephone calls for free. The author went into detail
about how the “little blue box” enabled a caller to make calls around the world
without cost and without the call being traced and also brought up the possibility
of using the blue boxes to break into the FBI’s computer system. Not long after
the article was published, Draper was arrested and charged with violating laws
on wire fraud. He was sentenced to five months of probation. He was arrested
again in 1976 and wasn’t released until February of 1977. As an inmate, Draper
used his radio to listen to the walkie-talkies of the prison guards. He provided the
D r ea d P i r at e R o b e r t s 145

other inmates lessons in phone phreaking. Toward the end of his sentence, he was
allowed to leave the prison during the day (his sentence was nights only). During
the day, he wrote a word-processing program called Easy Writer.
When Draper was released in 1977, Apple cofounder Steve Wozniak hired him
as a contractor. There he designed a device called a Blue Box that was able to iden-
tify phone signals and lines that allowed him to make free phone calls. Apple did
not pursue the device because of the fear of negative publicity. When outsiders got
ahold of the technology, they used it to harass offices or disrupt business.
Draper was sent back to prison for a parole violation and sent to Pennsylvania.
While he was there, another inmate asked him for help in hacking into the tele-
phone network. Draper thought he was an informer, so he provided false informa-
tion. When the inmate was unable to make the calls, he physically attacked Draper
and caused permanent damage to his vertebrae.
Following the failure of his business venture, Cap’n Software, Draper worked
for several years in the late 1980s for Autodesk Inc., a San Rafael, California, com-
pany that makes design software. He was laid off when new management took over
the company.
In 1987, law enforcement investigated Draper for a plot to forge tickets for the
Bay Area Rapid Transit (the BART) in San Francisco. He pleaded guilty to lesser
misdemeanor charges in 1988. This time, he was not sentenced to a corrections
facility but instead to a diversion program.
In his later years, Draper has traveled to Australia and India, where he made a
living earning money designing websites and writing computer code.

See also: Abene, Mark; Blankenship, Loyd, Timothy; Engressia, Josef Carl, Jr.

Further Reading
Draper, John and C. Wilson Fraser. 2018. Beyond the little blue box. Victoria, BC: FriesenPress.
Markoff, John. 2001. “The odyssey of a hacker: From outlaw to consultant.” New York
Times, January 29, 2001. https://www.nytimes.com/2001/01/29/business/the-odyssey
-of-a-hacker-from-outlaw-to-consultant.html
Rhoads, Christopher. 2007. “The twilight years of Cap’n Crunch; Silicon Valley legend
John Draper made his name with brains and pranks, before slipping to the margins;
Three jail stints and the ‘rave’ scene.” Wall Street Journal, January 13, 2007.
Rosenbaum, Ron. 1971. “Secrets of the little blue box.” Esquire (October): 117–226. h ttps://
classic.esquire.com/article/1971/10/1/secrets-of-the-blue-box
Schneider, Howard. 2013. “Playing tricks on Ma Bell; Early hackers made free phone calls
with a toy whistle and managed to reach the president on an unlisted hotline.” Wall
Street Journal, February 1, 2013. https://www.wsj.com/articles/SB1000142412788732
4039504578259861535539082

D R E A D P I R AT E R O B E R T S ( U L B R I C H T,
ROSS; 1984–)
Dread Pirate Roberts was the online name for the owner and operator of Silk Road,
an online marketplace that operated on the dark web, where drugs and other
146 D r ea d P i r at e R o b e r t s

items could be purchased. The online name was taken from the character of the
same name in the book and movie The Princess Bride (1973, novel; 1987, film).
The character wears a mask to protect his anonymity and also to hide the fact that
Dread Pirate Roberts is not a person but rather a title that passes from person to
person when the current Dread Pirate Roberts is ready to be done. The use of this
name led many to believe that the Dread Pirate Roberts who ran Silk Road was
not one person but a series of people (Bearman et al., 2015a). In 2013, Operation
Marco Polo, a multiagency law enforcement investigation into Silk Road, discov-
ered that Dread Pirate Roberts was Texas native Ross Ulbricht.
For Ulbricht, Silk Road was about cutting out government oversight from trans-
actions he believed the government should not be involved in. To truly be able to
do this, Ulbricht believed the transactions had to be anonymous. For this reason,
the site conducted transactions using Bitcoin. Ulbricht and many users subscribed
to libertarian ideology and saw Silk Road as an application of those ideals. This
can be seen in the rules for Silk Road. Following libertarian ideology that people
should have freedom to do what they like as long as it does not infringe on others’
ability to do the same, Silk Road prohibited the sale of certain items that could only
have been obtained by infringing on the freedom of others. This included items
that had been stolen and child pornography (Bearman et al., 2015a, 2015b).
Following Operation Marco Polo, the FBI arrested Ulbricht in San Francisco in
October 2013. On February 4, 2015, a jury found Ulbricht guilty of money laun-
dering, computer hacking, conspiracy to traffic fraudulent identity documents,
and conspiracy to traffic narcotics by means of the internet. On May 29, 2015, he
was sentenced to life in prison at age 31 (Segall, 2015).
There are many who see Ulbricht as a martyr for a noble cause. Some of Ulbricht’s
family and friends have put together a website (freeross.org) to share Ulbricht’s
story as they see it. According to the website, Ulbricht created Silk Road, but not
with specific designs to make it a drug-trafficking website. Rather, he intended
it as a “free-market economic experiment” where buyers and sellers could main-
tain anonymity. It notes that Silk Road never told users specifically what to sell,
though it did have prohibitions—as noted above—against selling items that would
infringe on others’ rights or involve victims (Free Ross Ulbricht, 2018). While it
may not have told users what to sell, it appears Silk Road had a user’s guide detail-
ing how sellers could package drugs to avoid detection by narcotics canines and
other detection devices that the postal service or other shipping companies might
use (Bearman et al., 2015a). The website then details and criticizes several aspects
of the criminal investigation against Ulbricht, such as the motivations of the offi-
cers involved and the overlooking (or perhaps covering up) of certain pieces of evi-
dence (Free Ross Ulbricht, 2018). Two agents involved in the investigation—Agent
Mark Force and Agent Shaun Bridges—were later convicted of stealing Bitcoin
during the investigation (Raymond, 2017).
One of the controversial portions of the legal case against Ulbricht is the allega-
tions of murders that Ulbricht allegedly paid for. One murder he is said to have
paid for is that of Curtis Green, an employee of Silk Road who was arrested and
was working with law enforcement. The arrangement to have Green killed was
D r ea d P i r at e R o b e r t s 147

set up with Agent Force—one of the agents who was later convicted for stealing
Bitcoin during this investigation—who was acting in an undercover capacity at
the time. Agent Force staged pictures of Green being tortured and of Green’s dead
body, and these were sent to Ulbricht. Ulbricht allegedly paid Agent Force for
carrying out the hit (Bearman et al., 2015a). Five other murders that Ulbricht is
alleged to have paid for appear to have been a scheme orchestrated against Ulbricht
to defraud him of money, with none of the murders actually taking place (Bearman
et al., 2015b). While Ulbricht was not convicted for these murders-for-hire, they
were mentioned during his trial on other charges and appear to have been consid-
ered by the judge when sentencing Ulbricht on those other charges (Segall, 2015).
Ulbricht appealed his sentence, claiming it was unreasonable, but the appellate
court upheld the sentence.
In keeping with the fictional character behind the name, the “Dread Pirate
Roberts” moniker was adopted by another after Ulbricht was arrested. Following
the shutdown of Silk Road in 2013 as part of Operation Marco Polo, the website
reopened shortly thereafter as Silk Road 2.0. This iteration of the site was founded
by Thomas White. White had gone by the name StExo on the original Silk Road
site but switched to the name Dread Pirate Roberts 2 with the founding of Silk
Road 2.0 (Cox, 2019). Silk Road 2.0 was short-lived, staying in operation only a
year. While running the site, White directed hackers to attack other dark web mar-
ketplaces, such as Agora, TorMarket, and Sheep Marketplace (Cox, 2016). While it
was in operation, it is estimated that Silk Road 2.0 generated $8 million in sales a
month. White and the other owners of Silk Road 2.0 took between 4 and 8 percent
of each transaction that was conducted through the site. White claims to have not
kept much of the profit for himself, instead passing it on to the Tor Project and
other organizations and charities (Cox, 2016). In 2014, Silk Road 2.0 was shut
down as part of Operation Onymous (Cook, 2014). As part of that investigation,
White was arrested by law enforcement in the United Kingdom. He ultimately
pleaded guilty to drug trafficking, money laundering, and making indecent images
of children. He was sentenced in 2019, receiving a sentence of over five years in
prison (Cox, 2019).

See also: Bitcoin; Money Laundering; Operation Marco Polo; Privacy; Silk Road;
Tor (The Onion Router)

Cox, Joseph. 2019. “Silk Road 2 founder Dread Pirate Roberts 2 caught, jailed for 5 years.”
Motherboard, April 12, 2019. https://motherboard.vice.com/en_us/article/9kx59a/silk
-road-2-founder-dread-pirate-roberts-2-caught-jailed-for-5-years
Free Ross Ulbricht. 2018. “Railroaded: The targeting and caging of Ross Ulbricht.” Free
Ross Ulbricht. https://freeross.org/railroaded/.
Raymond, Nate. 2017. “Ex-agent in Silk Road probe gets more prison time for bitcoin theft.”
Reuters, November 7, 2017. https://www.reuters.com/article/us-usa-cyber-silkroad/ex
-agent-in-silk-road-probe-gets-more-prison-time-for-bitcoin-theft-idUSKBN1D804H
Segall, Laurie. 2015. “Silk Road’s Ross Ulbricht sentenced to life.” CNN, May 29, 2015.
h ttps:// m oney.c nn .c om /2 015 /0 5 /2 9 /t echnology /s ilk -road -ross -u lbricht -p rison
-sentence/index.html

DREAMBOARD
Dreamboard was the name of a global community of pedophiles that shared images
of child abuse. It was an online, private, international network of an estimated
600 members who promoted acts of pedophilia. They sought to exchange massive
amounts of graphic, pornographic images of adults molesting children, some of
whom were infants. They had amassed a private collection of images of child sex-
ual (often violent) abuse. The children appeared to be the subjects of both physical
and emotional distress. Many were in obvious pain and crying.
Many of the group members claimed to believe that sexual abuse of children
should not be a crime. Instead, the members described their actions as more of
a hobby than a criminal offense. To become an official member of Dreamboard,
a person is required to upload images of children under the age of 12 in porno-
graphic acts at least once every 50 days. The content and quality of the material
was critical. Images of adults having violent sexual intercourse with young chil-
dren were given more value than other images.
Once a person became a member, they had to continue to create and upload
new images in order to remain a member in good standing. If an individual did not
continue to upload images, they could be removed as a member, and their access
to the network was removed. This process maintained a continuous stream of new
images of child molestation.
Given that process, the group established different types of memberships in
Dreamboard. The first category was the “Super VIP,” recognizing members who
continually obtained new images, often by molesting children themselves, and
then uploading those images. The second type of membership was VIP, which
included those members trusted by the organization. The third type included the
regular members, who were given access to view a limited number of photos.
Dreamboard also created rules for its members to obey. All members were
required to regularly upload new images of children engaging in sexual activity.
Members had to post their images to different categories, depending on the type
of image or abuse.
On August 3, 2009, law enforcement officials from the Homeland Security
Investigations team from U.S. Immigration and Customs Enforcement (ICE)
and the Department of Justice, along with officials from Eurojust (the European
Drink or Die 149

Union’s Judicial Cooperation Unit) and other international law enforcement agen-
cies, established Operation Delego to investigate Dreamboard. The investigation
quickly became the largest investigation of child abuse and exploitation in the hist-
ory of the United States. The investigation was an international investigation that
involved law enforcement from multiple international agencies.
The law enforcement agents soon discovered that the members of Dreamboard
used aliases. The members used an encrypted password that only members pos-
sessed. They also used proxy servers as a way to hide their location and identity.
Nonetheless, on August 3, 2011, U.S. Attorney General Eric Holder and Secre-
tary of the Department of Homeland Security (DHS) Janet Napolitano announced
criminal charges against 72 members of Dreamboard. The defendants were found
in five continents and 14 countries, including Canada, the Netherlands, Philip-
pines, Serbia, Switzerland, Germany, France, and others. Officials also found that
another 500 people were participating in Dreamboard.
As a result of the investigation, active Dreamboard member John Wyes (also
known as Bones) was found guilty of one count of engaging in a child exploita-
tion enterprise, one count of conspiracy to advertise child pornography, and one
count of conspiracy to distribute child pornography. The evidence gathered by law
enforcement indicated that Wyss helped to produce images of child pornography,
including a video that showed adults were having sexual relations with children.
He was sentenced to life in prison.
Another member, David Ettlinger (aka ee1) from Massachusetts, was a former
elementary school teacher who pleaded guilty to one count of engaging in a child
exploitation enterprise. He was sentenced to 45 years in prison, followed by a life-
time on supervised release. The investigation also charged eight other individuals,
whose prison sentences ranged from 17 years to life.

Sham Offers or Investment Schemes

Many e-mails contain offers for goods or services that are enticing and seem to be
bona fide proposals. It is usually offered for a sale price or with some other kind
of deal or may be described as “exclusive offers” for particular individuals. These
offers are often scams. Either the person “selling” the goods is a cybercriminal who
wants the victim’s credit card information or they take the money and never send
the promised item.

E-mail Bombing
An e-mail bombing occurs when a massive number of e-mails are sent to a person
or a company’s server; that system is unable to handle the volume of e-mails and
crashes. A cybercriminal who wants to do this only needs to compose a message in
an e-mail and then send the message multiple times. If that e-mail is resent mul-
tiple times, the offender can send hundreds of e-mails quickly. When many send-
ers use this technique, they can send hundreds of thousands of e-mails in a short
time span. Hacking tools are also available for purchase online that will automate
this process.

Cyberharassment or Cyberbullying
E-mails can easily be used to harass or bully another person online. The anonym-
ity provided by the internet makes it easy for a person to send threatening or even
abusive e-mails to another person. In some cases, offenders will ask others to send
negative e-mails to the victims so they receive multiple harassing e-mails. These
activities can be considered criminal acts, and those who are charged and found
guilty face years in jail, depending on the exact circumstances.

Blackmail
Cybercriminals use e-mail to blackmail victims. They may demand money from
the victim, with the threat of posting embarrassing pictures or information about
the offender if the money is not paid. In some cases, the pictures are not real but
have been altered by the offender. They may also threaten to harm the victim or
a family member. Hackers who blackmail victims through the internet can face
criminal charges with penalties of up to five years in prison and/or a monetary fine.

E-mail Spoofing/Phishing
A spoofed e-mail is one that appears to the recipient to be from a legitimate source,
such as a bank, an employer, or other organization, but has actually been sent by
a cybercriminal. The person who actually sent the e-mail is hidden or concealed
from the recipient. The person who receives the e-mail deems the e-mail to be
authentic and therefore trusts that it is safe to open. However, the e-mail may
include malware (viruses, worms, or Trojans) uploaded when the recipient opens
164 E - ma i l - Relat e d C r i me s

the e-mail. In some cases, the seemingly legitimate e-mail seems to be from a bank
asking the victim to provide an updated user ID and password, bank account
information, or credit card number. When a victim responds to the e-mail, they are
giving the offender access to their banking accounts or other private information.

Appeals for Help

Also known as the “Nigerian Scam” because it often originates in Nigeria, these
scam e-mails are geared to people who are willing to help another person in
exchange for a promised large sum of money. Many people refer to these e-mails
as the 419 e-mails, the criminal code section that controls these activities. These
e-mails are often from a wealthy individual who needs help to leave the country
(and once out will share his family fortune with the victim) or who needs money
to travel. Some offenders are able to obtain access to a person’s e-mail contacts and
send an e-mail to friends and family members, claiming they have been the victim
of a crime and need money to leave the country.

Fraudulent Tickets
Recipients have received e-mails that seem to be from a law enforcement agency,
indicating they have been given a traffic ticket for a moving violation. The victim
is asked to send their credit card information to a site, which is operated by a
criminal.
Many e-mail crimes go unreported, simply because people are embarrassed that
they fell for a scam, especially if they sent a large amount of money to a stranger.
Some victims may feel that the offenders cannot be found, which is not always
the case. If crimes are committed through e-mail, experts in digital analysis and
computer forensics can often shed light on the identity of the sender. It is possible
for an investigator to recover e-mails that have been deleted, along with any attach-
ments. The IP address of a sender can often be identified. Once that information is
collected, it can be analyzed and presented as evidence in a criminal trial or hear-
ing. All e-mail crimes should be reported to law enforcement.
It is difficult to prevent these e-mails from appearing in an inbox, but people
can take actions to prevent the likelihood of becoming a victim of e-mail crimes.
For example, it is best to install and regularly update a spam filter that will help to
identify bogus e-mails. When e-mails are received, it is a good idea to take a close
look at those e-mails that look suspicious or odd. A person can look for misspell-
ings or unusual names on the “from” line. Any e-mails that are unsolicited or con-
tain ads that are too enticing or too good to be true should be immediately deleted.

/ t he - c ybercrime - s cheme - t hat - a ttacks - e mail - a ccounts - a nd _ us _ 59834649e4b

03d0624b0aca6
Federal Bureau of Investigation. 2018. FBI releases the IC3 2017 internet crime report and calls
for increased public awareness. Washington, D.C.: FBI National Press Office, May 7, 2018.
https://www.fbi.gov/news/pressrel/press-releases/fbi-releases-the-ic3-2017-internet
-crime-report-and-calls-for-increased-public-awareness
Federal Bureau of Investigation, Internet Crime Complaint Center (IC3). “File a com-
plaint.” https://www.ic3.gov/complaint/default.aspx
U.S. CERT. 2008. “Computer forensics.” https://www.us-cert.gov/sites/default/files/publ
ications/forensics.pdf

E N C RY P T I O N
Encryption refers to the process by which data or text is encoded so that only an
authorized person is able to read it. Many times, sensitive information must be sent
from one office to another, or from one executive to another. That information is
often e-mailed or sent electronically. If that information were to be accessed by an
unauthorized person, it could result in the loss of personal data or company secrets.
By encrypting the data, the sender can ensure that the material will arrive safely.
Text that people can read and understand is called plaintext, and this is the
information the sender seeks to e-mail. This is also sometimes called cleartext or
the input to a cipher. The plaintext is encrypted or coded by use of a mathematical
algorithm. When this is done, it is called a ciphertext. Ciphertext is the encrypted
plaintext, or what results when data is encrypted. The ciphertext cannot be read
or understood by an individual. The ciphertext must be decrypted, or decoded,
before it can be understood by a recipient. In order to change ciphertext back to
plaintext, it must be decrypted by the use of a key. “Keys” are used to both encrypt
and decrypt the text. To encrypt the text, a public key is used; the key is known to
everyone and is distributed to the public. The recipient must have a private key to
decrypt the information.
The process of encryption is often used by companies when sending data elec-
tronically so no one is able to intercept the e-mail and access or steal the data. This
can include financial data, customer data, and trade secrets. Encryption also assists
a person to buy something without the threat of someone stealing their credit card
number.
Terrorists and other criminals use encrypted text, sometimes making it difficult
for law enforcement to track their behavior. Discussions between law enforcement
and companies that create algorithms have centered on the prospect of leaving
an “encryption backdoor” that would allow law enforcement to decrypt messages
if they can provide evidence of criminal activity. Or, similarly, those who operate
social media sites to create a backdoor on their sites if there is criminal activity dis-
covered in those platforms. The problem is simple: if those companies that design
the algorithms leave a backdoor for law enforcement to decode, it would also be
available to cybercriminals and hackers. They could discover this vulnerability and
use it to gain access to computer systems. This is a threat to people’s privacy and
civil liberties, according to some.
166 Encryption

For example, the FBI has noted that they are often unable to access cell phones
that are encrypted that could provide evidence of criminal behavior. In support of
their request, they noted that FBI agents were unable to access almost 8,000 devices
in 2017 (although some say this figure was inflated) (Hawkins, 2018). They have
asked for new laws that would require the makers of cell phones and software pro-
vide them with a way to access data if they have a warrant to do so. Those opposed
to the idea explain that methods to reduce the security of encrypted data for law
enforcement simply weaken encryption for all. This means that criminals would
have easier access to data as well.
On the other side of the argument is those who argue that even stronger encryp-
tion is needed than what is currently used as a way to protect data and information
from cybercriminals. They argue that the economy is so tied to the internet, it is
essential that the safety of data be ensured. It would be devastating if it were easier
for offenders to hack into information. Some experts have called for ubiquitous
encryption that ensures the security of data by giving only the sender and recipi-
ent the keys to decrypt the data. This is sometimes referred to as “end-to-end”
encryption.
Malware is available that allows criminals to decrypt encrypted files, allowing
them to steal data that has been encrypted. This points to the need for tighter
encryption. Other malware, called ransomware, encrypts a person’s or company’s
data, making it unusable to the owner. The offender demands a sum of money to
decrypt it. Many companies have been forced to pay the ransom simply to have
access to their customer files. This is particularly true with health care facilities that
need immediate access to files.

END USER LICENSE AGREEMENT

An end user license agreement (EULA) is a contract regarding a piece of software
that a customer must agree to in order to use the software. Where it is a contract,
a EULA will have some impact on whether certain uses of a piece of software are
legal or illegal. The EULA can also have legal consequences for the developer of the
software, having some impact on whether their actions in regard to the software
are legal or illegal.
For customers of software, EULAs primarily impact ownership rights. Specifically,
EULAs often purport to lease software to customers, not sell it to them. This limits
what a customer can legally do with that software. In the United States, a software
developer’s ability to treat the purchase of software by a customer as a lease instead of
a transfer of ownership was upheld in the federal case of Vernor v. Autodesk, 621 F.3d
1102 (2010). In that case, Timothy Vernor purchased copies of AutoCAD (drafting
software) from a direct customer of Autodesk—the developer of the software. After
purchasing the copies, Vernor then sold them on eBay. Autodesk required users of
the software to agree to its license agreement in order to install the software. Among
the licensing terms was the agreement that software users were unable to transfer
their license to use the software to another person. Accordingly, eBay was sent a
take-down notice by Autodesk with regard to Vernor’s auction of AutoCAD, resulting
in eBay canceling the auction. Vernor, believing he had the right to sell the software,
contested Autodesk’s assertions and continued to sell copies of AutoCAD on eBay.
Autodesk continued to object to the sale of AutoCAD by Vernor, and Vernor ultim-
ately filed suit to have the court declare his sale of the software to be legal. The court
ultimately ruled in favor of Autodesk, holding that a software developer could treat
the purchase of software by a customer as a lease if the developer specifies the transfer
is in fact a lease, specifically restricts the customer’s ability to transfer the software in
the terms of the lease, and imposes additional use restrictions on the software.
The terms of a EULA could prohibit certain activities of a customer that would
otherwise be legal if the customer owned the software in question instead of merely
leasing it. As seen in the Vernor case above, a common restriction is a prohibition
on transferring the software to someone else. Other restrictions may include a
prohibition on public criticism of the software and agreeing to not uninstall parts
of the program. From the standpoint of a software developer, these EULA terms
make sense. Prohibiting the transfer of software does help safeguard against illegal
copying of the software, while simultaneously eliminating a resale market for the
software, meaning everyone who wants a copy of the software must go through
the developer to get it. Curtailing criticism of software protects the developer from
negative reviews that could impact the developer’s ability to make a profit on the
software. Software (freeware and shareware in particular) may have adware bun-
dled with it, with the maker of the adware compensating the developer for bun-
dling it. If a customer is able to selectively remove the adware, the profit model of
the developer crumbles (Newitz, 2005).
While these restrictions make sense for software developers, they can be confus-
ing for customers. The difference between owning software and leasing software
168 E n d U s e r L i c e n s e A g r eeme n t

may not be one that the average customer understands. Thus, a customer may
attempt to sell a piece of software to another person, unaware that such an act is
illegal. In such an instance, the customer may be found to be in violation of the
developer’s copyright (see Terasaki, 2014). The same could be done if a customer
violates any of the other terms of the EULA. For example, a customer who alters a
piece of software to make it work with their computer setup would be in violation
of a EULA provision prohibiting alteration, thus running the risk of violating the
developer’s copyright.
Compounding the confusion for customers with EULAs is the fact that many
customers never actually read the EULA for a piece of software, even though soft-
ware often requires customers to signify (by checking the appropriate box) that
they have read, understood, and agree to the terms of the EULA. Knowing this,
several companies add farcical terms to their EULAs, aware that such terms will
never be enforced. These include giving away your first-born child as a condition
of using free Wi-Fi and agreeing to give your soul to a videogame retailer. At least
one company went in the opposite direction, agreeing to pay $10,000 to the first
person to send an e-mail address included in the middle of the EULA—a promise
they followed through on (Schwartz, 2019). While such terms poke fun at EULAs,
the reality is that failure to thoroughly read EULAs can, as mentioned above, result
in negative legal consequences for the user of the software. The reality is that even
if customers wanted to read the EULA for every piece of software and online site
they use, that may be impossible. It has been estimated that for the average person
in the United States, it would take approximately 76 working days to read all the
EULAs and other privacy policies they agree to in the course of a year. If everyone
were to actually do this, it is estimated that the productivity lost due to the time
required to read those EULAs would result in a $781 billion loss annually (Madri-
gal, 2012; McDonald and Cranor, 2008).
A concern raised by some is the uneven bargaining position customers have in
relation to software developers when it comes to EULAs (see Editorial Board, 2019;
Terasaki, 2014). Generally, a customer must agree to the EULA in its entirety to
use the software or service. Some of the terms customers must agree to in EULAs
can be onerous. Customers may have to agree to monitoring by the developer,
waiving claims against the developer if the software ruins their computer, and to
be bound by any changes in the EULA—which the developer may be able to make
without notice to the customer (Newitz, 2005). It is possible that if a EULA is too
one-sided in favor of a software developer, a court may deem the EULA uncon-
scionable and thus legally unenforceable, in whole or in part (Terasaki, 2014). This
happened in the case of Bragg v. Linden Research, Inc., 487 F. Supp. 2d 593 (2007).
In that case, Marc Bragg was a user of software created by Linden Research called
Second Life—a virtual world on the internet. Bragg had to agree to a EULA to use
Second Life. Bragg purchased several parcels of land in Second Life and acquired
other items in the virtual world as well. Following a purchase made by Bragg that
Linden Research claimed was outside the permitted channels, Linden Research
froze Bragg’s account, depriving him access to the parcels of land he purchased and
the other items he had acquired. It claimed it was permitted to do so under the
E n d U s e r L i c e n s e A g r eeme n t 169

terms of the EULA. Bragg filed suit against Linden Research in court, and Linden
Research filed a motion to have the case resolved via arbitration as per the terms of
the EULA. In finding the arbitration clause of the EULA unconscionable and thus
unenforceable, the court noted several provision in it that were clearly in favor of
Linden Research. Among those were a provision requiring that users seeking to
resolve a dispute do so through arbitration at Linden Research’s place of business
(while Linden Research itself could choose to freeze a user’s account in its sole
discretion) and a provision requiring the arbitration proceeding to be confidential
(Terasaki, 2014).
There are additional legal issues software developers must be aware of when
drafting a EULA beyond drafting it in a way that will not be unconscionable. Soft-
ware developers that do not properly disclose what their software does can end
up in legal trouble. This happened to Sony BMG in 2005. Sony BMG downloaded
software onto the computers of customers who purchased select CDs from them.
The software included a form of DRM software—software intended to prohibit
unauthorized copying of intellectual property, such as songs on a CD. The EULA
provided by Sony BMG did not mention the DRM component of the software
or that fact that it would be downloaded onto a customer’s computer (Russinov-
ich, 2005). Additionally, the software sent information about user’s music listening
habits to Sony BMG, despite the fact that the EULA specifically noted that personal
information would not be collected (Electronic Frontier Foundation, 2019). This
lack of disclosure in the EULA of the properties of the software made it appear to
be spyware—software that is installed on a computer without the user’s knowledge
and that transmits information to another party. Sony BGM ultimately faced several
lawsuits over this software. This included a U.S. class-action suit that Sony BMG
settled (Associated Press, 2005) and lawsuits from 42 individual states that Sony
BMG also settled for a total of over $5 million (McMillan, 2006).

See also: Copyright Infringement; Digital Millennium Copyright Act; Digital Rights
Management; Open-Source; Spyware

Further Reading
Associated Press. 2005. “Sony BMG tentatively settles suits on spyware.” New York Times,
December 30, 2005. https://www.nytimes.com/2005/12/30/technology/sony-bmg
-tentatively-settles-suits-on-spyware.html.
Editorial Board. 2019. “How Silicon Valley puts the ‘con’ in consent.” New York Times,
February 2, 2019. https://www.nytimes.com/2019/02/02/opinion/internet-facebook
-google-consent.html
Electronic Frontier Foundation. 2019. “Sony BMG litigation info.” Electronic Frontier
Foundation. https://www.eff.org/cases/sony-bmg-litigation-info
Madrigal, Alexis C. 2012. “Reading the privacy policies you encounter in a year would take
76 work days.” The Atlantic, March 1, 2012. https://www.theatlantic.com/technology
/archive/2012/03/reading-the-privacy-policies-you-encounter-in-a-year-would-take
-76-work-days/253851/
McDonald, Aleecia M., and Lorrie Faith Cranor. 2008. “The cost of reading privacy poli-
cies.” I/S: A Journal of Law and Policy for the Information Society 4, 3: 543–568.
170 E n g r e s s i a , J o s e f Ca r l , JR .

McMillan, Robert. 2006. “Sony rootkit settlement reaches $5.75M.” PCWorld, December
22, 2006. https://www.pcworld.com/article/128310/article.html.
Newitz, Annalee. 2005. “Dangerous terms: A user’s guide to EULAs.” Electronic Frontier
Foundation. https://www.eff.org/wp/dangerous-terms-users-guide-eulas
Russinovich, Mark. 2005. “Sony, rootkits and digital rights management gone too far.” Tech-
Net (blog), October 31, 2005. https://blogs.technet.microsoft.com/markrussinovich
/2005/10/31/sony-rootkits-and-digital-rights-management-gone-too-far/
Schwartz, Matthew S. 2019. “When not reading the fine print can cost your soul.” National
Public Radio, March 8, 2019. https://www.npr.org/2019/03/08/701417140/when-not
-reading-the-fine-print-can-cost-your-soul
Terasaki, Michael. 2014. “Do end user license agreements bind normal people?” Western
State University Law Review 41, 2: 467–489.

ENGRESSIA, JOSEF CARL, JR.(1949–2007)

Josef Carl Engressia Jr., otherwise known as Joybubbles, was a key person in the
1970s “phone phreaking” subculture, whose members found ways to hack into
telephones. After being arrested in 1971, Engressia eventually worked Mountain
Bell in Denver, Colorado, to help them solve security weaknesses in their network
and prevent others from taking advantage of the vulnerabilities.
Engressia was born in 1949 in Richmond, Virginia, but his family moved often.
Born blind and with an IQ of 172, Engressia became interested in telephones at an
early age. When he was seven years old, Engressia realized he could activate phone
switches by whistling a certain frequency. When he whistled a tone at 2,600 Hz
into a phone receiver, he could dial anywhere for free. Because of this skill, Engres-
sia was given the nickname “The Whistler.”
Because of his obsession with the phone, Engressia’s parents refused to have
a phone in the home. Engressia chose to attend the University of South Florida,
where he studied math. While in college, he could call long-distance for free by
whistling the right tones, as he had learned when he was younger. Engressia began
to charge other students one dollar to place a free long-distance call, and it wasn’t
long until someone reported him. Engressia was suspended from school in 1968
and fined $25 but was reinstated quickly, and he eventually graduated from the
university with a degree in philosophy.
This incident became public through the media, and the general public quickly
became aware of weaknesses of the phone system. One article that described the
activities and culture of the phone phreakers and brought a great deal of attention
to their activities was written by Ron Rosenbaum, entitled “Secrets of the Little
Blue Box.” In the article, published in Esquire magazine, Rosenbaum wrote about
Engressia and other phone phreakers who had successfully hacked the phones
and had created a “blue box” that could be used to override the phone system and
cheat the company to make calls around the world without cost and without being
traced.
After graduation, Engressia moved to Tennessee and continued to make free
phone calls by whistling the right tone. One day, as he was making a call, he
“dialed” a wrong number and spoke with an operator for Bell Telephone in
E n t e r ta i n me n t, E f f e c t s o n 171

Montreal. The operator became suspicious and started to monitor Engressia’s

phone calls, even though it was illegal. Engressia had discovered a way to call
around the world to himself by calling on one phone and answering another, all for
free. The employee eventually called the police and described what Engressia was
doing. The police raided Engressia’s home. He was arrested in 1971 and pleaded
not guilty to theft of service, but the judge reduced the charges to malicious mis-
chief. Engressia was given a suspended sentence on the condition that he never
work with phones again.
As phone companies moved to digital systems, Engressia could no longer make
free calls by whistling. Engressia moved to Minnesota in 1982 and helped with
research concerning how to control the odor of hog waste (because of his keen
sense of smell). He became an ordained minister for the Church of the Eternal
Childhood, a church he established. In 1991, he declared that he was legally
changing his name to Joybubbles and that he was “the age of five forever.” He often
acted very childlike, which some attributed to the fact that he was sexually abused
as a child by a teacher at a school for blind children. He decided to use the phone
to record his life story on a show called “Stories and Stuff,” a series of audio files in
which he discussed his thoughts on different issues.
Engressia died of a heart attack in 2007 at the age of 58.

top officials in the company sold their shares—almost $2 million in shares—days

after the breach was discovered but long before reporting the breach to the public.
Many accused these officials of insider trading.
The breach was reportedly the result of a vulnerability in Apache Struts, a free,
open-source software. There were many vulnerabilities in the software, and patches
were available to solve the problems. Because the patches have been available for
some time for many of the vulnerabilities, it was thought that Equifax should have
had them in place.
In light of the breach, Equifax offered victims a free year of credit-report moni-
toring services. But security experts suggested that free credit monitoring would
not prevent a criminal from stealing a person’s identity, and recommended instead
that consumers put a “freeze” on their accounts to prevent thieves from having
access to account information. It was also suggested that people watch their credit
reports and monitor bank accounts and report any suspicious activity. So the com-
pany then opted to waive all fees or repay fees for those who sought to put a freeze
on their credit as a way to prevent hackers from stealing their assets.
Not long after the breach was announced, members of the U.S. Senate Finance
Committee began asking questions about the loss of customers’ personal data. A
few days after the hearings, 36 Senators asked federal officials from the Depart-
ment of Justice, the Security and Exchange Commission (SEC), and the FTC to
look into the actions of Equifax officials.
In the end, it was reported that there were a series of deficiencies that resulted in
the hacking, including poor security safeguards and limited protection measures to
protect those affected. It was also discovered that Equifax retained personal infor-
mation too long. Executives at the company have announced that it has under-
taken efforts to improve its security and policies for destroying data.
Breaches are becoming more common and affect more people, largely because
there is more information collected and stored digitally than ever before. Unfortu-
nately, sensitive data such as social security numbers are often not protected
sufficiently.

EUROPEAN CYBERCRIME CENTER

Similar to events and trends in the United States, cybercrime has become a serious
matter for European countries. Some estimates show that cybercrime costs Euro-
pean Union (EU) member states about €265 billion each year. As a way to combat
this trend, Europol (the law enforcement agency for the EU) established the Euro-
pean Cybercrime Center (EC3) in 2013. The intent behind the new organization
was to strengthen law enforcement’s response to cybercrime so that there was a
more efficient and more effective approach to handling cybercrime events. The
new agency was given the mission of assisting law enforcement authorities in the
European Union to deter cybercrime and investigate events when they occurred.
The primary task of the newly created EC3 was to disrupt and prevent the
cybercrime activities of global organized crime networks that are responsible for
many of the cybercrimes committed that cause serious harm to victims. This is
essential as these offenses have the potential to injure the critical infrastructure
in any of the countries, as well as their information systems. To fulfill these goals,
the membership of the EC3 includes two forensics teams—one focuses on digital
forensics while the other emphasizes documents. There are two strategy teams, one
for outreach and one for support. A cyberintelligence team is in charge of collect-
ing information about cybercrimes to identify potential threats, but also to keep
data on trends and patterns for events. In addition to these specialized groups,
the Joint Cybercrime Action Taskforce (J-CAT) was also established to investigate
critical international cybercrime events that have an impact on EU member states.
Together, these groups seek to create workable partnerships among all of the mem-
bers and then develop a plan for the prevention of cybercrimes, while at the same
time increasing the public’s awareness of online crimes.
The agents working in EC3 rely on existing law enforcement techniques and
activities when investigating offenses. The crime areas they focus on include
cybercrime, high-tech crimes, social engineering, child sexual exploitation, forg-
ery of money and means of payment, payment fraud, and money laundering.
E x pl o i t K i t 179

EC3 participates in any operations or investigations that are requested by member

states. The new agency also serves as the clearinghouse for information and issue
analyses of events when they occur. The organization also provides expertise to
agencies that request it, as well as training in cybercrime investigations.
Members of EC3 often work cooperatively with other law enforcement agencies,
such as the FBI and the U.S. Department of Justice. As a result of one cooperative
investigation in 2014, law enforcement agents closed dozens of illegal websites
and took the operators into custody. According to officials at EC3, agents were able
to identify users of Tor, a network that encrypts the identities of users and their
activities online. The websites they closed provided a market for illegal drugs and
weapons. One of the men arrested was Blake Benthall, from California, who over-
saw the operation of Silk Road 2.0, a website popular for selling illegal goods. Also
arrested at that time was Thomas White, another operator of Silk Road 2. Others
arrested were from Sweden, Hungary, Ireland, Spain, and the United Kingdom.
In 2016, EC3 warned that acts of cybercrime are on the rise and that the num-
ber of cybercriminals is increasing. Moreover, there are many more opportunities
to commit acts of cybercrime online. To combat this, personnel at EC3 took part
in 131 investigations in 2015, which was an increase from 72 in 2014. However,
they noted that cybercriminals are constantly developing new methods to carry out
attacks, which are then sold or provided to criminals around the world, includ-
ing state actors and terrorists. They also noted the increased use of encryption by
offenders to hide their activities.

Federal Bureau of Investigation. 2019. “Cyber crime.” https://www.fbi.gov/investigate

/cyber
Geller, Eric. 2018. “FBI struggles to retain top cyber talent.” Politico, August 3, 2018.
https://www.politico.com/story/2018/08/03/fbi-cyber-security-talent-drain-hacking
-threat-russia-elections-760740
Monroe, Jana D. 2003. “Before House Judiciary Committee, Subcommittee on Courts, the
Internet and Intellectual Property.” Federal Bureau of Investigation, July 17, 2003.
https://archives.fbi.gov/archives/news/testimony/the-fbis-cyber-division
Poulson, Kevin. 2009. “The decade’s 10 most dastardly cybercrimes.” Wired, December 31,
2009. https://www.wired.com/2009/12/ye-cybercrimes/
Segall, Laurie. 2015. “Silk Road’s Ross Ulbricht sentenced to life.” CNN, May 29, 2015.
h ttps:// m oney.c nn .c om /2 015 /0 5 /2 9 /t echnology /s ilk -road -ross -u lbricht -p rison
-sentence/index.html
Selyukh, Alina. 2016. “The FBI has successfully unlocked the iPhone without Apple’s
help.” National Public Radio, March 28, 2016. https://www.npr.org/sections/thetwo
-way/2016/03/28/472192080/the-fbi-has-successfully-unlocked-the-iphone-without
-apples-help
Suro, Roberto. 1999. “FBI lagging behind on cyber crime.” The Washington Post,
October 7, 1999. http://www.washingtonpost.com/wp-srv/national/daily/oct99/cyber7
.htm

F E D E R A L I N F O R M AT I O N S E C U R I T Y
MANAGEMENT ACT OF 2002
The Federal Information Security Management Act of 2002 (FISMA) is a U.S. law
that creates a framework to protect government information, operations, and assets
from cyber threats. FISMA is chapter 3 of the Electronic Government Act of 2002
(PL 107-347). The law was originally proposed because federal agencies are often
targeted by cybersecurity attacks by individual cyber criminals or foreign govern-
ments. If criminals successfully breach the security of these sites, it can result in
personal or sensitive data being stolen and/or made public. Representative Thomas
Davis (R-VA) originally proposed the bill, and President George W. Bush signed it
into law in December 2002.
The law requires federal agencies to develop, document and implement pro-
grams that provide information security for their systems. Federal agencies are
also required to carry out annual reviews of their security plans, providing that
information to the Office of Management and Budget (OMB), which in turn must
report to Congress.
Specifically, the provisions of the law require that federal agencies:

1. Maintain and inventory of information systems that are maintained by that

agency: or systems that interface between the federal agency and an outside
agency;
2. Categorize information by the level of risk;
3. Develop and maintain a security plan for all systems; should be reviewed
regularly;
Fe d e r al I n f o r mat i o n Se c u r i t y M a n a g eme n t A c t o f 2 0 0 2 187

4. Utilize security controls: organizations must meet minimum security require-

ments set by National Institute on Standards and Technology (NIST);
5. Conduct risk assessments to determine if additional controls should be
added or if current ones should be changed.

If a federal agency chose to ignore the law, a judge was given a variety of penal-
ties that could be applied to the offender. These include a Congressional censure, a
reduction in federal funding, and damage to a person’s reputation.
The regulations for increasing cyber security that were set forth by FISMA
applied originally to all federal government agencies. The law was expanded to
include to state agencies that carry out federal programs such as Medicare and
Medicaid. Thus, some state agencies had to comply with FISMA regulations. Over
time, FISMA was again expanded to increase oversight of the private sector. Cur-
rently, if a private-sector company has a contract with the government to provide a
service or if it receives federal grant money, it must comply with FISMA.
The law makes it clear that FISMA agencies are still permitted to store data in
the cloud, even though it poses a security risk. Agencies often turn to this form
of data storage because it is cheap. If a cloud provider provides storage, it then
becomes subject to FISMA regulations. To help with this, the government created
the Federal Risk and Authorization Management Program (FedRAMP), a govern-
ment program that gives a standardized program for security assessment, autho-
rization, and monitoring of products that are held in the cloud. A cloud provider
needs to show they are complying with FISMA if they comply with security stan-
dards and guidelines that have been developed by NIST, called the integrated Risk
Management Framework. This is a statement of FISMA security standards to help
agencies create their individual security plans.
Since being passed, compliance with FISMA has successfully increased the
cybersecurity of sensitive federal data. Federal agencies and private companies
have been able to create and maintain a higher level of security and lessen the
chances of a security breach.
The original FISMA law was amended by the Federal Information Security Mod-
ernization Act of 2014 (44 U.S. Code § 3551; PL 113-283), sometimes referred
to as FISMA Reform. This bill was S2521 and was signed by President Obama. As
passed, the law requires less reporting, but it requires more reliance on continuous
monitoring of systems to identify threats. The law also increases the compliance
regulations and places an emphasis on problems that result after a security breach.
It became necessary that agencies plan for security for their data and information
so it remains safe. Part of this requires that employees are given the task of being
responsible for the security of an agency. They must continue to review the security
protocols in their agencies and revise them as needed. The bill also re-established
the oversight powers of the Office of Management and Budget (OMB) for security
policies and gave the DHS secretary the power to implement the security plans
developed. The DHS now had the ability to carry out information security policies
for civilian agencies, including the provision of technical assistance, among other
things.
188 F i n a n c i al C r i me s

prevention systems (IPSs). An IPS functions like an intrusion detection system

(IDS), gauging network traffic patterns and blocking traffic that is abnormal for
that network. While firewalls, IPSs, and IDSs are separate cybersecurity tools, the
distinction between these tools has faded as technology has advanced and these
tools incorporate aspects of the others (Bradley, 2019).
Firewalls can be either hardware or software. While both hardware and software
firewalls carry out the same basic function, there are advantages and disadvantages
to both. Hardware firewalls are generally easier to set up. A hardware firewall will
generally be external to a computer. These may be built into another network
device, such as a router. The design generally permits multiple computers to be
run through it, providing protection to all those computers with no additional
setup. While setup is easier, hardware firewalls only monitor incoming traffic, not
outgoing. While this protects against many cyberattacks, it does not protect against
all of them. Software firewalls, on the other hand, are able to monitor both incom-
ing and outgoing traffic. The security parameters of software firewalls are also gen-
erally more customizable than hardware firewalls (Norton, 2019).
As alluded to above, although firewalls can help prevent many cyberattacks,
there are ways to circumvent the security provided by them. Where firewalls block
data based on information the firewall collects about that data, if a cybercriminal
can find a way to falsify that information, they may be able to get data—such as
malware—past the firewall. One way of doing this is spoofing. Spoofing is the
process of making something appear that it is something it is not. For firewall cir-
cumvention, a cybercriminal would attempt to make a data packet appear to come
from an IP address other than the one it is actually coming from in order to fool
the firewall into letting it through. In this way, the spoofed data packets are work-
ing as a Trojan horse (Norton, 2019). Once the Trojan horse makes it through, the
malware included inside can be downloaded to the targeted computer. Another
similar method that can be used is the use of a virtual private network (VPN). A
VPN can be used to hide the IP address of an internet user. While these can be
used for privacy reasons, where the actual IP address of a user is hidden, a firewall
would not block data sent or received from that user, even if their actual IP address
was blocked. One type of cyberattack that may not be detected by a hardware
firewall is the use of a bot. A bot is a computer that has been hijacked by a cyber-
criminal, allowing them to surreptitiously control that computer. As noted above, a
hardware firewall is generally unable to monitor outgoing traffic from a computer.
Thus, if a computer has been infected with malware and become a bot, a hardware
firewall will be unable to monitor the outgoing activities a cybercriminal is initiat-
ing from that computer (Norton, 2019).
Installing malware is not the only reason that someone might want to circum-
vent a firewall. Firewalls are used by some countries to censor the material its citi-
zens can access on the internet. This can be seen with the censorship apparatus in
place in China, known as the “Great Firewall of China.” Citizens in those countries
can use the circumvention methods mentioned above to circumvent these firewalls
and access censored material. In these countries, circumventing these firewalls or
providing the means to circumvent these firewalls can be a crime.
192 Fl o r i d a C o mp u t e r C r i me A c t o f 1 9 7 8

See also: Bots and Botnets; China; Malware; Spoofing; Trojan Horse; Virtual Private
Network

Further Reading
Bradley, Tony. 2019. “Introduction to intrusion detection systems.” Lifewire, June 1, 2019.
https://www.lifewire.com/introduction-to-intrusion-detection-systems-ids-2486799
Cisco. 2019. “What is a firewall?” https://www.cisco.com/c/en/us/products/security/fire
walls/what-is-a-firewall.html
Griffiths, James. 2018. “A software developer just became the latest victim of China’s VPN
crackdown.” CNN, October 10, 2018. https://www.cnn.com/2018/10/10/asia/china
-vpn-censorship-intl/index.html
Norton. 2019. “How does a firewall work?” https://www.nortonsecurityonline.com/security
-center/how-does-firewall-work.html

FLORIDA COMPUTER CRIME ACT OF 1978

In response to a dog-racing betting scam, the Florida legislature passed the Florida
Computer Crime Act in 1978, one of the first laws to create laws defining com-
puter crimes. The law was in response not only to the scam at the race track but
also to increasing computer crimes in both the public and private sectors—and
the increase in costs that resulted from these crimes. Officials recognized that the
opportunities that existed for computer-related crimes were very high, and there
was a need for new, preventive action.
On August 30, 1977, Leon Rodriguez placed a bet at the dog track in Flagler,
Florida. When the race ended, Rodriguez and four other people had won a jackpot
of $15,000. Rodriguez had won legally, but the four other betters, who were “elec-
tronic partners,” had won the money illegally through a computer scam. Under
the scam, criminals made the losing tickets into winning bets by manipulating
the computers that reported race results. Fraudulent winning tickets were then
printed, and the winners cashed in their tickets the following day. The scam con-
tinued for many years, until the scam was discovered and the offenders arrested in
1977 (Hochman, 1986).
The content of the Florida Computer Crime Act includes regulations prohibiting
the intentional modification or deletion of data or programs found on a computer.
The law also makes it illegal to destroy or damage the hardware on a computer. A
third provision makes it illegal to knowingly take or disclose data or documenta-
tion that is a trade secret or confidential. These offenses are all defined as offenses
against intellectual property. These offenses are defined as a felony of the second or
third degree, depending on the provision.
Another portion of the Florida law makes it illegal for an offender to willfully
modify computer equipment or commit an offense against computer equipment.
This can include acts such as destroying or damaging a computer system or net-
work or destroying, damaging, or taking equipment or supplies. This is also
defined as a third- or fourth-degree felony, depending on the damage caused by
the destruction.
414s 193

People who use computers were also given some protection under the law.
According to the statute, any person who willfully or knowingly prevents a person
from using a computer system that they are authorized to use will be guilty of a
third-degree felony. If the offender commits the crime in an attempt to defraud a
person or to obtain property, then it becomes a second-degree felony. By Florida
law, a second-degree felony is punishable by a term of imprisonment of up to 15
years and a fine of up to $10,000, or a higher amount that is equal to double the
profit the offender made from the crime or an amount that is twice the amount of
the loss to the victim. A third-degree felony is punishable with a term of imprison-
ment of up to five years and a fine of up to $5,000 or higher, or an amount that
is twice the profit gained by the offense or double the loss suffered by the victim.
If an offender is found guilty of committing a first-degree misdemeanor in the
office, they may receive a punishment of up to one year in prison and a fine of up
to $1,000. The fine may be larger, as it can be the amount equal to twice the profit
gained from the offense or twice the loss suffered by the victim.

See also: CAN-SPAM Act of 2003; Computer Fraud and Abuse Act of 1986; Cyber-
security Act of 2012

Further Reading
Hochman, Marilyn. 1986. “The Flagler dog track case, 7 Computer L.J. 117.” The John
Marshall Journal of information Technology & Privacy Law 7, 1: 117–127.
UF Computing & Networking Services. 1999. “General information: Florida Computer
Crimes Act. CNS document ID: D0010.” www.security-science.com/pdf/general
-information-florida-computer-crimes-act.pdf

414s
In 1982, a group of six teenaged boys between the ages of 16 and 22 from Milwau-
kee, Wisconsin, formed a computer hacking group called the 414s after the city’s
telephone area code. The boys were members of a Boy Scout–affiliated Explorer
Post in the city that was sponsored by the International Business Machines Cor-
poration (IBM). The company sought to teach the kids how to use new comput-
ers. The boys met weekly to discuss computer techniques and find ways to access
computer games on different systems. To help them in their endeavor, they set up
a type of bulletin board on which they could secretly leave each other tips and
passwords, but they were also able to play computer games on these sites. The
members soon began to hack into modems belonging to companies that were
set up to give employees access to computers while they were traveling. The first
three digits of these systems comprised the area code, followed by a second series
of numbers. They were able to dial long distance without paying fees, a practice
referred to as phreaking.
In time, the members hacked into the computer systems of many high-profile
and government systems in the United States and Canada, including the nuclear
weapons laboratory in Los Alamos National Laboratory in New Mexico, the
194 414s

Sloan-Kettering Cancer Center in New York, a cement company in Montreal, and

the Security Pacific National Bank. The boys became the first group of computer
hackers and have been credited for bringing attention to the ease by which systems
could be accessed and the need for better computer security. The members may
have been acting out the events in the movie WarGames (1983), in which a teenage
hacker breaks into nuclear defense computers. The movie was released at the same
time the boys were carrying out their hacking activities.
Chen Chui, a systems manager for Sloan-Kettering, discovered the hacking by
noticing the failure of a computer that monitored radiation treatment for patients.
While looking into the event, he found that a file of billing records had been
deleted and passwords issued for five new accounts. He contacted the Federal
Bureau of Investigation (FBI), which then began an investigation and quickly dis-
covered the activities of the 414 group. Some of the group members were Timothy
Winslow, Gerald Wondra, and Neal Patrick.
One of the members, 17-year-old Patrick, became the public spokesman for the
group. To defend and explain the group’s activities, he was invited to be on the Phil
Donahue Show (a popular talk show at the time). He also appeared on the cover
of Newsweek magazine. He explained that the 414 members sought the challenge
of breaking into the systems. They were having fun, simply looking for new com-
puter games to play and had no intention of stealing information or selling it. They
were able to do so fairly easily, using simple computers and basic hacking methods
that were quite simple and could be used by many others. They used only their
home computers and their telephone lines. Though the group had no intention of
causing damage, they were the cause of financial harm. Sloan-Kettering claimed
the group caused $1,500 in damages because they deleted billing records as they
tried to hide their intrusion.
As the related events became more widely known, the public and company
officials recognized the vulnerabilities of computers and systems. They came to
the realization that more needed to be done to protect their systems and their
data. After it was discovered that the username and password for the Memorial
Sloan-Kettering Cancer Center were both “test,” the need for better passwords
and more secure technology became evident. Many companies made changes to
improve their security and patched potential access points to their systems.
In the end, the 414 members were not prosecuted, partly because some were
minors but also because there were no laws banning hacking at the time. The
members agreed to stop their hacking activities and pay restitution to the compa-
nies they hacked. Two members were convicted of misdemeanor charges of mak-
ing illegal or harassing phone calls across state lines (because they used a system
called Telnet that connected computer terminals to each other). These offenses at
the time were punishable by a maximum term of six months in prison and a fine of
$500. The government offered the boys a plea deal under which they were placed
on two years of probation and fined $500. Under the Federal Youth Corrections
Act passed in 1950, their records would be expunged.
In 1983, Patrick was asked to testify in front of the U.S. House of Representatives
about computer security and hacking, and six new federal laws were proposed and
Fraud 195

passed to deter cybercrime. One of those laws was the Computer Fraud and Abuse
Act, which Congress passed in 1984. Under this law, it became illegal to knowingly
access a computer without authorization or by exceeding access that has been
granted. It became a federal offense to knowingly access a computer with the intent
to defraud and obtaining anything of value or to cause damage to files (which the
414s did). The law also banned intentionally accessing any private computer sys-
tem of a U.S. agency or department.
In 2015, a documentary movie was made of their activities. Called The 414s: The
Original Teenage Hackers, the 12-minute film was directed by Michael Vollmann
and produced by Chris James Thompson. It was launched at the Sundance Film
Festival in 2015 and then shown on CNN. One of the hackers, Timothy Winslow,
eventually became a network engineer.

See also: Computer Fraud and Abuse Act of 1986; Hacker and Hacking

Further Reading
Elmer-DeWitt, Philip. 1983. “Computers: The 414 Gang strikes again.” Time, August 29,
1983. http://www.time.com/printout/0,8816,949797,000.html
Middleton, Bruce. 2017. A history of cyber security attacks: 1980 to present. Boca Raton, FL:
CRC Press.
Schumacher, Mary Louise. 2015. “Milwaukee’s original teen hackers focus of film pre-
miering at Sundance.” Sentinel Journal, January 20, 2015. http://archive.jsonline.com
/entertainment/movies/milwaukees-original-teen-hackers-focus-of-film-premiering-at
-sundance-b99429647z1-289228761.html
Storr, Will. 2013. “The kid hackers who starred in a real-life WarGames.” Telegraph, Sep-
tember 16, 2013. http://www.telegraph.co.uk/film/the-414s/hackers-wargames-true
-story/
Winslow, Timothy. 2016. “I hacked into a nuclear facility in the 80s. You’re welcome.”
CNN Films, May 3, 2016. https://www.cnn.com/2015/03/11/tech/computer-hacker
-essay-414s/index.html

FRAUD
Broadly speaking, fraud is “[a] knowing misrepresentation of the truth or conceal-
ment of a material fact to induce another to act to his or her detriment” (Garner,
2001). Fraud can be criminalized generally. Criminal law in the state of Arizona
contains such a statute, making it a crime to “knowingly [obtain] any benefit by
means of false or fraudulent pretenses, representations, promises or material omis-
sions” (ARS § 13-2310). Specific types of fraud can be separately criminalized as
well. Examples of this in federal criminal law include a credit card fraud statute
(15 U.S. Code § 1644), a securities fraud statute (18 U.S. Code § 1348), and a
computer fraud statute (18 U.S. Code § 1030). Fraud can also be an element of
other crimes. For example, California’s rape statute includes a provision criminal-
izing sexual acts that occur through intentional fraud on the part of the perpetrator
(California Code, PEN § 261). Given the broad definition of fraud and the mul-
titude of instances in which it can be used, it would be incorrect to categorize it
196 Fraud

strictly as a financial crime. However, fraud is often employed for the purpose of
illegally depriving someone of their money.
Fraud can be committed as a cybercrime. As noted above, computer fraud spe-
cifically is a crime in some jurisdictions. Even in those jurisdictions without a
specific computer fraud statute, a cybercriminal can still be found guilty of fraud
under a general fraud statute. For many financial crimes online, cybercriminals
will have to employ some sort of fraud to complete the crime. This stems from the
nature of cybercrime. A cybercriminal will not generally have the ability to simply
take an item away from someone as may be the case with some noncyber thefts.
In order to misappropriate someone else’s money online, a cybercriminal will first
have to gain access to that money. To accomplish this, some level of fraud will
generally be necessary.
There are some common methods by which cybercriminals use fraud to obtain
money from their victims. According to the FBI, one common method used by
cybercriminals in 2017 was to compromise business e-mail addresses (Federal
Bureau of Investigation, 2018). A cybercriminal can compromise a business e-mail
address either through social engineering or hacking. After the e-mail address
has been compromised, a cybercriminal can use that e-mail address to surrepti-
tiously transfer funds out of the business. It could also be used—while posing as
a legitimate employee within the business—to ask other employees for person-
ally identifying information, such as that included in payroll or tax withholding
records. Another common method mentioned by the FBI is tech support fraud.
In these cases, cybercriminals will poses as tech support personnel for a company.
The cybercriminals contact victims purporting to offer assistance to the victim
with made-up problems, such as a compromised e-mail account, resolving issues
with their cable television, or resolving issues with their bank account. If the vic-
tim believes the cybercriminal is in fact a legitimate tech support employee, they
can unwittingly provide personally identifying information to the cybercriminal,
enabling them to access and take the victim’s money.
There are additional fraudulent methods a cybercriminal might use. A cyber-
criminal may create a false online presence and attempt to lure in a victim through
romantic overtures—a practice known as catfishing. Once a victim believes the
romantic relationship is legitimate, the cybercriminal will concoct a financial dif-
ficulty and ask the victim for money. Another quick method used by cybercrimi-
nals is “Can you hear me?” calls. In that scheme, a cybercriminal will call potential
victims and ask “Can you hear me?” If a potential victim responds, their voice is
recorded by the cybercriminal. That recording can be used as a voice signature to
authorize money transfers over the phone (Tatham, 2019).
Cybercriminals are constantly evolving, and they take their schemes to where
people are online. An example of this is the increase in financial cybercrimes in
the popular video game Fortnite, which had 200 million users as of late 2018.
The game is free to play, though players can purchase additional items in the
game (character skins, dance moves, etc.) with V-Bucks—the in-game currency
which generally requires actual currency to purchase. Cybercriminals will offer
free V-Bucks to players, the condition being that the victims must first provide
Fraud 197

personally identifying information to the cybercriminal. As a good number of

those playing the game are children, it appears as though cybercriminals are trying
to target a vulnerable population who may not be as able to notice the signs of a
fraud scheme (Sun Reporter, 2018).

See also: Financial Crimes; Hacker and Hacking; Identity Theft; Phishing; Social
Engineering

Further Reading
Federal Bureau of Investigation. 2018. “2017 internet crime report.” https://pdf.ic3.gov
/2017_IC3Report.pdf
Garner, Bryan A. 2001. Black’s Law Dictionary. 2nd Pocket Edition. St. Paul, MN: West
Group.
Sun Reporter. 2018. “Fortnite V-Bucks scam warning issued by police as gamers lose
THOUSANDS to fraudsters.” The Sun, October 5, 2018. https://www.thesun.co.uk
/tech/7425496/fortnite-scam-free-vbucks-police-warning/
Tatham, Matt. 2019. “The Ultimate List of the Year’s Worst Scams.” Experian, March 11, 2019.
https://www.experian.com/blogs/ask-experian/the-ultimate-list-of-the-years-worst
-scams/
G
GAMBLING
Gambling is the playing of games of chance for money. The laws regarding gam-
bling differ from state to state. Perhaps the most extreme examples can be seen
in the neighboring states of Utah and Nevada. Utah prohibits almost all forms of
gambling. It does not even have a lottery. Nevada, on the other hand, allows casi-
nos throughout the state. Another level of complexity is added to this when taking
Native American reservations into account. Establishment of casinos is permitted
on reservations (25 U.S. Code § 2701 et seq.), and thus a state that does not permit
casinos might find a casino within its borders if a reservation within its borders
establishes one.
With the advent of the internet, gambling has moved online. Because gambling
websites are accessible from any state (or any country for that matter), online gam-
bling can be tricky to operate and regulate. States are split on how to handle online
gambling. Only a handful of states permit some form of it. The United States has
also faced issues regulating online gambling that is hosted in foreign countries
and occurs in the United States. On March 13, 2003, the country of Antigua filed
a complaint against the United States with the World Trade Organization over
the United States’s handling of online gambling from other countries. This com-
plaint stemmed from a criminal cases in the United States filed in 2001 against Jay
Cohen—one of the founders of a company involved in online gambling known
as World Sports Enterprise. World Sports Enterprise was licensed to operate in
Antigua in 1997, and it was the second largest employer in Antigua. The criminal
complaint against Cohen was for accepting bets in Antigua from jurisdictions in
the United States where gambling was illegal. Cohen was convicted and sentenced
to 21 months in prison. Following this case, Antigua’s online gambling business
dropped. The complaint filed with the World Trade Organization claimed that the
United States was impermissibly stifling Antigua’s legitimate business in violation
of obligations the United States had under a World Trade Organization treaty. The
Organization agreed. This ruling would seemingly restrict the United States from
limiting legitimate online gambling sites that are hosted in a foreign country from
operating within the United States (Pontell et al., 2011).
One of the arguments that comes up with gambling is whether or not the game
in question is a game of chance or a game of skill. Again, depending on the state,
placing bets on a game of skill might be legal in places where placing bets on a game
of chance may not be. A game of chance is one where the outcome of the game
is completely random (i.e., left to chance). A game of skill, as the term implies,
200 Gam b l i n g

requires some level of skill in determining the outcome of the game. For example,
a state lottery would be a game of chance because the numbers are chosen com-
pletely at random. Conversely, billiards would be a game of skill as the outcome
is based on the skill of the players. There are a host of games that fall somewhere
in between these two extremes. There can be debate whether games fall more on
the side of chance or more on the side of skill. Poker is one such game over which
this debate occurs. There is certainly chance built into the game, as players are
randomly dealt cards. However, there is skill involved as well, because players are
required to calculate their odds of winning a given hand, read their opponents to
try and ascertain how strong their hand might be, and then determine how much
to wager. At least one judge has determined that it is a game of skill (Secret, 2012).
There are online-specific games where this same debate is waged. Daily fantasy
sports falls into this category. Daily fantasy sports allow players to create a fan-
tasy team in their sport of choice (e.g., football, basketball, baseball) for the day
within a bracket with other players. There are fees charged to play. The winner
of a bracket gets the money. Companies that allow betting on daily fantasy sports
argue it is skill-based as it requires knowledge of players within the professional
sport they are betting on. The counterargument is that an individual player’s per-
formance on a day-to-day basis is more a matter of luck.
There is some concern over the fairness of online gambling. This may stem from
the fact that those playing these games do not get to directly see the people they
are interacting with. This can lead to distrust of the website hosting the online
gambling (e.g., claiming the dealing of cards is not truly random in online poker)
or distrust of those they are playing with (e.g., fears that other players of the game
are actually just different accounts being controlled by the same person to give
them an edge in the game). There have been lawsuits filed against online gambling
sites for fraudulent practices. Several online gambling sites have had employees
use the sites and gamble against customers. Online poker site Absolute Poker had
an employee hack into the system to be able to see opponents’ cards, and the
employee won at least $400,000 doing so (Brunker, 2007). Daily fantasy sport
sites Fan Duel and Draft Kings had employees of their sites gambling via the com-
petitor’s site, potentially using analytic information that their own company had
produced. This use of non-public information to win on a competitor’s site was of
concern (see Rovell, 2015). Fan Duel and Draft Kings were also accused of false
advertising, making claims that average players could win big using these gaming
sites (Rovell, 2015).

GAMEOVER ZEUS BOTNET

GameOver Zeus was a sophisticated piece of malware that was first discovered in
2011. It was used by cybercriminals to steal banking and other credentials from
victims. The Botnet was spread primarily via spam e-mail or phishing messages. A
victim received an e-mail that appeared to be from a bank and opened an attach-
ment, which immediately downloaded malware onto the computer that allowed
the offenders to control the computer. Once the hackers had access, they were able
to steal the victim’s banking credentials or other personal information. They would
then use that data to transfer money from the victim’s accounts into accounts con-
trolled by the criminals. In some cases, the hackers also used a DDoS attack that
would distract the victim from the GameOver Zeus attack.
An infected computer, called a bot, would become part of a global network of
infected compromised computers, also called botnets. The FBI estimated that the
GameOver Zeus botnet was responsible for the theft of millions of dollars from indi-
viduals and businesses, not only in the United States but also globally (FBI, 2014).
The GameOver Zeus botnet was also the means by which a malware called
Cryptolocker was spread. This malware encrypted the data on a computer and
prevented the owner from accessing any data or files until it was unencrypted or
unlocked by the criminal. The offender demanded a payment (usually in Bitcoins)
from the victim before they would unlock the files. This type of malware is called
“ransomware” and is becoming a popular form of malware. It had been estimated
that Cryptolocker was responsible for infecting over 234,000 computers, with over
$27 million in ransom payments (FBI, 2014).
In June 2014, officials in the U.S. Department of Justice and the FBI announced
they would conduct an investigation in cooperation with international law enforce-
ment agencies to discover who was responsible for the botnet. That same month,
in Operation Tovar, the FBI seized control of the networks used by the criminals to
infect the computers. Other agencies involved in the investigation were Europol,
the European Cybercrime Center (EC3), and the National Crime Agency from the
United Kingdom. Also participating in the investigation were security firms includ-
ing CrowdStrike, Dell, Symantec, and McAfee. At about the same time, officials in
other countries (Canada, France, Germany, the United Kingdom, and others) took
over servers that the offenders used to spread the virus. Together, they were able
to reroute the traffic to a safe, government-controlled computer that removed the
virus from the infected computer.
In July 2014, the Department of Justice declared that they were bringing crimi-
nal charges against the person who served as the administrator for the botnet,
202 G L OB A L H E L L ( g H )

Evgeniy Mikhailovich Bogachev, from the Russian Federation. The FBI identified
Bogachev as a major cybercriminal who also went by the name Lucky12345. He
is currently on the FBI’s Cyber Most Wanted List for the following charges: Con-
spiracy to Participate in Racketeering Activity; Bank Fraud; Conspiracy to Violate
the Computer Fraud and Abuse Act; Conspiracy to Violate the Identity Theft and
Assumption Deterrence Act; Aggravated Identity Theft; Conspiracy; Computer
Fraud; Wire Fraud; Money Laundering; Conspiracy to Commit Bank Fraud. The
Department of Justice is offering a $3 million reward for information leading to
Bogachev’s arrest and/or conviction.

See also: Bitcoin; Bots and Botnets; European Cybercrime Center; Federal Bureau
of Investigation; Malware; Phishing; Ransomware

Further Reading
Apuzzo, Matt. 2014. “Secret global strike kills 2 malicious web viruses.” New York Times,
June 3, 2014. https://www.nytimes.com/2014/06/03/world/europe/battling-destruc
tive-computer-viruses-agents-seize-networks-used-by-hackers.html.
FBI Most Wanted: Evgeniy Mikhailovich Bogachev. https://www.fbi.gov/wanted/cyber
/evgeniy-mikhailovich-bogachev
Federal Bureau of Investigation. 2014. “GameOver Zeus botnet disrupted: Collaborative
effort among international partners.” June 2, 2014. https://www.fbi.gov/news/stories
/gameover-zeus-botnet-disrupted
Krebs, Brian. 2014. “‘Operation Tovar’ targets ‘Gameover’ ZeuS Botnet, CryptoLocker
scourge.” Krebs on Security (blog), June 2, 2014. h ttps://krebsonsecurity.com/2014
/06/operation-tovar-targets-gameover-zeus-botnet-cryptolocker-scourge/
Nakashima, Ellen. 2014. “Governments, security firms coordinate secret operation to dismantle
GameOver Zeus botnet.” Washington Post, June 3, 2014. https://www.washingtonpost.com/
U.S. Department of Justice. 2014. “U.S. leads multi-national action against ‘Gameover
Zeus’ botnet and ‘Cryptolocker’ ransomware, charges botnet administrator.” U.S. DOJ
Office of Public Affairs, June 2, 2014. https://www.justice.gov/opa/pr/us-leads-multi
-national-action-against-gameover-zeus-botnet-and-cryptolocker-ransomware

GLOBALHELL (gH)
globalHell, or gH, is a “cybergang” founded by Patrick Gregory, a member of a
street gang who went by the name “MostHateD.” The group became sophisticated
computer hackers but had many of the same characteristics of a gang, such as the
organizational structure. They also carried out some of the same activities as a gang,
including trafficking in stolen credit card numbers. The members were also known
for hacking into the websites of high-profile organizations, including the FBI, the
White House, the interior department, the Senate, and the state of Virginia. They
also hacked the websites of corporations and private organizations. After hacking
into a company’s business, Gregory threatened the company by telling them to pay
a ransom, or he would destroy the business. After doing this, Gregory and other
members boasted about their actions, bringing attention to what they did.
The members of the group started to steal conference-calling codes, and with that
information, they created illegal conference calling “bridges.” This allowed hundreds
G L OB A L H E L L ( g H ) 203

of hackers to speak to each other simultaneously. However, members forgot to disable

the recording device, giving investigators a record of all of their conversations. On
May 9, 1999, police executed search warrants on 16 members of the organization.
The remaining members of the group hacked into and then damaged websites as a
way to show support for those who were taken into custody. One of the sites damaged
belonged to the FBI. The attack caused thousands of hits, shutting down the site.
Gregory, a 19-year-old from Houston, Texas, was charged with computer hack-
ing, and he faced up to five years in jail and a fine of $250,000. He agreed to coop-
erate with police in exchange for a possible reduced sentence. At the same time,
two other members of the group were convicted of committing various computer
crimes. One of those members was 19-year-old Eric Burns, also known as Zyklon,
from the state of Washington. He pleaded guilty to defacing the White House
website. Burns was also banned from using a computer for a three-year period. In
addition to hacking into the White House website, Burns was able to hack into the
websites for the North Atlantic Treaty Organization (NATO), a U.S. embassy, and
Vice President Al Gore. He hacked into the site of the U.S. Information Agency
(USIA), causing the agency to shut the site down for eight days. Burns said of the
attack, “I didn’t really think it was too much of a big deal” (CBS News, 1999).
The second member of the group who was convicted was Chad Davis, a 20 year
old from Wisconsin who also went by the moniker “Mindphasr.” Davis was sen-
tenced to six months in jail and three years of supervised release for defacing the
website of the U.S. Army. He was able to replace the homepage for the Army with
a message that said “Global Hell is alive. Global Hell will not die.”
After the members of the group were arrested, other members protested the
action by hacking into the websites of the White House and the U.S. Senate. The
sites were then defaced. No information was stolen, and it appeared that the goal
was simply to embarrass the owners.
At its peak, globalHell included about 60 members, but the organization broke
up in 1999 after 12 of the members were prosecuted. In all, members of the group
destroyed data on 115 websites, causing between $1.5 and $2 million in damages.

See also: Department of Defense, Attacks on; Federal Bureau of Investigation; 414s;
Hacker and Hacking; Legion of Doom

Further Reading
CBS News. 1999. “White House hacker faces jail.” November 23, 1999. h ttps://www
.cbsnews.com/news/white-house-hacker-faces-jail/
Goldman, John J. and Ush Lee McFarling. 2000. “Man accused of hacking into NASA
computers.” Los Angeles Times, July 13. 2000. http://articles.latimes.com/2000/jul/13
/news/mn-52233
Simons, John. 1991. “FBI sting targets computer hackers.” Deepdyve, January 1, 1991. https://
www.deepdyve.com/lp/elsevier/fbi-sting-targets-computer-hackers-D7M9BYqnf9
Suro, Roberto. 1999. “The hackers who won’t quit.” The Washington Post, September 1,
1999. http://www.washingtonpost.com/wp-srv/national/daily/sept99/global1.htm
ZDNet UK. 2000. “Global Hell hacker to plead guilty, part 1.” March 30, 2000. https://www
.zdnet.com/article/global-hell-hacker-to-plead-guilty-part-i/
H
HACKER AND HACKING
A hacker is a person who uses their computer skills to access another person’s or
organization’s computer system or network without permission or authorization.
They will intentionally breach a network’s security system. Once in a system, a
hacker may try to modify or change a system’s hardware or software so that it can
be used for another purpose, or so they can control what the computer does. A
hacker may upload malware so they can steal information from the user or the
company, or to modify the content of a website. Some hackers intend to take con-
fidential business operations or proprietary information from another business,
possibly a competitor. Some hackers plan to deface a website, launch malware, or
destroy systems altogether.
Hackers often focus on businesses, attempting to either cause damage to the
company or to steal secrets. However, government sites are often the targets of a
hacking attack. This is because many sites have sensitive information, such as per-
sonal information or military secrets. A hack into one of these sites can affect thou-
sands or even millions of people. If the hackers who access a government site have
the support of a government, they are referred to as nation-state-sponsored actors.
There are many reasons why a person would want to hack into another’s
computer system. Hackers may be motivated by revenge. They may be a former
employee who seeks to cause harm to a company’s reputation, or they may be
opposed to big business. These hackers may blackmail companies, steal credit card
information, or use ransomware. Other hackers are motivated by a desire to harm
others, so they may seek to release personal information or embarrassing e-mails
that will cause not only embarrassment but harm the victims’ careers. Some hack-
ers are motivated by financial gain and seek to steal financial information or credit
card numbers.
Some hackers choose to gain access to a site for political reasons. They may seek
to deface the site of a large corporation, for example, to denounce their business
practices. Or they may seek to encourage political action or activism. These hack-
ers are referred to as “hacktivists” and their actions called “hacktivism.” The words
are a combination of activism and hacking. These hackers will sometimes want to
deface websites, or they may want to steal information that is embarrassing to the
company and publish it. This may be not only embarrassing to the organization
but also harmful in some cases.
Some hackers may be interested in the fame they may receive after successfully
hacking into a site and see it as a way to bolster their status within the hacking
community. It can be difficult to know much about hackers and their activities
206 Ha c k e r a n d Ha c k i n g

because they don’t want to be known. Many hackers could face criminal punish-
ments if their activities are made public.
A large number of hackers simply find it a challenge to break into a secure sys-
tem, and do it for fun. They see it as a way to test their knowledge of technology
and as a way to improve their understanding of computers. They want to stay on
top of changes in technology and want to know how things work. They find hack-
ing to be exciting and entertaining.
Typically, a hacker has an expertise in computers and hacks into a system using
that expertise. They must be proficient in computers and technology in order to
find ways into a network. However, a hacker can use other methods to get into a
system. They can “shoulder surf” or simply look over a user’s shoulders to obtain
their passwords or personal information. Or they can use social engineering to try
to convince people to provide them with information so they can access websites.
A hacker may contact a user and convince them that they work for an IT depart-
ment, luring them into providing their password or personal information. They
can use that information to gain access to files.
Although many hackers are able to use their own skills to break into a computer
system, not all people who seek to be hackers have the knowledge to do this. They
are unable to create the malware programs they want to use to discover vulnerabili-
ties in other’s systems. If a potential hacker is unable to write their own code, they
can use premade malware that is available for sale on the internet or the dark web.

White Hat and Black Hat Hackers

A white hat hacker is a category of computer hacker who does not have the intent
to harm the computer network or steal data. They are “good guys” who seek to
access computer systems illegally simply to learn more about them. They are often
security experts who seek to discover security issues or people who just want to
know how the system works. They enjoy fixing or modifying things, and they
hack simply because they enjoy the challenge. White hat hackers typically have
an expertise in computers and have better computer skills than most people. They
may be hired by a company or organization to test their own security systems. The
hackers try to find weak points or vulnerabilities in their systems so preventive
action can be taken before an attack occurs.
A black hat hacker, on the other hand, is a person who has great knowledge of
computers and who seeks access to a system by bypassing security for criminal
reasons or for profit. They may also do so for political reasons. Once they have
access to a system, they may do things like steal data or other material, personal
information, or credit card information. They may also destroy or alter files or steal
trade secrets.

Hacker Subculture
While many hackers enjoy working individually, others come together in hacking
communities where they can provide support to each other. They can communicate
Ha c k e r a n d Ha c k i n g 207

with other hackers and share expertise with one another. The members give hack-
ers the opportunity to discuss hacking techniques or even events, problems, and
issues if they arise. Some hackers will share hacking codes or malware that others
can use. Hackers will also maintain communication and contact with other hack-
ers through journals and conferences.
Most of the time the communication is done with secrecy to hide the partici-
pants’ identity, not just from each other but also from law enforcement. That means
that the hackers will use code names in place of their real names. Many participants
in the hacking community, therefore, do not know each other’s real identities.
The term given to this phenomenon is “hacker subculture.” It refers to the
process whereby like-minded individuals who enjoy computer programming,
information technology, hacking and the like come together. Three norms or char-
acteristics have been linked to the hacker community: technology, knowledge, and
secrecy (Holt et al., 2018). The first of those, technology, refers to the interest that
hackers have in computer software and hardware as well as other devices, includ-
ing video games and cell phones. Through their hacking behaviors, those in the
community seek to develop their technical skills and then apply what they know
to existing technology.
The second norm, knowledge, refers to the overall knowledge that hackers have
regarding technology and computers. Hackers tend to spend a great deal of time
learning more about technology. They often will do that on their own, often by
hacking, but new sites have been developed as a place for hackers to share videos
and tutorials to demonstrate new hacking techniques.
The third norm of the hacking community is secrecy. Hackers tend to take
actions that will keep their identity secret, largely because their behaviors are ille-
gal. They will often use nicknames to refer to themselves in their communication
with others. This way, no one knows who they are. Research into the hacking com-
munity shows that most hackers are usually young, under the age of 30.

Effects
Hacking can sometimes be very destructive to the victims. Hacking may cause the
victim to suffer from economic losses due to a defaced website or resulting nega-
tive publicity. Companies have had intellectual property and trade secrets stolen,
resulting in economic damage. There may also be psychological impacts or social
consequences after the release of personal information that is embarrassing. Some
victims have had their credit card numbers stolen and bank accounts hacked,
resulting in a loss of thousands of dollars. Some companies have to pay for dam-
ages or losses to their customers in light of hacking actions. Hackers have stolen
military information that could be dangerous to the nation’s security.
There are many examples of hacking that has caused damage to a company.
One of those was the 2014 hacking of SONY Entertainment. Hackers who called
themselves the “Guardians of Peace” entered the computer systems, defacing
the screens displayed to employees. The hackers took control of the company’s
Twitter accounts, demanded money, and threatened to “bombard” the company
208 Ha c k e r a n d Ha c k i n g

if the money was not sent. Probably most damaging, however, was the release
of confidential documents that made public various company secrets, including
embarrassing e-mails sent to and from top executives, as well as private employee
information.
There have been multiple instances of hacktivism. One of those was against
Republican Senator Pat Toomey, from Pennsylvania. He announced that his cam-
paign organization was the target of an attempted hack in which people attempted
to access his e-mails. This was accomplished through a failed phishing scam.
Russian-based groups hacked the Democratic National Committee during the
2016 presidential campaign. Hackers also attempted to access Missouri Senator
Claire McCaskill’s accounts in February 2018, as well as those of Senator James
Shaheen of New Hampshire.
Steven Branigan identified seven steps needed to perform a successful hacking.
The first step is to select a target. This depends in part on the goal or aim of the
individual hacker. If the hacker seeks financial gain, then an appropriate target
would be a site that has a database of credit card information. If the hacker’s goal
is to attain publicity, then they should choose a popular site that many people rely
on. However, if the hacker seeks to access a site just for the challenge, then the
target site should be one that is challenging. The second step is to locate computers
of the target that may be accessible to the hacker, either through the internet or a
modem. It is essential that the hacker locate computers that are accessible; other-
wise, the attack cannot be implemented (Branigan, 2005).
The third step is to discover any vulnerabilities or backdoors in the security
systems of the target sites. The site may have particular times when they are less
secure. There are many tools that are available for identifying potential vulner-
abilities that are available for purchase or rental on the dark web, sometimes for a
relatively low price. The fourth step in a hack is to break into the computer system
by use of hacking tools, or to gain access to the system in some fashion. This can
be done with an individual’s technical expertise or with tools that are available on
the Internet. This can also be accomplished through social engineering techniques,
as described above (Branigan, 2005).
Once a hacker is in to the system, the fifth phase is to elevate any computer
access privileges to the highest level possible. This is a necessary step so that the
hacker has access to the greatest amount of data possible, or the “most secret” data
that typically is accessed by the fewest number of people. This process is referred to
as “rooting a box.” After this, the hacker should seek to find any additional vulner-
abilities that will provide him or her with additional access, or access to other com-
puters. And finally, the hacker should install a backdoor, which is a way to maintain
access to the site. It allows a person to return and reenter the system at a later time.
This is an important step. If the people overseeing the targeted site discover the
breach, they may patch the original vulnerability. A backdoor will give the hacker
the ability to access the site even if the vulnerability is fixed (Branigan, 2005).

See also: Black-Hat Hacker; Cracker and Cracking; Hacktivism; Sony Pictures
Entertainment Hack; White-Hat Hackers
Ha c k t i v i s m 209

Further Reading
Benjamin, Victor, Sagar Samtani, and Hsinchun Chen. 2017. “Conducting large-scale anal-
ysis of underground hacker communities.” In Cybercrime through an interdisciplinary
lens, edited by Thomas J. Holt. New York: Routledge, pp. 56–75.
Branigan, Steven. 2005. High-tech crimes revealed. Boston, MA: Addison-Wesley.
Holt, Thomas J. 2009. “Lone hacks or group cracks: Examining the social organization of
computer hackers.” In Crimes of the internet, edited by F. Schmalleger and M. Pittaro.
Upper Saddle River, NJ: Pearson Prentice Hall, pp. 336–355.
Holt, Thomas J., Adam M. Bossler, and Kathryn C. Seigfried-Spellar. 2018. Cybercrime and
digital forensics. New York: Routledge.
Steinmetz, Kevin F. 2015. “Crafty(y)ness: An ethnographic study of hacking.” British Jour-
nal of Criminology, 55, 125–145.
Turgeman-Goldschmidt, Orly. 2008. “Meanings that Hackers assign to their being a hacker.”
International Journal of Cyber Criminology 2, 2: 382–396.
Wade, Cassie, Jessica Aldridge, Lindsay Hopper, Holli Drummond, Ronald Hopper, and
Keith Andrew. 2011. “Hacking into the hacker: Separating fact from fiction.” In Crime
online, edited by Thomas J. Holt. Durham, NC: Carolina Academic Press, pp. 29–55.

HACKTIVISM
Hackers who access a computer network that belongs to another person without
their permission for ideological, religious, or political reasons are referred to as
hacktivists. Individuals use typical hacking techniques as a way to promote their
agendas or to promote their opinions, and try to convince others to support their
cause. For the most part, the activities of hacktivists do not cause fear—their acts
are not considered to be terrorist acts. Instead, they are acts of protest or political
action and expression.
Hacktivists use many techniques as they attempt to promote their agenda.
One is simply to hack into a computer system and deface a website. They may
post inaccurate information or messages from their organization. Other hacktiv-
ists choose to access files and steal personal information, e-mails, or records and
then publish them as a way to embarrass those involved. This happened in the
2014 attack on SONY Entertainment, when confidential e-mails from executives
were published that contained racist or offensive remarks. Some hacktivists rely
on denial-of-service attacks through which they are able to take a website offline.
Another technique is “doxing” through which the hacktivists gather background
information on a particular individual and post it online. Much of the information
posted can be not only embarrassing to the individual, but also to family members.
It can also discredit the person who is targeted. If personal addresses are posted
online, it can result in physical harm to the victim.
Some hacktivists may see their actions as a form of social protest; however,
online attacks are criminal acts. They can be disruptive to a business or govern-
ment office and can be harmful to a business or agency. It can be costly to any
victim, as an agency or company must pay for the costs related to addressing any
damage done by the attack. They must also pay for additional software or technol-
ogy that is needed to prevent any future attacks. For businesses, this money comes
210 Ha c k t i v i s m

from profits; for government offices, this money comes from taxpayers. Sometimes
the effect on the public’s trust in that organization, whether it be a business or gov-
ernment office, can be devastating.
Hacktivism is not a new phenomenon. In the 1980s and 1990s, a group called
Cult of the Dead Cow (cDc) encouraged hacking by their members and others.
Group members from Lubbock, Texas, included Swamp Ratte (otherwise known
as Grandmaster Ratte), Franken Gibe, and Sid Vicious. Their goal was “global
domination through media saturation.” The members of cDc encouraged hacking
behaviors by others and also supported acts of hacktivism to further their politi-
cal purposes. To support hacktivism by those less experienced in computers, the
group made hacking tools more readily available. These included Back Orifice
(BO) and Back Orifice 2000 (BO2K), Trojan Horse malware that allows people to
gain remote access to infected computers running the Microsoft Windows operat-
ing system. They continue to develop privacy and security tools for the Internet
and publish a magazine called Cult of the Dead Cow that was originally published
in the 1980s.
Members of cDc took advantage of infighting that was taking place on between
other hacking groups to grow into a larger, more easily recognized group. It quickly
became known for its use of humor in its activities. Members often wore clothing
with humorous depictions that outsiders sometimes found offensive, such as pic-
tures of a crucified cow. While members of other hacking groups (LOD and MOD)
were arrested and indicted for their hacking activities, cDc members were able to
evade law enforcement. It has been reported that Democratic presidential candi-
date Beto O’Rourke was a member of cDc while a teenager in Texas. His exact role
in the group is not fully known.
Another hacking group that supports hacktivism is Anonymous. The members
of this group have a history of attacking sites belonging to governments, businesses,
and even religious organizations. They have attacked the Church of Scientology,
the Recording Industry Association of America (RIAA), the Motion Picture Asso-
ciation of America (MPAA), and the BART subway system in San Francisco after
the police shot an unarmed passenger in 2009. Members of Anonymous launched
an attack on the state website in Missouri after the shooting of Michael Brown, an
unarmed black teenager in August 2014 in Ferguson. Members of the group used a
DoS attack and doxed various officials. The websites were brought offline for brief
times but state IT experts were able to bring them back online quickly.
In December 2010, a group of hacktivists who went by the name “Operation
Payback” hacked into PayPal, Visa, and MasterCard sites and launched a DoS attack
that took the sites down for a short time, preventing customers from accessing their
accounts. These attacks were in retaliation for the companies’ decisions to break
their support of WikiLeaks after it published top secret documents. The website of
the television station PBS was also defaced after it ran a show that was unfavorable
of WikiLeaks. It wasn’t long before arrests were made in the attacks. The offenders
were all young people who sought to show their support of WikiLeaks.
Political hacktivism has become more common in recent years. Examples
include an Anonymous cyberattack launched in Michigan to protest the water
Hat e C r i me 211

crisis in Flint. The group posted a video that accused the local media of hiding
facts related to the crisis from the public, and threated action against officials who
were responsible for the crisis, particularly the governor, who they claimed should
be charged criminally. The hospital, the Hurley Medical Center, was also the vic-
tim of a cyberattack the day after the original attack. Another example is an attack
launched against the North Carolina government website to protest a state law that
would require transgender people to use the bathrooms of their sex as noted on
their birth certificate. Despite the attack, the websites were not brought down and
were operational, making the attack less effective.
It is important that all organizations, businesses and government agencies, be
prepared for an act of hacktivism. They should ensure that their computer net-
works have updated security measures to block hackers from accessing their com-
puters. They also need to develop a plan to respond to an attack if it happens. This
way, the damage from an attack can be minimized.

See also: Anonymous; Assange, Julian; Denial-of-Service Attack (DoS); Hacker and
Hacking; Sony Pictures Entertainment Hack; WikiLeaks

Further Reading
Bergal, Jennin. 2017. “Hacktivists launch more cyberattacks against local, state govern-
ments.” PBS News Hour, January 10, 2017. https://www.pbs.org/newshour/nation
/hacktivists-launch-cyberattacks-local-state-governments
Cult of the Dead Cow. cultdeadcow.com/
Jordan, T. and P. Taylor. 2004. Hacktivism and cyber wars. London: Routledge.
McCormick, Ty. 2013. “Anthropology of an idea: Hacktivism.” Foreign Policy, 200 (May/
June): 24–25.
Menn, Joseph. 2019. “Beto O’Rourke’s secret membership in America’s oldest hacking
group.” Reuters, March 15, 2019. https://www.reuters.com/investigates/special-report
/usa-politics-beto-orourke/
Taylor, Paul. 2001. “Hacktivism: In search of lost ethics?” In Crime and the internet, edited
by David S. Wall. New York: Routledge, pp. 59–73.
Vamosi, Robert. 2011. “How hacktivism affects us all.” PC World, September 6, 2011.
https://www.pcworld.com/article/239594/how_hacktivism_affects_us_all.html

H AT E C R I M E
A hate crime is any crime committed where the victim is targeted based on their
race, ethnicity, sex, gender, sexual orientation, religion, or similar factor. In the
United States, hate crimes are generally handled one of two ways: as its own offense,
or as an allegation or sentence enhancement added to a crime. For example, if
someone assaults the victim because the victim is gay, that person could be charged
with assault, and that assault would be designated a hate crime. Hate crimes can
take place on the internet. Certainly, crimes that require physical contact with
the victim such as murder, rape, and assault cannot take place online. However,
crimes such as threatening, intimidating, harassment, and stalking can take place
via online communications.
212 Hat e C r i me

In the United States, it is a hate crime if someone injures or attempts to injure

via a weapon a victim selected because of their race, religion, national origin, gen-
der, sexual orientation, or gender identity (18 U.S. Code § 249). Hate crimes,
however, are by no means uniform across the United States. In fact, the exact defi
nition of a hate crime does not appear to be uniform, either. By way of example, the
Anti-Defamation League (2018) claims that five states (Arkansas, Georgia, Indiana,
South Carolina, and Wyoming) have no hate crime laws, whereas the National
Association for the Advancement of Colored People (2017) seems to indicate that
four states (Georgia, Indiana, Utah, and Wyoming) lack hate crime laws, or at least
hate crime laws that would increase the penalties for those offenders whose victim
selection was motivated by race, gender, and so on. Among those states that do
have hate crime laws, there is variance in the classes that are afforded protection
under those laws. Race, ethnicity, and religion are generally protected in states
that do have hate crime statutes. Most states that have a hate crime statute also
cover gender, sexual orientation, and disability. Age is not as thoroughly included,
though it is included in roughly a third of the states’ hate crime statutes. A growing
number of states cover gender identity in their hate crime statutes. Political affilia-
tion is covered in just a few jurisdictions—California, Iowa, Louisiana, South Car-
olina, West Virginia, and the District of Columbia—as is homelessness—Alaska,
California, Florida, Maine, Maryland, Rhode Island, Washington, and the District
of Columbia (see National Association for the Advancement of Colored People,
2017; National Coalition for the Homeless, 2012).
In the United States, there were over 7,000 hate crimes committed in 2017—a
jump from the year prior where over 7,000 hate crimes were committed (Federal
Bureau of Investigation, 2017, 2018). The majority of those crimes involved a
victim who was targeted because of their race or ethnicity. Just over 20 percent
involved a victim who was targeted because of their religion, and roughly 16 per-
cent were targeted because of their sexual orientation. The majority of these crimes
were crimes against the person (e.g., murder, rape, assault, intimidation).
There is a distinction between a hate crime and hate speech. A hate crime
involves criminal behavior exacted against a victim based on the victim’s member-
ship in a protected class (e.g., race, religion, gender). Hate speech is the convey-
ing of a hateful message against people of a protected class. Hate crimes can be
criminalized. Under the Free Speech Clause of the First Amendment to the U.S.
Constitution, hate speech is protected and cannot be criminalized (Matal v. Tam,
137 S.Ct. 1744 (2017)). A hateful message directed towards a protected class is not
a crime in and of itself. The communication must cross the line into speech that
is not protected by the First Amendment to be a crime—such as threatening to do
harm to someone because of their race.
Even though an online communication may be protected by the First Amend-
ment, this does not mean there will not be repercussions for those who use hate
speech online. The provisions in the U.S. Constitution only constrain the actions
of government officials. In other words, a citizen’s free speech can only be violated
if a government official attempts to restrain those rights. Private entities are free
to restrain speech as they see fit. Several online entities do prohibit hate speech
Hat e C r i me 213

on their websites, such as Facebook, Twitter, and Instagram (Facebook, 2018;

Instagram, 2018; Twitter, 2018). Thus, while hate speech may not be a crime,
using it can get a user potentially banned from using certain social media plat-
forms, message boards, or other websites. Several well-known people have had
their social media accounts suspended for this reason. YouTube star PewDiePie
had his Twitter account temporarily suspended in 2016 after making a joke about
ISIS—a group designated as a terrorist organization in the United States and
numerous other countries—on his account (Shah, 2016). Actress Rose McGowan
had her Twitter account temporarily suspended in 2017. McGowan—one of
several women who has accused movie produced Harvey Weinstein of sexually
assaulting them—made a string of posts about Weinstein’s sexual misconduct
right before she was suspended. Twitter indicated the suspension was due to the
inclusion of a phone number of someone famous in one of her posts (Bowles and
Buckley, 2017). Alex Jones—host of his own radio show and creator of the web-
site Infowars—was banned from several social media platforms in 2018, includ-
ing Twitter, Facebook, and YouTube. Facebook banned him for violating its hate
speech policy. YouTube appeared to ban him for the same reason (Hern, 2018).
Twitter banned him permanently for violating its abusive behavior policy (Conger
and Nicas, 2018).
Where people enjoy a degree of anonymity online, research has found that the
level of hate speech and related crimes has risen with the advent of the internet
(Banks, 2010). This anonymity also makes enforcement of hate crimes in the cyber
realm difficult.

Instagram. 2018. “Community guidelines.” https://help.instagram.com/477434105621119

National Association for the Advancement of Colored People. 2017. “State-by-state hate
crime laws.” https://www.naacp.org/wp-content/uploads/2017/09/Hate-Crimes-laws
-by-state.pdf
National Coalition for the Homeless. 2012. Hate crimes against the homeless: An orga-
nizing manual for concerned citizens. National Coalition for the Homeless. https://
nationalhomeless.org/publications/hatecrimes/hatecrimesmanual12.pdf
Shah, Saqib. 2016. “PewDiePie suspended from Twitter after tweeting Islamic State
joke.” Digital Trends, August 31, 2016. https://www.digitaltrends.com/social-media
/pewdiepie-twitter-ban/
Twitter. 2018. “Hateful conduct policy.” https://help.twitter.com/en/rules-and-policies/hateful
-conduct-policy

H E A LT H C A R E , E F F E C T S O N
Cybercrime poses a growing threat to health care. In the late 2010s, cyberattacks
on health care facilities and health care providers became more frequent and more
serious. In 2015, cybercriminals targeted the health care industry more than any
other sector (Zorabedian, 2016). One survey of the health care industry showed
that 90 percent of health care groups report having suffered a data breach within
the previous two years. According to the Identity Theft Resource Center, over
45 percent of computer breaches were health care related (RSA, 2011). Hacking
crimes can be carried out against health care providers, health care business associ-
ates, health plans, health care clearinghouses, pharmaceuticals, and other related
groups. Some estimates show that the health care industry in the United States
must pay over $6 billion a year because of cyberattacks (Socas, 2015).
Breaches in health care systems compromise the personal information of mil-
lions of patients. If an offender is able to hack into another person’s medical records,
the offender may be able to use the stolen information to commit many other types
of crimes. Common offenses include fraud or identity theft. Identity theft becomes
an attractive crime to some offenders who are seeking medical care, and can do so
under another’s identity. They may choose to use a patient’s insurance information
fraudulently. When this happens, patients may spend thousands of dollars to get
their personal health care records cleared. In the meantime, though, a victim may
not have access to medical care.
It is difficult for health care agencies to protect themselves. They often do not
have the resources nor the technological skill to prevent or deter the attacks. The
antivirus software that health care providers rely on is often outdated and not effec-
tive in preventing attacks.
The health care field is an attractive target for cybercriminals. Most medical
records today are electronic. It is easier and safer to track records and transfer
records in this form as compared to paper. This availability of online health records
gives offenders more opportunities to steal or compromise files. The files hold a
great deal of personal information on patients, including their birthdates (and ages),
family status, place of employment, Social Security numbers, medical conditions,
Heal t h Ca r e , E f f e c t s o n 215

and sometimes even payment methods. It is reported that a stolen medical record
can be sold for only $20 on the dark web, which can be more money than an
offender can charge for a stolen credit card number (Wedi, 2017).
The Health Insurance Portability and Accountability Act of 1996, or HIPA, man-
dates that healthcare agencies have safeguards in place to protect a patient’s privacy.
A doctor or other health care professional who does not abide by these guidelines
can face serious federal charges. If data files are accessed illegally, the organization
may face fines for being out of compliance with regulations. They may also be
opened to lawsuits from victims. They may also face damage to their reputation
among the public.
Recent cyberattacks on health care facilities have caused serious damage. In
March 2016, a cyberattack carried out on MedStar Health, a system that served
clients in Maryland and Washington, D.C., infected the system with malware that
caused it to lose access to patient records. The attack forced the company to shut
down multiple computer systems as a preventive measure to keep the malware
from spreading. Health care facilities in Kentucky, California, and Canada were
victims of ransomware attacks and were forced to pay money to an attacker in
order to have access to the patient’s files. Hollywood Presbyterian Medical Center
in California reportedly paid $17,000 in Bitcoin (about 40 Bitcoins) in a ransom
payment after they were attacked (Secure 360, 2016). The hospital was forced
to shut down all of their computers for a week, and instead depended on paper
records.
Breaches on health care facilities can be dangerous for both the company and
the victim. It is critical that companies keep their anti-virus programs updated and
watch for breaches regularly as a way to prevent attacks.

See also: Bitcoin; Economy, Effects on; Personally Identifying Information; Preven-
tion; Ransomware

Further Reading
RSA. 2011. “Cybercrime and the healthcare industry.” Healthcare Info Security, September
13, 2011. http://www.healthcareinfosecurity.com/whitepapers/cybercrime-healthcare
-industry-w-338
Secure 360. 2016. “The effects of cyber attacks on the health care industry.” June 15,
2016. https://secure360.org/2016/06/the-effects-of-cyber-attacks-on-the-health-care
-industry/
Socas, James. 2015. “Growing pains: Cybercrime plagues the healthcare industry.” Health-
care IT News, December 21, 2015. http://www.healthcareitnews.com/blog/growing
-ains-cybercrime-plagues-healthcare-industry.
Workgroup for Electronic Data Interchange. 2017. “The rampant growth of cybercrime
in health care.” February 8, 2017. www.wedi.org/docs/publications/cybercrime-issue
-brief.pdf
Zorabedian, John. 2016. “Why cybercriminals attack healthcare more than any other
industry.” Naked Security, April 26, 2016. https://nakedsecurity.sophos.com/2016/04
/26/why-cybercriminals-attack-healthcare-more-than-any-other-industry
216 Hijacking

HIJACKING
The term “hijacking” refers to an attack on a network in which the offender is able
to take over control of a communication between a sender and recipient, or maybe
the offender takes over a person’s online account and uses it. The offender pretends
to be the sender in the communication. In some cases, the offender is able to trick
the victim into providing private information, credit card information, passwords,
or other types of sensitive information. This gives the offender the ability to carry
out further acts against the victim. In more serious accounts, an account can be
completely erased.
One specific type of hijacking attack is called the “browser hijacking.” In this
case, the user is diverted to a site other than the intended site. An offender is able to
modify a web browser’s settings so the computer goes to sites that are not intended
by the user. In other words, the software changes the activities of a browser. Most
of the time, the hacker is being paid to get people to click on ads or increase the
number of people who visit a web page. By hijacking other computers, the hacker
can force computers to go to sites and encourage users to click on ads. Some ads
will be shown on a computer numerous times. In some cases, a browser hijacker
intends to install malware to enable them to steal personal information.
Another specific type of hijacking is the “man in the middle” (MIM) attack,
whereby the offender controls an ongoing communication between two people.
The offender is able to watch and monitor any communication as it takes place,
and if they choose, they can intercept a message and replace it with their own mes-
sage before it is resent. The people in the conversation have no idea their messages
have been replaced. This way, it appears to the receiver that they are still com-
municating with the intended person. The replaced message may be an attempt to
ruin a reputation, or it can be a way to trick the receiver into providing personal
data to the offender.
An example of this is if a person receives an e-mail from a bank asking them to
verify their account information. The e-mail appears to be from a bank employee,
so the victim provides the information. In essence, the victim is giving their per-
sonal account information to an offender, who can now enter into a site and steal
money.
Another form of hijacking is pharming, where malware is applied to a com-
puter, which causes the user to land on bogus websites that appear to be the actual
webpage. A victim, thinking they are on a legitimate site, may type in a password
or other personal or sensitive information. This is then stolen by the hacker and
sold or used to commit other cybercrimes.
There are two types of hijacking. The first is passive hijacking, where the
offender hijacks a session but then simply watches the communication. This
way, they remain hidden to the users. This is a technique that allows the hacker
to look for passwords or other sensitive information. It is said that the hacker
“sniffs” the network. The second type of hijacking is active hijacking. In an active
hijacking, the offender will take over the server within the conversation. At that
point, the offender can replace one of the people in the conversation or can change
Hijacking 217

passwords, delete files or e-mails, create new e-mails, or download files (which
could include malware).

cell phones), and the installation of antivirus software on personal computers

(United States of America, 2018).
Even if someone follows the recommendations of law enforcement to protect
their identity, they may still become the victim of identity theft. Data breaches at
major companies have become commonplace. In 2011, Sony suffered a breach
affecting 77 million customers (Baker and Finkle, 2011). In 2013, Yahoo suffered
a breach affecting 3 billion customers (Larson, 2017). In 2014, eBay suffered a
breach affecting 145 million customers (Wakefield, 2014). While individuals can
choose to be members or users of companies like Sony, Yahoo, or eBay, the 2017
breach of Equifax showed that some companies possess citizens’ personal informa-
tion without them being aware of it. As a credit reporting agency, Equifax is able
to legally obtain the credit information of individuals to construct a credit history
for those individuals as well as generate a credit score. This information is then
provided to businesses when you attempt to engage in certain transactions with
them, such as applying for a new credit card, renting an apartment, or seeking a
car loan. In short, essentially everyone’s information is likely to be in the posses-
sion of credit reporting agencies such as Equifax. Initially, Equifax estimated that
143 million people may have been affected by the data breach (Regnier and Wool-
ley, 2017). Equifax estimates that 2.4 million additional people had their personal
information stolen above their initial estimates (Equifax, 2018; Kennedy, 2018).

See also: Equifax Breach; Social Media; Sony Pictures Entertainment Hack

ILOVEYOU VIRUS
The ILOVEYOU virus, otherwise known as the Love Letter virus or the Love Bug,
became one of the most damaging malware to be introduced—and also the most
widely recognized malware. It was originally launched in May 2000, a year after
the Happy99 virus spread through e-mail. The ILOVEYOU virus attacked an esti-
mated 45 million users around the world who were using Microsoft Windows or
Microsoft Outlook. Victims received an e-mail with “ILOVEYOU” written in the
subject line. If a user opened the e-mail, the body of the e-mail would say, “Kindly
check the attached loveletter coming from me.” There was an attachment to the
e-mail that contained the virus. When it was opened, the virus was activated and
instantly loaded onto the victim’s hard drive, where it erased photos, music, and
other files. The virus then resent itself to the e-mail contacts in the victim’s address
book. Because a person received the e-mail from a friend or family member, they
were more likely to open it.
Because the virus sent itself to all of the e-mails in the address book, it spread
more quickly than other malware. If a large organization received the virus, it
caused thousands of e-mails to be sent to a server. A single employee’s e-mail
address may be copied numerous times. Many networks were overloaded, causing
slowdowns and eventually bringing down the internet. Ford Motor Company was
one company that fell victim to the virus, causing their e-mail to be unavailable for
a short time. Other organizations that were forced to shut down after becoming
infected included the U.S. Pentagon and Britain’s Parliament. It is estimated that
the virus caused $10 billion in damages to companies around the world. The virus
was also blamed for causing personal pagers to malfunction.
In the days after the ILOVEYOU virus swept around the world, copycat attack
viruses soon appeared. One of those was named “very funny.” This new virus, and
others that appeared, were not detected by most virus protection software, espe-
cially software that was designed to block the ILOVEYOU virus. In some cases, the
message in the subject line was changed to read “Joke,” “Mother’s Day,” or even
“Virus Alert!!!,” all of which made the recipient less likely to be cautious of the
contents. The new viruses were also feared to cause similar or worse damage than
the original virus.
In response to the virus, the U.S. president at the time, Bill Clinton, asked that
the FBI investigate the crime. The FBI assigned the task to New York’s field office,
with help from the offices in Newark, New Jersey, and Charlotte, North Caro-
lina. The National Infrastructure Protection Center oversaw the investigation. It
was discovered that the virus began infecting systems in Hong Kong, followed by
Europe and then the U.S. law enforcement soon traced the virus to two men in the
Philippines: Reonel Ramones and Onel de Guzman. Both men had dropped out of
a computer university in Manilla. De Guzman had actually proposed the virus in a
paper he had written for one of his courses.
Because the Philippines had no law against hacking crimes at the time, law
enforcement was unable to arrest them, and the offenders were not charged with
any crime.
222 Imm i g r at i o n a n d C u s t o m s E n f o r c eme n t

As expected, there were many calls for backing up systems and installing
updated virus protection software after the virus was detected. When the virus was
launched, many personal computer users did not have virus protection, and many
businesses were also lacking antivirus software. The virus made both people and
organizations aware of the need for additional and updated virus protection.

See also: Federal Bureau of Investigation; Malware; Melissa Worm; President and
Cybercrime

Further Reading
Goldenberg, Stuart. 2000. “Back up to beat the bug.” New York Times, May 11, 2000.
https://www.nytimes.com/2000/05/11/technology/back-up-to-beat-the-bug.html
Hill, Joshua B. and Nancy E. Marion. 2016. Introduction to cybercrime: Computer crimes,
laws, and policing in the 21st century. Santa Barbara, CA: ABC-CLIO.
Kleinbard, David and Richard Richtmyer. 2000. “Quickly spreading virus disables mul-
timedia files, spawns copycats.” CNN Money, May 5, 2000. h ttps://money.cnn.com
/2000/05/05/technology/loveyou/
Schwartz, John, and David A. Vise. 2000. “‘Love’ virus assaults world computers.”
Washington Post, May 5, 2000. https://www.washingtonpost.com/archive/politics
/2 000/0 5/0 5/l ove-v irus-a ssaults-w orld-c omputers/3 079f34d-f 8d9-4 004-b 858
-7015a4e22896/
Ward, Mark. 2010. “A decade on from the ILOVEYOU bug.” BBC News, May 4, 2010.
https://www.bbc.com/news/10095957

I M M I G R AT I O N A N D C U S T O M S E N F O R C E M E N T
The Bureau of Immigration and Customs Enforcement (ICE) is a federal agency in
the United States. It was created March 1, 2003, as part of a large federal govern-
ment restructuring. Following the terrorist attacks of September 11, 2001, the
United States formed the DHS to help protect the United States from future ter-
rorist attacks and to help assure the safety of the country in general (Department
of Homeland Security, 2015b). As part of this restructuring, the DHS absorbed all
or part of 22 federal agencies and programs. Two of those were the Immigration
and Naturalization Service and the Customs Service. These responsibilities of these
two agencies were parsed out to three separate agencies under the Department of
Homeland Security: the Bureau of Customs and Border Protection, the Bureau of
Citizenship and Immigration Services, and the Bureau of Immigration and Cus-
toms Enforcement (Bureau of Immigration and Customs Enforcement, 2019). The
mission of ICE is to “protect America from the cross-border crime and illegal immi-
gration that threaten national security and public safety” (Bureau of Immigration
and Customs Enforcement, 2018). Cybercrimes that take place in a cross-border
fashion are investigated by the bureau’s Cyber Crime Center. The Center was cre-
ated in 1997 under the control of the U.S. Customs Service, but it was placed
under the authority of ICE following the absorption of the U.S. Customs Service
into the Department of Homeland Security (Department of Homeland Security,
2015b).
Imm i g r at i o n a n d C u s t o m s E n f o r c eme n t 223

Among the cybercrimes that ICE investigates are child exploitation cases. In 2009,
ICE launched Operation Delego—an investigation into a pedophilia-promoting
website called Dreamboard. Members of the site lived in numerous countries. In
order to be a member of the site, a prospective member had to upload child por-
nography involving children 12 years old or younger. To maintain membership,
members had to continually upload child pornography to the site. The more child
pornography a member uploaded, the more they would be able to access from the
site’s archive. Members who uploaded child pornography with themselves perpe-
trating the sex acts on children gained even greater access to the site’s archive of
child pornography. By August 2011, 72 members were charged with crimes arising
from their involvement with Dreamboard, 56 of whom were arrested by that time,
with 13 of those 56 having pleaded guilty to their charges (Holder, 2011).
Additionally, as part of their cybercrime unit, ICE operates a child victim identi-
fication program. The first case the program assisted with was in November 2011.
In that case, an 11-year-old girl’s picture showed up on a website known to be fre-
quented by pedophiles. There was a poll along with her picture, asking members
of the website how this girl should be raped. Danish law enforcement first noticed
the picture and poll and contacted ICE. Agents with ICE were able to use the girl’s
picture—specifically, a street sign in the background with a sunflower on it—to
locate her in Kansas (where state highway signs have sunflowers on them) and rescue
her (see Department of Homeland Security, 2018). In November 2012—a year after
this girl was rescued—ICE initiated Operation Sunflower. The goal of this operation
was to rescue child victims of sexual exploitation and to apprehend those exploiting
them. The operation lasted roughly a month. In that time, ICE was able to identify
123 child victims, 44 of whom were rescued. The remaining 79 children were either
abused by someone outside of the home they lived in or were adults at the time ICE
contacted them (Bureau of Immigration and Customs Enforcement, 2013a).
ICE has been involved in cybercrime cases not involving child sexual exploita-
tion as well. In 2013, it was involved in Operation Marco Polo—an investigation
of the dark web marketplace Silk Road. The site was used to facilitate the sale of
illegal drugs and other criminal contraband. As a result of the investigation, Silk
Road was shut down, and its creator—Ross Ulbricht (also known as Dread Pirate
Roberts)—was arrested and sentenced to life in prison (Segall, 2015).
The Cyber Crime Center was impersonated as part of malware that made its
rounds in 2013. Victims’ computers displayed a message that claimed to be from
the Cyber Crime Center. The message told victims that their computer had been
frozen due to the victim engaging in illegal activity online. The malware did in fact
lock victims out of their computers. The message went on to tell victims that they
needed to pay a several-hundred-dollar fee to avoid prosecution. It further threat-
ened that if victims attempted to unlock their computers, all files on the computer
would be deleted (Pilici, 2013). ICE notified the public of this hoax in February
2013 (Bureau of Immigration and Customs Enforcement, 2013b).

See also: Child Pornography; Dread Pirate Roberts (Ulbricht, Ross; 1984–); Federal
Bureau of Investigation; Operation Marco Polo; Silk Road
224 Insurance

Further Reading
Bureau of Immigration and Customs Enforcement. 2013a. “123 sexually exploited chil-
dren identified by HSI during ‘Operation Sunflower.’” Bureau of Immigration and Cus-
toms Enforcement, January 3, 2013. https://www.ice.gov/news/releases/123-sexually
-exploited-children-identified-hsi-during-operation-sunflower
Bureau of Immigration and Customs Enforcement. 2013b. “SCAM ALERT: Cyber crimi-
nals masquerade as the ICE Cyber Crimes Center to extort money from web users.”
February 15, 2013. https://www.ice.gov/news/releases/scam-alert-cyber-criminals
-masquerade-ice-cyber-crimes-center-extort-money-web-users
Bureau of Immigration and Customs Enforcement. 2018. “What we do.” https://www.ice
.gov/overview
Bureau of Immigration and Customs Enforcement. 2019. “Celebrating the history of
ICE.” Bureau of Immigration and Customs Enforcement. https://www.ice.gov/features
/history
Department of Homeland Security. 2015a. “DHS unveils major expansion of ICE Cyber
Crimes Center.” Department of Homeland Security, July 22, 2015. https://www.dhs
.gov/news/2015/07/22/dhs-unveils-major-expansion-ice-cyber-crimes-center
Department of Homeland Security. 2015b. “Creation of the Department of Homeland
Security.” September 24, 2015. https://www.dhs.gov/creation-department-homeland
-security
Department of Homeland Security. 2018. “Cyber crime cases.” Retrieved from https://www
.dhs.gov/cyber-crime-cases on October 19, 2018.
Holder, Eric. 2011. “Attorney General Eric Holder announces results of international
child pornography investigation at Operation Delego press conference.” United States
Department of Justice, August 3, 2011. https://www.justice.gov/opa/speech/attorney
-general-eric-holder-announces-results-international-child-pornography
Pilici, Stelian. 2013. “The ICE Cyber Crime Center—Virus removal guide.” M alwaretips
.com, June 12, 2013. https://malwaretips.com/blogs/ice-cyber-crime-center-removal/
Segall, Laurie. 2015. “Silk Road’s Ross Ulbricht sentenced to life.” CNN, May 29, 2015.
h ttps:// m oney.c nn .c om /2 015 /0 5 /2 9 /t echnology /s ilk -road -ross -u lbricht -p rison
-sentence/index.html

INSURANCE
Cybersecurity insurance or cyber risk insurance has become a popular way for
companies, organizations, and individuals to protect their agencies or themselves
against damages that can result from a cyberattack and, for some, to help them
survive the aftermath of an attack. Cyber insurance first became available in the
mid-1990s as the internet became more widely used. In the beginning, the insur-
ance plans were made available by a limited number of companies for a limited
amount of protection. The number of organizations and individuals opting to pur-
chase insurance has increased since then. Today, the cyber insurance industry is
rapidly expanding and has become part of many organizations’ incident response
plans as they prepare for the inevitable attack. It is often purchased not only by
those in the health care or banking industries but also by those in retail, education,
manufacturing, and transportation.
Cyber insurance is the result of the increased number of cyberhacks that occur
each year. Not only are there more frequent attacks, but they are also becoming
Insurance 225

more serious and more damaging. Companies are purchasing insurance as a way
to minimize the costs of an attack, which can be thousands of dollars, rising into
the millions for a large hack on a large corporation. Cyber insurance is especially
critical for small or midsize companies that may have less security than larger
firms and may be more vulnerable to an incident. A cyberattack on a small com-
pany could be devastating. Unfortunately, many smaller companies are choosing
to forgo insurance. Recent statistics show that about 55 percent of Fortune 500
companies have purchased some form of cyber insurance. That percent drops to
35 percent for medium-sized businesses and only 10 percent for small businesses
(Fazzini, 2018). In all, companies spent over $2 billion on cyber insurance in 2017
(Fazzini, 2018). This number could rise to $20 billion by 2025 (Sloan, 2017).
Cyber insurance premiums vary and cover different costs related to a computer
hacking event. Some insurance plans assist a company or organization to pay for
recollection or recovery costs related to stolen or damaged information during a
hack. Many policies will pay for access to forensic investigations to determine, if
possible, the source of the attack and the techniques used for gaining access to a
network. This often includes longer-term monitoring of the computer systems for
months after an attack to ensure that there were no hidden backdoors or vulner-
abilities placed into a system that would allow an attacker to access the systems at
a later date. Insurance may also cover any legal liabilities, fines, and fees associated
with a breach. Notification of all customers who may be affected by a hacking and
other costs related to a settlement agreement (i.e., free credit monitoring) may be
very expensive and is often included in an insurance premium. Other costs that
may be covered include payments for extortion or ransomware to release data
that has been locked by cybercriminals. Finally, some policies provide incident
response teams to help an organization return to normal.
There are costs of an attack that are typically not covered by cyber insurance.
Most policies typically do not cover the value of the loss of intellectual property
or trade secrets. It is often very difficult to place a monetary value on a company’s
intellectual property so this is left uncovered. Most policies also do not cover any
security failures that were considered to be “preventable,” such as a failure of a
company to maintain an acceptable or minimal level of security needed to protect
the company’s systems. In other words, if an organization does not have adequate
cybersecurity software in place based on their level of risk, an insurance company
may not cover the costs of the breach. Additionally, if company employees do not
follow established protocols for ensuring the safety of data, the costs may not be
covered. For example, if an employee accesses sensitive data through an unsafe
network such as an airport or cybercafé, the damages may not be covered. The
same holds true of an employee who carries out an “insider” attack on the com-
pany that results in a loss of data or secrets.
Companies seeking to purchase cyber insurance must find an insurance plan to
fit the specific needs of the individual company. Since cyberattacks and resulting
damages are unpredictable, it is difficult for companies to know exactly what kind
of insurance policy to purchase. This is made more difficult because the cyber
insurance industry is relatively new and coverage provided is not standard. Com-
pany officials must base their policies on the company’s risk. They must determine
226 Insurance

their vulnerabilities and threats, and develop a policy to cover those. The National
Institute of Standards and Technology, located within the U.S. Commerce Depart-
ment, has developed security guidelines to help company officials assess their
risks. The price they will pay will depend on the company’s risk. A business with a
higher risk of becoming the target of cybercrime will need higher or more complex
coverage. The cost may also depend on the type and extent of cybersecurity put
in place by an organization, any prior claims made by the company, or even the
company’s annual revenue. An insurance policy can cost a small company a few
thousand dollars, whereas a larger organization will pay up to hundreds of thou-
sands of dollars for full protection.
Cyber insurance is not only important to companies and organizations; indi-
viduals may purchase cyber insurance as a way to cover costs associated with iden-
tity theft, credit card theft or online fraud, or even malware attacks on a personal
device or home computer. Some insurance policies will cover the legal fees asso-
ciated with comments posted on social media sites that may be damaging to an
individual.
There are two types of cyber insurance coverage: first-party and third-party
coverage. In a first-party coverage plan, insurance covers the damages or losses
that occur to individuals or businesses caused directly by a breach, such as data
recovery, or compensating a business for any income that it loses (sometimes called
Business Interruption Insurance), or paying a cyberextortionist who threatens to
carry out an attack or uses ransomware to demand payment for the return of data.
This also includes the investigation to determine how the attack occurred, notifi-
cation of customers who were affected, and efforts taken to mitigate damage to a
company’s reputation.
Third-party insurance coverage includes damages pertaining to customers or
partners who are affected. This includes the individuals and businesses responsible
for a computer system that is attacked and breached. It could cover protection for
an IT company that was responsible for storing data that was breached if the IT
company did not anticipate an attack and take precautions, or a company that was
supposed to build a secure website for a client and did not. Third-party insurance
would cover any legal fees, settlements that are agreed to, or fines that may result.

See also: Ashley Madison Breach; Cybersecurity; Equifax Breach; Hacker and Hack-
ing; National Institute of Standards and Technology Cybersecurity Framework;
Ransomware

Further Reading
Bhattarai, Abha. 2014. “Cyber-insurance becomes popular among smaller, mid-size
businesses.” Washington Post, October 12, 2014. https://www.washingtonpost.com
/business/capitalbusiness/cyber-insurance-becomes-popular-among-smaller-mid-size
-businesses/2014/10/11/257e0d28-4e48-11e4-aa5e-7153e466a02d_story.html
Fazzini, Kate. 2018. “Cyber insurance: Companies must weigh uncertainties in an
unproven market.” Wall Street Journal, May 18, 2018. https://www.wsj.com/articles
/c yber-i nsurance -c ompanies -m ust -w eigh -u ncertainties -i n -a n -u nproven -m arket
-1525987315
I n t e r n at i o n al I s s u e s 227

Grzadkowska, Alicja. 2018. “How cybercrime and coverage evolved in 2018.” Insurance
Business, December 12, 2018. https://www.insurancebusinessmag.com/us/news/cyber
/how-cybercrime-and-coverage-evolved-in-2018-118721.aspx
NTT Security. 2018. “Cybercrime insurance. A growing market. Are you covered?” h ttps://
www. nttsecurity. c om/ docs / l ibrariesprovider3 / resources /g bl _ thought _ leadership
_cyber_insurance_uea.pdf?sfvrsn=90cf809d_4
Shetty, Mayur. 2017. “In a first, cybercrime insurance cover for individuals.” The Economic
Times, November 3, 2017. https://economictimes.indiatimes.com/tech/internet/in-a
-first-cybercrime-insurance-cover-for-individuals/articleshow/61476025.cm
Sloan, Rob. 2017. “Cyber insurance may affect incident response industry.” Linkedin, Janu-
ary 17, 2017. https://www.linkedin.com/pulse/cyber-insurance-may-affect-incident
-response-industry-rob-sloan

I N T E R N AT I O N A L I S S U E S
Cybercrime is unique in that the perpetrator of such a crime can be anywhere
in the world where the internet is accessible, and the same applies to the victim.
Accordingly, to fully and effectively fight cybercrime, international cooperation
appears to be necessary. This sentiment was expressed by Meng Hongwei, former
president of Interpol, in 2016. He said:

Despite differences among countries, combating crimes and guarding the law is what
police do as their nature prescribes. Professionalism and integrity is what made us
friends who fought crimes side by side, and even more so in today’s integrated and
hi-tech world. The crimes we see are no longer those that a country can solve alone.
Any crack on the globe may become a source of evil that can plague the world.
Therefore it is imperative that police help each other, because it’s helping ourselves.
(Meng, 2017)

Meng also noted the importance of all stakeholders, not just governments, work-
ing together to fight cybercrime. It seems that many countries and other stakehold-
ers agree. In 2018, 50 countries vowed to work together to fight cybercrime and
other malicious online activity. Over 150 tech companies agreed to do the same.
This commitment was memorialized in the “Paris call for trust and security in
cyberspace.” The countries involved include France, Japan, and Canada. The com-
panies involved include Google, Microsoft, and Facebook. Just as notable as the
entities agreeing to this combined effort are those countries that did not agree: the
United States, Russia, and China (Corbet, 2018). One of the reasons there may be
a lack of international cooperation to fight cybercrime is that individual countries
may benefit from cybercrime that is committed within its borders. Indeed, China
and Russia are the two most prolific perpetrators of cyberattacks against other
countries (Center for Strategic and International Studies, 2019).
In China, the People’s Liberation Army (PLA)—the Chinese military—is respon-
sible for carrying out various cyberattacks on foreign countries and other entities.
In one incident, the PLA covertly installed microchips on server motherboards
manufactured in China. This allowed the PLA to scan activity on those servers,
which were used by foreign government agencies and businesses (Robertson and
228 I n t e r n at i o n al I s s u e s

Riley, 2018). As part of the government, the PLA’s actions are directed by the Chi-
nese government and permit the government to engage in espionage. This cyber-
crime clearly benefits China, and there would be no reason it would want to help
eradicate it. Chinese citizens who do not work for the government also engage in
cybercrime that appears to benefit China. This includes intellectual property theft
that permits Chinese industries to advance the state of technology in China (Com-
mission on the Theft of American Intellectual Property, 2017).
Russia has acted similarly. In 2016, Russia’s Main Intelligence Directorate of the
General Staff (GRU) hacked into computer networks of entities associated with
the campaign of presidential candidate Hilary Clinton and released information
obtained from those entities with the intent of influencing the presidential election
(Mueller, 2019). There is also evidence to suggest that cybercriminals in Russia
that do not attack domestic targets are permitted to continue in their activities
without apprehension (Maurer, 2018).
The United States has also engaged in cyberattacks on other countries. In 2010,
it is believed the United States worked with Israel to bring down Iran’s Natanz
nuclear facility via the Stuxnet computer worm. The worm caused the computers
at the nuclear facility to spin centrifuges faster than they were supposed to, dam-
aging the centrifuges in the process (Warrick, 2011). In 2013, it is believed that
the United States, in conjunction with South Korea, brought down North Korean
websites and restricted internet access within the country (Center for Strategic and
International Studies, 2019; Sang-Hun, 2013).
Where cyberattacks are being used by countries against each other, there does
arise a question as to whether these activities are truly crimes or acts of war (Flatow,
2011; Stoll, 2018). Thus far, it appears the United States has treated such as attacks
as the former. Twelve Russian officers who interfered in the 2016 presidential elec-
tion in the United States were indicted on federal criminal charges (Prokop, 2019).
The United States indicted five members of the PLA involved in espionage and theft
against U.S. businesses (United States Department of Justice, 2014). It also indicted
one member of the North Korean–sponsored Lazarus Group for his role in the hack
of Sony Pictures (United States Department of Justice, 2018). The indictments appear
largely symbolic, as those indicted appear to still be living in the countries that spon-
sored the attacks and are thus at no real risk of being extradited to the United States.
Lack of international cooperation in the extradition of cybercriminals exists
beyond those incidents where the person indicted carried out cyberattacks at the
behest of the country protecting them. A notable example of this is Julian Assange.
Assange was being investigated in the United States for possible criminal charges
arising out of his role with WikiLeaks (Weiss, 2010). Assange was granted asylum
at the Ecuadorian Embassy in London in 2012 after skipping bail in the United
Kingdom on an extradition matter with Sweden (BBC News, 2018). It became
apparent that the United States had indicted Assange in 2018, and Ecuador pro-
tected Assange until 2019. Another notable example is Edward Snowden. After
Snowden leaking NSA documents to the public, he fled to Hong Kong. While he
was there, a request was made by the United States to have Snowden extradited.
Hong Kong, claiming a mistake in the extradition paperwork regarding Snowden’s
I n t e r n at i o n al I s s u e s 229

name, delayed processing the extradition, which permitted Snowden the oppor-
tunity to leave Hong Kong for Russia (see Burrough and Ellison, 2014). Snowden
has not been extradited from Russia since arriving there in 2013. He has a resident
permit there that is good through 2020 (Kramer, 2017).

See also: Assange, Julian; China; North Korea; People’s Liberation Army Unit 61398;
Political Uses; Russia; U.S. Presidential Election Interference, 2016; WikiLeaks

Further Reading
BBC News. 2018. “Julian Assange in the Ecuadorian embassy: Timeline.” BBC News, Octo-
ber 19, 2018. https://www.bbc.com/news/world-europe-11949341
Burrough, Bryan, and Sarah Ellison. 2014. “The Snowden saga: A shadowland of secrets
and light.” Vanity Fair, April 23, 2014. https://www.vanityfair.com/news/politics/2014
/05/edward-snowden-politics-interview
Center for Strategic and International Studies. 2019. “Significant cyber incidents.” https://
www.csis.org/programs/cybersecurity-and-governance/technology-policy-program
/other-projects-cybersecurity
Commission on the Theft of American Intellectual Property. 2017. “Update to the IP Com-
mission Report.” http://ipcommission.org/report/IP_Commission_Report_ Update
_2017.pdf
Corbet, Sylvie. 2018. “50 countries vow to fight cybercrime—US and Russia don’t.” Associ-
ated Press, November 12, 2018. https://www.apnews.com/76ea0daee12645f0ae7177e
b506935cb
Flatow, Ira. 2011. “Cyberattacks may be ‘acts of war.’” National Public Radio, June 3, 2011.
https://www.npr.org/2011/06/03/136925541/cyber-attacks-may-be-acts-of-war
Kramer, Andrew E. 2017. “Russia extends Edward Snowden’s asylum.” New York Times, Jan-
uary 18, 2017. https://www.nytimes.com/2017/01/18/world/europe/edward-snowden
-asylum-russia.html
Maurer, Tim. 2018. “Why the Russian government turns a blind eye to cybercriminals.”
Slate, February 2, 2018. https://slate.com/technology/2018/02/why-the-russian-govern
ment-turns-a-blind-eye-to-cybercriminals.html
Meng Hongwei. 2017. “To ride the tide of the times and keep the hopes of a century: An
Interpol that faces the future.” Interpol, September 26, 2017. h ttps://www.interpol
.int/content/download/5351/file/Speech%20by%20President%20Meng%20Hongwei
%2086GA.pdf
Mueller, Robert S. 2019. “Report on the investigation into Russian interference in the 2016
presidential election.” Volume 1. United States Department of Justice. h ttps://www
.justice.gov/storage/report.pdf
Prokop, Andrew. 2019. “All of Robert Mueller’s indictments and plea deals in the Russia
investigation.” Vox, March 22, 2019. https://www.vox.com/policy-and-politics/2018/2
/20/17031772/mueller-indictments-grand-jury
Robertson, Jordan, and Michael Riley. 2018. “The big hack: How China used a tiny chip
to infiltrate U.S. companies.” Bloomberg Businessweek, October 4, 2018. h ttps://www
.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny
-chip-to-infiltrate-america-s-top-companies
Sang-Hun, Choe. 2013. “North Korea sees South and U.S. behind cyberstrikes.” New York
Times, March 15, 2013. https://www.nytimes.com/2013/03/16/world/asia/north-korea
-sees-south-us-behind-cyberstrikes.html
230 Interpol

Stoll, Richard J. 2018. “Is a cyberattack an act of war?” Houston Chronicle, July 26, 2018.
https://www.houstonchronicle.com/local/gray-matters/article/russia-cyberattacks-act
-of-war-military-force-13107824.php
United States Department of Justice. 2014. “U.S. charges five Chinese military hackers
for cyber espionage against U.S. corporations and a labor organization for commer-
cial advantage.” May 19, 2014. https://www.justice.gov/opa/pr/us-charges-five-chinese
-military-hackers-cyber-espionage-against-us-corporations-and-labor
United States Department of Justice. 2018. “North Korean regime-backed programmer
charged with conspiracy to conduct multiple cyber attacks and intrusions.” Septem-
ber 6, 2018. https://www.justice.gov/opa/pr/north-korean-regime-backed-programmer
-charged-conspiracy-conduct-multiple-cyber-attacks-and
Warrick, Joby. 2011. “Iran’s Natanz nuclear facility recovered quickly from Stuxnet cyberat-
tack.” Washington Post, February 16, 2011. http://www.washingtonpost.com/wp-dyn
/content/article/2011/02/15/AR2011021505395.html
Weiss, Baruch. 2010. “Why prosecuting WikiLeaks’ Julian Assange won’t be easy.” Washing-
ton Post, December 5, 2010. http://www.washingtonpost.com/wp-dyn/content/article
/2010/12/03/AR2010120303267.html

INTERPOL
Interpol, whose full name is the International Criminal Police Organization, is a
law enforcement organization that spans 194 countries. Its headquarters are in
Lyon, France. Interpol provides various services for law enforcement around the
world. This includes the maintenance of numerous databases on crimes and crimi-
nals that are available for law enforcement to access in member countries, investi-
gative support, and training (Interpol, 2019a). Cybercrimes are among the crimes
for which these services are provided.
Interpol was founded in September 1923. It was initially headquartered in
Vienna, Austria, and was called the International Criminal Police Commission.
During World War II, the Nazis took control of the organization, leading most
countries to discontinue their participation in the organization. After falling
under Nazi control, the organization was moved to Berlin, Germany. Following
World War II, the organization was rebuilt in 1946, with its new headquarters in
Paris, France. At that time, the organization adopted “INTERPOL” as its telegraph
address—the moniker by which the organization now goes by. Its headquarters
moved to Saint Cloud, France, in 1966 and then again to its current location in
Lyon, France, in 1989 (Interpol, 2019b). In April 2015, Interpol opened its Global
Complex for Innovation in Singapore. Within the complex is housed the Digi-
tal Crime Centre—a center for providing assistance on international cybercrimes.
While this center did not open until 2015, Interpol was involved in the investiga-
tion of cybercrimes prior to this (Interpol, 2015).
Interpol has focused on working with both the public and private sector in
addressing cybercrime. Interpol (in cooperation with Europol) has hosted a
cybercrime conference since 2013 which focuses on the ways the public and pri-
vate sector can work together. Said Tim Morris, Interpol’s Executive Director of
Police Services, “Only through a concerted globalized effort which maximizes
Interpol 231

our expertise and minimizes the gaps will we be best prepared to tackle emerg-
ing cyberthreats” (Interpol, 2018). This can be seen in several of their cybercrime
investigations. In 2015, Interpol worked with four organizations in the private
sector (Cyber Defense Institute, Kaspersky Labs, Microsoft and Trend Micro) to
take down the Simda botnet (Interpol, 2015). In 2017, Interpol worked with eight
countries (China, Indonesia, Malaysia, Myanmar, Philippines, Singapore, Thailand
and Vietnam) and seven organizations in the private sector (Booz Allen Hamil-
ton, British Telecom, Cyber Defense Institute, Fortinet, Kaspersky Lab, Palo Alto
Networks, and Trend Micro) to provide analysis of cybercrime threats in seven
of the eight participating countries (all but China). In regards to this operation,
Noboru Nakatani—Interpol’s Executive Director at the time—said that “[s]haring
intelligence was the basis of the success of this operation, and such cooperation is
vital for long term effectiveness in managing cooperation networks for both future
operations and day to day activity in combating cybercrime” (Interpol, 2017).

Keystroke monitors can be used alone by cybercriminals, or in conjunction with

other malware. A possible paring would be the use of a logic bomb with a key-
stroke monitor. A logic bomb is malware that is triggered upon the occurrence of
some event. When paired with a logic bomb, a keystroke monitor can be set up to
operate only after specific websites (bank websites, e-mail websites, etc.) have been
visited on a compromised computer (Armendariz, 2019). This limits the amount
of text a keystroke monitor captures, which in turn limits the amount of keystrokes
in a log that a cybercriminal will have to sift through to discover personally identi-
fying information of the victim.
Keystroke monitors can simply be software, or it can be hardware with software
installed on it. When it is just software, a keystroke monitor can be disseminated
any of the ways malware in general is disseminated (McAfee, 2013). There are dif-
ferent types of hardware that exist when looking at physical keystroke monitors.
Some are small universal serial bus (USB) devices that can be placed on the USB
connection of a USB keyboard before it is plugged into the USB port of a computer.
Others are keypad plates that go over an existing keypad. These tend to be used at
ATM machines and other terminals where monetary transactions take place. The
keypad plate is designed to fit over the existing keypad on an ATM machine, and it
appears to be the actual keypad. The device is also designed to trigger the buttons
underneath them, thus allowing a victim to complete a financial transaction by
putting in their PIN number, being none the wiser that their PIN number has been
stolen. These are often used with skimmers—physical devices that fit over pay-
ment card slots on ATM machines and similar terminals. Using a skimmer with a
keypad-style keystroke monitor allows cybercriminals to obtain both the payment
card information and the associated PIN number from a victim (Federal Deposit
Insurance Corporation, 2018).
There are measures that can be taken to avoid falling victim to keystroke moni-
toring. As when trying to avoid malware in general, it is best to avoid suspicious
websites and avoid downloading suspicious files, whether on a website or on an
attachment in an e-mail. Additionally, to circumvent the harms posed by keystroke
monitors, password managers and onetime passwords can be used. A password
manager will automatically enter login credentials for a user, thus removing the
need to type in a username and password and depriving a keystroke monitor of the
opportunity to capture those keystrokes. Onetime passwords, as the name indi-
cates, can only be used once. Each time a user logs into an account that employs
onetime passwords, a new password will have to be used. Thus, even if a cyber-
criminal is able to capture a onetime password via a keystroke monitor, that pass-
word will be invalid on a subsequent login attempt. There are other methods that
can be used, such as the use of a keyboard with a non-QWERTY key layout. These
can work, as most keystroke monitors will be based on the standard QWERY lay-
out, and the use of an alternate layout will cause the keystroke log generated for
a cybercriminal to be inaccurate. However, these can be inconvenient, as many
people may not be accustomed to alternate key layouts for general use. Also, it
is possible that cybercriminals may be aware of common alternative layouts and
would be able to convert the keystrokes to a readable format (McAfee, 2013).
Ke y s t r o k e M o n i t o r i n g 235

See also: Federal Bureau of Investigation; Identity Theft; Logic Bomb; Password;
Personally Identifying Information; Skimmer

Further Reading
Armendariz, Tommy. 2019. “What is a logic bomb?” Lifewire, March 4, 2019. h ttps://www
.lifewire.com/what-is-a-logic-bomb-153072
Chan, Sathena. 2017. “Using keystroke logging to understand writers’ processes on a
reading-into-writing test.” Language Testing in Asia Vol. 7, No. 10. https://doi.org/10
.1186/s40468-017-0040-5
Federal Deposit Insurance Corporation. 2018. “Beware of ATM, debit and credit card
‘skimming’ schemes.” https://www.fdic.gov/consumers/consumer/news/cnwin18/cards
kimming.html
Leijten, Marielle, and Luuk Van Waes. 2013. “Keystroke logging in writing research: Using
inputlog to analyze and visualize writing processes.” Written Communication 30, 3:
358–392.
McAfee. 2013. “What is a keylogger?” McAfee, June 23, 2013. https://securingtomorrow
.mcafee.com/consumer/family-safety/what-is-a-keylogger/
L
LEGION OF DOOM
Legion of Doom, or LOD, is a 15–20 member computer hacker group that was
based in the United States. Vincent Louis Gelormine, otherwise known as Lex
Luthor (based on the character in DC Comics), founded the group in 1984 after he
had a disagreement with his previous hacking group, Knights of Shadow. Known
at the time for being one of the most prominent hacking groups among hack-
ers, the group sought to infiltrate telephone networks that connected government
computer systems with corporate systems.
The members of the group were hackers who sought to exchange information
about their unauthorized hacking experiences as well as hacking techniques and
methods. Many of their tips were published in the Legion of Doom Technical Jour-
nal that provided information of interest to other hackers, such as basic hacking
principles, code, and examples of programming. The journal heightened the gen-
eral knowledge of hacking techniques. For the most part, the members of LOD
enjoyed the attention they received for their hacking activities, and they did not
attempt to hide what they did from the public. Their hacking was not intended
to cause harm.
However, two major members of LOD, Mark Abene (who went by the moniker
Phiber Optik) and Chris Goggans (known as Erik Bloodaxe, who also served as
editor of Phrack magazine), had a disagreement, and in 1989, Abene chose to leave
(or was kicked out of) LOD to form a new group, Masters of Deception, or MOD.
Members of MOD were known for hacking into networks so they could steal credit
card numbers or access (and post) the credit card purchasing information of celeb-
rities such as Julia Roberts. They also hacked into the computer system of AT&T.
The spat between LOD and MOD members continued for about two years. In
the hacker circles, the argument was sometimes referred to as the “Great Hacker
War.” The members of each group attacked each other through the internet. They
jammed each other’s phone lines and even monitored the other’s computer activity.
Members of both groups would, on occasion, switch their allegiance to the other
group or even cooperate with each other in hacking endeavors. This made it dif-
ficult to ascertain what group (or person) was responsible for hacking events.
One day, a meeting was taking place of LOD members via a hacked phone
company line when a MOD member, John Lee, who went by the name Corrupt,
entered the conversation. Members of LOD were upset and made some comments
offensive to MOD. Lee and other members of MOD joined together to harass mem-
bers of LOD, focusing their efforts on Goggans. They hacked into his phone line so
238 Legion of Doom

they could listen to his calls, they switched his service, and called him at all hours
of the day. Goggans responded by posting negative comments about MOD but
ultimately called the FBI for assistance.
The FBI had already been investigating MOD alongside the Secret Service in an
operation they called Operation Sun Devil. The trigger event occurred on Martin
Luther King Jr. Day in 1990, people with AT&T service heard the message, “All cir-
cuits are busy now, please try later.” This lasted for nine hours. About a week later,
the FBI and Secret Service arrested multiple members of MOD and charged them
with trespassing and computer tampering. The agents seized 42 computers and
over 20,000 computer disks, along with other items that served as evidence against
the hackers. The hackers stole login credentials, passwords, and other information,
forcing the company to spend $3 million on increasing their network security. In
the days after, LOD fell apart.
Another person associated with LOD who was investigated as part of Opera-
tion Sun Devil was Leonard Rose Jr., from Maryland, who also went by the name
“Terminus.” Agents searched his home and removed hundreds of items, including
computers and computer disks. He was indicted on five counts of computer fraud,
including the electronic transfer of a computer program that was owned by AT&T.
He was sentenced to serve one year in prison.
Eventually, Abene was charged with, and pleaded guilty to, federal charges of
conspiracy and unauthorized access to federal-interest computers. He later went
into the computer security business with former members of LOD, after being
adversaries for so long. He was later named one of New York City’s 100 smart-
est people. The Secret Service investigated Goggans, but he never faced crimi-
nal charges. He and LOD created an Internet Security consultancy group called
Crossbar Security to help any company that had been hacked by MOD. The com-
pany did not survive the dot-com bust, and Abene became an expert in computer
security and often provides assessment for national companies. He also serves as
a consultant to national news and media outlets, and has become an author of
multiple books on network security. Lee spent time in prison and currently directs
documentaries and music videos.

See also: Abene, Mark; Anonymous; Black-Hat Hackers; Chaos Computer Club;
Hacker and Hacking

Further Reading
Middleton, Bruce. 2017. A history of cyber security attacks: 1980 to present. Boca Raton, FL:
CRC Press.
Pots, Mark. 1991. “Hacker pleads guilty in AT&T case; Sentence urged for Maryland man
among stiffest yet for computer crime.” The Washington Post, March 23, 1991.
Schatz, Willie. 1990. “The terminal men: Crackdown on the ‘Legion of Doom’ ends an era
for computer hackers.” The Washington Post, June 24, 1990.
Slatalla, Michelle, and Joshua Quittner. 1995. Masters of deception: The gang that ruled cyber-
space. New York: Harper Collins.
Steinberg, Steve G. 1996. “The scare stories about security miss real issue.” Los Angeles
Times, June 17, 1996.
L e g i s lat i o n 239

L E G I S L AT I O N
Cybercrime legislation began in the United States in the late 1970s. The Florida
Computer Crimes Act of 1978 appears to be the first piece of cybercrime legisla-
tion. It was designed to cover three specific areas of cybercrime: the infringement
of intellectual property rights via computer, harm done to computers and its soft-
ware, and harm done to computer users—such as being locked out of a computer
(Florida Legislature, 1978). By 1981, 14 states followed Florida’s lead and passed
computer crime legislation (Harsch, 1981).
At that same time in the early 1980s, attempts were being made to pass federal
computer crime legislation. This appears to have received some pushback from
the computer industry (Harsch, 1981). This notwithstanding, work towards fed-
eral computer crime legislation was undertaken, at least in part in response to the
movie WarGames (1983), wherein a teenage boy almost inadvertently starts nuclear
war between the United States and U.S.S.R. via hacking (see Schulte, 2008).
The first piece of federal cybercrime-specific legislation—the Computer Fraud
and Abuse Act of 1984—was passed shortly thereafter. The legislation was amended
just two years later. Even as amended, the legislation had some limitations. The
law required suspects to make unauthorized access onto a computer for it to be
a crime, thus making any inside job by definition noncriminal. Also, the law did
not criminalize the mere access of a computer and viewing of data on it without
anything more (May, 2004).
Additional cybercrime legislation has followed. The Electronic Communica-
tions Privacy Act was passed in 1986, prohibiting the unauthorized interception
of electronic communications (see May, 2004). The Digital Millennium Copyright
Act was passed in 1998 to prohibit the use of certain digital tools to circumvent
measures implemented by companies to protect their copyrighted material. The
CAN-SPAM Act of 2003 created civil penalties for companies that engaged in
deceptive e-mail advertisement practices.
The more technology advances, the more need there is for cybercrime legislation
to address the new and innovative ways in which cybercriminals commit cyber-
crimes. It is not always necessary for states and the federal government to pass new
legislation to deal with cybercrime. There are many crimes that existed before the
advent of the internet but are still applicable to online behavior. For example, the
possession of child pornography was illegal before the internet existed. Prolifera-
tion of child pornography is certainly still a problem online. Similarly, financial
crimes such as theft and money laundering existed before the internet. The inter-
net has simply provided a new forum to commit these crimes. Thus, old criminal
legislation in many instances is still applicable to cyber situations, thus not requir-
ing any additional legislation.
There are several categories that cybercrime legislation can fall into. First
and foremost, many laws criminalize harmful online behavior. Examples of this
would be state laws criminalizing the posting of revenge porn or sexting between
minors—both things that the majority of states have enacted legislation on.
Second, there are online acts that are illegal but not criminal. These acts are
prohibited by civil law, and violators of those laws can be face fines, injunctions,
240 L e v i n , Vla d i m i r

and so forth. An example of this would be cybersquatting. This is treated as a civil

cause of action in the United States (U.S. Code, Title 15 § 1125(d)) and interna-
tionally (World Intellectual Property Organization, 2018). Violators may be forced
to forfeit the domain name in question. A violator would not be exposed to stan-
dard criminal penalties, however, such as incarceration.
Third, there is legislation that has both criminal and civil penalties for unau-
thorized behavior. Copyright laws in the United States fall into this category (U.S.
Code, Title 17 § 101 et seq.). Someone who intentionally infringes on another’s
copyright could face both criminal sanctions, as well as injunctions and the pay-
ment of damages on the civil end. The CAN-SPAM Act of 2003 in the United States
also falls into this category. The act regulates the sending of commercial e-mail.
Violation of some provision of the act can result in fines, while violation of other
provisions can result in criminal penalties such as incarceration.
Lastly, there is another body of cybercrime-related legislation. It provides regu-
lations for government agencies to abide by in order to protect against cybercrime.
An example of this is the Cybersecurity Workforce Assessment Act. It directs the
Department of Homeland Security to assess how well it is meeting its cybersecurity
obligations. Legislation such as this does not necessarily provide for punishments
if the tenets of the law are not fulfilled. Rather, it provides a framework an agency
is supposed to operate within.

See also: CAN-SPAM Act of 2003; Computer Fraud and Abuse Act of 1986; Cyber-
security Act of 2012; Cybersecurity Enhancement Act of 2014; Cybersecurity
Workforce Assessment Act of 2015; Cybersquatting; Digital Millennium Copyright
Act; Financial Crimes; Florida Computer Crime Act of 1978; Fraud; Personal Data
Notification and Protection Act of 2017; Punishment; Revenge Porn; Sexting

Further Reading
Florida Legislature. 1978. “Summary of general legislation 1978.” Florida Legislature.
https://fall.law.fsu.edu/collection/FlSumGenLeg/FlSumGenLeg1978.pdf
Harsch, Jonathan. 1981. “Computer crime: Grappling with a ‘high tech’ problem.” The
Christian Science Monitor, November 4, 1981. https://www.csmonitor.com/1981/1104
/110433.html
May, Maxim. 2004. “Federal computer crime laws.” SANS Institute Information Security
Reading Room, June 1, 2004. https://www.sans.org/reading-room/whitepapers/legal
/federal-computer-crime-laws-1446
Schulte, Stephanie Ricker. 2008. “‘The WarGames scenario’: Regulating teenagers and teen-
aged technology (1980–1984).” Television & New Media 9, 6: 487–513.
World Intellectual Property Organization. 2018. “WIPO cybersquatting cases reach new
record in 2017.” World Intellectual Property Organization, March 14, 2018. http://
www.wipo.int/pressroom/en/articles/2018/article_0001.html

LEVIN, VLADIMIR(1967–)
Vladimir Levin is a Russian hacker and cybercriminal who is known for com-
mitting the first banking crimes on the internet. Levin was a math major from
L e v i n , Vla d i m i r 241

St. Petersburg University who was able to use a list of stolen customer passwords
to log into bank accounts belonging to patrons at Citibank 18 times over the
span of a few months. He made 40 transfers, totaling over $10 million, from
customer bank accounts into accounts that were set up by other cybercriminals
located in Finland, the Netherlands, Israel, Germany, and the United States.
Three of the conspirators were arrested as they attempted to withdraw the funds
from the accounts. Each of the offenders named Levin as the architect of the
scheme. Levin was employed at the time at a computer company in St. Peters-
burg in Russia.
In August 1994, officials working in Citibank’s security system noted two trans-
fers that seemed to be abnormal. One of the transfers was for $26,800 and the
other for $304,000. Executives at the bank contacted the FBI. Agents were able
to track the transfers to a Russian hacker named Vladimir Levin. Officials arrested
Levin in Heathrow airport in London. He fought extradition to the United States
for two and a half years (because Russia had no extradition treaty with the United
States) before being transferred to the United States to face charges. In 1988 he
agreed to a plea bargain in which he pleaded guilty in the U.S. District Court for
the Southern District of New York to one count of conspiracy to defraud and to
the theft of $3.7 million. He was sentenced to three years in prison and ordered
to pay restitution of $240,015. Four of the other offenders pleaded guilty for
criminal charges of conspiracy to commit bank fraud, each serving a sentence in
prison.
In the end, Citibank retrieved all but $400,000 of the stolen funds. Levin’s
crimes were indicative of the harm that can occur if financial data is not well
protected, and they showed that banks and other institutions can be vulnerable
to cybercriminals. It also pointed to the need for increased computer security to
protect against these or similar crimes. The case was also responsible for the loss
of the public’s confidence in the online banking system. Many banking institutions
worked quickly to improve their online security systems.

See also: Banking Attacks; Black-Hat Hackers; Economy, Effects on; Hacker and Hacking

Further Reading
Dow Jones Newswires. 1998. “Russian hacker is sentenced to 3 years in Citibank heist.”
Wall Street Journal, February 24, 1998. https://www.wsj.com/articles/SB888360434859
498000
Hansell, Saul. 1995. “Citibank fraud case raises computer security questions.” New York Times,
August 19, 1995. https://www.nytimes.com/1995/08/19/business/citibank-fraud-case
-raises-computer-security-questions.html
Harmon, Amy. 1995. “Hacking theft of $10 million from Citibank revealed.” Los Angeles
Times, August 19, 1995. http://articles.latimes.com/1996-08-19/business/fi-36656_1
_citibank-system
Johnston, David Cay. 1995. “Russian accused of Citibank computer fraud.” New York Times,
August 18, 1995. https://www.nytimes.com/1995/08/18/business/russian-accused-of
-citibank-computer-fraud.html.
242 L i za r d S q u a d

LIZARD SQUAD
The Lizard Squad is a black hat hacking group led by Vinnie Omari, whose mem-
bers have participated in a variety of hacking events since being formed. They may
be most widely known for a hack on Sony PlayStation Network and Microsoft
Xbox Live on Christmas Day, 2014, that brought down the systems and prevented
many players from logging on to enjoy their new video games.
This is not the only attack the group’s membership carried out in 2014. That
year, about 60 customers of ISP Cox Communications were informed that an
employee at the company had been fooled by a phishing attack and gave out
personal information pertaining to the patrons. Cox was fined $595,000 for not
keeping the information secure. The person behind the attack, Evil Jordie, was a
member of the Lizard Squad. He called the Cox employee and acted as if he was
in the company’s IT department. The employee provided Evil Jordie with account
IDs, passwords, addresses, and driver’s license numbers, among other items. Evil
Jordie then posted the information online for all to see.
In August of that year, members posted on their Twitter account that there was a
bomb on an American Airlines flight, forcing pilots to make an emergency landing
despite the lack of an actual explosive. This event raised the interest of the Federal
Bureau of Investigation (FBI). The group continued its hacking activities in 2015.
That year, members of the group carried out an attack on the website for Malaysia
Airlines so that anyone entering the site received a message that said “404—plane
not found.” Other potential customers saw the message “ISIS WILL PREVAIL.”
They also decided to hack into the social media accounts owned by pop singer
Taylor Swift. They threated to post photos of Swift unless she paid them a ransom
of Bitcoins. However, the group did not actually possess compromising photos of
Swift.
After these hacking actions, the FBI and other law enforcement agents inves-
tigated the hacking of Lizard Squad members. They arrested one of the found-
ing members of the group, Zachary Buchta from Maryland. He pleaded guilty to
one count of conspiracy to commit damage to protected computers and was later
sentenced in federal court to three months in prison. He was also ordered to pay
$350,000 in restitution to two online gambling companies. He harassed any per-
son online, a service he provided in exchange for a $20 fee. Victims would receive
harassing phone calls filled with swearing. One victim received a call every hour
for 30 days in a row.
Other members of Lizard Squad were also arrested. One of those, Julius Kivimki,
from Finland, (who went by the name zeekill), was charged with over 50,000
computer crimes and convicted of those in July of 2015. Another member who
was charged with crimes was Bradley Jan Willem van Rooy, a 19-year-old from
the Netherlands, who was known as “UchihaLS.” He was charged with computer
crimes after carrying out distributed denial-of-service (DDoS) attacks and stealing
credit card information.

hired a network administrator in the wake of Lloyd’s firing—was using him as a

scapegoat for their own negligence. The State provided evidence of the tapes found
in Lloyd’s house, evidence that Lloyd was the employee that was in charge of the
computer network prior to his termination, and evidence of Lloyd’s motive. Prior
to his firing, Lloyd’s role with Omega shrank, and Lloyd acted out by physically
intimidating coworkers. This ultimately led to his firing (Gaudin, 2000; United
States v. Lloyd, 2001). The state argued the cyberattack was Lloyd’s retaliation for
the firing. The jury appears to have believed the State, and convicted Lloyd of
computer sabotage on May 9, 2000 (PBS, 2019). However, it did acquit him of
the charge of transporting stolen equipment (Department of Justice, 2002). Lloyd’s
conviction was momentarily set aside by the trial judge. This was due to a juror
expressing concern that her vote in jury deliberations may have been influenced
by a television program she had viewed about a computer virus. The appellate
court ultimately reinstated the conviction (United States v. Lloyd, 2001). Lloyd was
sentenced to 41 months in prison on February 26, 2002 (Department of Justice,
2002).

Keylogger and Spyware

A keylogger is a type of malware that collects all keystrokes and computer activi-
ties that are made by a user. When a user logs on to a banking site to access their
financial records, or purchases items online, the cybercriminal collects all of that
information and uses it to steal from the victim or sells the information to other
criminals. Some malware take screenshots of a computer at regular intervals and
transmit them to the offender.
Similar to keyloggers, spyware gathers names, passwords, and other confiden-
tial information from a user. Some spyware, called password stealers, focuses on
gathering a person’s login credentials, whereas other spyware gathers banking or
financial information.

Advanced Persistent Threat (APT)

Advanced persistent threat is malware that monitors a company’s security and
works to continually steal information from a computer or network over a longer
period of time. It is essential that the malware remain undetected for the attack to
be considered successful.

Easter Egg
The term “Easter egg” refers to an unexpected, harmless surprise that has been
hidden in computer software that has been placed there by a programmer. Some
Easter eggs give credit to the software developer, whereas others can be jokes,
M al wa r e 253

sound effects, or animation. They are usually hidden and largely unknown to most
users. An example of an Easter Egg is found in the 1988 movie The Wizard of Speed
and Time. After one of the animators working on the film was notified and told
that he would not receive credit for his work on the film, other animators and
filmmaker Mike Jittlov chose to spell the animator’s name out using marching toys
in one of the movie’s scenes (Kay, 2000). Most viewers of the film do not recognize
the word spelled out by the toys.
Critics of Easter eggs claim that programmers who are creating the surprises
will delay the release of the movie and other products because they are spending
time creating the hidden surprises. Some critics argue that the surprise Easter eggs
take up extra, unneeded disk space, meaning that the program will take longer to
install. In 2002, Microsoft banned the practice of adding hidden code to programs
through something called the Trusted Computing Initiative. In making the new
rules, Microsoft explained that Easter eggs and hidden codes can lead to security
issues. Some hidden code can contain malware, spyware, or otherwise be intended
to cause harm. For example, a TSA agent place hidden code into the TSA com-
puter system as a way to sabotage the terrorist screening database used by the TSA.
Hidden code placed by an IT contractor for the mortgage bank Fannie Mae was
intended to delete customer’s data (Bar-Yosef, 2012).

Law Enforcement Responses

Many malware threats are now blended threats that combine different aspects of
these malware forms into one attack. So, for example, a botnet will use both a Tro-
jan horse and spyware on a victim. Once the bot infects the computer, the Trojan
horse and spyware will allow the offender to gather a great deal of information
from the victim.
It is difficult for law enforcement to eradicate malware available to carry out
an attack. While law enforcement has intensified their online activities to collect
evidence against offenders, it is a difficult task to go after cybercriminals. If an
offender is arrested, there are others who step up to replace them. As the internet
continues to grow, the number of offenders is denial-of-service attacks, and spy-
ware. Moreover, stolen data is also readily available.
It is essential that users know how to prevent malware from being placed in their
computers or system so that their data and files can remain confidential. To do this,
antivirus software should be placed on the computer that will detect and, if needed,
remedy any malware that may be on the computers. A firewall can also be part of
a computer’s security system. This is a software program that screens out hackers,
viruses, worms, and other forms of harmful malware. It is essential that users know
how to recognize e-mails that may include malware. Company employees and per-
sonal users should know not to open e-mails or attachments from unknown send-
ers, or to refrain from going to websites that are not secure. It is also a good idea
to refrain from using unsecured Wi-Fi that is available in restaurants, hotels or
airports. This is a great place for cybercriminals to access unprotected computers.
254 M a n n i n g , C h el s ea

See also: Advanced Research Projects Agency Network; Bitcoin; Bots and Botnets;
Dark Web; Denial-of-Service Attack (DoS); E-mail-related Crimes; Exploit Kit;
Morris, Robert Tappan

Further Reading
Ablon, Lillian, Martin C. Libicki, and Andrea A. Golay. 2014. Markets for cybercrime tools
and stolen data. Washington, D.C.: Rand Corporation.
Bar-Yosef, Noa. 2012. “Examining the threat of Easter eggs.” Security Week, April 11, 2012.
http:/www.securityweek.com/examining-threat-easter-eggs.
Elisan, Christopher C. 2015. Advanced malware analysis. New York: McGraw-Hill.
Holt, Thomas J., Adam M. Bossler, and Kathryn C. Seigfried-Spellar. 2018. Cybercrime and
digital forensics. New York: Routledge.
Kay, Russell. 2000. “How to: Easter eggs.” Computerworld, September 18, 2000. https://
www.computerworld.com/article/2597221/app-development/easter-eggs.html
Musgrove, Mike. 2008. “That ‘friend’ may be a worm; Facebook, MySpace users hit by
software carrying spam.” The Washington Post, August 26, 2008.
Q&A about the Koobface virus. “NakedSecurity.” https://nakedsecurity.sophos.com
/questions-and-answers-about-koobface/
Richmond, Riva. 2010. “Attacker that sharpened Facebook’s defenses.” New York Times,
November 14, 2010. https://www.nytimes.com/2010/11/15/technology/15worm.html
Sidel, Robin. 2016. “Mobile bank heist: Hackers target your phone: Malicious programs
with names like Acecard and GM Bot gain popularity with thieves.” Wall Street Jour-
nal, August 26, 2016. https://www.wsj.com/articles/mobile-bank-heist-hackers-target
-your-phone-1472119200
Skoudis, Ed, and Lenny Zeltser. 2003. Malware: Fighting malicious code. Upper Saddle River,
NJ: Prentice Hall.
Timberg, Craig, Griff Witte, and Ellen Nakashima. 2017. “Malware, described in leaked
NSA documents, cripples computers worldwide.” The Washington Post, May 12, 2017.
https://www.washingtonpost.com/world/hospitals-across-england-report-it-failure
-amid-suspected-major-cyber-attack/2017/05/12/84e3dc5e-3723-11e7-b373-418f6
849a004_story.html?utm_term=.7f2c4305ba5f
Totty, Michael. 2011. “The first virus . . . and other not-so-great moments in the history
of computer mischief.” Wall Street Journal, September 26, 2011. https://www.wsj.com
/articles/SB10001424053111904265504576568770117066288
Weaver, Nicholas. 2001. “A brief history of the worm.” Symantec, November 26, 2001.
https://www.symantec.com/connect/articles/brief-history-worm

MANNING, CHELSEA(1987–)
Chelsea Manning is an activist and a government whistleblower. She was born
on December 17, 1987, in Crescent, Oklahoma. As a teenager, she lived for a
time—from 2001 to 2005—with her mother in Wales. She returned to the United
States to live with her father and stepmother for a time, and then she lived with
her aunt in Maryland. While living with her aunt, Manning saw a therapist, and for
the first time, she considered transitioning to presenting as female (Heller, 2017).
Instead, Manning enlisted in the U.S. Army in 2007, in part as an attempt to “man
up” (Shaer, 2017).
M a n n i n g , C h el s ea 255

Manning attended military intelligence school at Fort Huachuca in Arizona in

2008. Manning’s first duty station was in Fort Drum in New York. In 2009, she
was deployed to Iraq. In her role as an intelligence analyst, Manning saw firsthand
the way the United States was handling the war, and it concerned her. She con-
sidered leaking documents that showed some of the documents of concern to her.
Before heading back to the United States for a two-week period of leave, Manning
downloaded those documents to her laptop computer. While in the United States,
she attempted to have the documents published through the New York Times and
the Washington Post but was unable to make arrangements with either outlet to do
so. She ultimately sent the documents to WikiLeaks on February 3, 2010 (Shaer,
2017). In a text file accompanying the leaked documents, Manning said, “This is
possibly one of the more significant documents of our time removing the fog of
war and revealing the true nature of twenty-first century asymmetric warfare. Have
a good day” (Shaer, 2017).
Among those leaked documents was footage from U.S. military helicopters
in 2010 showing U.S. military personnel killing several civilians in New Bagh-
dad, Iraq, including journalists (WikiLeaks, 2010). The documents began being
published in April, 2010. In May, 2010, Manning began communicating with
a hacker named Adrian Lamo. In those communications, Manning admitted to
being involved in leaking documents to WikiLeaks (Hansen, 2011). Unbeknown
to Manning at the time, Lamo was working with the FBI, and ultimately turned her
in (Cadwalladr, 2018).
Manning was arrested on charges related to the leaked documents on May 27,
2010. She was initially held in custody at Camp Arfijan in Kuwait and then trans-
ferred to the marine base at Quantico. She spent nine months there in a form of
solitary confinement, only being allowed to leave her room one hour a day. Follow-
ing criticisms of the conditions of Manning’s detention, she was transferred to the
Midwest Joint Regional Correctional Facility at Fort Leavenworth. There, she was
allowed to be with the general inmate population (Shaer, 2017).
Manning was charged in a military court with various crimes for disclosing
documents. The most serious of those charges was aiding the enemy, a charge that
carries the potential of the death penalty. In addition to that, Manning was charged
with multiple counts of violating the Espionage Act, five counts of theft, two counts
of computer fraud, and multiple military infractions (BBC News, 2013). Manning
pleaded guilty to 10 of the 22 charges against her, namely the charges alleging she
leaked documents to WikiLeaks. However, Manning contested the others, includ-
ing the charge of aiding the enemy (Pilkington, 2013). At trial, a military judge
convicted Manning of the majority of the remaining charges—10 of the remain-
ing 12. However, Manning was acquitted of aiding the enemy (Jones and Szoldra,
2017; Kelley, 2013). She was sentenced to 35 years in prison. The day after she
was sentenced, Manning officially came out as transgender (Heller, 2017; Cadwal-
ladr, 2018). Her sentence was later commuted on January 17, 2017, by President
Barack Obama. She is now out of custody (Savage, 2017).
After being released from prison, Manning has made a living through speaking
engagements. She also ran for a U.S. Senate seat in Maryland in 2018 but lost in
256 M a n n i n g , C h el s ea

the Democratic primaries (Cadwalladr, 2018; Fritz, 2018). In early 2019, Manning
landed in custody again for refusing to testify before a federal grand jury about
WikiLeaks and Julian Assange. Manning was ordered to remain in custody until
she changed her mind and agreed to testify, or until the grand jury concluded its
investigation (Bach, 2019). The time that grand jury was required to serve expired,
and Manning was released from custody. However, a new grand jury was impaneled
shortly thereafter and resumed the investigation against WikiLeaks and Assange.
Manning was again summoned to testify before the new grand jury, and she again
refused. In May 2019, she was again incarcerated for her failure to comply with the
request of the grand jury (Ingber, 2019). She remained in custody even though an
indictment against Assange was issued while she was still in custody for failing to
testify to the grand jury in their investigation against him (United States Depart-
ment of Justice, 2019).
The public’s view of Manning is polarized. Some view Manning as a traitor. This
claim was the underpinning of Manning’s court martial, and some—such as Presi-
dent Trump—have outright called her a traitor. Others view Manning as a hero.
The city of Berkeley, California was scheduled to vote on a resolution recognizing
Manning as a hero back in December 2010 before the matter was ultimately tabled
(Valencia, 2010). Manning herself denies she is a traitor. However, she does not
refer to herself as a hero, either (Selk, 2017).

a member of LOD, obtained a document of MOD’s known as “The History of

MOD” and used a filter to rewrite the document in “jive.” This was seen as an
additional race-based attack against Lee. Lee and others retaliated against Gog-
gans and his newly-started cyber security firm, Comsec Data Security (Slattalla
and Quittner, 1995; Tabor and Ramirez, 1992). The retaliation came in the form of
overloading Comsec’s phone lines with phone calls, and eavesdropping conversa-
tions on Comsec’s phone lines (Slattalla and Quittner, 1995).
In 1992, five members of MOD where indicted by a federal grand jury for vari-
ous computer crimes. The charges included unauthorized access to computers,
unauthorized use of phone lines and long-distance calling card numbers, and
interception of login credentials. Those indicted were Abene (20 years old), Sitra,
Ladopoulos, Lee, and Julio Fernandez (18 years old, known online as Outlaw). Lee
and Fernandez faced additional charges for selling login credentials that the pur-
chasers used to gain unauthorized access to the credit reports of others (Tabor and
Ramirez, 1992). Others in MOD had used login credentials to gain unauthorized
access to the credit reports of others. Many of the reports pulled were of celebri-
ties, including Geraldo Rivera, David Duke, John Gotti, Julia Roberts, Winona
Ryder, Christina Applegate, and William Gaines. In one incident, Abene allegedly
responded to a journalist calling him a “punk” online by pulling that journalist’s
credit report and displaying it to the journalist online (Slattalla and Quittner, 1995;
Tabor and Ramirez, 1992). Only Lee and Ramirez, however, were alleged to have
sold access to those credit histories.
All five ultimately pleaded guilty. Sitra (22 years old) and Ladopoulos (22 years
old) were sentenced to six months of incarceration, followed by six months of
house arrest. Lee (21 years old) was sentenced to a year in jail that was to be fol-
lowed by three years of supervised release. While on supervised release, Lee vio-
lated the terms of his release by—among other things—acting as an accessory in an
instance of wire communication interception. He was sentenced to an additional
year of incarceration due to this violation of his release terms (United States v. Lee,
107 F.3d 4 (1997)). Abene was sentenced to a year in prison. Fernandez received
a suspended sentence, apparently for his willingness to testify against his codefen-
dants, though the need never arose (Slattalla and Quittner, 1995).
Following their sentences, several of these MOD members went on to work in
the computer industry. Abene worked in network security from the early 2000’s to
at least 2015 (Bukszpan, 2015). Ladopoulos did computer work for a broadcasting
company in New York following his release (Slattalla and Quittner, 1995). In 2015,
he ran a security firm called Supermassive Corp. (Halime, 2015). Sitra worked
with computers following his release, working for a business known as the Missing
Person’s Bureau (Slattalla and Quittner, 1995).

See also: Abene, Mark; Hacker and Hacking; Legion of Doom; Phreaker

Further Reading
Bukszpan, Daniel. 2015. “6 notorious hackers and their second careers.” Fortune, March
18, 2015. https://fortune.com/2015/03/18/famous-hackers-jobs/
M el i s s a W o r m 259

Halime, Farrah. 2015. “Hacker-proof helpers.” USA Today, February 4, 2015. h ttps://www
.usatoday.com/story/tech/personal/2015/02/04/ozy-hacker-proof-helpers/22829861/
Slatalla, Michelle, and Joshua Quittner. 1995. Masters of deception: The gang that ruled cyber-
space. New York: HarperCollins.
Tabor, Mary B. W., and Anthony Ramirez. 1992. “Computer savvy, with an attitude; Young
working-class hackers accused of high-tech crime.” New York Times, July 23, 1992.
https://www.nytimes.com/1992/07/23/nyregion/computer-savvy-with-attitude-young
-working-class-hackers-accused-high-tech-crime.html

MELISSA WORM
The Melissa worm—sometimes referred to as the Melissa virus—was a virus that
was released on March 26, 1999. It was designed by David Lee Smith. The virus
was apparently named after a stripper that Smith knew from Florida (Cluley, 2009;
Federal Bureau of Investigation, 2019). The virus spread through the use of infected
attachments in e-mails. It is one of the first viruses—if not the first virus—to utilize
mass e-mailing to spread (Cluley, 2009; Long, 2010).
The virus originated from Microsoft Word document uploaded by Smith to a
Usenet discussion group called a lt.sex. The document purported to be a list of 80
free passwords to pornographic websites (Federal Bureau of Investigation, 2019;
Long, 2010). Once the document was opened, the virus would hijack the user’s
Microsoft Outlook software and send out e-mails to the first 50 people in the user’s
e-mail address book (Cluley, 2009; Federal Bureau of Investigation, 2019). The
e-mails contained an attachment, and would include language to encourage e-mail
recipients to open the attachment. Apparently trying to appeal to the same curiosi-
ties as the initial document on the alt.sex forum did, e-mail attachments would
have names such as “naked wife” and “sexxxy.jpg.” Other e-mails would include a
message in the body of the e-mail claiming that the attachment was something the
recipient had requested, and that they should not show the attachment to anyone
else (Federal Bureau of Investigation, 2019). If a recipient opened the attachment,
the process would repeat, sending e-mails with virus-laden attachments to the
first 50 people in the recipient’s e-mail address book. In this way, the virus spread
exponentially.
Investigators were able to trace the virus back to the initial document posted
on the alt.sex forum. The document had been uploaded by an America Online
(AOL) user known as [email protected]. However, investigators determined that
account had been compromised by a hacker, which they later determined to be
Smith (Cluley, 2009). Smith, who went by the online name of Kwijybo (a term
from the television show The Simpsons), was also determined to be the author of
the virus (Cluley, 2009; Long, 2010). Smith was arrested at his residence in New
Jersey on April 1, 1999 (Federal Bureau of Investigation, 2019).
Smith does not appear to have been financially motivated in his design of the
Melissa worm. To the investigators’ understanding, it was designed to show he
could do it (Cluley, 2009). Nonetheless, the virus did have a financial impact.
Where the virus spread exponentially, e-mail servers became clogged, impairing
260 M i t n i c k , Ke v i n

the functionality of the servers. It is estimated that it cost victims $80 million
to repair the damage done by the Melissa virus (Federal Bureau of Investigation,
2019).
Following his arrest, Smith agreed to cooperate with law enforcement. He
pleaded guilty to charges against him in December, 1999 (Federal Bureau of Inves-
tigation, 2019). He assisted the FBI with other cybercrime investigations. He pro-
vided contact information for Jan de Wit—the designer of the Anna Kournikova
virus—which led to de Wit’s arrest in the Netherlands. It is believed that Smith
also assisted the FBI with an investigation into virus author Simon Vallor, who
was ultimately arrested in the United Kingdom in 2001 (Cluley, 2009). Smith was
sentenced in May 2002 to 20 months in prison for his crimes (Federal Bureau of
Investigation, 2019).

In December 2002, a judge declared that Mitnick was rehabilitated enough to

be given an amateur radio license. He has appeared as a computer security expert
on many television shows (60 Minutes, Court TV, Good Morning America, CNN,
National Public Radio) and has been the focus of magazine articles and newspaper
stories. He now runs a computer security company, Mitnick Security Consulting
LLC. He will examine a company’s computer systems for weaknesses and vulner-
abilities. He also advises the FBI and other Fortune 500 companies.
Mitnick has also become an author, penning The Art of Invisibility; Ghost in the
Wires; and The Art of the Deception. He appeared on an episode of the television
show “Alias” as a hacker. He also goes on speaking tours to tell his story and talk
about security issues. Congress sought out his expertise and asked him to testify
about the state of cybercrime and the need for additional laws. In his written testi-
mony, Mitnick declared, “I have gained unauthorized access to computer systems
at some of the largest corporations on the planet, and have successfully penetrated
some of the most resilient computer systems ever developed” (Testimony for the
U.S. Senate Governmental Affairs Committee, March 2000). Despite this, he con-
siders himself to be a recreational hacker who never sold any information for profit
or personal gain. He never stole money from another person or anyone’s identity.
He simply enjoys the challenge of hacking a system to see how it works (Penen-
berg, 1999).

See also: Engressia, Josef Carl, Jr.; Hacker and Hacking; White-Hat Hackers

Further Reading
Chuang, Tamara. 2018. “Kevin Mitnick was the FBI’s most wanted hacker in the 90s. He was
hiding in plain sight in Denver.” Denver Post, March 16, 2018. https://www.denvepost
.com/2018/03/16/kevin-mitnick-fbi-most-wanted-hacker-denver/
“A convicted hacker debunks some myths.” CNN, October 13, 2005. http://www.cnn.com
/2005/TECH/internet/10/07/kevin.mitnick.cnna/
Green, Andy. 2014. “Kevin Mitnick, once the world’s most wanted hacker, is now see-
ing zero-day exploits.” Security, September 24, 2014. https://www.wired.com/2014/09
/kevin-mitnick-selling-zero-day-exploits/
Hafner, Katie, and John Markoff. 1991. Cyberpunk: Outlaws and hackers on the computer
frontier. New York: Simon & Schuster.
Mitnick, K. D., and W. L. Simon. 2002. The art of deception: Controlling the human element of
security. New York: Wiley Publishing.
Mitnick, K. D., and W. L. Simon. 2005. The art of intrusion. Indianapolis, IN: Wiley.
Penenberg, Adam L. 1999. “Mitnick speaks!” Forbes, April 5, 1999. https://www.forbes
.com/1999/04/05/feat.html#36d2a97a6d8d
Shimomura, Tsutomu, and John Markoff. 1996. Take-down: The pursuit and capture of Kevin
Mitnick, America’s most wanted computer outlaw. New York: Hyperion.

MONEY LAUNDERING
Money laundering is the process of filtering the proceeds of illegal activity through
seemingly-legitimate sources (e.g., bank accounts, businesses) to obfuscate the
Money Laundering 263

true origin of those funds. Money laundering is common in drug trafficking and
other organized crime. While money can be laundered through noncyber means,
there are cyber methods through which money can be laundered as well. Money
laundering occurs to enable criminals to make use of the proceeds of their crimes
without arousing law enforcement suspicion.
Any method that can hide the true origin of money and allow the criminal to use
those funds without suspicion can be used. Foreign bank accounts and money ser-
vices might be used to hide the origins of the funds. In one case investigated by the
U.S. Drug Enforcement Administration (DEA) and Internal Revenue Service (IRS),
it was found that drug cartels were using money exchange houses in Mexico to
purchase drug trafficking equipment in the United States (Vulliamy, 2011). Those
exchange houses were able to use fake identities, and send funds to the United
States through Wachovia bank to make these purchases. The investigation dis-
covered that over $378 billion was likely laundered through Wachovia. Wachovia
bank was criminally charged for its failure to have a system in place to prevent the
bank from being used to launder money. Although the bank itself was criminally
charged, none of its executives were. It ultimately was required to pay $160 mil-
lion to the United States as part of an agreement entered between the bank and the
government (Vulliamy, 2011).
Cyber methods have been increasingly used to launder money. Cyber money
laundering employs similar techniques as noncyber money laundering. In the case
of Wachovia bank, the key thing money launderers sought to do was anonymize the
monetary transactions—something they were able to accomplish through the use
of exchange houses in Mexico. With cyber money laundering, the use of a crypto-
currency or other digital currency can accomplish this. To do this, money launder-
ers will first convert their cash into a digital currency. Bitcoin is perhaps the most
well-known cryptocurrency. However, Bitcoin is not truly anonymous. What makes
Bitcoin work is its use of blockchains—public ledgers of all Bitcoin transactions that
take place. Thus, not only is there a record of all transactions, but it is publicly avail-
able to everyone, including law enforcement. If law enforcement has a monitoring
tool that enables them to tie a person to an initial Bitcoin transaction, tracing the
money is easy at that point (Bloomberg, 2017). Because of this, cybercriminals have
turned to other cryptocurrencies—sometimes referred to as altcoins—to launder
money. Specifically, a cybercriminal might use a category of altcoin referred to as
privacy coins—cryptocurrencies that afford their users anonymity when conducting
transactions. After a cybercriminal converts funds to Bitcoin, a cybercriminal can
use a service that “mixes” Bitcoins. These services attempt to use temporary Bitcoin
wallets to route Bitcoin through. When those temporary wallets are no longer avail-
able, the hope is the Bitcoin will no longer be traceable. From there, the Bitcoin can
be converted to a privacy coin. A launderer may convert the initial Bitcoin to several
different privacy coins. From there, a launderer can convert those anonymous pri-
vacy coins back into Bitcoin and, from there, back into standard currency. At that
point, the origin of the funds will have been thoroughly obfuscated (Fruth, 2018).
There have been cases of cyber money laundering involving significant amounts
of money. In 2013, U.S. authorities shut down Liberty Reserve—an online money
264 Money Laundering

transfer business—for laundering $6 billion. Executives of the company were

arrested. At the time of its shut down, Liberty Reserve had roughly 1,000,000
customers around the world, 200,000 of those residing in the United States. The
company permitted customers to create accounts without verifying their identities.
This permitted customers to create accounts using fake identifying information
(Isodore, 2013). Liberty Reserve operated using a digital currency known as LR.
Payments could be made to other Liberty Reserve customers using LR. Liberty
Reserve did not permit customers to directly fund their accounts from other out-
side personal accounts. Rather, customers had to go through specific third-party
exchange companies that would process deposits and withdrawals. This further
allowed Liberty Reserve to not collect any personally identifying information on its
customers. In addition to this, customers submitting payments could opt to pay a
privacy fee (75 cents) to remove reference to the customer’s account number from
transfer of LR. This made LR transactions untraceable, even by Liberty Reserve
itself (Mabunda, 2018). All these procedures afforded customers a significant
amount of anonymity with their financial transactions. Accordingly, many cyber-
criminals used the site to facilitate criminal activity or hide the proceeds of criminal
activity, such as drug trafficking, credit card fraud, and Ponzi schemes (Isodore,
2013; United States Department of Justice, 2016). The founder of Liberty Reserve
(Arthur Budovsky) pleaded guilty to conspiracy to commit money laundering. On
May 6, 2016, he was sentenced to 20 years in prison and received a $500,000 fine
(United States Department of Justice, 2016).
Another cyber money launderer was arrested in 2017. Alexander Vinnik—a
Russian national—was arrested in Greece for laundering money through BTC-e, a
Bitcoin exchange operated by him. It is alleged that Vinnik used BTC-e to facilitate
crimes such as drug trafficking, identity theft, and fraud. It is believed that Vin-
nik laundered $4 billion. It is also believed Vinnik obtained funds that had been
hacked from the Bitcoin exchange Mt. Gox in 2014 (Artois, 2017). As of early
2019, Vinnik’s case is still pending. He is currently still in custody in Greece. The
United States has sought to have him extradited, as have France and Russia, who
also have charges pending against him (Alexandre, 2019).

Fruth, Joshua. 2018. “‘Crypto-cleansing’: Strategies to fight digital currency

money laun dering and sanctions evasion.” Reuters, February 13, 2018.
h ttps:// w ww.reuters.c om/a rticle/b c -f inreg-a ml -c ryptocurrency/c rypto-c leansing
-s trategies -t o -f ight -d igital -c urrency -m oney -l aundering -a nd -s anctions -e vasion
-idUSKCN1FX29I
Isodore, Christopher Violante. 2013. “Arrests made in $6 billion cyber money-laundering
case.” CNN, May 28, 2013. https://money.cnn.com/2013/05/28/news/companies
/money-laundering-arrests/index.html
Mabunda, Sagwadi. 2018. “Cryptocurrency: The new face of cyber money laundering.”
International Conference on Advances in Big Data, Computing and Data Communication
Systems. IEEE, August 6–7, Durban, South Africa.
United States Department of Justice. 2016. “Liberty Reserve founder sentenced to 20 years
for laundering hundreds of millions of dollars.” May 6, 2016. h ttps://www.justice.gov
/opa/pr/liberty-reserve-founder-sentenced-20-years-laundering-hundreds-millions
-dollars
Vulliamy, Ed. 2011. “How a big US bank laundered billions from Mexico’s murderous drug
gangs.” The Observer, April 2, 2011. https://www.theguardian.com/world/2011/apr/03
/us-bank-mexico-drug-gangs

M O R R I S , R O B E R T TA P PA N ( 1 9 6 5 – )
Robert Morris was born on November 8, 1965, the son of a computer scientist at
Bell Labs and later the chief scientist at the National Computer Security Center
(part of the National Security Agency). Morris went to Harvard University and
then to Cornell University for graduate school. While there, he sought to learn
more about the security of computer systems. He wrote what became the first
computer worm, aptly named the Morris worm. He was 21 years old when the
worm was released on November 2, 1988. The worm spread quickly through the
internet, marking the first time the internet was attacked.
The Morris worm was a self-replicating program that copied itself and then
infected machines much more quickly than Morris intended. It was estimated
that the worm infected about 6,000 computers in a 12-hour span. The malware
affected computers all around the country—in universities, medical facilities, and
the military. An infected machine would slow down to the point that they were
unusable, or would simply crash. Because the worms infected so many comput-
ers, it brought portions of the internet to a standstill. When Morris realized the
potential harm he had caused, he attempted to solve the problem. However, it was
difficult to discover if a computer had been infected, and it was even more difficult
to stop it from spreading.
At first, Morris tried to contact the system administrators at Cornell Univer-
sity, but they were unable to stop the virus from spreading. Morris and a friend
devised a method to kill the worm and tried to send an e-mail over the internet,
but because the network was clogged, the message didn’t reach users. Other solu-
tions were devised by computer experts at Purdue University and at the University
of California at Berkeley.
266 Motives

Morris had no intention to cause any damage or the resulting panic. The only
purpose was to break into as many computers as he could. The damages from the
attack were estimated to be around $100 million. Despite his lack of malevolent
intent, Morris was indicted for violating the Computer Fraud and Abuse Act of
1986. He was the first person to be indicted under the new law. He was sentenced
to three years of probation, with 400 hours of community service, and a fine of
$10,000. Morris appealed the conviction, but the appeal was not successful.
In the end, Morris received a PhD from Harvard, became a tenured faculty mem-
ber at the Massachusetts Institute of Technology, and is a co-founder of Viaweb,
a software company that helps people with few technical skills create an online
store by using a web browser. The worm he wrote brought the vulnerability of the
internet to the public’s attention for the first time. People realized that the internet
was not secure and that it wasn’t possible to rely on other users’ good intentions to
police themselves. Instead, the dangers of the internet became clearer.

of cybercrime. This is done through the creation of partnerships between public

and private organizations that set forth various programs geared toward protecting
computer systems. The group recognizes that strong cybersecurity policies must
exist in order for there to be accessible information as well as dependable and safe
commerce on the internet. The NCSA believes that safe and secure online activity
must be a shared responsibility and it works toward that goal. While the internet
can provide tremendous benefits, it can also be a very dangerous place, but people
and companies can limit that risk if they take precautions. It must be a shared task
between all citizens to be effective.
One way the NCSA does this is through a program called “Stop. Think. Con-
nect.” This program is an online education and awareness effort. Created in 2009,
the program was the product of input from officials in private companies, non-
profit organizations, and government leaders. The program provides resources
(posters, videos, and statistics) free to any interested individual that they can use
to help others know more. They stress the need to secure networks in businesses
but also in the home, and not to forget the security of mobile devices. They also
help people know what to do if they are the victim of a cyberattack.
Members of the organization also work to increase the number of degree pro-
grams in cybersecurity at colleges and universities. These programs are increasing
in frequency as there is a greater need for experts in cybersecurity. However, many
people are still finding that they must teach themselves the skills needed to suc-
ceed in cybersecurity-related jobs.
The NCSA hopes to decrease the number of individuals teaching themselves
cybersecurity skills by holding the National Cyber Security Awareness Month each
year in October. Throughout the month, NCSA supports different activities that
teach people how to stay safe while they use the internet. Started in 2002, and
with the help of the U.S. Department of Homeland Security, NCSA emphasizes
different topics throughout the month. Some of those include cybersecurity in the
workplace (which focuses on educating and training employees about safety), the
future of cybersecurity and the internet (emphasizing trends and new technolo-
gies), careers in cybersecurity, and techniques to protect critical infrastructure (i.e.,
transportation, power grids, financial institutions) from cyberthreats.
NCSA also holds Data Privacy Day each year on January 28 as a way to give
tribute to Convention 108, the international treaty on privacy and data protec-
tion. This is a day when the importance of protecting an individual’s private data
is the focus of activities on an international scale. Throughout the day, the NCSA
holds sessions to inform the public about how their personal information can be
accessed and shared with other organizations, often without permission or the
knowledge of the individual. The activities not only focus on ways that individuals
can protect their information but also give attention to ways businesses can protect
the privacy of customer or client data. The sessions are live-streamed so people
around the globe can attend. In 2019, participants included representatives from
the Federal Trade Commission, Verizon, Visa, the Identity Theft Resource Center,
Women in Security and Privacy, C onnectSafely.org, Microsoft, The Identity Theft
Resource Center, and LinkedIn.
278 Nat i o n al C y b e r s e c u r i t y a n d C r i t i c al I n f r a s t r u c t u r e P r o t e c t i o n

In their newsletter, NCSA offers tips to keeping a family’s data protected and
safe. Many families keep personal information such as health or financial records
stored on their personal computers, yet do not take actions to protect that data.
Children (and adults) may unknowingly “overshare” information on social media
platforms. NCSA provide hints and tips for preventing such oversharing, and how
to help children understand how to prevent sharing too much information online.
They also provide tops for keeping income information secure year-round, but
particularly through tax season.
For those who want to get involved, the NCSA has a Champion program. These
are organizations such as schools, nonprofit groups, government agencies, or indi-
viduals who want to work toward a more secure internet. NCSA provides many
opportunities for those who want to help others know more about cybersecurity.
People and groups can also get involved on social media.

integrity, confidentiality, or availability of an information system or network or any

information stored on, processed on, or transiting such a system; (2) violate laws
or procedures relating to system security; acceptable use policies, or acts of terror-
ism against such a system or network; or (3) deny access to or degrade, disrupt, or
destroy such a system or network or defeat an operations or technical control of
such a system or network.
The bill included provisions for the Secretary of Homeland Security to coordinate
the activities of all federal, state, and local governments, laboratories, critical infra-
structure owners and operators, and other entities to accomplish the following goals:

1. Facilitate a national effort to strengthen and maintain the nation’s critical

infrastructure from cyber threats;
2. Ensure that the policies and procedures of the DHS assist the owners and
operators of critical infrastructure in receiving appropriate and timely cyber
threat information when needed;
3. Seek expertise in industry sector-specific areas in order to develop voluntary
security and resiliency strategies and to ensure that the allocation of federal
resources is cost effective and reduces the burdens on the owners and opera-
tors of critical infrastructure;
4. Provide risk management assistance to groups when requested, as well as
provide educational services to owners and operators of critical infrastruc-
ture facilities; and
5. Coordinate a strategy for research and development for developing technolo-
gies pertaining to cyber security.

A key provision of the proposal included the goal of establishing a National

Cybersecurity and Communications Integration Center (NCCIC) that would share
information about cyber threats and attacks with the owners and operators of criti-
cal infrastructure, as well as with government agencies. Agencies would be required
to provide NCCIC with any information on cyber incidents (data breaches) or
threats, which would then be shared as needed with others. The members of the
NCCIC would include one ISAC (or Information Sharing and Analysis Center), the
Multi-State Information Sharing and Analysis Center, the U.S. Computer Emer-
gency Readiness Team, the Industrial Control System Cyber Emergency Response
Team, and the National Coordinating Center for Telecommunications.

See also: CAN-SPAM Act of 2003; Computer Fraud and Abuse Act of 1986; Cyber-
security Act of 2012; Cybersecurity Enhancement Act of 2014; Cybersecurity
Workforce Assessment Act of 2015

Further Reading
H.R. 3696. https://www.gpo.gov/fdsys/pkg/BILLS-113hr3696eh/pdf/BILLS-113hr3696eh
.pdf
H.R.3696—National Cybersecurity and Critical Infrastructure Protection Act of 2014.
Congress.gov. https://www.congress.gov/bill/113th-congress/house-bill/3696
280 Nat i o n al I n s t i t u t e o f S ta n d a r d s a n d Te c h n o l o g y

N AT I O N A L I N S T I T U T E O F S TA N D A R D S A N D
TECHNOLOGYCYBERSECURITY FRAMEWORK
The Cybersecurity Framework, developed by the National Institute of Standards
and Technology (NIST), outlines a plan to increase the nation’s cybersecurity while
at the same time protect personal privacy of users. The plan was initiated in 2014
in response to President Barack Obama’s Executive Order 13636, “Improving Crit-
ical Infrastructure Cybersecurity.” In this document, President Obama stated that
the nation must work to increase the security and resiliency of the nation’s critical
infrastructure and related cybersecurity framework. He described the intercon-
nectivity of the nation’s infrastructure (i.e., the elements that are needed for the
country operate such as agriculture, communications, manufacturing, energy and
banking) with the cyberenvironment. Each of these elements rely on computers
and the internet to function, and a successful cyberattack on one of them could not
only bring down that sector but affect others as well. Because of the risk of great
harm that could result from a cyberattack, Obama sought to provide measures to
improve the security of the country’s cyber system. Congress assisted this initiative
when it passed the Cybersecurity Enhancement Act of 2014 (Public Law 113-274).
Obama asked that NIST, part of the U.S. Department of Commerce, establish
a framework that would promote “efficiency, innovation and economic prosperity
while promoting safety, security, business confidentiality, privacy, and civil liber-
ties” (Obama, 2013). NIST created a document with the cooperation from both the
private sector and government officials. It is a way for organizations and businesses
to become more aware of cyberthreats and to help them plan for an attack if it were
to happen. It is also a way to help an organization set priorities for where to invest
money so they can manage cybersecurity risks in a way that is cost-effective but
without adding additional regulations. The document, “Framework for Improving
Critical Infrastructure Cybersecurity,” was issued in February 2014.
The framework was comprised of three sections: the Framework Core, the
Framework Profile, and the Framework Implementation tiers. The Framework
Core includes activities that are common to all infrastructure that allow for com-
munication between them, is based on industry standards and practices, and
includes five functions: identify, protect, detect, respond, and recover. The Frame-
work Profile includes individual, unique organizational approaches to enhance
cybersecurity and includes both a “current” profile that outlines current objectives
and a “target” profile with ways to improve an agency’s cybersecurity. The Frame-
work Implementation tiers identify the degree to which an organization contains
the elements defined in the Framework; they can range from partial to adaptive
(partial, risk informed, repeatable, adaptive).
The framework also includes measures that are geared to protect the privacy of
individual users. A person’s information may be at risk. Information is gathered,
maintained, or even disclosed by organizations. At times, there may be overcollec-
tion or over-retention of personal information, and this information may be acci-
dentally disclosed. Organizations have a responsibility to protect all information
they gather on an individual, and to ensure that a person’s personal information
remains safe.
Ne w s C o r p Ha c k i n g 281

The framework is voluntary and applies to all organizations regardless of their

size, complexity, or purpose. The intent of the report is not to replace an organiza-
tion’s existing cybersecurity plan, but rather to enhance it or even rearrange a plan
to make it more efficient. The general concepts in the plan should be modified, if
needed, to fit the individual agency’s needs, threats and vulnerabilities. The goal is
to increase the security of the nation’s cybersecurity and enable organizations to be
resilient to possible attacks and recover quickly from them. NIST points out that
the framework is not just intended for use by organizations in the United States; it
can be used by organizations around the world, which would also permit greater
communication and an even more secure cyber system. The department and stake-
holders continue to review the report and update it as needed to keep it current.

NEWS CORP HACKING

News Corp is a large corporation that oversees several different businesses. This
includes several news organizations. From 2000 to 2006, some of the British
news organizations overseen by News Corp—News of the World and The Sun,
specifically—were involved in phone hacking (Childress and Gavett, 2012). Those
whose phones were hacked include celebrities, politicians, soldiers, and crime
victims.
The hacking conducted by News Corp consisted of employees or contractors
accessing the voice mails of people targeted for media coverage by the news out-
lets overseen by News Corp. This was done to give journalists an edge in their
reporting, possibly uncovering new stories or new angles to stories by virtue of
the hacked information (BBC, 2014). Evidence of possible phone hacking first
emerged in 2005. In November of that year, News of the World published a story
about a knee injury sustained by Prince William. The information in the article
was not public knowledge, and officials for the royal family insist the information
282 Ne w s C o r p Ha c k i n g

could only have come from Prince William’s private voice mails (BBC, 2014; CNN,
2019). In 2007, two people—private investigator Glenn Mulcaire and News of
the World editor Clive Goodman—pleaded guilty to hacking those voice mails.
Goodman was sentenced to four months in jail, and Mulcaire—who had pleaded
guilty to additional hacking charges related to the voice mail of other victims—was
sentenced to six months (Tryhorn, 2007). Andy Coulson—also an editor at News
of the World—resigned in 2007 following the convictions of Mulcaire and Good-
man, though he denied knowing about the phone hacking that had taken place
while there (CNN, 2019).
This was not the end of this scandal, however. A sizeable amount of evidence
was seized from Mulcaire when he was initially arrested. It was found that Mulcaire
had hacked thousands of phones for News of the World. Further investigation of
that and other evidence ultimately led to additional criminal charges. (BBC, 2014).
There was evidence to suggest that News Corp had attempted to cover up their
phone-hacking endeavors. News of the World had reached several confidential
settlements with those whose phones it had hacked. This kept the scope of its
phone hacking efforts hidden for a time (BBC, 2014). After an investigation by law
enforcement was initiated against News of the World for phone hacking, it engaged
in further phone hacking of the investigators from Scotland Yard who were inves-
tigating it (Boyle, 2015).
The phone hacking engaged in by News of the World extended beyond public
figures. It was found that it had hacked the phones of soldiers who died in the
wars in Iraq and Afghanistan (Boyle, 2015). It was also reported that News of the
World had attempted to hack into the phones of victims of the September 11 ter-
rorist attack in New York (Daily Mail Reporter, 2011), though an investigation by
the FBI determined there was insufficient evidence to find this actually happened
(Flock, 2011). Perhaps the most egregious evidence against News of the World was
evidence of its hacking of the phone of Milly Dowler—a British teenager who was
kidnapped in 2002 and was ultimately murdered. Before it had been discovered
that Dowler had been murdered, News of the World hacked into her voice mail.
Reporters deleted voice mails in her mailbox to free up space for new messages to
be left. Dowler’s parents, seeing activity on their daughter’s voice mailbox, believed
it was evidence that their daughter may still be alive and was listening to her voice
mail (Boyle, 2015). News of this was made public on July 4, 2011. News of the
World shut down permanently six days later (CNN, 2019).
Several other people faced criminal charges arising from this phone hacking.
Many of these people pleaded guilty to their involvement in 2014 and 2015.
Mulcaire—the investigator previously convicted for other charges stemming from
the phone-hacking scandal—was one of these people. He was given a six-month
suspended jail term. Three editors pleaded guilty: James Weatherup, Greg
Miskiw, and Ian Edmondson. Weatherup received a four-month suspended jail
sentence, Miskiw received a six-month jail sentence, and Edmondson received
an eight-month jail sentence (Halliday, 2014; Telegraph, 2014). Three reporters
pleaded guilty as well: Neville Thrulbeck, Dan Evans, and Jules Stenson. Thurl-
beck received a six-month jail sentence, Evans received a 10-month suspended jail
Ne w s C o r p Ha c k i n g 283

sentence, and Stenson received a four-month suspended jail sentence (O’Carroll,

2015; Telegraph, 2014). Others who were charged opted to go to trial. Many that
went to trial were acquitted of the charges against them. Those acquitted were
editors Rebekah Brooks, Stuart Kuttner, and Neil Wallis (BBC, 2014; O’Carroll,
2015). Coulson—the editor who resigned from News of the World in 2007 fol-
lowing the initial round of criminal charges against Mulcaire and Goodman—was
found guilty at trial for his involvement in the phone hacking scandal. He was
sentenced to eighteen months in jail (Cowell and Bennhold, 2014).
Criminal charges were filed against individuals for crimes other than phone
hacking as well. In 2011, allegations arose that the London Metropolitan Police
were involved in the phone hacking scandal. Amid these allegations, both the com-
missioner and assistant commissioner of the London Metropolitan Police—Paul
Stephenson and John Yates respectively—resigned (CNN, 2019). Neither has
faced criminal charges. However, two employees of News of the World—Coulson
and Goodman—were charged with conspiracy to illegally pay officers for direc-
tory information. The jury was hung as to a verdict in that case (BBC, 2014).
The two face the possibility of a retrial on those charges (Cowell and Bennhold,
2014). Criminal charges were also filed against Charlie Brooks (husband of editor
Rebekah Brooks), Cheryl Carter (Rebekah Brooks’s personal assistant), and Mark
Hanna (head of security) for conspiracy to conceal information from the police
in the course of their investigation into the phone hacking matter. All three were
acquitted of those charges at trial (BBC, 2014).
There have been other repercussions for News Corp beyond the criminal
charges against many of its reporters and editors. It has paid out significant
amounts of money in settlement with the victims of the phone hacking. The
family of Dowler received over $3 million. Several others received funds, the
amounts of which were not disclosed. News of the World established a compen-
sation program in 2011 to provide compensation to victims (CNN, 2019). In
2012, Rupert Murdoch, founder of News Corp, resigned from his board posi-
tions at the British newspapers he oversaw and relinquished his title executive
chairman for News Corp’s publishing unit in the United Kingdom (CNN, 2019;
Childress and Gavett, 2012).

World Wide Web is limited to elite members of society—roughly a few thousand

citizens in total (Williams, 2010). North Korea does have local internet available
to citizens—known as the kwangmyong—that only permits users to view North
Korea–based websites (Amnesty International, 2019). Even though the kwang-
myong is available for citizens to use, the cost of obtaining access is prohibitive
for many citizens. Permission to access the kwangmyong must be obtained from
the North Korean government, and that permission can cost up to three times the
average monthly salary in North Korea (Wright and Urban, 2017).
North Korea’s internet scheme is designed to censor information unfavorable to
the North Korean government from entering the country. Accordingly, those who
access unauthorized information are deemed to have committed a crime. It is not
just through the internet that such information could be obtained, however. The
North Korean government is concerned that such information could be obtained
phone calls with people outside of North Korea. Thus, possession of a cellular
phone that is able to make a call outside the country is likewise considered a
crime. The punishment for committing one of these crimes can be severe. Possible
sentences include being sent to a labor camp or even being executed (Amnesty
International, 2019; Wright and Urban, 2017).
Whereas the domestic internet situation in North Korea is relatively unsophisti-
cated, its cyberattack capabilities appear more evolved. North Korea’s cyberattack
operations appear to be housed in its Reconnaissance General Bureau (RGB) and
coordinate attacks with the Korean People’s Army (KPA). The number of hack-
ers working for North Korea is estimated to be between 3,000 and 6,000. Many
of these hackers live outside of North Korea where they can utilize the advanced
technological infrastructure in other countries (Chanlett-Avery et al., 2017). North
Korea has carried out cyberattacks on entities from several foreign countries,
including the United States, Israel, South Korea, Russia, Chile, and Turkey (Center
for Strategic and International Studies, 2019). North Korea’s motivations for car-
rying out cyberattacks appear to be similar to those of other countries, such as
espionage and disrupting the operations of countries viewed as hostile to North
Korea. One of North Korea’s motivations that it does not necessarily share with
other countries is financial gain (Campbell, 2017). North Korea has carried out
cyberattacks on several economic institutions. As of 2018, North Korea cyberat-
tacks attempted to steal a combined amount of over $1 billion and successfully
stole over $100 million (Cohen and Marquardt, 2018). The reason North Korea
engages in theft-based cybercrimes appears to be circumvent sanctions imposed
on it by other countries. Those sanctions have had an economic impact on North
Korea, and cybercrime has provided an avenue for the country to generate income
(So-hyun, 2019). One attack carried out by North Korea for financial gain was the
release of WannaCry malware. WannaCry, released in 2017, was ransomware that
affected approximately 300,000 people worldwide. It was able to obtain $140,000
through use of the ransomware. North Korea has also used direct cyberattacks for
financial gain. In 2016, it was able to infiltrate the networks of banks in Bangla-
desh and Southeast Asia and transfer money out of those banks to itself. The thefts
totaled roughly $81 million (Chanlett-Avery et al., 2017).
N o r t h K o r ea 287

Another mechanism that North Korea uses to circumvent sanctions is cryp-

tocurrencies. Where cryptocurrencies are more difficult to trace than standard
currency, North Korea can more easily obfuscate the origins of its illegal gains
though cryptocurrency. This does not mean it is completely untraceable, however.
It appears that the funds obtained through the use of the WannaCry ransomware
were attained as bitcoin. North Korea has not converted the bitcoin to standard
currency as law enforcement was able to track down the Bitcoin as the proceeds of
the ransomware (Chanlett-Avery et al., 2017). North Korea is not obtaining bitcoin
exclusively through illegal means. It mines bitcoin as well (Pham, 2017). Legally
obtained cryptocurrencies also permit North Korea to circumvent sanctions as
the added anonymity of cryptocurrencies can help shield economic transactions
between North Korea and entities based in countries that have sanctioned North
Korea. North Korea is not the only country that uses cryptocurrency to circumvent
sanctions; it appears Russia and Iran may do so as well (Fruth, 2018).
Perhaps the best-known cyberattack perpetrated by North Korea was its hack
of Sony Pictures in 2014. The hack resulting in the destruction of data on Sony’s
network and the theft of information that was later released to the public. The
hack appears to be retaliatory. Sony was in the process of releasing The Interview—
a movie whose plot involved the assassination of North Korean president Kim
Jong-un. North Korea denied its involvement in this attack, though it applauded
the hackers that had perpetrated the cyberattack (Chanlett-Avery et al., 2017).
One North Korean citizen—Park Jin Hyok—was criminally charged in the United
States for his involvement in the hack of Sony, as well as for his involvement in the
WannaCry ransomware attack and the hack of banks in Bangladesh. The criminal
complaint against Hyok was unsealed in 2018. In the complaint, Hyok is alleged
to be a member of a North Korean–sponsored hacking team known as the Lazarus
Group (United States Department of Justice, 2018).
North Korea has been the victim of state sponsored attacks as well, particularly
from the United States. In 2017, there was indication that the U.S. Cyber Com-
mand conducted a DDoS attack on North Korea’s RGB. In 2013, North Korea
blamed the United States and South Korea for a similar attack that restricted inter-
net access in the country (Center for Strategic and International Studies, 2019).

The malware was spread by unwitting employees at these targeted companies

who inadvertently uploaded the malware onto computers after being sent to a
malicious website via e-mail or social networking. Once loaded on a computer, the
malware took over the computer, allowing the offenders to steal company secrets
and other information. This was the first time by a cyber-attack was used for indus-
trial espionage by a government-sponsored hacking group. The attack was carried
out smoothly and surreptitiously so that when it was first discovered, Google offi-
cials were under the assumption that it was an insider attack.
The results of Operation Aurora that were announced in 2013. According to the
report, U.S. government officials reported that the hackers were able to gain access
to many years’ worth of sensitive data. Additionally, officials at Google reported
that hackers stole some of its intellectual property and company secrets. They also
claimed that the hackers stole information on human rights activists.
It was also reported by top security experts that the goal of the breach was a form
of counterintelligence, specifically to discover the identities of Chinese intelligence
operatives who were living in the United States and who may have been under
surveillance by law enforcement in the United States. As one former official said,
“Knowing that you were subjects of an investigation allows them to take steps to
destroy information, get people out of the country” (Nakashima, 2013). The hack-
ers chose companies that had been served search documents or other legal papers
related to the surveillance operation or had some other information on it. For
example, Google has a database with details regarding years of surveillance orders,
including thousands of orders that had been issued by judges to law enforcement
agents who sought permission to monitor the mail of particular suspects. That
same former official indicated that Chinese hackers may have intended to deceive
U.S. intelligence officials by conveying false or even misleading information.
The most sensitive documents came from the U.S. Foreign Intelligence Surveil-
lance Court (FISA Court), which gives approval for law enforcement to carry out
surveillance of foreign suspects, including spies, diplomats, or suspected terrorists.
These orders, issued under the Foreign Intelligence Surveillance Act of 1978, are
classified and therefore secret. Consequently, U.S. officials were concerned when
informed of the breach as it may have allowed the offender to gain access to inves-
tigations that were being carried out by FBI agents on undercover Chinese agents.
Officials in China denied the attacks.
In general, U.S. officials have expressed alarm when it comes to hacking by the
Chinese. Intrusions have been uncovered at multiple locations, including defense
contractors, aerospace companies, oil and gas companies, and even branches of
the U.S. government. The FBI has investigated Chinese hacking practices and
have concluded that they have stolen massive amounts of data. The director of
the National Security Agency, Gen. Keith B. Alexander, has described to the theft
of proprietary data as the “greatest transfer of wealth in history” (Nakashima,
2013).
In the end, Google officials chose to halt its operations in China. The company
also began to notify users whose accounts may have been part of a state-sponsored
attack, a practice that other e-mail providers eventually mimicked. Many
Ope r at i o n I n n o c e n t Ima g e s 293

governments, including France, Germany, and Australia, warned residents to con-

sider using a browser other than Internet Explorer as a way to keep their data safe.

records or decodes dialing, routing, addressing, or signaling information transmit-

ted by an instrument or facility from which a wire or electronic communication is
transmitted, provided, however, that such information shall not include the contents
of any communication, but such term does not include any device or process used
by a provider or customer of a wire or electronic communication service for billing,
or recording as an incident to billing, for communications services provided by such
provider or any device or process used by a provider or customer of a wire commu-
nication service for cost accounting or other like purposes in the ordinary course of
its business.

There are multiple differences between a pen register and a wiretap. One is that the
pen register only gathers information on incoming and outgoing calls, whereas the
wiretap provides information on the content of the person who called. A pen reg-
ister can be used alongside a wiretap in order to gather additional evidence against
an offender. Triggerfish and stingray technology can track phone calls made from
a cellular phone and the content of text messages. In all cases, police must show
probable cause that a crime has been committed or will be committed in order to
obtain a warrant for a wiretap, a triggerfish, or a stingray device. The standard is
lower for a pen register. The agent only has to show that the information collected
is relevant to an ongoing criminal investigation.
It should be noted that a pen register shows only a general number called; it
cannot identify the specific person that picks up the phone on the other end of
the line. Nonetheless, reports show that the use of pen registers by federal law
P e n Re g i s t e r 307

enforcement has rapidly increased in recent years because it does not require a
search warrant.
In 1986, Congress passed the Electronic Communications Privacy Act that
placed limits on an officer’s ability to access a suspect’s electronic communica-
tions. Some provisions of this law were known as the Pen Register Act by which
Congress placed limits on use of pen registers by both law enforcement agents and
private individuals. Any law enforcement agent seeking to use a pen register must
be granted permission to use one by a court through a warrant issued by a judge.
The judge must ensure that the information sought by the pen register is somehow
related to an ongoing criminal investigation.
The laws for pen registers changed after the terrorist attacks of September 11,
2001, when Congress passed the USA PATRIOT Act. At the time, they sought to
gather information on which numbers were calling others. This was permitted until
2015, when President Barack Obama ordered the program to be stopped, which
occurred when the USA Freedom Act was passed (Obama, 2015). The PATRIOT
Act also altered the definition of a pen register. It now includes all devices that
provide a similar function with internet communications, which means that police
can gather information on outgoing calls from all devices, not just a phone. Any
law enforcement individual can ask a service provider to grant them access to
a suspect’s phone records so the police can see whom the defendant called. A
law enforcement agent is able to see the header information from an e-mail, the
addresses of all e-mails that are sent; the e-mails of people who sent e-mails; the
time of day the e-mail is sent and how large it is; and the content. For the internet,
the investigator can see the IP address of all websites accessed; the time of day the
site was accessed; and how long a person was on that site.
The U.S. Supreme Court has upheld the constitutionality of pen registers in
Smith v. Maryland, 99 S. Ct. 2577, 61 L. Ed. 2d 220 (1979). The justices decided
that that the use of a pen register is not an invasion of an individual’s right to pri-
vacy. The case revolved around robbery victim Patricia McDonough, who received
telephone calls from Michael Lee Smith, the man who claimed to be the person
who robbed McDonough. During one of the calls, the man asked McDonough to
step out of the home and onto the porch. As she did, she was able to identify the car
that she had previously described to the police as the one that belonged to the rob-
ber. The police discovered that the registered owner of the car was Smith. The
police then approached the telephone company and asked to install a pen register
that would trace all numbers that were dialed from Smith’s telephone. The register
provided proof that a call was made from Smith’s residence to McDonough’s tele-
phone. Based on this and other evidence, the police were able to obtain a search
warrant for Smith’s home, where they found a telephone book that was open to the
page that listed the victim’s address. Police arrested Smith.
The Supreme Court held that the pen register was installed on the telephone
company’s property, so Smith’s privacy was not being invaded. Further, Smith did
not expect privacy in the telephone numbers he dialed. Any phone number that a
caller dials must be processed through the telephone company, which also keeps
records of calls made for billing purposes. The court ruled that the victim did not
308 P e o ple ’ s L i b e r at i o n A r m y U n i t 6 1 3 9 8

have an expectation of privacy when he dialed telephone numbers. Thus, the court
ruled that the use of the pen register was not a “search” under the Fourth Amend-
ment, so a search warrant was not required for its installation.
In 2018, Federal Bureau of Investigation (FBI) agents attempted to gather evi-
dence against President Donald Trump’s personal attorney and vice-president of
the Trump Organization, Michael Cohen. In order to know who he was calling,
agents placed a pen register on his phones. Unlike a wiretap that allows officers to
know the content of all calls coming in and out of the home, the pen register only
shows who he called. They found that Cohen called someone in the White House,
but they were unable to know who that was or what was discussed.

In 2017, hackers accessed personal information for millions of customers of Equi-

fax, a major credit reporting agency. The hackers were able to view customers’
Social Security numbers, birthdays, driver’s licenses, and credit card information.
Although the breach continued from mid-May until July, Equifax did not announce
the breach until September. Without that knowledge, victims did not take precau-
tions to protect their information, increasing the chances of additional cybercrimes.
In discussing the events of the Equifax breach, Representative Langevin indi-
cated that had his original bill been passed, victims in this case would have been
notified much quicker and been able to take preventative action to protect them-
selves. In response, Langevin again proposed the Personal Data Notification Act
on September 18, 2017. Langevin noted that the company had done a “terrible
job communicating about the breach to date” (Uchill, 2017). While many states
at that time had existing laws that required some kind of notification to customers
if a data breach occurred, many other states did not. In addition, the laws across
those states were very different, and the standards among the state laws differed.
The proposed federal legislation would set a consistent standard across the nation
for notification of data breaches.
Members of the Judiciary Committee and the Subcommittee on Digital Com-
merce and Consumer Protection debated the bill. The general purpose or intent
of the bill was to establish a national data breach notification standard. Under
the proposal, any businesses that used, accessed, stored, disposed of, or collected
sensitive personally identifiable information would be required to notify their cus-
tomers whose personal information may have been accessed or acquired after a
security breach. Examples of personal information that would be covered under
the bill include Social Security numbers, passport numbers, financial account
numbers, or credit card numbers. Notification of clients and customers would not
be required if there was no risk of harm to the individuals.
312 P e r s o n al Data N o t i f i c at i o n a n d P r o t e c t i o n A c t o f 2 0 1 7

When a company discovers a possible breach of their computer systems, offi-

cials would be required to notify their clients or customers within 30 days of the
discovery. This could be done by a letter, a phone call, or even an e-mail that
would provide the client or customer with a general description of the informa-
tion that was, or may have been, accessed. In addition to the general notification,
the business or agency must give the client or customer with a toll-free phone
number that they could use to contact someone who has more specific details
about the breach and the information that may have been stolen. If the breaches
may have affected over 5,000 customers, the company or organization would
have to notify major media outlets. In addition to all of this, the affected business
or organization would also have to notify credit reporting agencies of the possible
breach.
Another provision in the proposal would require officials in the DHS to estab-
lish a federal agency that would gather information on all security breaches that are
discovered by companies and organizations. Any business who discovers a breach
must notify DHS so information on that breach could be detailed and collected.
Some data breaches were considered to be more serious and had to be reported to
the U.S. Secret Service, the FBI, and the Federal Trade Commission (FTC). This
would be breaches of databases that included information on over 500,000 indi-
viduals, a federal government database, or a database that included information on
federal employees who work in law enforcement or national security.
Officials in a business or organization that fail to follow these new rules on
breaches may be found guilty of violating federal laws regarding unfair and decep-
tive acts. Any cybercriminals who hack into these databases may also be charged
with various state-level offenses if the attorney general of that state has reason to
believe that victims in that state may have been affected by the official’s failure
to report the breach. The state attorney general also has the option to bring civil
charges against company officials as a way to force them to comply with the rules
established here. This can include civil penalties of up to $1,000 per day per cus-
tomer whose personal information was, or may have been, accessed in the breach,
with a maximum fine of $1 million per breach.
While many company officials showed their support for the proposed bill, oth-
ers were less supportive. Some of their concerns revolved around the definition
of personal identification. Under the bill, passwords were included as personally
identifiable information, which, according to some executives, generally do not
result in a security threat. They noted that that a breach of passwords should not
trigger the notification process. Other executives indicated that the 30 day period
for notifying victims after a breach was too short for the company to fully investi-
gate a possible breach and discover the full extent of the damage, if any. Yet other
opponents argued that the states already had laws, and they should be the ones
that oversaw these events instead of the federal government. Finally, opponents
also complained that the proposed law only covered personal information that was
included in electronic format and ignored paper forms.

See also: Equifax Breach; Personally Identifying Information; President and Cybercrime
P e r s o n all y I d e n t i f y i n g I n f o r mat i o n 313

Further Reading
HR 1704. “Personal Data Notification and Protection Act of 2015.” Congress.Gov. https://
www.congress.gov/bill/114th-congress/house-bill/1704
HR 3806. “Personal Data Notification and Protection Act of 2017.” Congress.Gov. https://
www.congress.gov/bill/115th-congress/house-bill/3806
Mims, Christopher. 2017. “After Equifax, should the government force companies to report
hacks? Companies like Equifax don’t like you knowing they’ve been hacked—but
it would be better for consumers and businesses if they were quicker to report it.”
Wall Street Journal, September 24, 2017. https://www.wsj.com/articles/should-the-u-s
-require-companies-to-report-breaches-1506254402
Obama, Barack. 2015. ”Address before a joint session of the Congress on the State of the
Union.” Online by Gerhard Peters and John T. Woolley, The American Presidency Proj-
ect, January 20, 2015. http://www.presidency.ucsb.edu/ws/?pid=108031
Uchill, Joe. 2017. “Dem reintroduces breach notification law in Equifax wake.” The Hill,
September 18, 2017. http://thehill.com/policy/cybersecurity/361164-dem-reintroduces
-national-breach-notification-law

P E R S O N A L LY I D E N T I F Y I N G I N F O R M AT I O N
Personally identifying information is any information that can be used to as a
means of identifying an individual. This information can be used by cybercrimi-
nals to defraud or otherwise victimize the individual whose information was
obtained. Personally identifying information includes information that can be used
to directly identify someone, such as an individual’s name, date of birth, and social
security number. It also includes contact information for an individual, such as a
phone number, physical address, or e-mail address. Demographic information,
such as race and sex, would be included as well. In the cyber context, online
account information is also personally identifying information. This includes the
login credentials (username and password) for financial, social media, and other
online accounts. Any information that could be used to answer a security question
for one of those accounts (e.g., your mother’s maiden name, the name of your first
pet, the color of your first car) also becomes personally identifying information
(LifeLock, 2019).
There are several ways a cybercriminal might use the personally identifying
information of others. Generally speaking, this information is used by cybercrimi-
nals for financial gain. One way this can be done is through identity theft. Armed
with the proper personally identifying information of a victim, a cybercriminal
can pose as the victim to either access existing financial accounts of the victim or
to start new accounts under the victim’s identity. Both result in financial loss to
the victim. Some cybercriminals amass the personally identifying information of
numerous victims and then sell that information online to other cybercriminals via
an online black market website.
There are several ways a cybercriminal can collect the personally identifying
information of a victim. A common method is phishing—posing as someone
you are not for the purpose of convincing a victim to divulge personally iden-
tifying information to you. This is often done via e-mail. Phishing can be used
314 P e r s o n all y I d e n t i f y i n g I n f o r mat i o n

to exponentially obtain the personally identifying information of victims. Once a

cybercriminal is able to use personally identifying information to compromise the
e-mail or other electronic communication account of one victim, that cybercrimi-
nal can then spoof e-mails to the victim’s contact list, posing as the victim. If these
additional phishing attacks are successful, the cybercriminal not only has more
potential victims to profit from, but they can repeat the cycle, sending spoofed
e-mails to the new victims’ contact lists.
There are physical methods of obtaining personally information as well, such as
scavenging (e.g., looking for information on documents that have been thrown in
the garbage). Another avenue cybercriminals can use is the collection of information
that is publicly available. Gathering data in that fashion can be time-consuming.
There are data-aggregation websites that compile publicly available data and make
it available to others—usually for a fee. Websites that provide data like this are
not violating the law, as the data provided is publicly available, and the website is
simply saving others the hassle of compiling that data (Cox, 2018). Nonetheless,
if a cybercriminal uses that data to ultimately commit identity theft or some other
crime, that would clearly be illegal.
A number of things can be done to prevent personally identifying information
from falling into the hands of cybercriminals. This includes limiting the amount
of information shared on social media, and only divulging personally identifying
information to entities that need the information and who you trust to keep it
private (LifeLock, 2019). Businesses must also worry about their data collection
policies as cybercriminals may target them to collect the personally identifying
information of numerous people in one attack. One recommendation to businesses
by the Federal Trade Commission (2016) is to only collect and retain data that
is absolutely necessary to operate the business, thus minimizing the amount of
information cybercriminals might be able to obtain should they be able to breach
the business’s security measures. A nondigital way that both individuals and busi-
nesses can prevent personally identifying information from falling into the hands
of cybercriminals is the proper disposal of physical records that contain such infor-
mation. This requires that records are not just thrown away but also in some way
destroyed (e.g., shredded) before they are thrown away (Federal Trade Commis-
sion, 2016; LifeLock, 2019). If this is done, a cybercriminal engaging in scavenging
will not be able to obtain information from the trashed records.

LifeLock. 2019. “What is personally identifiable information (PII)?” LifeLock. https://

www.lifelock .com /learn -identity -theft -resources -what -is -personally -identifiable
-information.html

PHARMING
Pharming is a cyberattack wherein a cybercriminal will create a mimicked version
of a legitimate website. This is done to deceive victims into divulging personally
identifying information to the cybercriminal via the spoofed website, believing
they are providing it to the operators of the legitimate website. Once a cybercrimi-
nal obtains that information, they can use it to commit identity theft, theft, and
other financial crimes.
There are several ways pharming can take place. One method cybercriminals
might use is typosquatting—using a domain name that it one character different
from a legitimate domain name. This is done to try and catch users of a legitimate
website that are careless when entering the domain name (Brody et al., 2007). If
the website at a typosquatting domain name spoofs the legitimate website, a user
that is unaware of the fact they made a typo might enter their personal information
(e.g., login credentials, bank account number). While this is a method cybercrimi-
nals could use to conduct a pharming attack, it does not appear that this method
is used often. One study found that less than 3 percent of the typosquatted web-
sites were associated with cybercrime (Ducklin, 2018). The lack of pharming via
typosquatted websites may be due to the scarcity of typosquatting domain names.
Engaging in criminal activity via such a domain name may require a cybercriminal
to ultimately abandon that domain name, and the profit that can come from it.
Indeed, 15 percent of the typosquatted websites visited in the study bombarded
visitors with ads and popups—a potential means of generating revenue.
Another method used to pharm is through the use of malware. To enable
pharming, malware can be designed to affect the functionality of a computer’s
web browser. Specifically, the malware will cause a computer to direct the user to
the cybercriminal’s spoofed website instead of the actual website typed into the
web browser (Brody et al., 2007; Kaspersky, 2019). A pharming attack using this
method was carried out in 2007. In that attack, cybercriminals designed malware
that would redirect victims to spoofed versions of bank account websites. The
malware would redirect victims to spoofed bank websites if they attempted to visit
one of over 50 different bank websites. Once login credentials were entered by vic-
tims, they were redirected to the legitimate bank websites and logged in with the
credentials they have provided to the cybercriminals, thus leaving them unaware
they have been hit by a pharming attack (Kirk, 2007).
Cybercriminals may attack a DNS server instead of a computer to carry out a
pharming attack. By using DNS spoofing, cybercriminals can cause a DNS server
to direct correctly entered domain names to internet protocol (IP) addresses that
do not correspond to those domain names. This can send victims to a spoofed
website (Brody et al., 2007; Kaspersky, 2019). This method of pharming can be
more difficult to protect against. In instances of pharming via typosquatting, users
316 Phishing

can take precautions and make sure to type carefully when visiting websites where
they will be asked to enter sensitive information. In instances of pharming via
malware, users can keep their antimalware software up to date and engage in safe
web-browsing practices to help avoid having pharming malware downloaded onto
their computers. With DNS spoofing, these precautions may be insufficient, as the
attack is against a DNS server, which the user will not generally have control over
(Kaspersky, 2019).
While some forms of pharming may be more difficult to protect against, there
are still measures that can be taken to mitigate the risk of falling victim to a pharm-
ing attack. In addition to the precautions mentioned above, users can pay attention
to the websites they visit. If the website does not appear the way it normally does
(e.g., the design is different, the address bar looks different, the site asks for infor-
mation it does not normally ask for), it is possible the website is part of a pharming
attack (Kaspersky, 2019). The majority of pharming attacks spoof the websites
of financial institutions. Accordingly, there are additional precautions those insti-
tutions might take to protect against pharming attacks. For example, banks may
implement a system whereby customers choose a personal image that is to appear
whenever they attempt to log in to their account. If the image does not appear, it
is an indication that the website the customer accessed may not be legitimate, and
they should not enter their login credentials (Brody et al., 2007).

personally identifying information they obtain to commit theft or other financial

crimes.
Phishing can occur by any means of electronic communications. However,
the vast majority of phishing appears to occur via e-mail (Verizon, 2018). Other
methods include text message, social media message, or phone call—referred to
as “vishing” (Vanian, 2019). Phishing can be used to gain one individual’s personal
information. It can also be used to gain information that would permit the cyber-
criminal to access the computer network of a business, government agency, or
other organization. When a phishing scheme is set up to target a specific victim,
it is referred to as spear phishing. When the specific victim being targeted by a
phishing scheme is the head or other high-profile member of an organization, it is
referred to as whaling. Whereas general phishing attacks that are mass distributed
to numerous potential victims do take efforts to make their fraudulent communi-
cations seem authentic, spear phishing and whaling attacks generally may be more
detailed, the details of the communications being tailored to the specific target
(Gil, 2018).
Phishing remains a popular method of attack for cybercriminals. As technology
advances, cybersecurity has improved, making it more difficult for cybercriminals
to find and exploit software weaknesses in computer networks. Although phish-
ing attacks rely on human error instead of software weakness, it is still a viable
way—and perhaps a more effective way—for a cybercriminal to infiltrate a com-
puter network (Vanian, 2019).
Research suggests that most people do not fall prey to phishing attacks. In fact,
one report found that 78 percent of people never click on phishing e-mails (Veri-
zon, 2018). This does not mean, however, that phishing attacks are unsuccessful.
That same report found that in a phishing attack, roughly 4 percent of the people
who receive a phishing e-mail do click on them.
There are steps that can be taken to mitigate the harm of a phishing attack.
Many phishing e-mails are kept from inboxes via a spam filter. Cybercriminals may
devise ways to prevent their phishing e-mails from getting filtered, and thus rely-
ing solely on a spam filter may be insufficient to avoid a phishing attack. Because
phishing e-mails can still sneak through, knowing how to identify a phishing e-mail
is important. If the e-mail comes from someone unknown to the victim or from
an organization with whom the victim does not conduct business, it is possibly a
phishing attack and should not be opened or responded to (Federal Trade Com-
mission, 2019). If a phishing e-mail is detected, reporting the e-mail can poten-
tially help prevent harm to others from that phishing attack. In an organization, if
one employee is hit by a phishing attack, it is possible that other employees were
hit by the same attack. The sooner the attack is reported, the sooner the organiza-
tion’s cybersecurity personnel can respond to that attack and mitigate the damage
done by it (Verizon, 2018). In addition to reporting a phishing attack to the appro-
priate people within an organization, phishing attacks—whether they be directed
at members of an organization or at individuals in their personal capacity—can
report the attack to governmental agencies, such as the Federal Trade Commission
in the United States. Despite the benefits of reporting phishing attacks, it does not
318 P h r ea k e r

appear many people who detect a phishing attack ultimately report it. One report
found that only 17 percent of phishing attacks are reported (Verizon, 2018).

phones—whether they were playing Pokémon Go or engaging in other activity on

their mobile phone (Southwark News, 2016).
Based on these early uses of Pokémon Go to lure in victims, there was concern
that the game might be used for more nefarious purposes, such as pedophiles luring
children to their location (Criddle, 2016; Garber-Paul, 2016). These concerns were
heightened when a report discovered that the developers of Pokémon Go uninten-
tionally placed Pokémon at locations in New York city that were in front of the resi-
dences of registered sex offenders. There was some indication that a similar thing was
occurring in other states, such as California (Baitinger and Musumeci, 2016). The
state of New York went so far as to ban convicted sex offenders from playing Poké-
mon Go or similar games as a term of their parole (Vasquez, 2016). There have been
some incidents involving Pokémon Go, sex offenders, and children. In two separate
incidents—one in Indiana and the other in Wales—sex offenders were found play-
ing Pokémon Go with minors just outside of courthouses (BBC News, 2016; Vasquez,
2016). A separate incident in Wales involved a man who invited children to his home
on the premise that numerous Pokémon were present there, though it is not clear
whether the man was a sex offender or what his intentions were (Criddle, 2016).
In addition to the physical threats posed to those who play Pokémon Go, there
are cyber threats as well. Fraudulent versions of Pokémon Go were apparently
designed when the game was released. These versions would download malware
to the victim’s phone, which could result in the theft of information contained on
that phone (Criddle, 2016).
While players of Pokémon Go face the risk of being the victims of one of the
crimes described above, they could also be involved in crimes arising from their use
of the game. One concern is drivers being distracted by Pokémon Go, resulting in car
accidents. These incidents may go beyond mere distracted driving. Drivers might
intentionally drive in illegal ways in order to catch Pokémon while driving. The
game is only designed to operate if the mobile phone is traveling under 20 miles per
hour. This results in people driving slowly in locations that require a higher speeds
and in people abruptly stopping to catch a Pokémon once it is found (Criddle,
2016; Garber-Paul, 2016). Players might also exploit the game to catch Pokémon
in a manner not permitted by the game. Specifically, players can spoof the GPS
coordinates of their mobile phone in order to catch Pokémon without ever leaving
their homes (Malwarebytes, 2019). Users doing this would violate the game’s terms
of service (Niantic, 2019). Spoofing GPS coordinates could allow players to access
in-game content—such as usable items in the game—in a more expeditious fashion
than would be physically possible without GPS spoofing. Where this allows players
to avoid purchasing items in the game, it could be viewed as theft.

PRESIDENT AND CYBERCRIME

Presidential statements and actions on cybercrime can have an impact on the laws
and policies that regulate online activities throughout the United States and the
world. Since cybercrime is a relatively new activity, there have been only four presi-
dents who have spoken about online crimes and their plans to thwart such activity.
Democrat Bill Clinton was the first president to mention the problem of cyber-
crime. In 1996, during his first term in office, Clinton established the first Com-
mission on Critical Infrastructure that had the responsibility to identify the nation’s
critical infrastructures that were at risk of either a physical attack or a cyberattack.
In doing so, he was specifically concerned with those infrastructures that rely on
computer systems to operate, which would make them more of a target to hack-
ers. Clinton described the need for such a strategy in a speech he gave in 2000.
He indicated that the country’s critical systems, including the power structures,
nuclear plants, air traffic control, and computer networks, are all connected by
computers. He described one incident in which a satellite malfunctioned, disrupt-
ing technology around the world. To help protect against cyberevents like these,
Clinton worked with members of both the public and the private sectors to develop
a national plan to increase the nation’s cybersecurity (Clinton, 2000).
Clinton also provided money for counterterrorism and cybercrime programs
carried out by the Department of Justice. In an Appropriations Act in 2001, Clin-
ton provided $100 million that would help fund “State and local first-responder
training, staff support for the Joint Terrorism Task Forces and enhanced technol-
ogy and intelligence-gathering along the northern border” (Clinton, 2001).
In the days after the terrorist attacks of September 11, 2001, Republican Presi-
dent George W. Bush established a committee that would create a strategy to
improve the country’s cybersecurity. He appointed Richard Clarke to serve as the
National Cybersecurity Advisor, and gave him the task of reviewing vulnerabilities
that existed in cyberspace. Another task given to Clarke was to review the tactics
that terrorist groups use to recruit people who have advanced cyber skills.
Bush initiated several approaches to fighting cybercrime. One was to work coop-
eratively with the leaders of other nations to address the problem. For example, in
2001, Bush described his interaction with the European Union regarding cyber-
crime, “We emphasize the need to take mutually reinforcing action in response to
common problems in fighting international crime. We have, therefore, launched
multi-annual cooperation in several areas, such as . . . cybercrime” (Bush, 2001).
He also issued a statement after meeting with the prime minister of India, Man-
mohan Singh, in which he said the two countries “recognized the importance of
capacity building in cyber security and greater cooperation to secure their growing
electronic interdependencies, including to protect electronic transactions and criti-
cal infrastructure from cybercrime, terrorism and other malicious threats” (Bush,
2006).
Another approach Bush took toward combating cybercrime was to support the
Council of Europe Convention on Cybercrime. In asking for the Senate to ratify the
document, Bush said that the convention would help combat global cybercrime
“By providing for broad international cooperation in the form of extradition and
P r e s i d e n t a n d C y b e r c r i me 331

mutual legal assistance, the Cybercrime Convention would remove or minimize

legal obstacles to international cooperation that delay or endanger U.S. investiga-
tions and prosecutions of computer-related crime” (Bush, 2003). As a result, Bush
said the convention would deny “safe havens” to terrorists and other cybercrimi-
nals. The U.S. Senate ratified it on August 3, 2006, and President Bush signed it
on September 22, 2006. The convention became effective for the United States on
January 1, 2007.
In 2013, Democratic President Barack Obama called cybercrime “one of the
most serious economic national security challenges that we face as a nation.”
Although Obama understood that the internet provides “incredible information
and allows us to reach out around the world also makes our bank accounts vulner-
able,” he also realized that cybercrime “is a huge problem and a growing problem.
And so we’ve got to be in there in some way to help protect the American people,
even as we’re also making sure that government doesn’t abuse it” (Obama, 2013a).
Recognizing that cybercrime did not affect only one country, Obama sought
international cooperation. After meeting with the leader of the United Kingdom,
David Cameron, Obama said, “We believe we can make (our) relationship even
stronger with deeper cooperation in areas critical to . . . our national security, like
cybercrime” (Obama, 2011b). After speaking with leaders from North America,
including Canadian Prime Minister Stephen Harper and Mexican President Felipe
de Jesus Calderon Hinojosa, Obama reported that they “underscore that fighting
cybercrime is essential to promoting economic growth and international security”
(Obama, 2012).
Obama also talked to the leaders of Estonia, Latvia, and Lithuania about cyber-
crime. Afterward, he promised to strengthen the United States’ attention to cyber-
crime, both regionally and around the world. He sought to work closely with
members of both the public and private sectors and to cooperate with law enforce-
ment agencies from other countries to investigate and prosecute acts of cybercrime.
In the end, Obama described the goal of an open, secure, and reliable internet that
promotes the free flow of information but at the same time protects the privacy of
users (Obama, 2013b). Obama also spoke with the leaders of Japan, India, Bra-
zil, China, Singapore, and Cuba about the need to increase cybersecurity. Finally,
Obama sought to attack transnational criminal organizations “that engage in cyber-
crime, threaten sensitive public and private computer networks, undermine the
integrity of the international financial system, and impose costs on the American
consumer” (Obama, 2011a).
Upon beginning his term as president in 2017, Republican Donald Trump
announced that it would be the policy of the executive branch to “strengthen
enforcement of Federal law in order to thwart transnational criminal organiza-
tions . . . that are related to . . . cybercrime” (Trump, 2017a).
Like other presidents, Trump also took an international approach to fighting
cybercrime. After meeting with the leaders of Malaysia, Trump said, “The United
States and Malaysia acknowledged that cyber and other crimes often help finance
terrorist networks. The countries committed to utilize available multilateral instru-
ments . . . in order to strengthen domestic legislation and foster international
332 P r e s i d e n t a n d C y b e r c r i me

cooperation in combating cybercrime” (Trump, 2017b). He followed that with a

statement after meeting with leaders in the Asia-Pacific Economic Summit, saying
we “must also deal decisively with other threats to our security and the future of
our children, such as . . . cybercrime” (Trump, 2017d). Finally, Trump also spoke
with the leaders from Vietnam and explained that “we continue to work with our
Vietnamese partners and with partners across the region on a range of challenges,
including . . . cybercrime” (Trump, 2017c).

communications, but it is also used by cybercriminals to do the same (Leyden,

2006).
Attitudes toward PGP have shifted over the years. Following the initial release
of PGP in 1991, there was a demand for e-mail encryption software. Zimmermann
was solicited by volunteers to help work on PGP and to port it to other platforms.
In September, 1992, PGP 2.0 was released. It contained some improvements and
was available for numerous platforms and in numerous languages. The popularity
of PGP—and its worldwide availability—appears to have caught the eye of law
enforcement in the United States (Zimmermann, 2001). While there was public
demand for encryption software, the government had concerns with its implemen-
tation. Around the time PGP was being written and released, the government had
been advocating the implementation of encryption software that would permit the
NSA a bypass around the encryption. The NSA wanted this in place so it could not
be prevented from accessing data in instances where it had a warrant or other court
order to obtain that data. PGP was not designed to permit this. Indeed, it appears
Zimmermann may have created PGP in response to the government’s proposal to
require encryption to provide a bypass for the government (Stay, 1997).
In 1993, a federal investigation was opened to determine whether Zimmermann
violated U.S. law by distributing PGP. The investigation involved the U.S. Customs
Service. At the time, cryptographic software was considered a munition for pur-
poses of the Arms Export Control Act. Thus, export of cryptographic software such
as PGP to foreign countries could potentially have been considered a violation of
this Act (Stay, 1997). The investigation in Zimmermann continued for three years.
On January 11, 1996, the U.S. government closed the investigation without filing
criminal charges against Zimmermann. The government provided no explanation
why they closed the investigation (Zimmermann, 1996a). Since that time, encryp-
tion has become more commonplace. Government regulations may even require
organizations to use encryption to not run afoul of information disclosure laws
(Leyden, 2006). Nonetheless, the government’s decision to not prosecute Zimmer-
mann is not necessarily recognition that his actions were legal. Someone distrib-
uting cryptographic software to foreign countries in the United States could still
potentially face legal repercussions (Zimmermann, 1996a).
Zimmermann no longer owns PGP. As noted above, he initially released PGP
as freeware. After the criminal investigation was closed in 1996, he founded PGP
Inc. which retained ownership of PGP. PGP Inc. was acquired by Network Associ-
ates Inc. in 1997. Network Associates developed PGP for both commercial and
freeware uses. Network Associates sold the rights to PGP to PGP Corporation
in 2002, and PGP Corporation was acquired by Symantec in 2010 (Open PGP,
2016b; Zimmermann, 2019). There are still encryption products that incorporate
Open PGP standards—the open standards version of PGP that had been made
available by Network Associates when they still controlled the rights to PGP (Open
PGP, 2016b). Zimmermann appears to be a proponent of Open PGP products and
vendors (Zimmerman, 2019).

effective sharing of information regarding the threats of cyberattacks or actual

attacks if they occur. That way others can take actions to protect their systems, if
need be. Moreover, law enforcement will benefit from additional evidence as they
search for the offenders.
In a similar vein, all enforcement procedures should be applied similarly by all
states. That way an offender cannot choose to commit a crime in a venue that has
a lower penalty or punishment.
Law enforcement in all states need to have more training in cybercrime. Most
departments are becoming more effective at fighting cybercrime. They are becom-
ing more comfortable with the internet and technology, and there are more officers
who have expertise and knowledge of technology. Some departments have placed
officers in positions to pose as minors online as a way to catch predators and oth-
ers seeking to harm users. Nonetheless, there are many agencies that need more
officers who are trained in tracking down cybercrimes and cyberoffenders.
Prevention of cybercrime cannot be limited to an agency, business, or individ-
ual. Instead, a true attack on cybercrime must be international. Cybercriminals do
not recognize national borders. A cyberattack can come from anywhere around the
globe. This points to the importance of international treaties and agreements such
as The Convention on Cybercrime that was negotiated by the Council of Europe.
It is a true effort to improve the international enforcement of cybercrimes through
creating similar laws between countries. It also increases the investigatory powers
of law enforcement, increases the cooperation, and requires that police are avail-
able to help each other at any time.
It is essential that children who use the internet are protected as well. Adults
should monitor what sites the child goes to and the time they spend on the sites.
If they spend a longer time on some sites, it could indicate a problem and should
be noted. If porn is found on a computer, it could be a possible sign that the child
has had contact with a pedophile. Adults should be cautious if the child turns
the computer monitor off quickly or changes the screen if an adult enters the
room.
While it is impossible to prevent a cybercrime from occurring, precautions such
as these can reduce the impact of a cyberattack or lessen the chances that an attack
will occur.

additional layer of privacy to customers using them, but cryptocurrency transac

tions are still able to be traced by law enforcement and others with the proper
tools.

PROFITS FROM CYBERCRIME

Cybercrime provides high returns with a low risk for offenders. There is a signifi-
cant amount of money that can be made through the commission of crimes com-
mitted via the internet. When it comes to cybercrimes, there are very low costs
with a potentially very large profit, and few offenders are caught and punished for
the acts. It has been estimated that the total global impact of cybercrime is around
$3 trillion (Khimji, 2015).
It is often difficult to track the source of a cyberattack. The offender(s) could be
located in a different country where the laws are different, and cooperation with
law enforcement may be difficult. Offenders are well organized and know what
they want or need to do. Many cyber-attacks are committed by highly organized
international crime groups, many of whom have developed relationships with
drug cartels and terrorist cells (Dethlefs, 2015). Cybercriminals are often able to
carry out an attack and move to a different location to evade authorities.
Because so many cybercrimes go unreported, it is difficult to know the exact
costs of these crimes. Company officials either choose not to report a crime because
they fear the effect it could have on their business, or they may be unaware that an
attack occurred. Cybercrime has become a cost of doing business; they occur often
and have a major impact on businesses. In 2013, the U.S. government notified
3,000 companies that they had been hacked (Center for Strategic Studies, 2014).
For companies, especially small companies, a cyberattack can be devastating.
The average cost of a corporate data breach is estimated to be about $5.9 million,
and the cost of lost business from a breach averages $3.2 million (Dethlefs, 2015).
A report by Hewlett Packard and Ponemon Institute of Cybercrime indicates that
the average American firm pays $15.4 million a year on hacking attacks (Ponemon,
2016). Companies have to pay for preventative measures to lessen the chances that
they will become a victim, such as improving security. In the event that an attack
occurs, companies may suffer loss of financial assets. They will also have to pay
costs of recovering from the attack and costs related to damage done to the com-
pany’s reputation. The costs of recovering from attacks is increasing as the attacks
become more common and more complex.
Cybercrime has become more profitable than global trade in drugs, includ-
ing marijuana, cocaine, and heroin combined (Khimji, 2015). The revenues from
cybercrime are often greater than revenues from legitimate small or mid-size com-
panies. Profits from cybercrime are estimated to be about $200 billion every year
(McGuire, 2018). This comprises general earnings from illicit and illegal online
sales of goods ($860 billion), intellectual property theft ($500 billion), data trading
P r o f i t s f r o m C y b e r c r i me 345

($160 billion), crimeware-as-a-service ($1.6 billion), and ransomware ($1 billion)

(McGuire, 2018). Put another way, if cybercrime were a country, it would have the
13th-highest gross domestic product (GDP) in the world. Individually, it is esti-
mated that an average hacker will earn around $30,000 a year from their activities.
There is no doubt that the costs of cybercrime will increase in the future. An
increasing number of businesses rely on the internet for sales and customer rela-
tions. In addition, more consumers are purchasing goods online. The increase in
retail marketing and sales opens up more opportunities for theft and fraud. More-
over, it is becoming easier to launch an attack. Cyber criminals can easily purchase
the software needed to carry out a cybercrime—they do not need to know how
to write it themselves. To make matters worse, the average price of launching a
distributed DDoS attack has decreased recently. It now will cost an offender about
$38 per hour to carry out an attack (Griffiths, 2015).
It is essential that information on cyber threats and crimes is collected and
tracked in order to watch trends, and also to possibly prevent attacks. In some
countries, companies are not required to report data breaches when they occur,
so many companies will not contact officials. They don’t want the public to know
about a possible breach. This means that the data regarding crimes is incomplete
and inaccurate. In order to improve policies and response to crimes, all offenses
must be reported.

Jarvis, K. 2014. “Cryptolocker ransomware, 2013.” www.secureworks.com/cyber-threat

-intelligence/threats/cryptolocker-ransomware.
Sharp, Alastair. 2017. “Cyber extortion demands surge as victims keep paying: Syman-
tec.” Reuters, April 26, 2017. https://www.reuters.com/article/us-cyber-ransom/cyber
-extortion-demands-surge-as-victims-keep-paying-symantec-idUSKBN17S1U6.

R E P U TAT I O N , E F F E C T S O N
One of the harms that can be inflicted on victims of cybercrime is reputational
harm. The type of harm suffered by human victims differs from the harm suffered
by organizational victims. Cybercrime can also have an effect on the reputation of
the cybercriminals that commit it.
Reputational harm to people based on online activity is a widely-shared con-
cern. One study found that just under half (45%) of people believed that one’s
reputation could not recover from negative information posted online—be that
posting the result of criminal activity or otherwise (Norton, 2010). There are some
cybercrimes where the harm is specifically the posting of information harmful to
another person. This includes revenge porn and the related crime of sextortion.
Revenge porn is where a cybercriminal makes sexually explicit photographs or
video of someone else available online without that person’s permission. Sextortion
is where a cybercriminal threatens to post revenge porn of someone unless that
person pays the cybercriminal or otherwise provides them something of value. If
such photographs or video is posted online, it can damage the reputation of the
person depicted in those photographs or that video. Just the fact that pictures or
video depicting the victim in such a fashion exists can potentially damage the rep-
utation of the person depicted. One study found that only one-third of victims of
sextortion told anyone that they had been so victimized, and even fewer—only 16
percent—reported the incident to law enforcement (Wolak and Finkelhor, 2016).
Among the reasons given for this lack of reporting are shame and embarrassment.
Another online behavior that, by itself, is not necessarily criminal but can lead
to criminal activity (and reputational harm) is doxing. Doxing is where some-
one posts online the personally identifying information of someone else, such as
their contact information. Doxing can harm the reputation of the person targeted.
This can be seen in the incident known as Gamergate, which started in 2014.
As part of this incident, several women were doxed by hackers. As a result of
the doxing, these women received death threats and threats of rape (McDonald,
2014; Quinn, 2017). Their reputations were also tarnished. For example, the rep-
utation of Zoe Quinn—an independent video game developer doxed as part of
Gamergate—suffered after allegations were leveled against her that she slept with
a video game reviewed to improve the review given to her game (Quinn, 2017).
Organizations can also suffer reputational harm if they are the victims of cyber-
crime. Much as doxing can result in reputational harm for a human victim, leaked
information can also cause reputational harm for an organizational victim. This can
be seen with Edward Snowden’s leak of the Prism program to the public. Under the
Prism program, the NSA is able to collect information from technology companies
354 Rep u tat i o n , E f f e c t s o n

that it feels will be helpful in counterterrorism efforts. According to the leaks by

Snowden, the NSA had direct access to the servers of several large technology
companies, such as Microsoft, Apple, Google, and Yahoo. The reputation of the
NSA was impacted by this revelation, as were the reputations of the technology
companies who were seen to be cooperating with the NSA. Those companies took
measures to try and assure customers that customer privacy was a key concern for
them as a means to rehabilitate that reputation (Hautala, 2016).
As can be seen in the example above, for business victims, reputational harm
can result in actual economic harm for them. It is not just information leaks that
cause this problem for business victims. Cyberattacks in general cause problems
for business victims as well. When a business suffers a cyberattack, it may gain a
reputation for being vulnerable to attacks, which can lower consumer confidence
in that business. Cyberattacks can lower the valuation of a business and its stock
prices (Bose and Leung, 2014; Goel and Shawky, 2009; Pirounias et al., 2014;
Spanos and Angelis, 2014).
Commission of cybercrime can also have an impact on one’s reputation. Those
who are convicted of crimes—cybercrimes included—face the stigma of being
labeled a criminal. However, with cybercrime, the level to which this stigma
attaches can vary from country to country. One study found that cybercriminals are
less likely to be stigmatized in countries were internet accessibility is low and the
resources devoted to fighting cybercrime are low (Kshetri, 2010). In some coun-
tries, express or tacit approval of cybercrime may have an impact on the level of
reputational harm suffered by cybercriminals. For example, China has policies in
place that appear to encourage intellectual property theft by its citizens (Commis-
sion on the Theft of American Intellectual Property, 2017). In Russia, cybercrimi-
nals appear to be able to avoid apprehension as long as they focus their criminal
efforts on foreign targets (Maurer, 2018).

Instagram. 2018. “What should I do if someone shares an intimate photo of me without

my permission?” Instagram. https://help.instagram.com/1769410010008691?helpref
=search&sr=1&query=revenge%20porn
Lee, Henry K. 2012. “Woman, man charged in Mark Jackson extortion case.” San Fran-
cisco Chronicle, June 29, 2012. https://www.sfgate.com/warriors/article/Woman-man
-charged-in-Mark-Jackson-extortion-case-3672018.php
National Crime Agency. 2018. “Record numbers of UK men fall victim to sextortion gangs.”
http://www.nationalcrimeagency.gov.uk/news/1360-record-numbers-of-uk-men-fall
-victim-to-sextortion-gangs
Reddit. 2018. “Do not post involuntary pornography.” https://www.reddithelp.com
/en/categories/rules-reporting/account-and-community-restrictions/do-not-post
-involuntary-pornography
Romano, Aja. 2018. “Facebook’s plan to stop revenge porn may be even creepier than
revenge porn.” Vox, May 24, 2018. https://www.vox.com/2018/5/23/17382024
/facebook-revenge-porn-prevention
Solon, Olivia. 2017. “Facebook asks users for nude photos in project to combat ‘revenge
porn.’” The Guardian, November 7, 2017. https://www.theguardian.com/technology
/2017/nov/07/facebook-revenge-porn-nude-photos
Twitter. 2018. “About intimate media on Twitter.” https://help.twitter.com/en/rules-and
-policies/intimate-media
Wolak, Janis, and David Finkelhor. 2016. Sextortion: Findings from a survey of 1,631 victims.
Durham, NH: Crimes against Children Research Center.

ROOTKIT
A rootkit is malware that is able to disguise its existence on an infected computer. It
does so by hiding existence of various elements—files, processes, network connec-
tions, and so on—from other programs on the computer or from the computer’s
operating system (Goncharov, 2012). Rootkits generally try to hide these elements
from antivirus software and similar security tools (Kaspersky, 2013). By doing so,
a rootkit can not only avoid detection but can also avoid being removed from the
infected computer.
A rootkit itself conceals the presence of malware. The payload of the rootkit
can vary. Additional malware that may be included as a payload include keystroke
monitors, spyware and bots. Rootkits commonly allow a cybercriminal to surrepti-
tiously access the infected computer (Kaspersky, 2013).
There are two general categories of rootkits: rootkits that operate at the applica-
tion (user) level and rootkits that operate at the kernel level (Goncharov, 2012;
Kaspersky, 2013). Application-level rootkits tend to be more common. These root-
kits operate by modifying applications (software) on a computer. As long as the
operating system of a computer has not been infected by a rootkit, the operating
system may be able to detect a rootkit operating at the application level (Shakarian
et al., 2013). Accordingly, cybercriminals may attempt to use a rootkit that can
affect the operating system of a computer, namely a kernel-level rootkit. A kernel
is the part of a computer’s operating system that communicates with the com-
puter’s hardware. The kernel manages aspects of the operating system that are
358 Russia

necessary for it to function properly, such as data storage and memory (Santana,
2017). A kernel-level rootkit gives a cybercriminal more control over the functions
of a computer. Because a kernel-level rootkit can modify the operating system
of a computer and not just a single application on the computer, it is also better
able to avoid detection and removal (Shakarian et al., 2013). Kernel-level rootkits
are generally more complex pieces of malware and are thus less common than
application-level rootkits (Kaspersky, 2013). However, where these are available
via black markets online, they may not be as rare as they once were (Goncharov,
2012; Shakarian et al., 2013). For a computer infected with a kernel-level rootkit,
it may be necessary to reinstall the operating system on the computer to get rid of
it (Kaspersky, 2013).
Another type of rootkit that is not as common as the rootkits mentioned above
is a bootkit. As noted above, it is sometimes necessary to reinstall the operating
system on the computer to get rid of it. A bootkit infects and modifies a computer’s
boot loader. A boot loader is the program on a computer that loads the operating
system. Accordingly, it runs before an operating system runs. Thus, if a bootkit
is installed on a computer, reinstalling the operating system may not get rid of it
(Goncharov, 2012; Kaspersky, 2013).

See also: Bots and Botnets; Keystroke Monitoring; Malware; Payload; Spyware

Further Reading
Goncharov, Max. 2012. “Russian underground 101.” Trend Micro Incorporated. h ttps://
www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp
-russian-underground-101.pdf
Kaspersky. 2013. “What is a rootkit and how to remove it.” Kaspersky, March 28, 2013.
https://usa.kaspersky.com/blog/rootkit/1508/
Santana, Mario. 2017. “Eliminating the security weakness of Linux and UNIX operating
systems.” In Computer and information security handbook, 3rd Edition, edited by John
R. Vacca. Cambridge, MA: Elsevier.
Shakarian, Paulo, Jana Shakarian, and Andrew Ruef. 2013. Introduction to cyber warfare: A
multidisciplinary approach. Waltham, MA: Elsevier.

RUSSIA
Cybercrime is an issue in Russia just as it is in the United States. Research in 2017
indicated that over one-third of Russians had been the victims of a cybercrime (Mos-
cow Times, 2017). The policies and practices of the Russian government with regard
to cybercrime enforcement, however, would appear to encourage cybercriminals to
commit cybercrimes against foreign targets rather than domestic targets. Evidence
suggests that Russia tends to not concern itself with the apprehension of cyber-
criminals who attack foreign targets, whereas those who attack domestic targets
risk apprehension (Maurer, 2018). It would appear that Russian cybercriminals are
aware of this. For example, in 2018, 36 defendants from around the world were
indicted in the United States for their roles in the Infraud Organization—a cyber-
crime organization that trafficked in personally identifying information of victims,
Russia 359

financial account information of victims, and malware (United States Depart-

ment of Justice, 2018a). The Infraud Organization website was hosted in Russia.
In 2011, the website’s founder prohibited trafficking of information belonging to
Russian victims. It appears that Russia did not assist the United States in bringing
down the Infraud Organization (Carlin and Newman, 2018). Additionally, there is
evidence that some Russian-made malware is designed to avoid attacking comput-
ers of Russian residents, and some websites that install spyware as a paid service
refuse to install it on Russian computers (Maurer, 2018).
Russia has a fairly established cybercrime black market. In 2006, the Russian
Business Network (RBN) was established. The RBN was an ISP based in Russia.
The RBN initially hosted legitimate websites. However, it soon hosted almost
exclusively (if not entirely exclusively) websites engaged in cybercrime. It pro-
vided bulletproof hosting—hosting that will continue even if the website in ques-
tion is involved in illegal activities. At the time, it was estimated that the RBN was
responsible for 60 percent of all cybercrime worldwide. The RBN went offline in
2007 (Warren, 2007). The cybercrime black market in Russia, however, still exists.
The current cybercrime black market operates much like a legal market and caters
to numerous cybercrime needs (Goncharov, 2012; Steadman, 2012). The goods
and services available for purchase in that market include DDoS attacks, spam-
ming, and rootkits. Prices vary depending on the good or service sought. A rootkit,
for example, can cost around $500. Services vary depending on the needs of the
customer. Spam services can be relatively inexpensive. Some spam services will
distribute one million e-mails for as little as $10. DDoS attacks can be inexpensive
as well. You can purchase the shutdown of a website for a full day for as low as
$30. If you wish to shut down a website for a longer period of time, it can get more
expensive. To shut a site down for a month would cost about $1,200 (Goncharov,
2012). The relatively low cost of many cybercrime goods and services enables
more people to engage in cybercrime (Barbaschow, 2017).
Russia itself has carried out numerous cyberattacks against foreign entities.
From 2006 to early 2019, Russia carried out just under 100 cyberattacks against
foreign entities—second only to China. The countries attacked include the United
States, Germany, Estonia, Georgia, and Ukraine (Center for Strategic and Inter-
national Studies, 2019). There are two methods by which Russia tends to carry
out state-sanctioned cyberattacks against foreign entities. First, there are instances
when state officials carry out the attack. This can be seen in a U.S. indictment
against members of the Russian GRU. This case stemmed from an antidoping
investigation into Russian athletes that arose around the Sochi Winter Olympics
in 2014. That investigation found there was a state-sponsored system in place in
Russia to circumvent testing for banned substances in their athletes.
From 2014 to 2018, seven officers in the GRU hacked into the networks of sev-
eral foreign entities for the purpose of gathering information that could be used to
spread disinformation about the antidoping investigation. The goal was to discredit
the investigation (United States Department of Justice, 2018b). In another instance
of state-sponsored hacking, three of the officers involved in the cyberattacks above
were also involved in the hack of Democratic National Committee (DNC) e-mails
360 Russia

in the United States prior to the 2016 presidential election in the United States (U.S.
News, 2018). The other tactic Russia uses to perpetrate state-sponsored cyberat-
tacks is the use of existing cybercrime organizations. In those instances, Russia will
use nonstate actors to carry out cyberattacks on behalf of the Russian government.
There are advantages to this system. It creates ambiguity when authorities attempt
to track down the offender. Investigators may be unable to clearly tie the attack of
a private actor working for Russia back to Russia itself. This ambiguity provided
Russia with plausible deniability with regard to these cyberattacks (Cybereason
Intel Team, 2017).
In some instances, those carrying out cyberattacks for Russia may be compelled
to do so. This can be seen in the Yahoo data breach in 2014. In that case, Russian
operatives hacked into Yahoo and stole the personal information of over 500 mil-
lion customers. In that case, Russian operatives worked with two cybercriminals:
Alexsey Alexseyevich Belan and Karim Baratov. It appears Belan agreed to work
with Russian officials to avoid arrest and extradition by those officials on prior
cybercrime charges out of the United States and Europe. Oleg Gordievsky, the
former head of the KGB’s London office, indicated in 1998 that such arrange-
ments are made by the Russian government with apprehended cybercriminals. For
other cybercriminals, they may agree to cooperate with the Russian government
for economic benefit. In the Yahoo data breach, Baratov appears to have cooper-
ated for this purpose (Maurer, 2018). While there are advantages to outsourcing
cyberattacks, there is evidence to suggest that Russia’s ability to control the private
cybercriminal groups they use is lessening. The incentives that can be offered to
cybercriminals by Russia decrease as cybercrime becomes more global and incen-
tives from other sources increase (Cybereason Intel Team, 2017).
One type of cyberattack that Russia has used with some frequency is misin-
formation campaigns. As was mentioned above, Russia engage in such an attack
to discredit the investigation into Russia’s athlete doping program. Perhaps the
best-known misinformation campaign perpetrated by Russia involved the 2016
presidential election in the United States. Leading up to the presidential election in
2016, Russia engaged in misinformation campaign with the goal of creating discord
within the political system in the United States and influencing the 2016 presiden-
tial election. This was done through the IRA. Members of the IRA used fabricated
social media accounts—on sites like Facebook, Instagram, and Twitter—through
which they claimed they were activists in the United States. These accounts some-
times falsely claimed affiliation with actual political organizations within the United
States, such as the Tennessee GOP. Additionally, social media advertisements were
also purchased by the IRA under the names of persons and other entities in the
United States. This misinformation campaign was accompanied by cyberattacks
on the computers of presidential candidate Hilary Clinton, wherein information
was stolen and publicly released (Mueller, 2019). The United States is not the
only country that has been attacked by Russia with a misinformation campaign. In
2017, Sweden was also target by Russia. It appears that Russia spread false docu-
ments and other misinformation with the intent of weakening public support for
policies in Sweden (Center for Strategic and International Studies, 2019).
Russia 361

Russia has also been the target of cyberattacks from other countries. Russia and
Russian industries have been targeted by China, North Korea, and countries in the
Middle East. The United States also announced in 2018 that it targeted Russian
cyberoperatives it feared might try to interfere in the 2018 election in the United
States. The United States stated this was a deterrence measure (Center for Strategic
and International Studies, 2019).

RUSSIAN BUSINESS NETWORK

The Russian Business Network (RBN) was an ISP based in Russia. It was estab-
lished in 2006. When the RBN started, it initially hosted many legitimate websites.
However, it soon began hosting websites that were engaged in cybercrime. A study
scanned all the internet addresses registered to the RBN at one point and found
that every single website was involved in some criminal enterprise. While it was
in operation, it was estimated that the RBN was responsible for 60 percent of all
cybercrime worldwide (Warren, 2007).
Getting the RBN to host a website was not straightforward. The RBN did not
have a homepage through which the administrators could be contacted. Contact
with administrators had to be accomplished by sending them an instant message
or through specified online forums that were Russian language–based. Those wish-
ing to have their website hosted through RBN would also have to prove to the
administrators that they were neither law enforcement officers nor working with
law enforcement. This generally required the applicant to demonstrate they were
involved in the theft of financial and personally identifying information of victims
(Krebs, 2007).
One of the draws of the RBN for cybercriminals was the bulletproof hosting it
provided. Bulletproof hosting is website hosting that continues despite law enforce-
ment efforts to shut the website down or complaints made to RBN. This permit-
ted cybercriminals to function without interruption. Bulletproof hosting came at
a cost. The RBN charged $600 a month to have a website hosted—approximately
10 times as much as website hosting through a traditional ISP would have cost at
the time (Krebs, 2007). Exactly how the RBN was able to provide such services
without being shut down by Russian law enforcement is not known. However,
there are some factors that likely contribute to their ability to provide the service.
Those operating on the RBN tended to not target Russian citizens when carrying
out cybercrimes, thus avoiding local attention. There were allegations that the RBN
had ties to the Russian government. The creator of the RBN—known online as
Flyman—is believed to be the nephew of a prominent Russian politician (Warren,
2007). There were also allegations that bribery of government officials may have
taken place (Krebs, 2007).
Prosecuting the RBN proved difficult when it was in operation. As an ISP, it was
not technically involved in cybercrime. It simply hosted websites that were engaged
in cybercrime (Krebs, 2007). The RBN itself essentially made this argument when
defending against claims that it was responsible for a substantial amount of cyber-
crime around the world. The RBN claimed that no more cybercrime happened on
R u s s i a n B u s i n e s s Ne t w o r k 363

its network than any other ISP (Singel, 2007). It also claimed that it addressed
complaints of criminal activity taking place on its network promptly. There is some
indication that the RBN would take down websites engaged in criminal activity
and technically comply with efforts to remove criminal content from its network,
but those websites would be back online the next day (Singel, 2007).
The RBN was fairly short-lived. It ceased operations in 2007. In November of
that year, the RBN attempted to move its operation from servers in St. Petersburg,
Russia, to servers in China. This occurred as the RBN was attracting attention from
various cybersecurity groups who were trying to track down those behind the
RBN. The attempted move was unsuccessful, and the RBN essentially disappeared
at that point (Warren, 2007). However, there is evidence to suggest that members
of the RBN are still engaged in the same activities as they were when the RBN was
still operating, albeit under different names. These activities include offering bul-
letproof hosting for cybercriminal operations (Leyden, 2017).

to cybercriminals. That information was obtained by CardersMarket in part by

stealing it from other websites that already had the information for sale (Poulson,
2009). Max Vision—the site’s founder—was ultimately sentenced to 13 years in
prison and ordered to pay $27.5 million in restitution (Poulsen, 2010).
The Secret Service has worked with law enforcement in other countries when
investigating cybercrime. In 2018, the Secret Service and other U.S. law enforce-
ment agencies worked with law enforcement in Canada, Indonesia, Malaysia,
Mauritius, Nigeria, and Poland in Operation Wire Wire. Operation Wire Wire
investigated hackers involved in business e-mail compromise schemes—attacks
where corporate e-mail accounts are compromised in order to fraudulently wire
money from those businesses to cybercriminals. The operation resulted in the
arrest of 74 people internationally, 42 of whom were arrested in the United States
(United States Department of Justice, 2018).
Another international investigation was conducted by the Secret Service in 2019.
That year, the Secret Service arrested individuals—primarily from Romania—for
defrauding victims in the United States through the use of fictitious auctions on
eBay and other sites. The cybercriminals would advertise items for sale that did not
exist. They would then accept the money from the victims and never deliver the
goods (United States Department of Justice, 2019).
Another cybercrime threat faced by the financial system is cryptocurrency.
Because cryptocurrencies offer some level on anonymity to the user, they are often
used by cybercriminals to launder money. Indeed, the cybercriminals in the auc-
tion fraud case mentioned above used cryptocurrency to launder the fraudulently
obtained proceeds of the auctions to coconspirators in Romania (United States
Department of Justice, 2019). The Secret Service has been able to essentially shut
down two cryptocurrencies through their efforts—e-Gold and Liberty Reserve
(United States Secret Service, 2017). The Secret Service has asked the U.S. Con-
gress for legislative assistance in regard to cryptocurrency, advocating additional
regulations that would allow law enforcement to combat the anonymity afforded
by many cryptocurrencies (Stanley, 2018).
In addition to investigating cybercrimes, the Secret Service operates the National
Computer Forensic Institute. The Institute provides cybercrime training to law
enforcement and court personnel (House Committee on Oversight and Govern-
ment Reform, 2015).
One of the key responsibilities of the Secret Service is the protection of the
president of the United States. This responsibility was informally undertaken at
first. In 1894, President Grover Cleveland asked for the Secret Service to provide
protection for him. Following the assassination of President William McKinley in
1901, the U.S. Congress formally gave the responsibility of presidential protection
to the Secret Service and provided it funding to do so in 1906. Since that time, the
scope of protection the Secret Service is to provide has extended to the vice presi-
dent, former presidents, major presidential and vice presidential candidates, and
the immediate families of those persons. A 2015 governmental report suggested
that the investigative roles of the Secret Service were cutting into its ability to pro-
vide adequate protection to the president and others it was tasked with protecting
368 Se x t i n g

(House Committee on Oversight and Government Reform, 2015). It suggested

that the Secret Service shed—at least in part—its cybercrime and other investiga-
tive responsibilities to have the ability to focus on its protective mission. The report
noted the potential overlap in responsibilities in cybercrime investigations that can
happen at the federal level. Numerous federal agencies are involved in cybercrime
investigations in addition to the Secret Service. These include the FBI; Immigra-
tion and Customs Enforcement (ICE); the Bureau of Alcohol, Tobacco, Firearms,
and Explosives (ATF); the Federal Trade Commission (FTC); the Securities and
Exchange Commission (SEC); and Postal Inspection Service. The report notes that
if the cybercrime investigative functions of some of these agencies were consoli-
dated, it would be a more efficient use of resources.

photograph would likely be a crime under a state or federal child pornography

statute.
There are situations where one minor will send another minor a sexually explicit
photograph of himself or herself. One study indicates 4 percent of teens with a cell
phone have sent a sexually suggestive nude or nearly nude photograph of them-
selves and that 15 percent of teens with a cell phone have received such a photo-
graph (Lenhart, 2009). Another study indicates 2.5 percent of teens have sent or
appeared in a nude or nearly nude photograph and that 7.1 percent had received
such a photograph (Mitchell et al., 2012). Those numbers drop when considering
photographs that did not merely contain nudity but are also of a sexually explicit
nature. One percent of teens indicated they had appeared in or sent a sexually
explicit photograph, and 5.9 percent indicated they had received such a photo-
graph (Mitchell et al., 2012).
One sexting case in Washington resulted in three minors being charged. In 2010,
the photograph of a naked 14-year-old girl was circulated among students at the
girl’s middle school as well as at other schools. The picture was initially sent to her
boyfriend, but after the couple broke up, her boyfriend sent the picture to another
girl. That girl and one other girl widely disseminated the picture from there. The
boyfriend and the two girls were charged with distribution of child pornography,
as no specific sexting statute was in place as the time (Pawloski, 2010). It appears
this was done maliciously and thus fits the profile of revenge porn. One of the girls
who disseminated the photograph sent it with the caption, “Ho Alert! If you think
this girl is a whore, then text this to all your friends.” The three teens ultimately
pled guilty to misdemeanor charges of telephone harassment (Hoffman, 2011).
Given the prevalence of sexting among minors, several states have enacted laws
to address the situation. Twenty-two states currently have laws that address sexting.
The majority of these statutes treat the offense as a misdemeanor. New Mexico’s
sexting statute is unique in that minor-to-minor sexting is exempt from crimi-
nal liability. For those states that have not passed specific sexting laws (and even
among those that have), child pornography laws may still apply to minors who
send or receive sexually explicit pictures, as it did in the Washington case above.
While sexting between two consenting adults is not generally going to be crimi-
nal, sexting between an adult and a minor would be. This behavior would not fall
under a state sexting statute, as those statutes are generally designed to regulate the
sending of sexually explicit pictures between minors. Rather, an adult engaging in
such behavior could be charged with child pornography and similar offenses. One
case involving the sending of sexually explicit images and messages between an
adult and a minor is the case of Anthony Weiner, a former U.S. congressman from
New York. In that case, Weiner solicited a girl whom he knew to be 15 years old to
send images of herself to him in sexually suggestive positions. Weiner pled guilty
to transferring obscene material to a minor for his sexually explicit communica-
tions. He was sentenced to 21 months in prison (Herbst, 2017).
While sexting can have consequences in the criminal justice system, there can
be other consequences from sexting. As noted above, what might start as a consen-
sual sharing of sexually explicit pictures between minors can sometimes devolve
370 Silk Road

into a situation when those pictures are shared as revenge porn. This can have a
significant emotional impact on the person in the pictures. There are at least two
instances—one in 2008 and the other in 2009—where this has resulted in the
minor depicted in the pictures committing suicide (see Celizic, 2009; Kaye, 2010).

what are known as a “bug bounty”—a monetary reward provided to a freelance

hacker for discovering a bug in an organization’s network security that was previ-
ously unknown (Bergal, 2018). For organizations simulating cyberattacks against
itself, the simulations will sometimes extend beyond just testing for programming
bugs. One potential weak link in cybersecurity is human beings. A common tactic
used by cybercriminals to infiltrate a computer network is phishing—fraudulently
eliciting personal information from personnel authorized to access the computer
network in question. That personal information can be used by a cybercriminal to
gain access to the computer network themselves. In one simulation, the Royal Bank
of Scotland conducted a simulation whereby it launched phishing attacks against
its employees. The simulation helped the bank identify employees who were sus-
ceptible to phishing attacks. The bank was then able to train those employees on
phishing attacks. This reduced the success rate of phishing attacks on the bank by
78 percent (Waugh, 2019).

Nishiuchi and Chikaraishi, 2018). Some countries—such as Germany, Norway,

and Switzerland—use smart cards as a form of identification for citizens (Poller
et al., 2012). Smart cards have also been used in key cards to access buildings
(United States General Accounting Office, 2003). Just as with EMV cards, smart
cards used for other functions do have increased security features compared to
magnetic strip–based cards. This does not make them invulnerable to attacks from
cybercriminals; the information on these cards could be used to the victim’s detri-
ment just as having their financial information could. Key cards could be used by
cybercriminals to access buildings they are unauthorized to access, and they can
then commit theft or other crimes therein. Government identification cards have
personally identifying information on them that could be used by a cybercriminal
to defraud a victim. Having other personal information about a victim—such as
their health care status and travel patterns—would be an invasion of privacy at
least, and could be potentially be used for various criminal purposes, such as stalk-
ing, extortion, and insurance fraud.
These privacy concerns lead some who develop systems that use chip-based
cards to implement additional features to prevent an invasion of privacy. However,
in some instances, these increased security measures can create unintended vul-
nerabilities. For example, one feature of German chip-based citizen identification
cards is the lack of a unique authentication key—a feature implemented to prevent
the identification of card users by a unique key through the authentication process.
Instead, a batch of cards is given identical authentication keys so the key cannot be
tied to one user. While this affords an added level of privacy to users, it does make
it easier for cybercriminals to use cloned citizen identification cards. If a cybercrim-
inal is able to clone an authentication key, a system authenticating the card with a
cloned key would not be able to detect it as a clone, as the system is designed to
accept multiple copies of the same authentication key (Poller et al., 2012).

See also: Credit Card Fraud; Personally Identifying Information; Privacy; Skimmer;
Vulnerability

Further Reading
Chang, Ellen. 2018. “This new chip-theft scam will blow your mind.” Experian, April 24,
2018. https://www.experian.com/blogs/ask-experian/this-new-chip-theft-scam-will-bl
ow-your-mind/
Eddy, Max. 2019. “How to spot and avoid credit card skimmers.” PCMag, February 6,
2019. https://www.pcmag.com/article/328010/how-to-spot-and-avoid-credit-card-ski
mmers
Elkins, Kathleen. 2015. “Why it took the US so long to adopt the credit card technol-
ogy Europe has used for years.” Business Insider, September 27, 2015. https://www
.businessinsider.com/why-it-took-the-us-so-long-to-adopt-emv-2015-9
EMVCo. 2014. “A guide to EMV chip technology.” Version 2.0. EMVCo. https://www
.emvco.com/wp-content/uploads/2017/05/A_Guide_to_EMV_Chip_Technology_v2
.0_20141120122132753.pdf
EMVCo. 2019. “Worldwide EMV deployment statistics.” EMVCo. https://www.emvco.com
/about/deployment-statistics/
378 Sniffer

Espinoza, Catalina, Marcela Munizaga, Benjamin Bustos, and Martin Trepanier. 2018.
“Assessing the public transport travel behavior consistency from smart card data.”
Transportation Research Procedia 32: 44–53.
Hansen, Margaret M. 2008. “Smart card technology and healthcare information: A dynamic
duo.” The University of San Francisco. https://repository.usfca.edu/cgi/viewcontent.cgi
?article=1009&context=nursing_fac
Nishiuchi, Hiroaki, and Makoto Chikaraishi. 2018. “Identifying passengers who are at
risk of reducing public transport use: A survival time analysis using smart card data.”
Transportation Research Procedia 34: 291–298.
Poller, Andreas, Ulrich Waldmann, Sven Vowe, and Sven Turpe. 2012. “Electronic identity
cards for user authentication—Promise and practice.” IEEE Security & Privacy 10, 1:
46–54.
United States General Accounting Office. 2003. Progress in promoting adoption of smart card
technology. https://www.gao.gov/assets/240/236767.pdf

SNIFFER
A sniffer (sometimes referred to as a packet sniffer or network sniffer) is software
that allows one to view the data that travels across a computer network. The soft-
ware records the data flowing through the network and puts that data in a readable
format. It does not interfere with the data through this process (Mitchell, 2019).
Sniffers can be used by cybercriminals to capture personally identifying informa-
tion transmitted across a computer network. This includes the usernames and
passwords of a victim, a victim’s credit card number, and a victim’s social security
number—all forms of identity theft. This information can then be used to defraud
the victim out of money.
Although sniffers can be used maliciously by cybercriminals, they would not be
considered malware. There are legitimate uses for a sniffer. A network administra-
tor can use a sniffer to log and analyze network traffic. Analyzing network traffic
helps one determine where bottlenecks in network traffic are occurring so those
bottlenecks can be resolved. A sniffer can also be used to diagnose connectiv-
ity issues between different computers on the network. Past records kept from a
sniffer can be used to help recover the username and password of an authorized
network user who has forgotten one or both. Additionally, a sniffer could be used
to identify those who are using the network but are unauthorized to do so (Ansari
et al., 2003).
There are ways to protect against sniffing by cybercriminals. For network admin-
istrators and others who oversee a network, sniffer detection software can be used
to determine is a sniffer is operating on the network. For individuals using a net-
work, the use of a VPN—software that encrypts internet traffic before being trans-
mitted over a network—can be used. In such an instance, the data sent can still
be captured by sniffer, but the cybercriminal will be unable to read the encrypted
data without additional resources to decipher the encryption (Ansari et al., 2003;
Mitchell, 2019). Use of Tor—software that can also be used to anonymize one’s
internet traffic—can potentially be used. Tor works differently than VPNs. Tor
utilizes a network of computers, known as nodes. Tor picks a random path of
S n o w d e n , E d wa r d 379

these nodes to go through when a user accesses a server. Tor does use encryption
through this process. However, when a Tor user does ultimately connect to its
intended network from the exit node—the last node in the chain of random nodes
the user was processed through—the operator of that exit node can potentially
view the internet traffic of that Tor user. Thus, if an exit node operator (all of whom
are volunteers) wants to use a sniffer on the traffic passing through their exit node,
they could (Franceschi-Bicchierai, 2015).
Although sniffing generally refers to the monitoring of network traffic, the con-
cept is being expanded to other technological areas. In 2018, Amazon filed a pat-
ent that included a “voice sniffer algorithm” that could be used by certain Amazon
products with a smart-speaker to sniff and analyze conversations within range of the
device. Google has filed similar patents. As with network sniffers, there are legiti-
mate uses for such technology. It appears that Amazon and Google may use the voice
sniffer to assist in targeted advertising (Porter, 2019). Just as with network sniffers,
however, the technology could ultimately be used for malicious purposes, such as
a cybercriminal not only sniffing network traffic for personally identifying informa-
tion but also potentially sniffing conversions for personally identifying information.

See also: Identity Theft; Malware; Password; Tor (The Onion Router); Virtual Pri-
vate Network

Further Reading
Ansari, Sabeel, Rajeev S.G., and Chandrashekar H.S. 2003. “Packet sniffing: A brief intro-
duction.” IEEE Potentials 21, 5: 17–19.
Franceschi-Bicchierai, Lorenzo. 2015. “A researcher used a honeypot to identify malicious
Tor exit nodes.” Motherboard, June 26, 2015. https://motherboard.vice.com/en_us
/article/mgbdwv/badonion-honeypot-malicious-tor-exit-nodes
Mitchell, Bradley. 2019. “What is a network sniffer?” Lifewire, February 26, 2019. https://
www.lifewire.com/definition-of-sniffer-817996
Porter, Tracey. 2019. “Slaves to Google and Amazon—What happens when data reliance
gets out of hand?” Marketing, February 25, 2019. https://www.marketingmag.com.au
/hubs-c/feature-porter-slaves-algorithms-mk1901/

S N O W D E N , E D WA R D
Edward Snowden was born in Elizabeth City, North Carolina, on June 21, 1983. In
2006, despite not having a high school diploma, Snowden was hired by the U.S.
Central Intelligence Agency (CIA) to work on network security (Burrough and
Ellison, 2014). Shortly after hiring him, the CIA put Snowden through its secre-
tive school for those who specialize in technology. After completing the six-month
schooling, Snowden was placed on assignment in Geneva, Switzerland (Bamford,
2014). While on assignment, Snowden witnessed the inner workings of the CIA.
Given the nature of his job, he had top-secret security clearance and thus had
access to inside information (Burrough and Ellison, 2014). What he saw con-
cerned him, though he did not act on that concern at the time (Bamford, 2014).
He left employment with the CIA in 2009. Although there is disagreement as to
380 S n o w d e n , E d wa r d

exact reasons why Snowden left, it seems apparent that Snowden was not happy
about leaving (see Burrough and Ellison, 2014).
Later in 2009, Snowden found employment with Dell. He initially was assigned
to work out of Yokota Air Base—just outside of Tokyo, Japan—with the U.S.
National Security Agency (NSA), one of Dell’s clients (Bamford, 2014; Burrough
and Ellison, 2014). His employment with Dell subsequently took him to Maryland
in 2011 and Hawaii in 2012. He continued to work with the NSA in Hawaii, ini-
tially as a contractor for Dell but ultimately as a contractor for company Booz Allen
(Bamford, 2014). It was while he was employed with Booz Allen that he disclosed
top-secret information about the NSA’s information-gathering efforts to the public.
The thought of leaking information pertaining to the United States’ intelligence
collection efforts was something that had been simmering with Snowden for a
while. He considered it when employed with the CIA in Geneva. However, he
decided against it because he believed that Barack Obama—who had recently been
elected president—would run intelligence gathering operations differently once he
took office (Bamford, 2014; Burrough and Ellison, 2014). During his subsequent
employment as a contractor for the NSA during President Obama’s time in office,
he observed that nothing had changed since he had worked for the CIA. While
working as a contractor for the NSA, Chelsea Manning—an intelligence analyst for
the United States army—leaked a substantial number of government documents.
These documents were released through WikiLeaks in 2010 and 2011. Although
the leaks were made anonymously, Manning’s identity was ultimately discovered.
Manning was held in custody starting in July 2010 and was eventually sentenced
to 35 years in prison in 2013. Seeing how Manning was treated did influence
Snowden, who was not eager to be similarly punished (see Burrough and Ellison,
2014). Despite this, Snowden began copying NSA files during this time, starting in
the summer of 2012, and began contacting potential journalists to leak the story
in December of that same year (Burrough and Ellison, 2014). It appears that what
pushed Snowden to finally act was the testimony of James Clapper—director of
national intelligence at the time—before a committee of the U.S. Senate. In his
testimony in March 2013, Clapper claimed that the NSA did not “wittingly” collect
information on United States citizens. Snowden believed Clapper was lying. Based
on what Snowden had observed, massive amounts of information were being col-
lected by the NSA. Snowden made plans at this point to leak confidential NSA
documents (see Bamford, 2014).
Snowden left Hawaii on May 18, 2013. He took a flight to Hong Kong and took
up temporary residence at a hotel in neighboring Kowloon. He reached out to vari-
ous journalists while in Kowloon. He contacted Glenn Greenwald with the Guard-
ian, Barton Gellman with the Washington Post, and documentarian Laura Poitras.
Greenwald and Poitras ultimately met Snowden at his hotel in Kowloon on June 3
of that year. Just a few days later, both the Guardian and the Washington Post began
publishing stories about the leaks (see Burrough and Ellison, 2014; Greenwald
and MacAskill, 2013). After the stories broke, Snowden went into hiding. Julian
Assange and Sarah Harrison—both with WikiLeaks—attempted to help Snowden
find a safe landing place. Assange had been granted asylum by Ecuador and was in
S n o w d e n , E d wa r d 381

the Ecuadoran embassy in London, avoiding apprehension and extradition him-

self. Although he was unable to come to Hong Kong to help directly, Harrison was
able to. Originally, plans were made for Snowden to seek asylum from Ecuador as
well. On June 23, Snowden boarded a flight out of Hong Kong to Moscow along
with Harrison. This was to be the first leg of a flight that would ultimately head
to Ecuador. However, he never left Russia and has remained there ever since (see
Burrough and Ellison, 2014). Russia has granted him a resident permit that is cur-
rently good through 2020 (Kramer, 2017).
The full extent of what Snowden leaked is not known. Investigators estimate
Snowden had access to roughly 1.7 million documents, with somewhere between
50,000 and 200,000 documents being disclosed to Greenwald and Poitras (Bur-
rough and Ellison, 2014). The exact content of those documents is not known,
either. There is some information that we know was contained in Snowden’s leaked
documents, such as information on Prism—the NSA program that gathered data
from technology giants such as Microsoft, Facebook, Apple, and Google (Bur-
rough and Ellison, 2014; Greenwald and MacAskill, 2013). There are other bits of
information that have been attributed to Snowden’s leaked documents that some
believe are from another as-yet-unidentified leaker, such as the fact that the NSA
was tapping the phone of German chancellor Angela Merkel (Bamford, 2014).
Opinions of Snowden vary widely. Many view him as a hero. Indeed, he has
been the recipient of numerous awards due to his leaking of documents, includ-
ing the Right Livelihood Award, the Bjørnson Prize, and the Stuttgart Peace Prize
(Courage Foundation, 2014a, 2014b, 2015). Others view him as a traitor, as evi-
denced by his outstanding criminal charges in the United States.
Snowden—if apprehended and extradited to the United States—faces crimi-
nal charges for alleged violation of the Espionage Act. If convicted, he could face
up to 30 years in prison (Kramer, 2017). There are many who believe Snowden
should be pardoned. One petition asking for Snowden’s pardon garnered over
a million signatures and was supported by the American Civil Liberties Union,
Human Rights Watch, and Amnesty International (Morris, 2017). Conversely,
many believe Snowden is a criminal and should be turned over to the United
States for prosecution. Despite calls for Russia to turn over Snowden by a former
acting director of the CIA (see Morell, 2017)—and Russia apparently giving some
consideration to the idea (McFadden and Arkin, 2017)—he still remains out of
custody in Russia.
In September 2019, Snowden released an autobiography, Permanent Record. The
United States filed a civil lawsuit against Snowden for publishing the autobiogra-
phy, which the Department of Justice said is in violation of CIA and NSA nondis-
closure agreements.

unsolicited advertisements (Anonymous, 2007; Fletcher, 2009). The first noted

instance was that of a dentist, Messrs Gabriel, sending an unsolicited advertise-
ment for his dentistry to British politicians (Anonymous, 2007).
Spam is often associated with unwanted e-mail, but spam can be any unwanted
electronic message. There are terms that refer to specific types of spam. Spit refers
to unwanted messages received via internet telephone (acronym: spam over inter-
net telephone), and spim refers to spam received via instant message (acronym:
spam over instant message).
Spam is a widespread problem. It has been estimated that 88 percent of e-mails
globally are spam (Rao and Reiley, 2012). The problem extends beyond the annoy-
ance caused by spam. It has been estimated that spam costs Americans $20 billion
annually (Rao and Reiley, 2012).
In the United States, the CAN-SPAM Act was passed in 2003 to combat the
problems brought about by spam. The Act requires companies that send out adver-
tisements via e-mail to disclose that the e-mail is an ad. It also requires companies
to allow people to opt out of receiving e-mails in the future. Violations of this law
can result in financial penalties for companies (Federal Trade Commission, 2009).
There can be criminal repercussions for spammers who use spam as a means
of committing some existing fraud, such as fraud and theft. An example of this is
the 2017 arrest of Peter Yuryevich Levashov—a Russian spammer who had been
operating for years. Levashov would offer to send out millions of spam messages
for his customers in exchange for money. The amount would vary depending on
the content of the spam. Spam for counterfeit goods would go for $200 a mil-
lion, where spam pushing phishing attacks—e-mails trying to fraudulently elicit
personal information from recipients—went for $500 a million (Graff, 2017).
He pleaded guilty on September 12, 2018, to offenses in the United States tied
to his spamming, as well as other cybercrimes tied to his distribution of malware
and stealing login information of victims (United States Department of Justice,
2018).

See also: Advanced Research Projects Agency Network; CAN-SPAM Act of 2003;
E-mail-related Crimes; Fraud; Phishing

Further Reading
Anonymous. 2007. “The etiquette of telecommunications: Getting the message, at last.”
The Economist, December 13, 2007. https://www.economist.com/node/10286400
/print?story_id=10286400
Federal Trade Commission. 2009. “CAN-SPAM Act: A compliance guide for business.”
https://www.ftc.gov/tips-advice/business-center/guidance/can-spam-act-compliance
-guide-business
Fletcher, Dan. 2009. “Spam.” Time, November 2, 2009. http://content.time.com/ time
/business/article/0,8599,1933796,00.html
Graff, Garrett M. 2017. “How the FBI took down Russia’s spam king—And his massive bot-
net.” Wired, April 11, 2017. https://www.wired.com/2017/04/fbi-took-russias-spam
-king-massive-botnet/
390 Sp o o f i n g

MacNaughton, Ian (director), Graham Chapman (writer), John Cleese (writer), Terry Gil-
liam (writer), Eric Idle (writer), Terry Jones (writer), and Michael Palin (writer). 1970.
Season 2, Episode 12 in Monty Python’s Flying Circus. London: BBC.
McWilliams, Brian. 2004. Spam kings: The real story behind the high-rolling hucksters pushing
porn, pills and @*#?% enlargements. Cambridge, UK: O’Reilly.
Rao, Justin M., and David H. Reiley. 2012. “The economics of spam.” Journal of Economic
Perspectives 26, 3: 87–110.
United States Department of Justice. 2018. “Russian national who operated Kelihos bot-
net pleads guilty to fraud, conspiracy, computer crime and identity theft offenses.”
September 12, 2018. https://www.justice.gov/opa/pr/russian-national-who-operated
-kelihos-botnet-pleads-guilty-fraud-conspiracy-computer-crime

SPOOFING
In the context of cybercrime, spoofing is where something is disguised to appear
to be something it is not. Spoofing is used by cybercriminals to enable them to
commit cybercrime. There are several different types of cyber spoofing, including
e-mail spoofing, DNS spoofing, caller ID spoofing, IP spoofing, and GPS spoofing
(Malwarebytes, 2019).
E-mail spoofing is where an e-mail is sent that appears to come from one source,
but in fact has been sent by another source. This form of spoofing can be used by
cybercriminals to steal personally identifying information from victims. This is
done through a phishing attack. The cybercriminal sends an e-mail that appears to
be from a legitimate source: an established business, a government agency, and so
forth. The e-mail, under the guise of being a legitimate entity making a legitimate
request, will ask the victim to provide personally identifying information, such as
their login credentials, social security number, or birthdate. If a victim falls for the
ruse, the cybercriminal can obtain the personally identifying information and use
it to steal money from the victim. E-mail spoofing can also be used to spread mal-
ware. The tactic is generally the same. A cybercriminal will send an e-mail to the
victim, posing as a legitimate source. In these instances, however, the cybercrimi-
nal asks the victim to open an attachment or click on a link in the e-mail. If the
victim does so, the attachment or link will actually download malware on the vic-
tim’s computer. While a spoofed e-mail claiming to be from a friend of the victim
may raise red flags if the cybercriminal asks for personally identifying information,
a spoofed e-mail from a friend asking the victim to click on a link to an interest
news article, for example, might not (Malwarebytes, 2019).
Caller ID spoofing is where someone makes it appear that they are calling from
a phone number other than the one they are actually calling from. Similar to the
e-mail spoofing, caller ID spoofing can be used to trick a victim into thinking a
call is coming from a legitimate entity, such as a business or government agency.
If the victim believes the call is actually from a legitimate entity, they may divulge
personally identifying information to the cybercriminal spoofing the call. Another
tactic cybercriminals use when caller ID spoofing is neighborhood spoofing. This
is where the cybercriminal spoofs the number to appear to be coming from the
neighborhood of the victim by making the area code and first three numbers of
Sp o o f i n g 391

the number the same as the victim’s phone number. This is done to increase the
likelihood of a victim answering the phone (Federal Communications Commis-
sion, 2019). These calls can be used to gather personally identifying information
as well. They could also be used to capture the voice of a victim. If the victim ver-
bally responds to questions asked by the cybercriminal over the phone—especially
those that ask for a “yes” or “no” response—a cybercriminal could record those
responses and use them as a voice signature to authorize a money transfer from
the victim’s bank over the phone (Federal Communications Commission, 2019;
Tatham, 2019).
IP spoofing occurs when someone alters the IP address of their computer to
appear to be a different IP address. By doing this, a cybercriminal can obfuscate
where a cyberattack is actually coming from, making it difficult for law enforce-
ment and others to track down where the attack actually came from. IP spoofing
can also be used to circumvent security measures employed by computer networks
that only allow trusted computers—computers with an IP address that the net-
work recognizes as having permission—to access the network. If a cybercriminal
is able to spoof the IP address of their computer to make it appear to be a trusted
computer, they can access networks they would otherwise be unable to (Kasper-
sky, 2019).
IP spoofing also permits a person to spoof the physical location of the computer.
With location spoofing, a person has their computer or other electronic device
indicate that it is accessing the internet from a physical location different from the
one it is actually accessing the internet from. This is often done through the use
of a VPN. Where a VPN serves as an intermediary between a user and the web-
site they are ultimately accessing, the website being accessed ascertains the user’s
location via that user’s representation of their location through the VPN. Location
spoofing is used to access internet content that is unavailable in their geographic
location. Indeed, circumventing censorship is an advertised feature of some VPNs
(ExpressVPN, 2019). An example of this can be seen in China. China censors the
internet within its borders via the Great Firewall of China. A user in China that
wishes to circumvent the Great Firewall can use a VPN. By listing their location
as something other than China (i.e., spoofing their location), the user can access
the internet without those restrictions. It is a crime to circumvent internet restric-
tions in this way in China. Since 2017, several people providing and using VPN
services in China have been sentenced to prison for their actions (Banjo and Chen,
2019). Location spoofing is also commonly used to circumvent geo-blocking.
Geo-blocking is where an entertainment company restricts the geographic areas
from which certain content may be viewed. As each country has its own copyright
laws, entertainment companies will employ geoblocking to avoid running afoul
of those laws, only permitting the content to be viewed in countries where those
companies have secured the rights to show it. One study found that avoiding geo-
blocking was the primary motivation for people to use VPNs, with nearly half of
VPN users indicating that was their motivation (Valentine, 2018). Those who use
location spoofing to avoid geoblocking are likely acting illegally. Entertainment
companies, such as Netflix and HBO, prohibit the circumvention of geoblocking
392 Sp o o f i n g

in their terms of service (HBO, 2019; Netflix, 2019). Violating the terms of service
can give rise to a civil cause of action against the violator. However, it is possible
that the violator could also face criminal charges. As noted in HBO’s terms of ser-
vice: “If you choose to access [material] from other locations you do so on your
own initiative and at your own risk. You are responsible for complying with local
laws, if and to the extent local laws are applicable” (HBO, 2019). In other words, if
a user illegally accesses copyrighted material, and the laws of the country in which
the user resides treats that illegal access as a crime, that user may face criminal
charges in addition to a civil cause of action from the entertainment company.
GPS spoofing is similar to location spoofing. Instead of changing one’s location
through a VPN, however, GPS spoofing changes the actual GPS coordinates of an
electronic device capable of being traced via GPS. GPS spoofing can be used to cir-
cumvent services that are GPS-dependent. For example, some games playable on
cell phones are dependent on GPS, such as Pokémon Go. The location of items in
the game is tied to the GPS location of the phone. By using GPS spoofing, a player
can trick the game into thinking the phone is at a specific GPS location, and the
player can collect the item tied to that location (Malwarebytes, 2019). Use of GPS
spoofing in Pokémon Go is considered a violation of the terms of service (Niantic,
2019). Where the game offers the in-game purchase of items, if GPS spoofing
were used to obtain items in a manner that would alleviate the player’s need to
purchase those items, it could be considered theft. GPS spoofing can potentially
be used for other purposes as well. In 2011, the Iranian military was able to spoof
the GPS coordinates of a U.S. drone. By doing so, the drone landed at a location it
thought was its home base in Afghanistan but was actually in Iran. This permitted
the Iranian military to study the technology of the drone once it was intercepted
(Peterson and Faramarzi, 2011).

See also: China; Copyright Infringement; Domain Name System Cache Poisoning;
Malware; Personally Identifying Information; Phishing; Spoofing; Virtual Private
Network

Further Reading
Banjo, Shelly, and Lulu Yilun Chen. 2019. “Digital dissidents are fighting China’s censor-
ship machine.” Bloomberg Businessweek, June 3, 2019. https://www.bloomberg.com
/news/articles/2019-06-03/digital-dissidents-are-fighting-china-s-censorship-machine
ExpressVPN. 2019. “How to change your location in Google Chrome.” ExpressVPN.
https://www.expressvpn.com/support/troubleshooting/spoof-location-google-chrome/
Federal Communications Commission. 2019. “Caller ID spoofing.” https://www.fcc.gov
/consumers/guides/spoofing-and-caller-id
HBO. 2019. “HBO terms of use.” https://www.hbo.com/terms-of-use
Kaspersky. 2019. “What is IP spoofing?” https://usa.kaspersky.com/resource-center/threats
/ip-spoofing
Malwarebytes. 2019. “Spoofing.” https://www.malwarebytes.com/spoofing/
Netflix. 2019. “Netflix terms of use.” https://help.netflix.com/en/legal/termsofuse
Niantic. 2019. “Niantic Terms of Service.” https://nianticlabs.com/terms/en/
Sp y wa r e 393

Peterson, Scott, and Payam Faramarzi. 2011. “Exclusive: Iran hijacked US drone, says Ira-
nian engineer.” Christian Science Monitor, December 15, 2011. https://www.csmonitor
.com/World/Middle-East/2011/1215/Exclusive-Iran-hijacked-US-drone-says-Iranian
-engineer
Tatham, Matt. 2019. “The ultimate list of the year’s worst scams.” Experian, March 11,
2019. https://www.experian.com/blogs/ask-experian/the-ultimate-list-of-the-years
-worst-scams/
Valentine, Olivia. 2018. “VPNs are primarily used to access entertainment.” Global Web
Index, July 6, 2018. https://blog.globalwebindex.com/chart-of-the-day/vpns-are
-primarily-used-to-access-entertainment/

S P Y WA R E
Generally speaking, spyware is software that gathers information about the user
of a computer without the consent of the user, and it transmits that information
to someone else. The precise definition of spyware is not universally agreed upon.
One area of disagreement centers on what constitutes consent. Some software may
gather information about its users—either directly or through software bundled
with it—and this is disclosed in an end user license agreement that comes with
the software. The question in these instances becomes whether informing users
about information gathering through an end user license agreement is sufficient.
The concern is that such a method may be too indirect, and thus such users can-
not truly be said to have consented to the software gathering data and sending it
to the makers of the software (Federal Trade Commission, 2005). Another area
of disagreement centers on the degree of harm this type of software must cause
before it is considered to be spyware. Some believe the software must actually
cause some sort of harm—be malware—to be considered spyware. Others main-
tain that all software that gathers data without the consent of the user is, per se,
spyware because the nonconsensual gathering of data is harmful in and of itself
(Federal Trade Commission, 2005).
Spyware can be used for a multitude of reasons. One piece of spyware (known
as Turla or Uroburos) targeted computers belonging to governments that are mem-
bers of NATO—including the United States—in an apparent attempt at cyber
espionage. The spyware gained attention in 2014 but had been under observa-
tion by some security companies for years prior to this. Although it has not been
definitively determined, many believe this spyware was created and disseminated
by Russia (Reuters, 2014). A similar attack was carried out by China to infiltrate
not only the computers of foreign governments but also the computers of for-
eign companies. China did this not through software but rather through hardware.
Evidence of this attack began to emerge in 2015. That year, Amazon was consid-
ering the acquisition of Elemental Technologies, a creator of video-compression
software. As part of a preacquisition investigation of Elemental Technologies by
Amazon, it was discovered that the servers used by Elemental Technologies con-
tained small microchips on the motherboards that were not part of the original
schematic for the motherboards. These servers were manufactured for Elemental
394 Sp y wa r e

Technologies by Super Micro Computer, a company based in the United States

that subcontracted at least some of the manufacture of their servers to companies
in China. It is believed that the additional, undisclosed microchips were added to
the motherboards by the PLA (the Chinese military) during manufacture in China.
The servers were used by several U.S. agencies, including the CIA, the Department
of Defense, and the navy. The servers were also used by several large corporations,
including Amazon and Apple. It is believed the added microchip permitted China
to monitor the usage of the computer within which it was installed (Robertson and
Riley, 2018).
In addition to being used by governments to engage in governmental and busi-
ness espionage, spyware can be used by individuals for more personal reasons.
There are companies that sell spyware to individuals. For some of these compa-
nies, the spyware is pitched as a means to catch a cheating spouse. Indeed, spyware
appears to be used frequently in domestic cases. In 2014, one survey found that
75 percent of the domestic violence shelters they contacted housed victims whose
phone conversations had been eavesdropped by their abusers (Shahani, 2014).
The use of spyware to monitor people in this manner is generally illegal. However,
the marketers of this software will include language—whether on their website,
in an end user license agreement, or other method—indicating the software is
intended for legal uses only (Cox, 2017; Shahani, 2014).
There are certain types of software that are arguably spyware. Adware, depend-
ing on how it operates, could fall into this category. Adware is software that dis-
plays advertisements to users. This can be incorporated as a side function of some
other software, such as a web browser. In some instances, adware will gather
data from a user (such as web browsing history) to tailor the advertisements
displayed to the user’s interests. If the user has not consented to that informa-
tion being gathered, the adware could be classified as spyware (see Federal Trade
Commission, 2005). Certain types of DRM software may fall into the category
of spyware. In 2006, Microsoft designed a tool—Windows Genuine Advantage
Notifications—that would verify that the Windows operating system installed on
a computer was obtained legitimately. The software did send information back
to Microsoft, though the company maintained that the information sent was not
meaningful information. The company did note it had not been as forthcoming as
it could have been about the software and what it did (Evers, 2006). Sony BMG
employed similar—yet seemingly more invasive—DRM methods in 2005. The
company would download software onto the computers of those who purchased
certain CDs from them. Neither the fact that the software had DRM functionality
nor that it would be downloaded on a user’s computer was included in the end
user license agreement provided by Sony BMG (Russinovich, 2005). The software
also captured information concerning a user’s listening habits even though the end
user license agreement claimed such information would not be captured (Elec-
tronic Frontier Foundation, 2019). Sony BGM faced numerous lawsuits over the
implementation of this software (Associated Press, 2005; McMillan, 2006).
In some instances, law enforcement may use spyware in their investigations.
Federal law enforcement has used keystroke monitors to track the computer habits
Sp y wa r e 395

of suspected criminals, and law enforcement may also use devices to surrepti-
tiously intercept the cell phone communications (see McCullagh, 2007; Siegel,
2017). The collection of such information in the United States by law enforcement
would have to comply with the search and seizure requirements of the Fourth
Amendment of the U.S. Constitution as well as other applicable laws. A concern
law enforcement may have when authorized to use spyware by a court is whether
the suspect’s antimalware software will catch the spyware and delete it. Some pri-
vate antimalware companies have indicated that, if they were ordered by a court,
they would not tell a customer of the presence of government-installed spyware.
However, antimalware companies that were asked if they have ever received such
an order either denied they had, indicated they did not know if they had, or did
not answer the question. Nonetheless, there is some indication that one such com-
pany (McAfee) contacted the FBI in 2001 to make sure its antimalware software
would not interfere with the FBI’s spyware (McCullagh, 2007).

See also: Digital Rights Management; End User License Agreement; Malware; Rootkit

Further Reading
Associated Press. 2005. “Sony BMG tentatively settles suits on spyware.” New York Times,
December 30, 2005. https://www.nytimes.com/2005/12/30/technology/sony-bmg
-tentatively-settles-suits-on-spyware.html
Cox, Joseph. 2017. “I tracked myself with $170 smartphone spyware that anyone can buy.”
Motherboard, February 22, 2017. https://motherboard.vice.com/en_us/article/aeyea8/i
-tracked-myself-with-dollar170-smartphone-spyware-that-anyone-can-buy
Electronic Frontier Foundation. 2019. “Sony BMG litigation info.” h ttps://www.eff.org
/cases/sony-bmg-litigation-info
Evers, Joris. 2006. “Microsoft’s antipiracy tool phones home daily.” CNet, June 8, 2006.
https://www.cnet.com/news/microsofts-antipiracy-tool-phones-home-daily/
Federal Trade Commission. 2005. Monitoring software on your PC: Spyware, adware, and
other software. https://www.ftc.gov/sites/default/files/documents/reports/spyware-work
shop -m onitoring -s oftware -y our-p ersonal -c omputer-s pyware -a dware -a nd -o ther
-software-report/050307spywarerpt.pdf
McCullagh, Declan. 2007. “Will security firms detect police spyware?” CNet, July 17, 2007.
https://www.cnet.com/news/will-security-firms-detect-police-spyware/
McMillan, Robert. 2006. “Sony rootkit settlement reaches $5.75M.” PCWorld, December
22, 2006. https://www.pcworld.com/article/128310/article.html
Reuters. 2014. “Suspected Russian spyware in Europe, US attacks.” CNBC, March 7, 2014.
https://www.cnbc.com/2014/03/07/suspected-russian-spyware-in-europe-us-attacks
.html
Robertson, Jordan, and Michael Riley. 2018. “The big hack: How China used a tiny chip
to infiltrate U.S. companies.” Bloomberg Businessweek, October 4, 2018. h ttps://www
.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny
-chip-to-infiltrate-america-s-top-companies
Russinovich, Mark. 2005. “Sony, rootkits and digital rights management gone too far.”
Microsoft TechNet (blog), October 31, 2005. https://blogs.technet.microsoft.com
/markrussinovich/2005/10/31/sony-rootkits-and-digital-rights-management-gone
-too-far/
396 S tat e A c t o r

Shahani, Aarti. 2014. “Smartphones are used to stalk, control domestic abuse vic-
tims.” National Public Radio, September 15, 2014. https://www.npr.org/sections
/alltechconsidered/2014/09/15/346149979/smartphones-are-used-to-stalk-control
-domestic-abuse-victims
Siegel, Robert. 2017. “Local police departments invest in cell phone spy tools.” National
Public Radio, February 17, 2017. https://www.npr.org/2017/02/17/515841069/local
-police-departments-invest-in-cell-phone-spy-tools

S TAT E A C T O R
A state actor is someone who works for or on behalf of the government. When
looking at cyberattacks, knowing whether the attack was perpetrated by a state
actor could have an impact on whether the attack is treated as a cybercrime or as
a warfare matter (Flatow, 2011; Stoll, 2018). Additionally, the distinction between
a state actor and a non-state actor matters in the context of criminal investigations
and the maintenance of the rights of suspects.
State actors carry out and are the victims of cyberattacks with some regularity,
with hundreds of such attacks occurring between 2006 and 2019 (Center for Stra-
tegic and International Studies, 2019). The use of the internet for military objec-
tives is an open field, with state actors still figuring out the contours of what types
of attacks could be carried out via cyber means (Kallberg and Thuraisingham,
2013). In instances where different state actors use cyberattacks against each other,
it might be expected those attacks would be treated as a warfare matter. However,
this does not generally appear to be the case. The Center for Strategic and Interna-
tional Studies (2019) put it this way:

If Chinese or Russian spies had backed a truck up to the State Department, smashed
the glass doors, tied up the guards and spent the night carting off file cabinets, it
would constitute an act of war. But when it happens in cyberspace, we barely notice.

Although these cyberattacks are not generally treated as acts of war, there are
instances where they have been treated as criminal matters in the United States.
For example, the United States indicted 12 Russian officers for interfering with
the 2016 presidential election (Prokop, 2019). Moves like these seem to be largely
political, as it is not expected that the country that sponsored the cyberattack will
cooperate with the extradition of those who were indicted for their role in the
attack.
The other instance where the distinction between a state actor and a nonstate
actor has significance in relation to cybercrime is in the enforcement of laws pro-
hibiting cybercrime. In the United States, the distinction between a state actor and
a nonstate actor is important when it comes to the rights granted to citizens under
the Constitution. Specifically, where the government is responsible for maintain-
ing the rights of the citizens, only state actors can be held liable for infringing
those rights. In the context of criminal law, these Constitutional rights include
the right against unreasonable search and seizure (Fourth Amendment), the right
S tat e A c t o r 397

against self-incrimination (Fifth Amendment), and the right to an attorney (Sixth

Amendment).
The most common state actor a person would encounter when dealing with
a criminal case would be a law enforcement officer, such as a police officer or a
Federal Bureau of Investigation (FBI) agent. Thus, law enforcement officers are
responsible for assuring that someone accused of a crime has their Constitutional
rights honored. If a law enforcement officer violates a citizen’s rights, there are
repercussions. Perhaps the most common consequence of law enforcement vio-
lating a citizen’s rights in a criminal case is suppression of the evidence (e.g., the
state is prohibited from using the illegally obtained evidence in a trial against the
suspect whose rights were violated). In some instances, a suspect who had their
rights violated might file a civil lawsuit against the department of the officer that
violated their rights. The officer who violated a suspect’s rights might face criminal
prosecution themselves, depending on the flagrancy of the violation. These rights
must be honored for those suspected of cybercrimes just as much as they must be
honored for someone suspected of any other crime.
By contrast, a nonstate actor is not obligated to uphold a citizen’s Constitutional
rights. A non-state actor is anyone who does not work for the state. This is true
even if the person in question has responsibilities similar to a law enforcement
officer. For instance, a loss prevention officer for a department store or a security
officer for a concert venue would not be considered state actors. Both positions
have duties similar to a law enforcement officer, such as crime apprehension and
order maintenance. However, people in both positions are employed by private
businesses, not the state.
Although nonstate actors are not obligated to uphold the Constitutional rights
of citizens, this does not mean there are no consequences for the actions of non-
state actors. For example, if a loss prevention officer breaks into the car of a sus-
pected shoplifter looking for evidence, that officer could potentially be sued civilly
or prosecuted for a crime just as a state actor could, albeit under different statutes
in most instances. The pertinent difference is that any evidence found in the car
by the loss prevention officer could still be used against the shoplifter. If a police
officer (a state actor) were to do the same thing, the evidence could not be used
against the shoplifter.
It is possible that a nonstate actor could be deemed to be an agent of (i.e., work-
ing for) a state actor, and this would make that agent responsible for upholding
a citizen’s constitutional rights just the same as the state actor they work for. An
example of this would be the use of an undercover informant. That informant
would be no more able to conduct an illegal search of someone’s dwelling than the
officer they work for.
As mentioned above, Constitutional rights in the criminal justice system apply
just as much in the cyber world as they do anywhere else. Thus, if a law enforce-
ment officer wanted to conduct a search of someone’s hard drive for evidence of a
crime, they would first need to obtain a warrant just as they would if they wanted
to search someone’s house for evidence of a crime. Likewise, nonstate actors would
not be obligated to uphold citizens’ constitutional rights in the cyber world. For
398 Storm Botnet

example, if a private e-mail provider or social media company wanted to take the
information of one of its customers and provide it to the government as evidence
in a criminal case, that evidence could be used against that customer as long as
the e-mail provider or social media company was not working at the direction of
the government. As mentioned above, there could be other repercussions for the
e-mail provider or social media company even though they are nonstate actors.
However, suppression of the customer’s information in a criminal case would not
be one of those remedies.

permitting a cybercriminal to bypass all the standard security measures in place,

superzapping may not leave behind evidence that files have been manipulated by
the cybercriminal, making detection of the activities of the cybercriminal difficult
(Parker, 1989).
Where superzapping can be a powerful tool in a cybercriminal’s arsenal, regulat-
ing the availability and use of Superzap and similar programs becomes important
for network administrators to prevent unauthorized use of them. Indeed, super-
zapping may unintentionally be made available to a cybercriminal when network
administrators fail to see superzapping as a threat and thus fail to secure Super-
zap or similar programs (Kabay, 2002; Parker, 1989). There are various security
measures that have been suggested to secure these programs. In order to keep the
programs off the network itself, thus assuring it is not generally available to any-
one who accesses the network, it has been suggested that the programs be kept
in a physical safe. Also, where employees of a company with access to these pro-
grams could potentially use them for criminal purposes, it has been suggested that
the implementation of a policy that requires two employees to authorize the use
of Superzap or a similar program could reduce the likelihood of those programs
being used against the company (Kabay, 2002).

to attend Stanford University, where he worked on Infogami, a way to create web-

sites. After his freshman year, he did not return to Stanford but instead continued
to work for Infogami. The company merged with Reddit in November 2005 and
formed a new firm called Not a Bug, which the owner of Wired magazine then
acquired. Swartz initially began to work on Wired but left the company after a short
time. He chose to become a computer programmer and political activist.
In September 2007, Swartz was part of a group that created a new firm, Jottit.
The following year, he downloaded almost 2.7 million federal court documents,
with the goal of making them available to the general public. The FBI investigated
Swartz for this activity, but no charges were filed.
After this experience, Swartz chose to assist in the creation of the Progressive
Change Campaign Committee, which sought to provide support for progressive
government policies such as health care reform. He also agreed to be a cofounder
of Demand Progress, an organization that provided encouragement to individuals
who wanted to get involved in supporting civil liberties and other related policies.
In these positions, Swartz actively campaigned to show his opposition to a pro-
posed law called the Stop Online Piracy Act, which was introduced into Congress
in 2011 and sought to deter people from violating copyright laws. Swartz and
other critics claimed that the law would make it easier for law enforcement to shut
down websites run by people who were accused of breaking the law. The proposed
bill did not pass.
Because of his expertise in computers and technology, Swartz became a research
fellow at Harvard University’s Safra Research Lab on Institutional Corruption. In
2010 and 2011, using his research fellow account from his position at Harvard
University, Swartz used the network from Massachusetts Institute of Technology
(MIT) to download hundreds of academic journal articles from JSTOR, an online
repository for academic articles and manuscripts. The amount Swartz downloaded
far exceeded the maximum amount allowed. Once they were downloaded, he
posted the articles on the internet, a violation of copyright laws.
A U.S. Secret Service agent and MIT police arrested Swartz in January 2011 near
the campus of Harvard University on charges of breaking and entering, wire fraud,
computer fraud, unlawfully obtaining information from a protected computer, and
recklessly damaging a protected computer. He was also charged with acts related
to the Computer Fraud and Abuse Act of 1986 (CFAA).
If convicted of the charges, Swartz was facing a possible fine of up to $1 million,
with a possible 35 years in prison. In addition to these penalties, Swartz would be
forced to forfeit any assets, pay restitution, and spend time on supervised release.
The prosecutors offered Swartz a plea bargain that would have required him to
serve six months in a federal minimum security prison if he pleaded guilty to 13
federal crimes. Swartz rejected the offer and proposed a counteroffer, but the pros-
ecution rejected it so Swartz sought to have a trial.
Many of Swartz’s supporters claimed that the federal government charged
Swartz far more severely simply as a means to ensure his punishment. To show
support for Swartz, the hacking group Anonymous launched a DoS attack against
the Department of Justice.
404 S wat t i n g

Before the trial started, Swartz took his own life on January 11, 2013, by hang-
ing himself in his apartment in Brooklyn, New York. Upon his death, the federal
prosecutors dropped all charges against him.
Not long after Swartz’s death, U.S. Representative Zoe Lefgren (D-CA) proposed
a bill (HR 2454/S1196) she called Aaron’s Law. She explained that the government
relied on some vague wording in the laws to argue that violating the service’s user
agreement or terms of service of the online service (in this case, JSTOR) was a
violation of the CFAA. Further, Lefgren argued that this interpretation of the law
may result in many ordinary activities being considered criminal, resulting in high
penalties. Lefgren’s proposal would exclude violations of terms of service from the
CFAA. Even though the bill had significant support from other members of Con-
gress, it stalled in committee and was not passed. The proposal was reintroduced
in May 2015 as HR 2454/S1030, but it failed to pass again.
After Swartz’s suicide, his family and friends accused U.S. Attorney General
Eric Holder and the Department of Justice for cracking down on Swartz too hard
by overcharging him and threatening him with extreme prison time if he did not
plead guilty. While Holder expressed sympathy to Swartz’s family, he described the
case as a “good use of prosecutorial discretion” (Holpuch, 2013). Others claim the
case was delayed for too long simply as a way to punish Swartz even more and also
because of his political activism. In 2013, Swartz was posthumously inducted into
the Internet Hall of Fame.

See also: Computer Fraud and Abuse Act of 1986; Hacker and Hacking

Further Reading
Day, Elizabeth. 2013. “Aaron Swartz: Hacker, genius . . . martyr?” The Guardian, June 1, 2013.
https://www.theguardian.com/technology/2013/jun/02/aaron-swartz-hacker-genius
-martyr-girlfriend-interview
Holpuch, Amanda. 2013. “Attorney General Holder defends Aaron Swartz hacking prose-
cution.” The Guardian, March 7, 2013. https://www.theguardian.com/technology/2013
/mar/07/eric-holder-defends-aaron-swartz-hacking-prosecution
MacFarquhar, Larissa. 2013. “Requiem for a dream.” The New Yorker, March 11, 2013.
https://www.newyorker.com/magazine/2013/03/11/requiem-for-a-dream
Peter, Justin. 2016. The idealist: Aaron Swartz and the rise of free culture on the internet. New
York: Scribner.
Scheiber, Noam. 2013. “The inside story of why Aaron Swartz broke into MIT and JSTOR.”
The New Republic, February 13, 2013. https://newrepublic.com/article/112418/aaron
-swartz-suicide-why-he-broke-jstor-and-mit
Swartz, Aaron. 2015. The boy who could change the world: The writings of Aaron Swartz. New
York: The New Press.

S WAT T I N G
Swatting is the practice of calling for the police to respond to the home of someone
else under false pretenses. The term “swatting” is derived from the fact that a SWAT
S wat t i n g 405

(Special Weapons and Tactics) team will often show up to respond to the false
report. In many instances, the victims of swatting are people who do live streams of
video games. By making a false report to law enforcement, people watching the live
stream online will be able to watch the person’s house get stormed by the police.
Swatting is generally intended as a prank. However, swatting is illegal. Someone
who swats another person could be guilty of false reporting to law enforcement,
misuse of 911, or a similar charge.
Swatting can be dangerous. In one incident in Wichita, Kansas, swatting
resulted in someone’s death. In that case, two teenagers were playing Call of Duty.
One of the teenagers, Casey Viner, became upset with the other, Shane Gaskill,
and enlisted a third person, Tyler Barriss, to swat Gaskill. Gaskill caught wind of
what was going on and provided Viner and Barriss with an old address where he
no longer lived. Barriss called the police and claimed he had committed a murder
and was holding another person hostage. He gave the police the old address Viner
had given them. The police responded to the old address. The residents there were
not aware of what was going on. Andrew Finch, age 28 at the time, was shot and
killed by officers when he answered the door. Gaskill, Viner, and Barriss were all
charged with federal crimes arising from the incident. Barriss, the man who made
the actual call to the police, was charged with involuntary manslaughter in state
court (Burgess, 2017; Chokshi, 2018).
This incident in Wichita was not Barriss’s first time swatting. Barriss was charged
with multiple federal crimes for other swatting incidents he had been involved in
prior to the Wichita case. In some of those instances, it is alleged that others would
pay Barriss to swat someone. Three other people were charged with federal crimes
for soliciting Barriss to carry out swats for them, all in 2017 (Helsel and Blankstein,
2019). While in custody on charges for the Wichita incident, Barriss was able to
access the internet through an inmate kiosk at the Sedgwick County Jail in Kansas.
He logged into one of his Twitter accounts and threatened to swat more people
(Crecente, 2018).
Barriss pleaded guilty to 51 federal charges related to his swatting activity. This
included three counts stemming from the Wichita incident—false information and
hoaxes, cyberstalking, and conspiracy. He also pleaded guilty to two counts of
making bomb threats against the Federal Communication Commission and the
FBI on December 14, 2017, and December 22, 2017, respectively. The remain-
ing 46 counts were for earlier swatting incidences and unauthorized use of credit
cards. Among the 46 charges he pleaded to were charges of making interstate
threats and conspiracy to commit bank fraud (Leiker, 2018). As of early 2019,
Barriss’s state charge of involuntary manslaughter is unresolved, as are the federal
charges against his two codefendants, Gaskill and Viner.
There are other cases of swatting that have resulted in force being used by
law enforcement against unsuspecting victims. On February 18, 2005, two
men—Zachary Lee of Maryland and Robert Walker-McDaid of Coventry,
England—made plans to swat Tyran Dobbs. Walker-McDaid made the call from
England to a U.S. terrorism hotline, posing as Dobbs. He claimed to be armed and
406 S wat t i n g

have hostages. When the SWAT team arrived, Dobbs was shot in the face and chest
with rubber bullets. Dobbs’s facial bones were broken, and his lungs were bruised
(Kentish, 2017). Lee pleaded guilty to conspiracy to provide false information and
false information and hoax on November 7, 2017 (United States Attorney’s Office,
District of Maryland, 2017). Walker-McDaid’s case appears to be outstanding as of
early 2019.
Several celebrities has been swatted. Ashton Kutcher and Justin Bieber were
both swatted by a 12-year-old boy in October 2013 (Duke, 2013). Other swat-
ted celebrities include Russell Brand, Mylie Cyrus, and Justin Timberlake. David
Hogg—one of the survivors of the shooting at Stoneman Douglas High School in
Parkland, Florida—was also swatted in 2018, though he was out of town at the
time it happened (Fagan 2018).
It is estimated that there are 400 instances of swatting that occur every year,
with an average cost to law enforcement of $10,000 per incident (Burgess, 2017).
See also: Cyberbullying; Doxing
Further Reading
Burgess, Katherine. 2017. “Swatting is ‘a potentially deadly crime’ that’s become ‘extraor-
dinarily common.’” The Wichita Eagle, December 29, 2017. https://www.kansas.com
/news/local/article192152254.html
Chokshi, Niraj. 2018. “3 men face federal charges in fatal ‘swatting’ prank.” New York
Times, May 24, 2018. https://www.nytimes.com/2018/05/24/us/gamers-swatting-charges
.html
Crecente, Brian. 2018. “Inmate awaiting trial in fatal swatting case gets online, threatens
to swat again.” Variety, April 10, 2018. https://variety.com/2018/gaming/news/inmate
-swatting-case-tweets-1202749320/
Duke, Alan. 2013. “Boy admits ‘swatting’ Ashton Kutcher, Justin Bieber.” CNN, March 12,
2013. https://www.cnn.com/2013/03/11/showbiz/kutcher-swatting-conviction/index
.html
Fagan, Kaylee. 2018. “Everything you need to know about ‘swatting,’ the dangerous
so-called ‘prank’ of calling a SWAT team on someone.” Business Insider, June 5, 2018.
https://www.businessinsider.com/what-does-swatting-mean-2015-3
Helsel, Phil, and Andrew Blankstein. 2019. “3 charged in ‘swatting’ cases connected to man
charged in death of Kansas man.” NBC News, January 23, 2019. https://www.nbcnews
.com/news/us-news/3-charged-swatting-cases-connected-man-charged-death-kansas
-man-n962026
Kentish, Benjamin. 2017. “British man charged after U.S. gamer is shot by Swat police fol-
lowing hoax terrorism call.” The Independent, April 10, 2017. https://www.independent
.co.uk/news/uk/home-news/robert-mcdaid-charged-tyran-dobbs-swatting-hoax-call
-swat-terrorism-maryland-shot-gun-explosives-a7677071.html
Leiker, Amy Renee. 2018. “Tyler Barriss, who made fatal swatting call in Wichita, guilty of
51 federal charges.” The Wichita Eagle, November 13, 2018. https://www.kansas.com
/news/local/crime/article221616115.html
United States Attorney’s Office, District of Maryland. 2017. “Catonsville man pleads guilty
to conspiracy in ‘swatting’ incident.” United States Attorney’s Office, District of Mary-
land, November 7, 2017. https://www.justice.gov/usao-md/pr/catonsville-man-pleads
-guilty-conspiracy-swatting-incident
S y ma n t e c 407

SYMANTEC
Symantec is a Mountain View, California-based cybersecurity company known for
producing antivirus and data management programs. The name is a combination
of the words “syntax,” “semantics,” and “technology.” Originally founded in 1982
by Gary Hendrix as a way to learn more about artificial intelligence, it was one of
the first tech companies to focus on fighting computer viruses. Two years after the
company’s startup, C&E Software acquired Symantec, but retained the company’s
original name. One of Symantec’s first products, Q&A, was very successful. The
company also released an antivirus program for Apple computers that sold over
$100,000 in its first month. Then it began to purchase existing products and com-
panies. By 1988, Symantec sold 20 different products. In 1990, Symantec merged
with Peter Norton Computing and decided to focus on the development of anti-
virus programs that could be used not only by large companies but also by home
computer users with little knowledge of computers. The company’s antivirus and
data management programs are sold under the Norton name (Norton, n.d.).
Not long after that, Symantec purchased Certus Corporation, which produced
the Novi Antivirus software, and then the Peter Norton Computing Company.
This allowed Symantec to sell an antivirus software program to the general public.
When the Melissa virus was released, many organizations relied on Symantec anti-
virus software to keep their computers safe.
Symantec products include both Norton Internet Security and Symantec End-
point Protection. Both programs are types of security software, but they are geared
toward different groups. The Norton division includes Norton Antivirus, Norton
Internet Security, and Norton 360. These programs detect malware and viruses on
networks. They also include e-mail spam filtering and methods to identify phish-
ing attempts. Endpoint Protection has products for both small businesses and
those that have over 100 employees. The software is sold as a box copy or can be
downloaded.
In 1999, some of the employees of technology investment firm Battery Ven-
tures, along with Ted Julian, an expert in the security and technology field, created
@stake that developed security software as well as offered consulting services and
training. In 2000, the company acquired L0pht Heavy Industries and Cerberus
Information Security Limited, an internet security firm. In 2004, Symantec bought
@stake, a California-based company that provides network security services. Many
experts in computer security were employed by the new company, including for-
mer Cult of the Dead Cow member Peiter Zatko, AKA Mudge, and Chris Wysopal,
also known as Weld Pond.
The company continues to grow and expand as they acquire companies that have
expertise in protecting computer systems and data. In 2004, the company released
L0phtCrack, a password auditing system that identifies weak passwords that peo-
ple often use, such as birthdays or a spouse’s or child’s name, and changes pass-
words if needed to delete suspicious accounts. In August 2005, Symantec acquired
another software security company, Sygate. Starting in November 2005, all Sygate
personal firewall products were no longer available to customers. In 2007, Syman-
tec acquired Altiris, which produces software management programs, and Vontu,
408 S y ma n t e c

a company that specializes in data loss prevention. The following year, Symantec
executives agreed to acquire three new companies, PC Tools, AppStream Inc., and
MessageLabs. In 2010, Symantec officials made public their plans to acquire PGP
Corporation and GuardianEdge, and then they acquired Rulespace later that year.
In 2011, they obtained Clearwell Systems, and in 2012 they acquired LiveOffice,
a company that managed cloud storage and backup systems. They also bought
Odyssey Softwary and Nukona Inc. in 2012.
In 2014, officials at Symantec announced that it had plans to divide into two
publicly traded companies. One company would provide expertise on security and
the other on information management. The latter company (Veritas Technologies)
was then sold to the Carlyle Group. NitroDesk Inc. joined Symantec in 2014.
Symantec continues to develop technology to help keep computers and networks
safe. In 2016, it announced a program to help protect cars that are connected to
the internet against zero-day attacks. Officials in the company made an announce-
ment in November 2016 that it was acquiring the identity theft–protection com-
pany LifeLock for a cost of $2.3 billion. It also acquired Blue Coat Systems in
2016. Then in August 2017, officials announced that Symantec was selling the
side of the company that verifies the identity of websites, and on January 4, 2018,
they announced a new agreement with BT Enterprises to create endpoint security
protection.
Even with all of the changes, the company continues to provide customers with
technology to keep their computers and their data safe. They provide consulting
and education services to those who need it, but they also offer a variety of pro-
grams to protect people and companies from becoming victims of an attack.

SYRIAN ELECTRONIC ARMY

The Syrian Electronic Army is a hacker group that is supportive of Syrian presi-
dent Bashar al-Assad. Assad became the president of Syria in July, 2000. At that
time, he was elected to a seven-year term. Since then, Assad has been reelected to
two additional seven-year terms, in 2007 and in 2014. In March 2011, a civil war
broke out in Syria. The catalyst for this civil war appears to be the detainment of
boys who had put graffiti critical of Assad and the Syrian government on the walls
of their school. Protests followed the incarceration of these youths, and the Syr-
ian government began to use military force to dispel these protests (Stracqualursi
and Kelsey, 2017). It was around this same time that the Syrian Electronic Army
first emerged. In April, 2011, it started a Facebook page. That page was quickly
taken down by Facebook. Over the next several weeks, the Syrian Electronic Army
attempted to start a total of 18 different Facebook pages, all of which were taken
down by Facebook. In May 2011, it launched its own website (Norman, 2019).
That website described the Syrian Electronic Army as “a group of enthusiastic Syr-
ian youths who could not stay passive towards the massive distortion of facts about
the recent uprising in Syria” (Smith-Spark, 2013).
The Syrian Electronic Army appears to deny that it is working at the behest of
the Assad-led government (Fowler, 2013; Noman, 2019). Indeed, as of early 2019,
there appears to be no direct evidence to show that the Syrian Electronic Army
is being directed in that way. However, there is evidence that would indicate the
Assad-led government tacitly supports it. The Syrian government authorized the
registration of the Syrian Electronic Army’s website, and hosted it until June, 2013
(Fowler, 2013; Noman, 2019). Assad has voiced support and appreciation for the
Syrian Electronic Army, as have Syrian-government-run media outlets (Fowler,
2013; Noman, 2019).
In its first few years of operation, the Syrian Electronic Army primarily engaged
in website vandalism and DDoS attacks. These attacks were directed toward the
websites and social media accounts of those opposed to the Assad-led government
and the websites and social media accounts of organizations in Western countries
in general (Noman, 2019). Those attacked include CBS, MPR, BBC, al-Jazeera, and
FIFA (Fowler, 2013). In addition to these attacks, spam campaigns were directed
by the Syrian Electronic Army against the Facebook pages of similar organizations
and individuals. The organizations and individuals whose Facebook pages were
attacked include Barack Obama, Nicolas Sarkozy, Oprah Winfrey, al-Arabia TV, the
European Union, Human Rights Watch, and Sheikh Yusuf Al Qaradawi (Noman,
2019). The attacks of the Syrian Electronic Army have escalated past website van-
dalism. In 2013, the New York Times website was attacked. The Syrian Electronic
Army was able to not only vandalize the website of the New York Times but was
also able to gain control of the website’s domain name, shutting the site down for
20 hours (Smith-Spark, 2013). In late 2018, information emerged that the Syrian
Electronic Army was working on using spyware called SilverHawk on Android
devices to track the activities of those they wished to target (Brewster, 2018).
The exact membership of the Syrian Electronic Army is unknown. Although the
group claims to be composed primarily of Syrians, its use of online recruitment
410 S y r i a n E le c t r o n i c A r m y

methods means that members could be from anywhere there is an internet connec-
tion (Smith-Spark, 2013). There are a handful of members whose identities have
been discovered. They are Ahmad Umar Agha (known as The Pro online), Firas
Dardar (known as The Shadow online), and Peter Romar. Agha and Dardar were
added to the Federal Bureau of Investigation’s Cyber Most Wanted list in 2016
(Federal Bureau of Investigation, 2016). Romar was extradited to the United States
from Germany in 2016 and pleaded guilty to conspiring to receive extortion pro-
ceeds and conspiring to unlawfully access computers (United States Department
of Justice, 2016). Romar was given credit for time served as his sentence (Weiner,
2018). Agha and Dardar have been charged with multiple felonies in the United
States, including wire fraud, identity theft, and conspiracies related to computer
hacking. However, as of early 2019, both still remain at large and are believed to
be in Syria (Federal Bureau of Investigation, 2016; Weiner, 2018). There are other
members of the Syrian Electronic Army that have been discovered, though they
are known only by their online names, such as Medo Coder and Raddex (Brewster,
2018).

After MLT was arrested, TeaMpoisoN disbanded. MLT emerged as a white-hat

security expert, giving his attention to legal computer security endeavors such as
identifying vulnerabilities in different websites, including the U.S. Department of
Defense. He also founded a computer security research organization called Project
Insecurity that teaches individuals about security awareness.
In 2015, it was reported that Hussain was killed by a U.S. drone strike near
Raqq, Syria. Since his early days in TeaMpoisoN, Hussain had become a top mem-
ber of the terrorist group the Islamic State of Iraq and Syria. Law enforcement also
thought that he had become the leader of the CyberCaliphate hacking group that
had been blamed for spreading propaganda by defacing websites and hacking into
social media accounts.

TOR (THE ONION ROUTER)

Tor (an acronym for “The Onion Router”) is software that allows users to navigate
the internet in a more anonymous capacity. The initial version of the software was
released in 2002. Tor increases anonymity of users by utilizing a network of com-
puters (nodes). The Tor software picks a random path of nodes to go through when
a user accesses a server, the links between each node being encrypted. By doing
this, the origin of the user’s computer is obfuscated (Tor, 2018).
Tor software can be used for many legitimate purposes. As the developers of the
software note, it can be used by journalists to communicate with whistleblowers,
the military to gather intelligence, and individuals who simply wish to conduct a
sensitive search of the internet anonymously (Tor, 2018). Indeed, the vast majority
of web traffic through Tor appears to be for legitimate purposes (Greenberg, 2015).
Though the majority of web traffic through Tor is legitimate, there is a fair
amount that is not. The Tor software not only allows users to navigate the internet
anonymously, it also allows users to host websites anonymously. These are known
as Tor hidden services (Greenberg, 2015). Collectively, the hidden service sites
that are accessible through Tor and similar services are known as the dark web.
It appears the Tor hidden services are commonly used for conducting criminal
activity, such as drug trafficking, money laundering, and distribution of child por-
nography (Greenburg, 2015; Moore and Rid, 2016). Indeed, Silk Road—an online
marketplace that was known for drug sales—was a Tor hidden service.
The U.S. government has had a hand in the development of Tor. Tor originally
was developed by the Office of Naval Research starting in 1995 (Onion Rout-
ing, 2005). Its goal was to protect government communications (Tor, 2019).
The project was handed over to Roger Dingledine and Nick Mathewson—both
programmers—in 2002 (Zetter, 2005). The government continues to use Tor for
intelligence gathering and to protect the online activity of military agents (Tor,
2019). The ability of Tor to provide privacy and security to the online activity of its
Trojan Horse 415

users increases the more users it has. This is so because the more users there are,
the less likely it becomes that a third party monitoring web traffic will be able to
determine who it sending data. It appears this may have been part of the reason the
Office of Naval Research turned the project over in the first place—to diversify the
user base of Tor so those monitoring Tor traffic would not easily deduce that Tor
web traffic likely originated from the navy (see Zetter, 2005). The U.S. government
has continued funding the development of Tor over the years. There appears to
be some evidence that the developers of Tor would notify the U.S. government of
vulnerabilities Tor faced before it notified all its users (Farquhar, 2018).

UNITED LOAN GUNMEN

The United Loan Gunmen was a hacker group the carried out a string of attacks
on prominent websites in 1999. This included ABC, C-Span, the Drudge Report,
NASDAQ, and the Associated Press. The attacks generally consisted of cybervan-
dalism, with the group editing the home page of the sites they attacked.
With the ABC website, the group posted a message apparently protesting the
encroachment of media companies into the internet. A portion of the message
read: “As what has always happened [sic] with television, radio, and newspapers,
corporations and companies are trying to stake there [sic] claim into our informa-
tion superhighway. Unlike the world of TV and radio . . . the common man, like
you and I, can take control” (Glave, 1999a).
A few weeks after the attack on ABC, C-Span was hit. The group posted a fab-
ricated transcript of a conversation between the U.S. Secretary of War (a position
that does not exist) and the leader of a country in the Middle East that took place
in 1983. The transcript claimed that the United States was planning on starting a
conflict in the Middle East to benefit the U.S. military industrial complex (Associ-
ated Press, 1999b).
Roughly a week after the C-Span attack, the Drudge Report website—a media
website that at the time of the attack tended to focus on gossip—was attacked. While
not known for certain, it is possible the site was targeted after Matt Drudge—the
namesake of the site—mentioned the United Loan Gunmen during his radio news
program. The group left the following message: “United Loan Gunmen take con-
trol of Matt Drudge’s Data Stockyard to once again show the world that this is the
realm of the hacker.” They also added news headlines to the site. Notably, they
added the headline “Kevin Mitnick Still in Jail,” with the headline linking to a web-
site seeking Mitnick’s release (Glave, 1999b). Mitnick was a prominent hacker who
was serving time in prison at the time of this attack.
Just days after the attack on the Drudge Report, the group attacked NASDAQ.
This attack broke the pattern of previous attacks carried out by the group. The
previous attacks had targeted the websites of media outlets. This attack target a sig-
nificant financial institution. Again, it appears the group just left a message on the
home page of NASDAQ’s website. The message read: “The Elite Computer Hacking
group ULG uprooted the Nasdaq Stock Market Web Site. . . . Their goal was to
attempt to make stocks rise drastically, thus making all investors happy, hopefully
ending with the investors putting bumper stickers on their Mercedez [sic] that say
‘Thanks ULG!’” (Kahney, 1999).
Over a month later on Halloween, the group again targeted a media outlet and
attacked the Associated Press. The message in this attack was simply an Edgar
Allan Poe poem (Associated Press, 1999a).
There has been some speculation that the United Loan Gunmen may have been
the same group as Hacking for Girlies—another hacker group at the time (Bur-
rough, 2000; Kahney, 1999). Hacking for Girlies was responsible for an attack on
the New York Times’s website roughly a year prior to the attacks carried out by the
United Loan Gunmen. Similarities between the attack on the New York Times and
the attacks by the United Loan Gunmen have been noted—such as the code used
U n i t e d S tat e s C y b e r C o mma n d 421

by both groups. However, there is no definitive proof that the two groups are one
and the same (Burrough, 2000).

of Cyber Command is to “direct, synchronize, and coordinate cyberspace plan-

ning and operations to defend and advance national interests in collaboration with
domestic and foreign partners” (U.S. Cyber Command, 2018). As part of this mis-
sion, Cyber Command does work to defend U.S. Department of Defense computer
systems from cyberattack. Additionally, it works to defend the U.S. infrastructure
from cyberattacks in general (U.S. Department of Defense, 2018).
There are numerous entities that can launch cyberattacks against the United
States. As noted above, cybercriminals can launch such attacks. Terrorist organiza-
tions or hacktivist groups may do the same (U.S. Cyber Command, 2018). While
Cyber Command does work to prevent cyberattacks from all sources, its focus is
on cyberattacks from countries (Department of Defense, 2018).

limits removed, the cybercriminals are able to withdraw an “unlimited” amount

of money from ATMs (limited only by the amount of money actually in the ATMs
targeted). Money is withdrawn until financial institutions recognize what is going
on and prevent further withdrawals (Federal Financial Institutions Examination
Council, 2014; United States Attorney’s Office Eastern District of New York, 2014).
The amount of money that can be stolen through this method is substantial. In
2011, an international cybercriminal organization managed to steal $14 million
in just 48 hours. In that instance, the organization obtained prepaid debit card
information to perpetrate the unlimited operation. The prepaid debit cards were
ones that the American Red Cross intended to provide to disaster victims. Qen-
drim Dobruna—one of the members of that cybercriminal organization—pleaded
guilty to bank fraud and was sentenced to 50 months in prison in 2015 (United
States Attorney’s Office Eastern District of New York, 2014, 2015). In 2012 and
2013, another international cybercriminal organization carried out two unlim-
ited operation attacks, stealing a combined total of $45 million. In the first
attack, the organization targeted a company that processed prepaid debit cards
in the United Arab Emirates. The second attack targeted a similar company is
Oman. In the United States, seven members of this cybercriminal organization
were arrested for their involvement in these attacks—Jael Mejia Collado, Joan
Luis Minier Lara, Evan Jose Pena, Jose Familia Reyes, Elvis Rafael Rodriguez,
Emir Yasser Yeje, and Chung Yu-Holguin (United States Attorney’s Office Eastern
District of New York, 2013).
As with cybercrime in general, there is the risk that another unlimited operation
attack could be carried out. Indeed, in late 2018, the Federal Bureau of Investiga-
tion (FBI) provided a warning to financial institutions concerning an imminent
unlimited operation attack. It appears the warning may have been in relation to an
unlimited operation attack that happened shortly after the warning was given. In
that incident, approximately $13.5 million was stolen from accounts through an
Indian bank in India, Hong Kong, and Canada (Krebs, 2018).

See also: Credit Card Fraud; Federal Bureau of Investigation; Keystroke Monitor-
ing; Malware; Phishing; Skimmer

Further Reading
Federal Financial Institutions Examination Council. 2014. “Cyber-attacks on financial
institutions’ ATM and card authorization systems.” April 2, 2014. https://ithandbook
.ffiec.gov/media/154261/unlimited_atm_cash-out_4-2-2014-final.pdf
Frazee, Gretchen. 2018. “Hackers are preparing an ‘unlimited’ ATM cash heist. Here’s how
to protect yourself.” PBS, August 15, 2018. https://www.pbs.org/newshour/economy
/hackers-are-preparing-an-unlimited-atm-cash-heist-heres-how-to-protect-yourself
Krebs, Brian. 2018. “FBI warns of ‘unlimited’ ATM cashout blitz.” Krebsonsecurity, August
12, 2018. https://krebsonsecurity.com/2018/08/fbi-warns-of-unlimited-atm-cashout
-blitz/
United States Attorney’s Office Eastern District of New York. 2013. “Eight members of
New York cell of cybercrime organization indicted in $45 million cybercrime cam-
paign.” United States Department of Justice, May 9, 2013. https://www.justice.gov
424 U . S . P r e s i d e n t i al E le c t i o n I n t e r f e r e n c e , 2 0 1 6

/usao-edny/pr/eight-members-new-york-cell-cybercrime-organization-indicted-45
-million-cybercrime#FOOT1
United States Attorney’s Office Eastern District of New York. 2014. “International hacker
pleads guilty to 2011 global cyberattack.” United States Department of Justice, July 11,
2014. https://www.justice.gov/usao-edny/pr/international-hacker-pleads-guilty-2011
-global-cyberattack
United States Attorney’s Office Eastern District of New York. 2015. “Cybercriminal sen-
tenced to 50 months for his role in hacking campaign.” United States Department of
Justice, June 29, 2015. https://www.justice.gov/usao-edny/pr/cybercriminal-sentenced
-50-months-his-role-hacking-campaign

U.S. PRESIDENTIAL ELECTION

INTERFERENCE, 2016
During the 2016 U.S. presidential election, Russia used cyberattacks in an attempt to
influence the election’s outcome. According to Robert S. Mueller (2019)—the spe-
cial counsel appointed to investigate Russia’s interference in the election—Russia’s
interference had a two-prong approach. First, Russia engaged in a misinformation
campaign using false social media accounts. Second, Russia infiltrated the com-
puters of individuals and other entities associated with the campaign of presiden-
tial candidate Hilary Clinton, stole information from those computers, and then
released that information to the public.
The misinformation campaign conducted by Russia was done through the IRA.
The IRA is a Russian organization funded by Russian oligarch Yevgeniy Viktoro-
vich Prigozhin. Prigozhin is believed to have ties to Vladimir Putin, the president
of Russia. Members of the IRA created false social media accounts, pretending to
be activists in the United States. The accounts would occasionally falsely claim
that the fictitious activist was affiliated with an actual political organization in the
United States. These accounts would be used to spread information with the pur-
pose of influencing the United States electorate. The IRA started in 2014. Its initial
goal was to create discord generally in the political system of the United States.
By 2016, the goal of the IRA became more specific. The information it spread
was designed to favor presidential candidate Donald Trump and discredit Hilary
Clinton. It is believed that this shift in goals occurred—at least in part—because
Putin blamed Clinton for inciting protests against him in 2011 and 2012 while
she was secretary of state (Office of the Director of National Intelligence, 2017).
The IRA was able to reach a sizeable portion of the electorate through their efforts.
Facebook estimated the IRA was able to reach approximately 126 million people
through its accounts on the social media platform. Twitter estimated that over a
million of its users had been reached by IRA accounts on its platform. In some
instances, political figures in the United States had retweeted information from IRA
Twitter accounts (albeit without knowledge that the accounts were IRA-run). In
addition to false accounts, the IRA also paid for advertisements on Facebook to try
and reach and influence more people. Facebook indicated the IRA had purchased
over 3,500 advertisements.
U . S . P r e s i d e n t i al E le c t i o n I n t e r f e r e n c e , 2 0 1 6 425

Russian efforts to hack into computers and other databases of those associated
with the Clinton campaign began in 2016. These attacks were carried out by Rus-
sia’s GRU. Among those hit were Clinton’s campaign chairman John Podesta and
the Democratic National Committee. The GRU used spearphishing to gain access
to the e-mail accounts of victims. Information gained from the e-mail accounts
of victims of the spearphishing was used to access the networks of other victims.
Among the documents stolen were personal e-mails, fundraising data, and opposi-
tion research on Trump. The documents were released to the public prior to the
election through online entities created by the GRU, known online as “DCLeaks”
and “Guccifer 2.0.” WikiLeaks also released some of these documents (WikiLeaks,
2016). Evidence exists that indicates the documents were sent to WikiLeaks by the
GRU, though WikiLeaks denies it received the documents from Russia. WikiLeaks
appears to have gotten involved due to Julian Assange’s opposition to Clinton.
This incident led to accusations against WikiLeaks of being biased and politi-
cally motivated (Smith, 2016). The timing of the releases by WikiLeaks seemed
to further such opinions. For example, speeches Clinton gave to Wall Street
bankers—wherein she expressed that it was necessary in politics to have “both
a public and a private position” (BBC News, 2016)—were released minutes after
video surfaced of Trump bragging about groping women (Smith, 2016).
Mueller’s investigation into Russia’s interference in the 2016 presidential elec-
tion resulted in the indictment of 25 Russian individuals and three Russian compa-
nies. Of those 25 individuals, 12 were officers in the GRU. The companies charged
include the IRA and two shell companies that were used to fund the IRA. Among
the individuals indicted is Prigozhin, the financier of the IRA (Prokop, 2019).
While the results of Mueller’s investigation provide evidence of Russia’s inter-
ference in the 2016 presidential election in the United States, not everyone has
agreed that this is the case. Russia has denied that it interfered. Also, Trump has
discounted Russia’s involvement in the 2016 election, casting such claims as a
fiction concocted by supporters of Clinton to explain why she lost the election
(Decker, 2016).
Russia’s interference in the 2016 presidential election does not appear to be
an isolated incident. Russia also attempted to influence the United States elector-
ate during the 2018 midterm elections (Ferran and Good, 2018). One Russian
citizen—Elena Khusyaynova—was indicted for conspiring to defraud the United
States by spending over $10 million on political advertisements in the United
States for the purpose of interfering with the political system in the United States.
It is believed that Khusyaynova works for Concord—one of the shell companies
used to fund the IRA that was indicted by Mueller (Gerstein, 2018).

of China) to censor certain websites. Russia likewise regulates VPNs, requiring

them to register with the government and to block websites banned by the govern-
ment (Kan, 2019).
According to one study, less than a third of the people surveyed (29%) indi-
cated they used a VPN (Moscaritolo, 2018). While the use of a VPN can increase
online security, the use of a VPN does not guarantee that a user will be immune
from cybercrime. A VPN does encrypt communications to keep them private from
others. However, the VPN provider is still privy to that information. If a VPN pro-
vider decides to sell that information (something free VPN providers may are more
likely to do as a means of gathering revenue), your information is no longer secure
(Dinha, 2019). It is possible that an employee of the VPN provider might access
personal information for criminal purposes. In short, a VPN is only as secure as the
provider of that VPN. Tor faces similar problems. The operator of the last computer
in the random path of computers that a Tor user is processed through (known as
the exit node) can observe that user’s online activity even though it is not viewable
by others. Accordingly, if the operator of an exit node wants to intercept personal
information passing through their node and use it for criminal purposes, they can
(Franceschi-Bicchierai, 2015).

Computer viruses operate in a similar fashion on computers. A computer virus will

infect a host computer and then replicate itself on that host computer. Just as a
biological virus can spread, so too can a computer virus spread.
There are several names for various forms of malware, and the distinction
between various forms of malware is not universally agreed upon. This applies to
viruses. Computer viruses are similar to computer worms. While the exact distinc-
tion between viruses and worms is disputed, there are some general differences
recognized between the two forms of malware. Viruses—as noted above—as simi-
lar to their biological counterparts in that they require a host to replicate. Worms
also replicate, but they do not require a host computer to do so. Also, viruses are
generally used to describe malware that spreads on a single computer, whereas
worms are able to spread over computer networks (Karresand, 2002). This is not
to say that viruses cannot spread from one computer to another. However, a virus
generally will require some sort of human action (e.g., the owner of the infected
computer sending an infected e-mail to someone and that person opening the
infected e-mail on their computer) to spread, whereas a worm does not necessarily
require a human action. The terms “virus” and “Trojan horse” are often conflated
as well. A Trojan horse generally refers to malware that makes its way onto a tar-
get computer through some form of deception. How it spreads from there is less
specific. Thus, a Trojan horse could be considered a virus by some and a worm by
others (Karresand, 2002).
Computer viruses are designed to harm the target computer. What type of harm
the virus is designed to cause (i.e., the payload) can vary from virus to virus. The
Stuxnet virus, for example, was designed to do physical damage to property. Spe-
cifically, it was designed to damage equipment at an Iranian uranium enrichment
facility (Weinberger, 2012). The Zeus virus compromises personal information on
target computers. The Code Red virus was able to force websites to shut down,
including the White House website (Weinberger, 2012). As noted above, there is
not a universally agreed-upon distinction between different forms of malware, and
it could be argued that these examples are not viruses at all. Nonetheless, these
examples do illustrate the point that the harm caused by viruses and other malware
is not always well defined. Thus, simply referring to a piece of malware as a virus
does not give one a full picture of the threat posed by the malware. It is necessary
to describe the features of the malware (e.g., the way the malware spreads, the
specific harm it causes) to understand the malware and begin to combat it (Kar-
resand, 2002).

others that discover vulnerabilities in an organization’s system a specific method to

report those vulnerabilities to the organization.

See also: Bypass; Hacker and Hacking; Identity Theft; Password; Spyware

Further Reading
Arora, Ashish, Ramayya Krishnan, Rahul Telang, and Yubao Yang. 2010. “An empirical
analysis of software vendors’ patch release behavior: Impact of vulnerability disclo-
sure.” Information Systems Research, Vol. 21, No. 1, pp. 115–132.
Arora, Ashish, Anand Nandkumar, and Rahul Telang. 2006. “Does information security
attack frequency increase with vulnerability disclosure? An empirical analysis.” Infor-
mation Systems Frontiers, Vol. 8, No. 5, pp. 350–362. https://doi.org/10.1007/s10796
-006-9012-5
Corfield, Gareth. 2019. “Buffer overflow flaw in British Airways in-flight entertainment
systems will affect other airlines, but why try it in the air?” The Register, March 8, 2019.
https://www.theregister.co.uk/2019/03/08/thales_topseries_vuln/
Lindros, Kim. 2016. “12 hardware and software vulnerabilities you should address now.”
Computerworld, October 12, 2016. https://www.computerworld.com/article/3130119
/12-hardware-and-software-vulnerabilities-you-should-address-now.html
Mahairas, Ari, and Peter J. Beshar. 2018. “A perfect target for cybercriminals.” The New
York Times, November 19, 2018. https://www.nytimes.com/2018/11/19/opinion/water
-security-vulnerability-hacking.html
McCullen, Robert. 2018. “Cyberthreats: A 10-year perspective.” Forbes, May 15, 2018.
https://www.forbes.com/sites/forbestechcouncil/2018/05/15/cyberthreats-a-10-year
-perspective/#29b167525e9e
Porup, J. M. 2018. “Do you need a vulnerability disclosure program? The feds say yes.”
CSO, August 7, 2018. https://www.csoonline.com/article/3294418/do-you-need-a
-vulnerability-disclosure-program-the-feds-say-yes.html
Robertson, Jordan and Michael Riley. 2018. “The big hack: How China used a tiny chip
to infiltrate U.S. companies.” Bloomberg Businessweek, October 4, 2018. h ttps://
www.bloomberg. com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny
-chip-to-infiltrate-america-s-top-companies
W
WA R D I A L E R
A war dialer is a piece of software that calls a range of phone numbers and notes
which of those numbers is connected to a standard telephone, fax machine, or
modem (Mienel, 1998; Ryan, 2004). The software is able to determine whether
a number is connected to a modem based on the carrier tone produced when
that number is called (Berghel, 2004). A log of the numbers associated with a
modem—indicating a connection to a computer—is then made.
The term “war dialer” comes from the 1983 movie WarGames (Ryan, 2004).
In the movie, the protagonist uses the technique described above to locate the
computers of a computer game company. The “war” part of the movie’s title has
been added to the term “dialing” to describe this practice. A war dialer is thus the
software that enables one to engage in war dialing.
The legality of war dialing is dubious. The Federal Communications Commis-
sion (FCC) regulates the use of autodialers—automatic telephone dialing systems
(Federal Communications Commission, 2015). Generally, autodialers that contact
people without their consent operate illegally. Though not specifically addressed
by name, the definition of autodialers by the FCC would appear to encompass war
dialers (Federal Communications Commission, 2015). Thus, if a war dialer were
to call a number without the consent of the owner of that number, that act would
likely be considered to be in violation of FCC regulations. As will be discussed
below, war dialers are generally used as a hacking tool, and thus it is difficult to
envision a situation where someone would consent to being called by a war dialer.
Thus, the use of war dialers is likely illegal in most (if not all) instances.
Detecting those using war dialers can be more difficult than detecting those who
use general autodialers. This is because war dialers have a purpose distinct from
general autodialers. General autodialers are generally used by telemarketers and
other businesses to contact potential customers. Those who are contacted through
an autodialer who do not wish to be contacted will likely know who is contacting
them, and they can file a complaint against the offending company accordingly.
Someone using a war dialer does not aim to contact anyone. As noted above, a war
dialer is simply trying to locate numbers that are connected to a modem. A war
dialer can accomplish this without anyone ever answering the phone. If someone
picks up the phone—indicating the number that is being called is connected to a
telephone and not a modem—the war dialer will simply hang up and move on to
the next number (Ryan, 2004). Thus, those who are contacted by war dialer either
never answer the phone and are unaware they have been contacted, or they answer
the phone to the sound of a disconnected call. In the latter instance, the person
438 Wa r d r i v i n g

contacted will not immediately (if ever) be able to determine who contacted them,
making the filing of a complaint difficult, if not impossible.
It is not the inconvenience of receiving a random call from a war dialer that is
the primary harm of war dialing. It is what is done with the information obtained
from a war dialer that is most harmful. Once a modem-associated phone number
is discovered, the owner of the war dialer can then attempt to hack into the com-
puter connected to that modem, or the owner could post that data online for oth-
ers hackers to make use of (Ryan, 2004). If someone is hacked using data derived
from a war dialer, there is a bevy of other crimes that hacker could be charged with,
depending on the type of harm that hacker inflicts on the owner of that computer.
It should be noted that war dialers can be used by people other than hackers
intending to do harm to the computers they locate. It is possible that a company
or government agency may want to hire someone to attempt to hack into their
computers to help expose vulnerabilities in their computer system. Indeed, hack-
ers have helped some states test the vulnerability of their electronic voting systems
to war dialing and other hacking tactics (Ryan, 2004). In such an instance, the
use of a war dialer would likely be legal. The business or agency has consented to
the hacker using a war dialer to attempt to access its computers and would thus
not appear to run afoul of FCC regulations. Additionally, the hacker has no intent
to do harm to the computers if they do gain access. There is a gray area when
dealing with benevolent hackers—hackers who hack to alert their targets of the
vulnerabilities of their computer network, but do not have the express consent of
their targets to engage in such hacking. Those hackers may be in violation of FCC
regulations if they do not have consent, but they are likely not in violation of any
criminal laws if no harm is caused by their actions (Ryan, 2004).

is similar to war dialing. Wardialing is the process of dialing a range of phone

numbers and logging those that are connected to a modem, and thus connected
to a computer. As the existence of modem connections via phone line predates
Wi-Fi networks, war dialing predates wardriving. Accordingly, the term “wardriv-
ing” was derived from “war dialing.” The term “war dialing” originally came from
the 1983 movie WarGames, wherein the movie’s protagonist engaged in war dialing
(Ryan, 2004). The “war” part of the movie’s title was added to the term “dialing” to
describe this practice.
Wardriving originated around 1999. The practice was founded by Peter Shipley
(Berghel, 2004). The concerns with wardriving are similar to war dialing. With war
dialing, once a log of computer-connected phone lines is compiled, hackers can
then attempt to gain unauthorized access to those computers through those phone
lines. With wardriving, once a log of Wi-Fi networks is compiled, hackers can then
attempt to gain unauthorized access to those networks.
With both war dialing and wardriving, those who compile logs will often
share those logs on the internet. With wardriving, however, an additional
method of disseminating information from those logs has emerged, known as
warchalking. Warchalking is the practice of using chalk to make notations of
available Wi-Fi networks. These marks can be made on any surface within the
range of that Wi-Fi network, such as the wall of a building or the sidewalk. A
body of warchalking symbols has emerged—similar to the symbol system used
by hobos during the Great Depression—letting warchalkers communicate (Ber-
ghel, 2004).
There is a range of harm that can result from wardriving. On one end of the
scale, you may simply have people taking advantage of an unsecured Wi-Fi net-
work, gaining internet access without having to pay for it. On the other end, a
Wi-Fi network could be accessed with malicious intent, exposing the victim of
wardriving to malware attacks, rendering their personal information vulnerable,
or similar harms.
Wardriving can also be beneficial. As with war dialing, proactive network admin-
istrators may use driving to determine the vulnerabilities in their network (Ber-
ghel, 2004). These vulnerabilities can then be addressed, making their network
more secure. There is an ethical gray area with wardriving regarding beneficent
wardrivers—those who wardrive with the intent to expose Wi-Fi network vulner-
abilities, but without the intent to exploit those vulnerabilities. Those wardrivers
arguably provide a service to those network owners whose networks have vulner-
abilities. However, where the consent of the network owners is not first obtained
before looking for these vulnerabilities, there arises a question as to whether such
actions are ethical (Ryan, 2004).

individual computer owners? There is perhaps no easy answer to that question.

The Welchia worm, if nothing else, can serve as a cautionary tale of how good
intentions can still have catastrophic effects.

Julian Assange founded WikiLeaks in 2006. Prior to founding the organization,

Assange worked in computer programming. He had also been involved in hacking
early on in life. In 1991, he was arrested for hacking into the computer systems of
Nortel (Khatchadourian, 2010). He ultimately pleaded guilty to numerous crimi-
nal charges related to that incident but avoided incarceration as part of his sentence
(Kwek, 2010). As to his motivations for founding WikiLeaks, Assange has said:

I looked at something that I had seen going on with the world, which is that I thought
there were too many unjust acts. And I wanted there to be more just acts, and fewer
unjust acts. . . . [Y]ou can change the behavior of many people with a small amount
of information. The question then arises as to what kinds of information will produce
behavior which is just and disincentivize behavior which is unjust? (Assange, 2014)

Assange saw the censorship of information as detrimental. There are those who
might be able to use information to effectuate change of an unjust situation, but
if they never receive that information, they will never be able to act on it. Assange
noted that many people in possession of sensitive information—such as govern-
ment employees or employees of large corporations—may self-censor because of
fear of the repercussions of sharing that information with the public. For Assange,
having an organization like WikiLeaks that would allow individuals to share infor-
mation with anonymity so they did not have to fear the repercussions of their
actions helped negate this self-censorship, which in turn would make important
information available that could hopefully be used to curb injustice (Assange,
2014).
Assange described himself at one point as the editor-in-chief of WikiLeaks
(Guardian, 2010). Due to various legal concerns—some tied to his involvement
with WikiLeaks and some not—Assange has been living at the Ecuadoran embassy
in London since 2012. This has at times impeded his ability to communicate and
be involved with WikiLeaks (Greenfield, 2018). Accordingly, Assange stepped
down as editor-in-chief of WikiLeaks in late 2018, handing that position to Kris-
tinn Hrafnsson—an Icelandic journalist who had been a spokesman for WikiLeaks
six years preceding her appointment as editor-in-chief (Corfield, 2018).
WikiLeaks has made several noteworthy document leaks, many of them reveal-
ing classified government documents. The leak that initially appears to have
brought WikiLeaks into the limelight was the 2010 leak of documents by Chel-
sea Manning—an U.S. Army intelligence officer at the time (Cadwalladr, 2018;
Khatchadourian, 2017). The leaks included diplomatic cables, as well as docu-
ments concerning the wars in Iraq and Afghanistan. The leak contained footage
from U.S. military helicopters in 2010. The footage depicts the slaying of several
people in New Baghdad, Iraq; journalists were among those slain (WikiLeaks,
2010). Manning was charged with disclosing these videos and the other docu-
ments to WikiLeaks and was ultimately convicted and sentenced to 35 years
in prison. President Obama later commuted her sentence, and she is now free
(Savage, 2017). Opinions on WikiLeaks and Manning were split following this
leak. Manning has been referred to as a traitor by some and as a hero by others
444 W i k i L ea k s

(see Valencia, 2010). One study found that the public was nearly split on whether
the release of documents related to the war in Afghanistan served or harmed the
public interest. Of those who had some knowledge of WikiLeaks disclosures,
42 percent said it served the public interest, and 47 percent said it harmed it.
In regards to the disclosure of diplomatic cables, 60 percent of those with some
knowledge of the disclosures felt it harmed the public interest, compared to 31 per-
cent who felt it benefited it (Pew Research Center, 2010).
WikiLeaks has disclosed numerous documents since then. In 2011, WikiLeaks
released documents related to prisoners held at the detention center at Guanta-
namo Bay, Cuba. The documents include the names of the detainees, detainee
accounts of how they came to be in Guantanamo Bay, assessments of the reliability
of the information detainees provided, and a threat assessment of the detainees
(WikiLeaks, 2011).
While many of the leaks WikiLeaks publishes are from governments and politi-
cal groups, it has not limited itself to leaks from those sources. In 2008, WikiLeaks
published the secret bibles of Scientology. It has also republished documents ini-
tially leaked from other sources. In 2013, it republished communications among
climate change researchers allegedly discussing how to manipulate data that does
not support their position that climate change was occurring. These e-mails were
initially obtained by a hacker and published in November 2009 (Leyden, 2012).
As of early 2019, it is still unknown who the hacker was. This incident has come
to be known as Climategate.
The response to these disclosures has been mixed. Climate change skeptics
claimed the communications were proof that the scientists mentioned in the com-
munications were falsifying evidence of climate change. Others claim the disclo-
sures prove nothing of the sort and that the communications are taken out of
context by skeptics wishing to discredit the evidence in support of climate change.
The Climategate disclosures do not appear to have had much of an impact on the
opinions of climate researchers (see Henig, 2009). WikiLeaks also republished
a document archive from Sony in 2015. The documents were initially obtained
and disclosed by hackers calling themselves the Guardians of Peace. As there was
speculation that the hack was orchestrated by North Korea over its upcoming
release of The Interview—a comedy whose plot centered on the assassination of
North Korean leader Kim Jong-un—WikiLeaks saw the documents to be of public
interest. It republished the documents in a form that was more easily searchable
(Thielman, 2015).
WikiLeaks found itself in the middle of a document disclosure in 2016 that
led some to question the neutrality of WikiLeaks. That year, it released e-mails of
presidential candidate Hilary Clinton and other DNC officials (WikiLeaks, 2016).
Many of these e-mails were released prior to the 2016 election. Several of the
e-mails contained information that appeared to be detrimental to Clinton’s presi-
dential run. In one e-mail, it appears Clinton may have been provided a ques-
tion in advance of a Democratic presidential primary debate by CNN employee
Donna Brazile. Also included in the disclosures were statements made by Clinton
to Wall Street bankers in a paid speech. In one speech, she said the following about
W i k i L ea k s 445

politics: “But if everybody’s watching, you know, all of the back room discussions
and the deals, you know, then people get a little nervous, to say the least. So, you
need both a public and a private position.” In another e-mail, Clinton’s campaign
chairman—John Podesta—criticized Clinton for having terrible instincts. In yet
another e-mail, a Clinton spokesman—Josh Schwerin—appeared to indicate that
President Barack Obama had lied to the press about his awareness of Clinton’s use
of a private e-mail server while serving as President Obama’s Secretary of State
(BBC News, 2016). The use of a private e-mail server was an issue over which Clin-
ton came under scrutiny as it potentially violated federal law regarding retention of
official communications of government officials.
The content of these leaked communications, coupled with the timing of them
before the 2016 presidential election, led to criticisms of WikiLeaks being politi-
cally motivated (Smith, 2016). Public opinion of WikiLeaks appeared to change
based on one’s political affiliation. In one study, it was found that 12 percent
of Republicans who were aware of the e-mail leaks felt the disclosure of the
e-mails was harmful to the public, compared to 48 percent of Democrats who
were aware of the leaks who felt the disclosure was harmful. This differed from
attitudes towards the disclosure of diplomatic cables from Chelsea Manning six
years prior. With regard to that disclosure, 75 percent of Republicans who were
aware of the leaks found them to be harmful to the public, compared to 53 per-
cent of Democrats who were aware of the leaks finding them to be harmful to
the public (Moore, 2016). During the 2008 U.S. presidential election, WikiLeaks
disclosed e-mails that had been hacked from Sarah Palin, the Republican vice
presidential candidate in that year’s election. Palin criticized WikiLeaks follow-
ing this incident. Following the disclosure of diplomatic cables from Manning
in 2010, Palin said WikiLeaks should be permanently shut down. Following the
release of the DNC e-mails, Palin apologized to Assange for her past criticisms
(Engel, 2017). Clinton did ultimately lose the 2016 U.S. presidential election.
Although the e-mails disclosed by WikiLeaks may have played a part in that, the
exact impact of the e-mails on the election is difficult is not impossible to deter-
mine (Enten, 2016).
Since the founding of WikiLeaks, several websites have been founded that
seek to serve the same purpose. There are several that do exactly what WikiLeaks
does, but with a regional focus (e.g., B alkanleaks.eu, Frenchleaks.fr). Some past
regional sites (e.g., T
haileaks.info, Tunileaks.appspot.com) were set up to mirror
WikiLeaks documents in countries that had blocked WikiLeaks itself (Greenberg,
2011). Other leak sites focus on documents relating to a specific topic. Some past
topic-specific leak sites include Unileaks.org (leaks regarding institutions of higher
education) and Enviroleaks.org (leaks regarding the state of the environment).
There are others that are still in operation as of early 2019, such as Securileaks.org
(leaks regarding global security) and Mormonleaks.io (leaks regarding the Mor-
mon church).

See also: Assange, Julian; Hacker and Hacking; Manning, Chelsea; Sony Pictures
Entertainment Hack
446 W i k i L ea k s

Further Reading
Assange, Julian. 2014. “Julian Assange: Why I founded WikiLeaks.” Newsweek, Decem-
ber 24, 2014. https://www.newsweek.com/julian-assange-why-i-founded-wikileaks
-294283
BBC News. 2016. “18 revelations from Wikileaks’ hacked Clinton emails.” October 27,
2016. https://www.bbc.com/news/world-us-canada-37639370
Cadwalladr, Carole. 2018. “I spent seven years fighting to survive’: Chelsea Manning
on whistleblowing and WikiLeaks.” The Guardian, October 7, 2018. https://www
.theguardian.com/us-news/2018/oct/07/chelsea-manning-wikileaks-whistleblowing
-interview-carole-cadwalladr
Corfield, Gareth. 2018. “‘Incommunicado’ Assange anoints new WikiLeaks editor in chief.”
The Register, September 27, 2018. https://www.theregister.co.uk/2018/09/27/assange
_replaced_as_wikileaks_editor/
Engel, Pamela. 2017. “Sarah Palin apologizes to WikiLeaks founder Julian Assange, who
she says ‘finally opened people’s eyes.’” Business Insider, January 4, 2017. https://www
.businessinsider.com/sarah-palin-apologizes-to-julian-assange-2017-1
Enten, Harry. 2016. “How much did WikiLeaks hurt Hillary Clinton?” FiveThirtyEight,
December 23, 2016. https://fivethirtyeight.com/features/wikileaks-hillary-clinton/
Greenberg, Andy. 2011. “TooManyLeaks: A list of twenty WikiLeaks copycats.” Forbes,
April 8, 2011. https://www.forbes.com/sites/andygreenberg/2011/04/08/toomanyleaks
-a-list-of-twenty-wikileaks-copycats/#2330b43147d9
Greenfield, Patrick. 2018. “Julian Assange to regain internet access at embassy base—
Reports.” The Guardian, October 14, 2018. https://www.theguardian.com/media/2018
/oct/14/julian-assange-to-regain-internet-access-in-embassy-base
The Guardian. 2010. “Julian Assange answers your questions.” December 3, 2010. h ttps://
www.theguardian.com/world/blog/2010/dec/03/julian-assange-wikileaks
Henig, Jess. 2009. “Factcheck: Climategate doesn’t refute global warming.” Newsweek,
December 10, 2009. https://www.newsweek.com/factcheck-climategate-doesnt-refute
-global-warming-75749
Khatchadourian, Raffi. 2010. “No Secrets: Julian Assange’s mission for total transparency.”
The New Yorker 86, 16: 40.
Khatchadourian, Raffi. 2017. “Julian Assange, a man without a country.” The New Yorker,
August 21, 2017. https://www.newyorker.com/magazine/2017/08/21/julian-assange-a
-man-without-a-country
Kwek, Glenda. 2010. “Magnet for trouble: How Assange went from simple island life to
high-tech public enemy number one.” Sydney Morning Herald, December 8, 2010.
https://www.smh.com.au/technology/magnet-for-trouble-how-assange-went-from
-s imple -i sland -l ife -t o -h ightech -p ublic -e nemy -n umber -o ne -2 0101208 -1 8pb3
.html
Leyden, John. 2012. “Climategate cops: We’ll NEVER solve email leak hack riddle.” The
Register, July 20, 2012. https://www.theregister.co.uk/2012/07/20/climategate_hack
_investigation_killed_off/
Moore, Peter. 2016. “Turnaround in public opinion on latest Wikileaks.” YouGov, Octo-
ber 25, 2016. https://today.yougov.com/topics/politics/articles-reports/2016/10/25
/turnaround-public-opinion-latest-wikileaks
Pew Research Center. 2010. “Most say WikiLeaks release harms public interest.” Pew
Research Center, December 8, 2010. http://www.people-press.org/2010/12/08/most
-say-wikileaks-release-harms-public-interest/
W o me n , E f f e c t s o n 447

Savage, Charlie. 2017. “Chelsea Manning to be released early as Obama commutes sen-
tence.” New York Times, January 17, 2017. https://www.nytimes.com/2017/01/17/us
/politics/obama-commutes-bulk-of-chelsea-mannings-sentence.html
Smith, David. 2016. “From liberal beacon to a prop for Trump: What has happened to
WikiLeaks?” The Guardian, October 14, 2016. https://www.theguardian.com/media
/2016/oct/14/wiileaks-from-liberal-beacon-to-a-prop-for-trump-what-has-happened
Thielman, Sam. 2015. “WikiLeaks republishes all Sony hacking scandal documents.” The
Guardian, April 17, 2015. https://www.theguardian.com/technology/2015/apr/16
/wikileaks-documents-sony-hacking-school
Valencia, Nick. 2010. “Berkeley tables resolution to call suspected WikiLeaks soldier
‘hero.’” CNN, December 15, 2010. http://www.cnn.com/2010/US/12/15/california
.berkeley.wikileaks/index.html
Wikileaks. 2008a. “Church of Scientology’s ‘Operating Thetan’ documents leaked online.”
https://wikileaks.o rg/w iki/C
hurch_of_Scientology%2 7s_%2 7Operating_Thetan%2 7
_documents_leaked_online
Wikileaks. 2008b. “VP contender Sarah Palin hacked.” https://wikileaks.org/wiki/VP_con-
tender_Sarah_Palin_hacked
Wikileaks. 2010. “Collateral murder.” https://collateralmurder.wikileaks.org/en/index.html
Wikileaks. 2011. “The Guantanamo files.” https://wikileaks.org/gitmo/
Wikileaks. 2013. “CLIMATE: Assortment of statements from East Anglia.” https://wikileaks
.org/gifiles/docs/40/404797_climate-assortment-of-statements-from-east-anglia-.html
Wikileaks. 2015. “Press release.” https://wikileaks.org/sony/press/
Wikileaks. 2016. “DNC email database.” https://wikileaks.org//dnc-emails/
Wikileaks. 2018. “Hillary Clinton email archive.” https://wikileaks.org/clinton-emails/

W I R E TA P P I N G , see P E N R E G I S T E R

WOMEN, EFFECTS ON
As the number of women using the internet and social media increases, more
women are reporting becoming victims of cyberviolence. Statistics on this phe-
nomenon are lacking, but initial statistics show that cyberviolence against women
is concerning. One study by the UN indicates that 73 percent of women report
being abused in some way through an online medium (UN Report, 2015). Another
study estimates this number to be 57 percent (Rad Campaign, 2018). Another
report by the EU indicates that one in 10 women have been the victim of cyber vio-
lence (European Institute for Gender Equality, 2017a). Victimization is also related
to age. A study by the Cyber Crime Awareness Foundation found that 73.71 per-
cent of young women between the ages of 18 and 30 reported that they were the
victim of cybercrime. This is the highest percentage of cybercrime victimization of
all age groups (Mahmud, 2018). Additionally, about 63 percent of women in Amer-
ican report that they know someone who has been the victim of online harassment,
whereas only 37 percent of men report this (Women’s Media Center, “Research”).
Many of the cybercrime offenses that affect women are related to social media.
However, it also is a convenient way to harass or bully the women (Halder and
448 W o me n , E f f e c t s o n

Jaishankar, 2011). Harassment is sometimes carried out through e-mails. An

offender may send e-mails that are threatening, offensive, or even bullying in
nature. The offender may threaten to cause harm to the victim or their family and
friends. Even though many offenders may not go through with the threats, many
others choose to carry through with the violence. It has been estimated that users
who have female usernames in chatrooms are 25 times more likely to receive mes-
sages that are either threatening or sexually explicit than those who use either male
names or names that are not identified as either male or female (Women’s Media
Center, “Research”).
Another similar and common cyber offense against women is stalking. About
26 percent of young women admit to being cyberstalked as compared to 7 percent
of young men (Women’s Media Center, “Research”). There are a multitude of ways
an offender can stalk a women online. An offender may follow a woman and then
post their daily routine online or what they are wearing, just so the victim knows
they are being watched. A stalker may also send multiple e-mails to the offender
each day that will bog down the victim’s e-mail service. Offenders can even publish
a victim’s personal information on line, so their home address and phone num-
ber will be made available to the public. This is made worse when the offender
encourages others to call and leave messages that are embarrassing or hurtful. The
offender may hack into a woman’s e-mails in order to intercept private communi-
cations, which may then be posted online.
Some offenders will create fake e-mails that appear to be coming from a female
victim, but they are actually from an offender. This is a form of identity theft. The
sent e-mail may include embarrassing or hateful messages, or it may be a plea
to send money. Similarly, offenders may imitate a victim in a social media outlet
or in a chat room. Those who read the comments will assume they are from the
cybercriminals. Other criminals have been known to photoshop a woman’s face to
a nude body and make it appear that they are involved in obscene behavior. This
photo can then be posted online or sent to others through an e-mail. It is often
difficult to discern if the photo is real. This technique is referred to as morphing.
A similar offense is to use hate speech or defamation against the victim. Offend-
ers use the computer to publish untrue or false comments about a person. Some
offenders will make critical comments about a woman, her body, a criminal back-
ground, or her private sexual history. They may make threats to release informa-
tion if the victim doesn’t do something, such as send money.
Women also are likely to become victims of cyber theft, particularly the e-mails
that promise to provide money for helping another person. Since women tend to
be the ones who care for others, they are more likely to fall victim to a plea for help,
even if it is not real.

Human Trafficking and Sex Trade

A dangerous issue that affects women is sex-oriented crimes. One of those is
human trafficking and the sex trade. Female victims are solicited through online
sites, and after a series of e-mails geared toward making the victim comfortable
W o me n , E f f e c t s o n 449

with the offender, they may meet in person and be lured into committing sex
offenses. Women are sometimes forced to “sex chat” with offenders, who then post
those messages online for other to see.
There are also thousands of sites dedicated to pornography and online prosti-
tution, and the number of those sites is increasing regularly. One study estimated
that there were 300,000 internet websites devoted to pornography, which was
a 350 percent increase from the previous year (Hughes, 2003). Another study
estimated that 37 percent of the internet is made up of pornographic matter
(Ward, 2013).
Women are frequently the victims of “revenge porn” whereby an offender will
post sexually graphic images of them without their permission or consent. The
photos or videos may have been captured during a previous relationship, or the
offender may have hacked into the personal files of the woman. Females comprise
upwards of 95 percent of the victims of this kind of attack (Women’s Media Center,
“Online”)
Many sites include opportunities for escort services that tend to be more
high-end or upscale, and are usually charge people by the hour. Here, the women
involved tend to be more attractive (Sharp and Earle, 2002, p. 37). There are also
prostitution sites made up of “independent” workers, who are women who have
chosen not to work for another person. The prices charged are less than for female
escorts. The websites for these women tend to be less professional and include
more pornographic pictures. Another type of online prostitution is massage par-
lors. For these, the prices tend to be cheaper but do not include the price for any
sexual acts (Sharpe and Earle, 2002).
Many women become the victims of romance schemes. It is estimated that
63 percent of victims in romance scams are female, with an average age of 50.
Moreover, it is estimated that women involved in these scams lose twice as much
money than men (Peachey, 2019). The women often meet someone on an online
dating site and fall in love. The offender asks for money so they can pay off debts
or so they can travel to see the woman. Unfortunately, once the money is received,
the person is never heard from again.
The women who become victims of cybercrimes often suffer both short- and
long-term consequences. In the short term, the victims will lose money and feel
scared or threatened. In the long term, female victims may find their reputations
harmed or even ruined. Their relationships with others can also be harmed or
ruined if posted comments are embarrassing or harmful. In some cases, the harass-
ment can lead to the loss of a job or career opportunities. The crimes can also lead
to emotional effects, including suicide or other violent acts (European Institute for
Gender Equality, 2017b; Judge, 2019).

is somewhat unique to computer worms is the ability to overload the process-

ing ability of a computer, causing it to shut down. A computer worm is able to
do this because it is self-replicating. It is able to make numerous copies of itself
on an infected computer, to the point where the infected computer is not able to
match the processing power necessary to run all copies of that worm. This is not
to say a computer virus could not accomplish the same thing, albeit with some
human-initiated action. However, the nature of computer worms makes such an
attack easier to carry out with a computer worm.
As noted above, a worm is not limited to replicating itself on the originally
infected computer or other electronic device. Worms can spread to other elec-
tronic devices without human intervention as well. To spread from one electronic
device to another, those electronic devices would have to be connected in some
fashion—the internet being perhaps the most likely way. The worm could use some
sort of messaging system—such as e-mail or an instant messaging application—to
help itself spread.
The damage done by computer worms can be extensive. The Code Red worm is
one of the most damaging computer worms to date. The worm infected just under
a million systems overall, a quarter of those within the first nine hours of opera-
tion. The damage resulting from the work was in excess of $2 billion (Rhodes,
2001). As mentioned above, the damage can extend beyond economic damage
(e.g., private data can be compromised).
Not all computer worms are released with the intent to do harm. There are
worms that have benevolent purposes. Some worms (e.g., Welchia, CodeGreen)
were released specifically to counteract malicious worms. Although these worms
are released with benevolent intent, there are still ethical concerns regarding these
types of worms because, even though they are released with the intent to do good,
the worms still access computers without the consent of the owner. Also, even
though the purpose of these worms is to help the owners of the accessed comput-
ers, there can be unintended consequences of the worms that end up doing harm
(Bransfield, 2003).

See also: Code Red; Malware; Melissa Worm; Nimda; Payload; Virus; Welchia Worm

Further Reading
Bransfield, Gene. 2003. The Welchia worm. Global Information Assurance Certification
Paper, December 18, 2003. North Bethesda, MD: SANS Institute.
Karresand, Martin. 2002. A proposed taxonomy of software weapons. Master’s thesis in
Computer Security at Linköping University, Sweden.
Rhodes, Keith A. 2001. Testimony before the Subcommittee on Government Efficiency, Financial
Management, and Intergovernmental Relations, Committee on Government Reform, House
of Representatives. Washington, D.C.: United States General Accounting Office.
Y
YOUTH AND CYBERCRIME
Like many people, young people rely on the internet for everyday activities, from
communicating with friends to shopping, schoolwork, and video games. Most
youth today grew up with technology and devices, utilizing the internet daily, and
have become comfortable with it. At the same time, they are more likely to give
out personal information, especially on social media. They are also likely to have
passwords that are easy to hack. As they use the internet more, young people are
becoming victims of cybercrimes. Also, because young people tend to use tech-
nology more often, they are more likely to become victims of online crimes when
compared to adults.
As victims of cybercrimes, youth are harassed by peers, are exposed to por-
nography, and are victims of identity theft. The exact number of young victims
of cybercrime is difficult to know for sure, as they are not always reported to law
enforcement. One survey found that 5.3 percent of youth aged 15–24 years were
reported that they were victims of cybercrime in 2008 (Oksanen and Keipi, 2013).
They are likely to be victims of cyberbullying, pirating materials, and sexting, but
they are also offenders of cybercrimes.
Cyberbullying is a growing problem among young people and in schools. This is
the use of technology, and especially social media, to threaten, harass, or embarrass
others. It is often linked to low self-control that is often found in young people. It
has also been linked to peer pressure—many children who participate in online
bullying are influenced by their friends to do so. According to the National Crime
Prevention Council, 17 percent of youth reported that someone had been posting
untruths about them online, and 13 percent learned that an offender was pretend-
ing to be them and posting information to others; 10 percent of youth were report-
edly victimized when someone unknown to them posted unﬂattering pictures of
them online, without their permission (National Crime Prevention Council, n.d.).
Youth are likely to pirate music and movies, simply because young people often
do not have a lot of extra money. One study on pirating activities by youth found
that 52 percent of eighth graders had pirated either a movie, music, or games in
their lifetime; 44 percent reported that they pirated in the past year, and 35.1 per-
cent admitted that they pirated sometime in the previous month. When it came
to pirating most often, 16.1 percent pirated on a daily basis. When 11th grade
students were questioned about their pirating behavior, those number increased
significantly. When it came to older students, 72.3 percent admitted to pirating
behavior at some point in their lifetime. Moreover, 63.8 percent of eleventh grad-
ers agreed that they pirated something in the previous year, with 52.8 percent
454 Y o u t h a n d C y b e r c r i me

reporting something in the past month and 25 percent carrying out pirating behav-
ior on a daily basis (Gunter et al., 2010). In another study, it was found that males
were more likely to show attitudes that were more favorable toward music piracy
than females (Malin and Fowers, 2009).
Sexting is another offense that is common among young people. They are likely
to send and/or receive sexually explicit or graphic images through their phones.
The images can be saved or forwarded to others. In some states, youth who do
this can be charged with possession of child pornography. Any youth convicted of
sexting and transmitting pornography may be labelled as a sex offender. A study
on sexting found that about 13 percent of youth in the study had sent either a nude
or partially nude photo of themselves to another person through a text within the
previous year (Ricketts et al., 2015).
Conversely, youth are frequently the offenders when it comes to cybercrimes.
They often have the technical skills needed to carry out cybercrimes. Youth see
cybercrime as an opportunity to make quick money. The number of youth pros-
ecuted for crimes under the Unauthorized Computer Access Law has increased
fourfold between 2003 and 2013 (Kar, 2013). Research found that peers who have
friends who engage in cybercrime are more likely to commit cybercrimes them-
selves. Often those involved are kids with low self-control (Holt et al., 2012).
To protect youth from becoming victims of cybercrimes, law enforcement and
other experts recommend that parents remain involved in the children’s online
behavior. They should watch the child’s activities on social media and the inter-
net. Parents should, even at an early age, teach children to be more aware of the
importance of online security and the use of better passwords. They should also
stress the need to caution and restraint when posting personal information online.

National Crime Prevention Council. n.d. “Cyberbullying.” http://www.ojp.gov/cds/internet

safety/NCPC/ Stop%20Cyberbullying%20Before%20It%20Starts.pdf
Oksanen, A., and T. Keipi. 2013. “Young people as victims of crime on the internet: A
population based study in Finland.” Vulnerable Children and Youth Studies, 8, 298–309.
Ricketts, Melissa, Carrie Maloney, Catherine Marcum, and George Higgins. 2015. “The
effect of internet related problems on the sexting behaviors of juveniles.” American
Journal of Criminal Justice 40, 2: 270–284.
Z
Z E R O - D AY AT TA C K S
A zero-day attack is a when a cybercriminal exploits or takes advantage of an
unknown security vulnerability (a weakness or flaw) in a computer program to
compromise the integrity or confidentiality of the product. Once a hacker is able
to find a glitch in a software program (the vulnerability), they can install malware
such as viruses or worms into a network. The criminal can edit the program and
make it do something other than it is intended. It is called a zero-day attack (or
a zero-day vulnerability) because there are zero days to fix the problem as the
vulnerability will be discovered after the attack has occurred. Day zero is the day
when the owner learns of the vulnerability.
Most of the time, the creator of software is not aware of a vulnerability, so no
fix (called a patch) has been created. The hacker who discovers the vulnerability
will be able to control that computer until the attack is discovered. Cybercrimi-
nals like these types of attacks because every user of the software is then vulner-
able. Anyone who downloads that software program may also have the malware
uploaded into their system. Zero-day attacks are often difficult to find, so the
hacker has a long time to gather information from those affected. Moreover, as
there could be a long time between when the malware is uploaded and when it is
found, there is a long time during which the infected malware can spread.
In some cases, the cybercriminal will discover a vulnerability and sell the infor-
mation on the dark web for others to use. They will sell zero-day vulnerabilities
on a zero-day market. There are three types of zero-day markets. One is the black
market or the dark web. Here, hackers will sell the details about the vulnerability
to other cybercriminals, who can use the attack to upload malware to steal pass-
words and credit card information. Because vulnerabilities are difficult to find, they
are in high demand and also very expensive on the dark web. They will often cost
between a few thousand dollars to $300,000, depending on the extent of the vul-
nerability. As the majority of vulnerabilities can only be used once, they are more
expensive (Ablon et al., 2014).
The second market is the white market, which comprises researchers and hack-
ers who will find a vulnerability and then contact the software vendor or owners
and give that information to them so the weakness can be fixed. The hacker may
ask for money and demand payment before they provide the information. Busi-
nesses will often buy information about a vulnerability so they can find a patch
before it is discovered by a hacker. The third market is the gray market, where
researchers and hackers will sell the information about zero-day exploits to mili-
tary or intelligence agencies to use for intelligence reasons.
458 Z e r o - Day At ta c k s

A zero-day attack will always be successful. The software creator does not know
about the weakness, so they are not aware that the program could be hacked.
Moreover, because the vulnerability is unknown, there is no patch or fix available.
By the time the attack is discovered, it has probably already allowed the attacker to
gather personal information from victims. These attacks can cause a lot of damage
because they can be attacking a system for a long time before the owner is aware
of it.
If a vulnerability becomes known to a hacker, they will often keep it a secret
until they have a chance to either use it or sell it to another hacker. If it is discov-
ered by a company, officials will typically work to fix it as quickly as they can.
Some officials may choose to announce the problem to the public and encourage
users to patch it before too much harm occurs.
A similar term is “zero-day virus” or “zero-day malware,” which is a previously
unknown virus or malware. These are particularly damaging because there will be
no antivirus software or patch to remove the virus from a computer.
The Stuxnet virus was a zero-day attack carried out by the United States against
Iran. It began in 2006 when the United States sought to access the computer sys-
tems of a nuclear power plant in that country. They were able to upload malware
into the computer system of the plant that disabled almost 1,000 centrifuges in
the plant. Officials in the plant said they discovered the bug and contained it. The
2014 cyberattack on Sony was also a zero-day attack. Here, the hackers uploaded
malware to the Sony system to get access to it and then gained access to confiden-
tial documents.
It is difficult to defend against a zero-day attack because the weakness is
unknown. However, there are steps that can be taken to mitigate damage from
a zero-day attack. The most important is to install security software and keep it
updated. That way, if malware is uploaded, it may be discovered before much data
is stolen. Another step is to keep up to date with any patches the company makes
available.
A half-day attack, also called a one-day or two-day attack, occurs when the
creator of the software is aware of the vulnerability and has made a patch available
to users, and even though the consumers are aware of the patch, they have not
applied it yet. This delay in applying the fix gives the cybercriminal time to steal
data from the victim.

Boyle, Randall J. 2013. Corporate Computer Security. Boston, MA: Pearson.

Brenner, S. W. 2008. Cyberthreats: The Emerging Fault Lines of the Nation State. New York:
Oxford University Press.
Broadhurst, Roderic, Peter Grabosky, Mamoun Alazab, Brigitte Bouhours, and Steve Chon.
2014. “Organizations and Cyber Crime: An Analysis of the Nature of Groups engaged
in Cyber Crime.” International Journal of Cyber Criminology, Vol. 8, No. 1, pp. 1–20.
Brody, Richard G., Elizabeth Mulig, and Valerie Kimball. 2007. “Phishing, Pharming and
Identity Theft.” Academy of Accounting and Financial Studies Journal, Vol. 11, No. 3,
pp. 43–56.
Bryant, Robin, and Sarah Bryant. 2014. Policing Digital Crime. Farnham, Surrey: Ashgate.
Calce, M., and C. Silverman. 2008. Mafiaboy: How I Cracked the Internet and Why It’s Still
Broken. Toronto: Penguin Group Canada.
Caravut, Sinchai. 2008. Multiple Logs Analysis for Detecting Zero-Day Backdoor Trojans.
Cleveland, OH: Cleveland State University Press.
Carr, Jeffrey. 2010 Inside Cyberwarfare. Sebastopol, CA: O’Reilly Media.
Casey, Eoghan. 2004. Digital Evidence and Computer Crime. Boston, MA: Elsevier.
Clough, Jonathan. 2015. Principles of Cybercrime. Cambridge, UK: Cambridge University
Press.
Cohn, William A. 2007. “Yahoo’s China Defense.” New Presence: The Prague Journal of Cen-
tral European Affairs, Vol. 9, No. 3, pp. 30–33.
Coleman, Gabriella. 2014. Hacker, Hoaxer, Whistleblower, Spy: The Many Faces of Anonymous.
London: Verso.
Commission on the Theft of American Intellectual Property. 2017. Update to the IP Commis-
sion Report. Seattle, WA: The National Bureau of Asian Research.
Council of Europe. 2007. Cyberterrorism: The Use of the Internet for Terrorist Purposes. Stras-
bourg Cedex, France: Council of Europe Publishing.
Denning, Peter J. 1989. The ARPANET after Twenty Years. Moffett Field, CA: Research Insti-
tute for Advanced Computer Science.
Elisan, Christopher C. 2015. Advanced Malware Analysis. New York: McGraw-Hill.
Englander, Elizabeth Kandel. 2013. Bullying and Cyberbullying: What Every Educator Needs
to Know. Cambridge, MA: Harvard Education Press.
Essany, Michael. 2012. LulzSec: How a Handful Of Hackers Brought the US Government to Its
Knees: 50 days of Lulz. New York: Hyperlink.
Furnell, Steven. 2002. Cybercrime. Boston, MA: Addison-Wesley.
Gillespie, Alisdair A. 2016. Cybercrime: Issues and Debates. New York: Routledge.
Goel, Sanjay, and Hany A. Shawky. 2009. “Estimating the Market Impact of Security Breach
Announcements on Firm Values.” Information & Management, Vol. 46, pp. 404–410.
Hafner, Katie, and John Markoff. 1991. Cyberpunk: Outlaws and Hackers on the Computer
Frontier. New York: Simon & Schuster.
Harrell, Erika. 2015 (revised 2017). Victims of Identity Theft, 2014. Washington, D.C.:
Bureau of Justice Statistics.
Hileman, Garrick, and Michel Rauchs. 2017. Global Cryptocurrency Benchmarking Study.
Cambridge, UK: Cambridge Centre for Alternative Finance.
Hill, Joshua B. and Nancy E. Marion. 2016. Introduction to Cybercrime: Computer Crimes,
Laws, and Policing in the 21st Century. Santa Barbara, CA: ABC-CLIO.
Holt, Thomas J. 2017. Cybercrime through an Interdisciplinary Lens. New York: Routledge.
Holt, Thomas J., Adam M. Bossler, and Kathryn C. Seigfried-Spellar. 2018. Cybercrime and
Digital Forensics. New York: Routledge.
B i b l i o g r ap h y 461

Holt, Thomas J., George W. Burruss, and Adam M. Bossler. 2015. Policing Cybercrime and
Cyberterror. Durham, NC: Carolina Academic Press.
Howard, Philip N., Aiden Duffy, Deen Freelon, Muzammil Hussain, Will Mari, and Marwa
Mazaid. 2011. “Opening Closed Regimes: What Was the Role of Social Media during
the Arab Spring?” Seattle: University of Washington.
Jaishankar, K. 2011. Cyber Criminology. Boca Raton, FL: CRC Press.
Jewkes, Yvonna. 2007. Crime Online. Devon, UK: Willan Publishing.
Jordan, T., and P. Taylor. 2004. Hacktivism and Cyber Wars. London: Routledge.
Jung, Jeyong, and Julak Lee. 2017. “Contemporary Financial Crime.” Journal of Public
Administration and Governance, Vol. 7, No. 2, pp. 88–97.
Karresand, Martin. 2002. A Proposed Taxonomy of Software Weapons. Master’s thesis in Com-
puter Security at Linköping University, Sweden.
Kehoe, Brendan P. 1996. Zen and the Art of the Internet: A Beginner’s Guide. Upper Saddle
River, NJ: Prentice Hall.
Knotts, Rose, and Tom Richards. 1989. “Computer Security: Who’s Minding the Store?”
The Academy of Management Executive, Vol. 3, No. 1, pp. 63–66.
Kremling, Janine, and Amanda M. Sharp Parker. 2018. Cyberspace, Cybersecurity, and
Cybercrime. Thousand Oaks, CA: Sage.
Kshetri, Nir. 2010. “Diffusion and Effects of Cyber-Crime in Developing Economies.” Third
World Quarterly, Vol. 31, No. 7, pp. 1057–1079.
Lapsley, Phil. 2013. Exploding the Phone. New York: Grove Press.
Law Library of Congress. 2018. Regulation of Cryptocurrency around the World. Washington,
D.C.: The Law Library of Congress.
Lemley, Mark A., and R. Anthony Reese. 2004. “Reducing Digital Copyright Infringe-
ment without Restricting Innovation.” Stanford Law Review, Vol. 56, No. 6, pp. 1345–
1434.
Leukfeldt, E. Rutger, Anita Lavorgna, and Edward R. Kleemans. 2016. “Organised Cyber-
crime or Cybercrime that is Organised? An Assessment of the Conceptualisation of
Financial Cybercrime as Organised Crime.” European Journal on Criminal Policy and
Research. doi:10.1007/s10610-016-9332-z
Levine, Yasha. 2018. Surveillance Valley: The Secret Military History of the Internet. New York:
Public Affairs.
Li, Xingan. 2017. “A Review of Motivations of Illegal Cyber Activities.” Criminology & Social
Integration Journal, Vol. 25, No. 1, pp. 110–126.
Littman, Jonathan. 1997. The Watchman: The twisted Life and Crimes of Serial Hacker Kevin
Poulsen. Boston, MA: Little, Brown and Company.
Long, Johnny. 2008. No Tech Hacking: A Guide to Social Engineering, Dumpster Diving, and
Shoulder Surfing. Rockland, MA: Syngress.
Martellozzo, Elena, and Emma A. Jane. 2017. Cybercrime and Its Victims. London: Routledge.
Martin, Keith M. 2017. Everyday Cryptography: Fundamental Principles and Applications.
Oxford: Oxford University Press.
McDonald, Aleecia M., and Lorrie Faith Cranor. 2008. “The Cost of Reading Privacy
Policies.” I/S: A Journal of Law and Policy for the Information Society, Vol. 4, No. 3,
pp. 543–568.
McQuade, S. C. 2006. Understanding and Managing Cybercrime. Boston, MA: Pearson/Allyn
and Bacon.
McWilliams, Brian. 2004. Spam Kings: The Real Story Behind the High-Rolling Hucksters Push-
ing Porn, Pills and @*#?% Enlargements. Cambridge, UK: O’Reilly.
462 B i b l i o g r ap h y

Middleton, Bruce. 2001. A History of Cyber Security Attacks: 1980 to Present. Boca Raton,
FL: CRC Press.
Mirkovic, Jelena, Sven Dietrich, David Dittrich, and Peter Reiher. 2005. Internet Denial of
Service: Attack and Defense Mechanisms. Upper Saddle River, NJ: Prentice-Hall.
Mitnick, K. D., and W. L. Simon. 2002. The Art of Deception: Controlling the Human Element
of Security. New York: Wiley Publishing.
Mitnick, K. D., and W. L. Simon. 2005. The Art of Intrusion. Indianapolis, IN: Wiley.
Moore, Daniel, and Thomas Rid. 2016. “Cryptopolitik and the Darknet.” Survival, Vol. 58,
pp. 7–38.
Mouton, Francois, Louise Leenan, and H. S. Venter. 2016. “Social engineering Attack
Examples, Templates and Scenarios.” Computers and Security, Vol. 59, pp. 186–209.
Mueller, Robert S. 2019. “Report on the Investigation into Russian Interference in the 2016
Presidential Election.” Volume 1. United States Department of Justice. https://www
.justice.gov/storage/report.pdf
Mullen, P. E., M. Pathe, and R. Purcell. 2009. Stalkers and Their Victims. New York: Cam-
bridge University Press.
Musa, Sarhan M. 2018. Network Security and Cryptography: A Self-Teaching Introduction.
Dulles, VA: Mercury Learning and Information.
Nakamoto, Satoshi. 2008. “Bitcoin: A Peer-to-Peer Electronic Cash System.” https://bitcoin
.org/bitcoin.pdf
Office of the Director of National Intelligence. 2017. Assessing Russian Activities and Inten-
tions in Recent U.S. Elections. Washington, D.C.: Office of the Director of National
Intelligence.
Office of the Inspector General. 2018. A Special Inquiry Regarding the Accuracy of FBI State-
ments Concerning Its Capabilities to Exploit an iPhone Seized during the San Bernardino
Terror Attack Investigation. Washington, D.C.: Office of the Inspector General.
Olson, Parmy. 2012. We Are Anonymous. New York: Little, Brown and Company.
Pallante, Maria A. 2013. “The Next Great Copyright Act.” The Columbia Journal of Law & the
Arts, Vol. 36, No. 3: 315–344.
Phillips, Whitney. 2015. This Is Why We Can’t Have Nice Things: Mapping the Relationship
between Online Trolling and Mainstream Culture. Cambridge, MA: MIT Press.
Pickett, K. H. Spencer, and Jennifer M. Pickett. 2002. Financial Crime Investigation and Con-
trol. New York: John Wiley & Sons, Inc.
Pirounias, Sotirios, Dimitrios Mermigas, and Constantinos Patsakis. 2014. “The Relation
between Information Security Events and Firm Market Value, Empirical Evidence on
Recent Disclosures: An Extension of the GLZ Study.” Journal of Information Security and
Applications, Vol. 19, pp. 257–271.
Poller, Andreas, Ulrich Waldmann, Sven Vowe, and Sven Turpe. 2012. “Electronic Iden-
tity Cards for User Authentication—Promise and Practice.” IEEE Security & Privacy,
Vol. 10, No. 1, pp. 46–54.
Pontell, Henry N., Gilbert Geis, and Gregory C. Brown. 2011. “Internet Gambling.” In
Cyber Criminology, edited by J. Jaishanker. Boca Raton, FL: CRC Press, pp. 13–28.
Poulsen, Kevin. 2011. Kingpin: How One Hacker Took Over the Billion-Dollar Cybercrime
Underground. New York: Crown Publishers.
Register of Copyrights. 2015. Orphan Works and Mass Digitization. Washington, D.C.:
United States Copyright Office.
Rey, Sergio J. 2009. “Show Me the Code: Spatial Analysis and Open Source.” Journal of
Geographical Systems, Vol. 11, No. 2, pp. 191–207.
B i b l i o g r ap h y 463

Romney, Marshall. 1995. “Computer Fraud—What Can Be Done about It?” The CPA Jour-
nal, Vol. 65, No. 5, pp. 30–32.
Ryan, Patrick S. 2004. “War, Peace, or Stalemate: Wargames, Wardialing, Wardriving, and
the Emerging Market for Hacker Ethics.” Virginia Journal of Law & Technology, Vol. 9,
No. 7, pp. 1–57.
Salus, Peter H. 1995. Casting the Net: From ARPANET to Internet and Beyond. Reading, MA:
Addison-Wesley.
Santana, Mario. 2017. “Eliminating the Security Weakness of Linux and UNIX Operating
Systems.” In Computer and Information Security Handbook, 3rd Edition, edited by John
R. Vacca. Cambridge, MA: Elsevier.
Satapathy, C. 2000. “Impact of Cyber Vandalism on the Internet.” Economic and Political
Weekly, Vol. 35, No. 13, pp. 1059–1061.
Schiller, Craig A., Jim Binkely, David Harley, Gadi Evron, Toni Bradley, Carsten Willems,
and Michael Cross. 2007. Botnets: The Killer Web App. Burlington, MA: Syngress.
Schmitt, M. N. 2013. Tallinn Manual on the International Law Applicable to Cyber Warfare.
Cambridge, UK: Cambridge University Press.
Shabtai, Asaf, Yuval Elovici, and Lior Rokach. 2012. A Survey of Data Leakage Detection and
Prevention Solutions. New York: Springer.
Shakarian, Paulo, Jana Shakarian, and Andrew Ruef. 2013. Introduction to Cyber Warfare:
A Multidisciplinary Approach. Waltham, MA: Elsevier.
Shaw, Thomas J. 2011. Information Security and Privacy: A Practical Guide for Global Execu-
tives, Lawyers and Technologists. Chicago, IL: American Bar Association.
Skoudis, Ed, and Lenny Zeltser. 2003. Malware: Fighting Malicious Code. Upper Saddle
River, NJ: Prentice Hall.
Slatalla, Michelle, and Joshua Quittner. 1995. Masters of Deception: The Gang that Ruled
Cyberspace. New York: HarperCollins.
Spanos, Georgios, and Lefteris Angelis. 2016. “The Impact of Information Security Events
to the Stock Market: A Systematic Literature Review.” Computers & Security, Vol. 58,
pp. 216–229.
Stay, Ronald J. 1997. “Cryptic Controversy: U.S. Government Restrictions on Cryptog-
raphy Exports and the Plight of Philip Zimmermann.” Georgia State University Law
Review, Vol. 13, No. 2, pp. 581–604.
Swartz, Aaron. 2015. The Boy Who Could Change the World: The Writings of Aaron Swartz.
New York: The New Press.
Terasaki, Michael. 2014. “Do End User License Agreements Bind Normal People?” Western
State University Law Review, Vol. 41, No. 2, pp. 467–489.
Tiirmaa-Klaar, Heli, Jan Gassen, Elmar Gerhards-Padilla, and Peter Martini. 2013. Botnets.
New York: Springer.
Trautman, Lawrence. 2014. “Virtual Currencies Bitcoin & What Now after Liberty Reserve,
Silk Road, and Mt. Gox?” Richmond Journal of Law & Technology, Vol. 20, No. 4,
pp. 1–108.
United Nations Office on Drugs and Crime. 2017. World Drug Report 2017. New York:
United Nations.
United States Copyright Office. 2011. Legal Issues in Mass Digitization: A Preliminary Analy-
sis and Discussion Document. Washington, D.C.: United States Copyright Office.
U.S. General Services Administration. “Continuous Diagnostics and Mitigation Program.”
https://www.gsa.gov/technology/technology-products-services/it-security/continuous
-diagnostics-mitigation-cdm-program
464 B i b l i o g r ap h y

Wall, David S. 2001. Crime and the Internet. New York: Routledge.
Wenke Lee, Cliff Wang, and David Dagon. 2008. Botnet Detection: Countering the Largest
Security Threat. New York: Springer.
Wolak, Janis, and David Finkelhor. 2016. Sextortion: Findings from a Survey of 1,631 Victims.
Durham, NH: Crimes against Children Research Center.
Wolak, Janis, David Finkelhor, and Kimberly J. Mitchell. 2005. Child Pornography Possess-
ors Arrested in Internet-Related Crimes: Findings from the National Juvenile Online Victim-
ization Study. Washington, D.C.: Center for Missing and Exploited Children.
Woodward, John D., Jr., Nicholas M. Orlans, and Peter T. Higgins. 2003. Biometrics. Berke-
ley, CA: McGraw-Hill.
Yu, Shui. 2014. Distributed Denial of Service Attack and Defense. New York: Springer.
Zetter, Kim. 2014. The Countdown to Zero Day: Stuxnet and the Launch of the World’s First
Digital Weapon. New York: Crown Publishers.
Index

Note: Page numbers in bold indicate the location of main entries.

Aaron’s Law, 65, 404. See also Swartz, as malware or spyware, 8

Aaron removal programs, 8
Abandonware, 1–2 on social media, 8
and Canada, 2 Anonymous, 9–13
definition of, 1 and Arab Spring, 11
and European Union, 2 arrests and trials, 12
and Japan, 2 BART subway system attack, 10
legal status of, 1 Canadian government denial of service
and Music Modernization Act, 2 attack, 12
and orphaned works, 1–2 Church of Scientology attack,
unauthorized used of, 1–2 xxiv, xxv, 10
and United States, 2 and 4chan, 9, 10
Abene, Mark, 2–4 Department of Justice attack, 403
and Crossbar Security, 4 Habbo Hotel raid, 9–10
early years, 2–3 HBGary website attack, 11
and grand jury trial, xxi, 3 history and origins of, xxiv, 9–10
and Legion of Doom, 3, 237, 238 members, 9
and Masters of Deception, xxi, 257, 258 Operation Darknet, 11
media appearances, 4 Operation Ferguson, 11
and phone phreaking, 3 PayPal attack, xxv, 10
Advanced persistent threats, 4–6 response to terrorist attacks, 11
definition of, 4 RIAA and MPAA attacks, xxv, 10
GhostNet, 5 and TeaMpoisoN, 411
Operation Aurora, 4–5, 291–292 and Trump, Donald, 12
protection measures, 5 Ashley Madison breach, 13–14
Stuxnet, 4 impact of, 14
typical offenders, 4 and The Impact Team, 13
Advanced Research Projects Agency investigation and fines, 14
Network, 6–7 reason for, 13
and Eisenhower, Dwight D., 6–7 Assange, Julian, 15–18
history and creation of, 6–7 arrest in United Kingdom (2019), 15, 16
as the “internet,” 7 early years, 15
purpose of, 6 in Ecuadorian embassy (London), xxvii,
renamed DARPA, 7 16–17, 228, 380–381, 443
Adware, 8–9 founding of WikiLeaks, 15
and Ancheta, Jeanson James, 8–9 and Manning, Chelsea, xxx,
definition of, 8 15, 16, 256
and free software, 8 rape charges, 15–16
466 Index

Assange, Julian (Continued) Biometrics, 28–30

and U.S. presidential election definition of, 28
interference (2016), 17, 425, 444–445 efficiency of, 28
See also WikiLeaks fingerprints, 28
Auernheimer, Andrew Alan Escher, history of, 28
18–20 privacy and ethical concerns, 29
aka Weev, 18 security concerns, 29
Amazon attack, 18 traits other than fingerprints, 29
arrests and imprisonment, xxvii, 19 Bitcoin, 30–32
and AT&T attack, 18 bans on, 31
as black-hat hacker, 33 and blockchain, 30, 31, 88, 128, 263,
and Goatse Security, 18 273, 301
webmaster for The Daily Stormer, 19 and criminality, 31
Awareness, 20–21 as cryptocurrency, 85, 86
and cyberbullying, 21 and the dark web, 117–118
Cybercrime Awareness Month, 21 definition of, 30
DHS tips for, 20 as digital currency, 129
importance of, 20 and drug trafficking, 151
and smart home technology, and GameOver Zeus botnet, 201
20–21 and money laundering, 263, 264
and Nakamoto, Satoshi, xxv, xxvi, 30,
Backdoor, 23, 208 88, 273–274
and Code Red, 59, 60 and ransomware, 249, 351, 352
and cracking, 79 and Silk Road, 146–147, 296, 371
definition of, 23 Black-hat hackers, 32–34
encryption backdoor, 165 Auernheimer, Andrew Alan Escher,
and exploit kits, 180 18–20, 33
and Nimda, 284–285 and cracking, 79
and OceanLotus, 23 definition of, 32
purpose and uses of, 23 and financial gain, 32
and secrecy, 23 Gonzalez, Albert, 33
Banking attacks, 24–28 and gray-hat hackers, 442
ATM fraud, 25 Lizard Squad, 242
by bank employees, 25 and malicious intent, 33
banking security, 26–27 Moss, Jeff, 33
and Carberp Trojan, xxv, xxvi, xxvii, 26, motivations of, 32–33
44–45 phreak.nl hacking group, xxiii
DDoS attacks, 24 and politics, 32
examples, 26 Poulsen, Kevin (Dark Dante), 33,
extortion attacks, 24 328–329
incidence statistics, 24 white-hat hackers compared with,
by Izz ad-Din al-Qassam Cyber 206, 441
Fighters, 26 Blankenship, Loyd, 34–35
Lloyds Banking Group attack, 26 aka the Mentor, 34
Operation Icarus (Anonymous), 26 author of rulebook/toolkit for GURPS
phishing attacks, 25 Cyberpunk, 34
salami attacks, 25 hacking groups, 34
SWIFT banking network attacks, 26 and Steve Jackson Games, Inc. v. United
types, 24–26 States Secret Service, 34
Index 467

Blockchain, 30, 31, 88, 128, 263, 273, results and impact of, 42, 43
301. See also Bitcoin and Thomas, Paige, 42–43
Blue-hat hackers, 442 Carberp, 44–45
Bots and botnets, 35–37 arrests of eight creators of, 45
definition of bot, 35 and banking attacks, xxv, xxvi, xxvii, 26,
definition of botnet, 36 44–45
Gameover Zeus, 36 and Bolek Trojan, 45
knowbot, 35 detection evasion, 45
and malicious acts, 35 evolution of, 45
Mirai, 36 first appearance, xxv, 44
protection measures, 36 leak of, xxvii
shopbot, 35 mechanism of, 44
Srizbi, 36 online banking and social media attacks,
and “zombie” machines, 35 xxvi, 26, 44
Bush, George W. subscription offers, 44
and CAN-SPAM Act of 2003, 40 Center for Internet Security, 46–47
and Comprehensive National activities of, 46
Cybersecurity Initiative, 60 creation of, xxiii, 46
and Council of Europe Convention on and Multi-State Information Sharing and
Cybercrime, 330–331 Analysis Center, 46
and Federal Information Security purpose of, 46
Management Act of 2002, 186 Chaney, Christopher, 47–48
and 9/11 attacks, 330–331 arrest and sentencing of, 48
and Operation Olympic Games, 297 celebrity e-mail hacks, 47
Bypass, 37–38 and Operation Hackerazzi, 47–48
definition of, 37 Chaos Computer Club, 48–50
intentional bypass (backdoor), 37–38 Chaos Communication Congress, 49
law enforcement’s use of, 38 Deutsche Bundespost hack, 49
methods of, 37 history and founding of, 48–49
and San Bernardino attack and Holland, Wau, 48–49
investigation, 38 and Koch, Karl, 49
mission of, 48
Calce, Michael, 39–40 and smartphone biometrics,
aka Mafia Boy, 39 49–50
arrest and “open custody” sentence, 39 and Wenery, Steffen, 48
DoS attacks, xxiii, 39 Child pornography, 50–54
early years, 39 combating pedophile information
as white-hat hacker, 39–40 networks in Europe, 52–53
CAN-SPAM Act of 2003, xxiv, 8, 40–42, on the internet, 51–52
239, 240, 389 and law enforcement, 53
arrest of Robert Soloway (“Spam King”), regulation of, 50–51
41–42 China, 54–58
corporate support for, 41 business espionage, 56
criticism of and opposition to, 41 censorship, 54–55, 191, 391
first arrest under (Anthony Greco), 41 cybercrime punishment, 54
provisions of, 40–41 intellectual property theft, 55
purpose of, 40 as victim of cyberattacks, 56–57
Capital One breach, 42–44 See also People’s Liberation Army Unit
and Consumer Data Protection Act, 43 61398
468 Index

Cleary, Ryan, 58–59 and Digital Millennium Copyright Act,

aka ViraL, 58 xxii, 70, 131–132, 133, 172, 239
arrest and sentencing of, xxvii, 58, economic impact of, 70
247–248 and file-sharing risks, 70
DDoS attacks, 58, 247–248 and freebooting, 69
member of LulzSec, 58, 247–248 and intellectual property theft, 69
Clinton, Bill and the internet, 69
cybercrime policy, 330 laws, 70
cybersecurity budget, xxii, 330 and National Intellectual Property Rights
on digital signatures, 136 Coordination Center (FBI), 71, 290
response to attacks of Michael Calce, 39 and No Electronic Theft Act, 70
response to ILOVEYOU virus, 221 and peer-to-peer file-sharing, 69–70
Code Red, 59–60 and Prioritizing Resources and
and backdoor, 59 Organization for Intellectual Property
harm and impact of, xxiv, 59, 451 Act, 70
self-replication of, 59 prosecution of, 70–71
targets of, 59 Corporate account takeover, 71–72
White House attack, 59, 432 definition of, 71
Code Red Version 2, 59–60 impact of, 71–72
Comprehensive National Cybersecurity protection measures, 72
Initiative, 60–63 and small businesses, 72
background and origins of, 60–61 Costs of cybercrime, 72–76
and Bush, George W., 60 and continuous monitoring, 75
initiatives, 61–62 costs of deterrence and prevention of
and NSA, 62 cybercrime, 73
and Obama, Barack, 61 costs of investigations, 73
and Utah Data Center, 62 costs to customers, 75
Computer Fraud and Abuse Act of 1986, costs to specific countries, 73–74
63–67, 195, 239 costs to specific industries, 74
amendments, 63, 65 crimes by current or former employees,
and e-mail bombs, 161 74–75
first person criminally charged under, 64 loss of information, 73
history and origins of, 63–64 statistics, 72–74
and Mitra, Rajib, 111 Council of Europe Cybercrime
and Morris, Robert Tappan, 266 Convention, 76–79
passage of, xix, 63 and Additional Protocol to the
provisions of, 64 Convention on Cybercrime, 79
and Swartz, Aaron, 64–65, 403 adoption of, 77
Continuous Diagnostics and Mitigation chapters and articles, 77–78
(CDM), 67–69 history and creation of, 76–77
and communication, 68 provisions of, 77
and cost efficiency, 67–68 purpose of, 76
and financial grants, 68 supporters and opponents of, 78
phases of, 67 Cracker and cracking,
and privacy, 68 79–80
purpose and goals of, 67–68 and black-hat hackers, 79
Copyright infringement, 69–71 definition of, 79
definition of, 69 hacker compared with, 79
Index 469

and Mitnick, David, xviii, xix, xxi, xxiii, and Sedwick, Rebecca, 90
80, 260–262, 420 statistics, 90–91
success of, 79 and trolling, 91
Craigslist killers, 80–82 Cyberextortion. See Ransomware
Anderson, Michael Jon, 80–81 Cybersecurity, 92–94
Beasley, Richard, 81–82 and Cybersecurity and Infrastructure
Katehis, John, 82 Security Agency Act, 93, 97
Markoff, Philip, 81 definition of, 92
Rafferty, Brian, 81–82 Finance Division of the Securities and
use of the term, 80 Exchange Commission guidelines,
Credit card fraud, 83–85 93–94
account takeovers, 84 forms of, 93
and card skimmers, 84 proposed departments and
definition of, 83 frameworks, 94
in-person crimes, 84 security training, 93
and keyloggers, 84 software and technology, 93
and malware, 84 Cybersecurity Act of 2012, 94–97
methods of, 84 and Collins, Susan, 94
Neiman Marcus breach, 83 and Feinstein, Dianne, 94
protection measures, 84–85 and Lieberman, Joe, 94
statistics, 83 proposal of, 94–95
Target breach, 83 provisions of, 95–96
theft of mailed credit cards, 84 and Rockefeller, John, 94
and virtual credit cards, 85 vote on, xxvii, 96
Cryptocurrency, 85–87 and Whitehouse, Sheldon, 94
Bitcoin, 85–86 Cybersecurity and Infrastructure Security
and cybercrimes, 86 Agency (CISA), 93, 97–98
definition of, 85 mission statement, 97
prohibitions on, 86 and National Cybersecurity and
theft of, 86 Communications Integration Center, 97
See also Bitcoin provisions of, 97
Cryptography, 87–89 and Trump, Donald, 97
asymmetric key encryption, 88 Cybersecurity Enhancement Act of 2014,
and Bitcoin, 88 98–99
and blockchains, 88 and Obama, Barack, 98
cryptanalysis, 88 passage of, xxviii, 98, 280
cypherpunks, 88 proposal of, 98
definition of, 87 provisions of, 98
history of, 87 and Rockefeller, John D., IV, 98
symmetric key encryption, 88 Cybersecurity Workforce Assessment Act
Cyberbullying, 89–92 of 2015, 100–101
criminality of, 91 and Consolidated Appropriations Act,
definitions of, 89 100
and flaming, 91 goals and provisions of, 100
impact of, 89–90 increased collaboration between
and masquerading, 91 agencies, 100–101
and Meier, Megan, 90 and Obama, Barack, 100
and Raza, Gyslain, 89 scholarships and tuition waivers, 100
470 Index

Cybersquatting, 101–103 and credit card fraud, 83

definition of, 101 Darknet Heroes League, 117
international jurisdiction, 101–102 definition of, 117
and Lamparello v. Falwell, 103 and law enforcement, 118
and People for the Ethical Treatment of legal issues, 118
Animals v. Doughney, 102 Mollyworld, 117
and social media, 102 and privacy, 118
and typosquatting, 103 Silk Road 3, 117
and Virtual Works, Inc. v. Volkswagen of and Tor browser, 118
America, 102 See also Dread Pirate Roberts (Ulbricht,
Cyberstalking, 103–107 Ross); Operation Marco Polo
and Combat Online Predators Act, 106 Darkode (online black market), 185,
and cyberharassment, 103–104 300–301
definition of, 103 Data leakage, 119–121
and Dellapenta, Gary, 106 definition of, 119
and flaming, 106 by disgruntled employees, 120
and gender, 105 examples of, 120
methods of, 104–105 impact of, 120
and Model Anti-Stalking Code, 104 intentional and unintentional leaks, 119
prevention guidelines, 105 prevention measures, 120
and state laws, 106 Data sovereignty, 121–122
statistics, 105 definition of, 121
victims of, 104 and E.U. legislation, 122
and Violence against Women Act, 106 and Microsoft case, 121
and Working to Halt Online Abuse and Snowden, Edward, 121
(WHOA), 105 and U.S. legislation, 122
Cyber-surveillance malware, 107–109 Decryption. See Encryption
definition of, 107 DEF CON, 60, 123–124, 125
Duqu malware, 107–108 Beard and Mustache contest, 124
Flame malware, 108 Biohacking Village, 123
Gauss malware, 108–109 first conference, xx
Cyberterrorism, 110–113 founding of, 33, 123
and cyberwarfare, 110–111 hands-on experiences, 33, 123
definitions of, 110 and Moss, Jeff, 33, 123
and Ferizi, Ardit, 111 origins of the name, 123
and Ghost Security Group, 112 Packet Hacking Village, 123–124
and technology, 111 Tamper-Evident Village, 124
tracing, 111 Denial-of-service attack (DoS), 124–126
Cyberwarfare, 113–115 advanced persistent DoS attack, 125
definitions of, 113 definition of, 124–125
determining responsibility, 114–115 harm from, 125
against government websites, 114 protection measures, 126
impact of, 114 signs of, 125–126
as “virtual conflict,” 113 Twitter attack, 125
Department of Defense, attacks on, 126–128
Dark web, 117–119 by China, 127
access to, 118 and “dynamic defense” cybercrime
and botnets, 138 strategy, 127
Carder, 117 by Russia, 127
Index 471

statistics, 126–127 Doxing, 140–144

2008 flash drive malware attack, 126 and British National Party WikiLeaks
2015 e-mail network hack, 127 information release, 141
2015 messaging service hack, 127 and criminality, 142
2007 spear phishing attack, 126 definition of, 140
Digital currency, 128–131 harm from, 140–142
Bitcoin, 129 and McAdams v. Marquette University,
cryptocurrency, 128–129 140–141, 142
definition of, 128 by news outlets, 143
digital currency exchanges, 129 offline, 142–143
e-gold, 128–129 and Tripathi, Sunil, 142
and legal challenges, 129–130 Draper, John, 144–145
Mt. Gox, 129 aka Cap’n Crunch, xviii, 144
and regulation, 129 arrest and imprisonment of, 144–145
See also Bitcoin; Cryptocurrency and Blue Box, 144–145
Digital Millennium Copyright Act, 131– early years, 144
133 Esquire article on, xviii, 144
and copyright infringement, 70 and phone phreaking, 144–145, 318
and digital rights management, 133, 172 Dread Pirate Roberts (Ulbricht, Ross),
passage of, xxii, 70, 131, 239 145–148
provisions of, 131 murder allegations against, 146–147
Digital rights management, 133–135 and Operation Marco Polo, 146–147,
criticism and controversy, 133–134 295–296
definition of, 133 and Silk Road, 145–147, 295–296
and Digital Millennium Copyright Act, United States v. Ulbricht, 296
133, 172 Dreamboard, 148–149
International Day against DRM, 134 investigation and convictions, 149
stated need for, 133 members and types of memberships,
Digital signatures, 135–137 148
Clinton, Bill, on, 136 rules for members, 148
definition of, 135–136 Drink or Die, 149–151
and Electronic Signatures in Global and disbandment of, 150
National Commerce Act, 136 members, 149–150
and public key infrastructure, 136 and Operation Buccaneer, 150
safety and legitimacy concerns, 136 Drug trafficking, 151–153
uses for, 135–136 and cell phones, 151–152
Distributed denial-of-service attack and cryptocurrency, 151
(DDoS), 137–139 cyber means of, 151
and botmasters, 137–138 definition of, 151
and botnets, 138 Dumpster diving, 153–154
definition of, 137 definition of, 153
examples of, 138–139 methods of, 153
types and methods of, 137 protection measures, 153
Domain name system cache poisoning, Duqu malware, 107–108, 109
139–140
definition of, 139 Economy, effects on, 155–157
example of, 140 annual costs of cybercrime, 155
protection measures, 140 costs to businesses, 155
spoofing attack, 140 direct losses, 155–156
472 Index

Economy, effects on (Continued) and uneven bargaining position of

impact on consumers, 156–157 consumers, 168–169
indirect losses, 156 and Vernor v. Autodesk, 167
loss of consumer confidence, 156 Engressia, Josef Carl, Jr., 170–171
Einstein, 158–159 arrest and sentencing of, 170–171
and Department of Homeland Security, and phone phreaking, 144, 170–171, 318
158–159 as “The Whistler,” 170
phases of, 158 Entertainment, effects on, 171–174
purposes and goals of, 158 compounding economic effect, 172
weaknesses of, 158–159 and DRM, 172
Electronic Frontier Foundation, 159–161 financial impact, 171
and ACLU v. Reno II, 160–161 and intellectual property theft, 171–172
and Bernstein v. U.S. Department of non-economic impacts, 173
Justice, 160 and streaming services, 172
founding of, 159 Equifax breach, 174–176
history of, 159–160 and accusations of insider trading, 175
and Jackson, Steve, 159–160 and Apache Struts vulnerability, 175
legal advocacy, 160 impact of, 175
legal cases, 160 Ethics, 176–178
and MGM v. Grokster, 160 and Ashley Madison breach, 177
purpose of, 159 definition of, 176
E-mail bomb, 161–162 and drug use and drug trafficking, 176
definition of, 161 and hacktivists, 177
direct and paid distribution, 161–162 and intellectual property theft, 176
purposes of, 161 and privacy, 177
E-mail-related crimes, 162–165 and transparency, 177
appeals for help, 164 European Cybercrime Center, 178–179
blackmail, 163 cooperative investigations, 179
cyberharassment or cyberbullying, 163 crimes areas, 178–179
e-mail bombing, 163 and EU cybercrime costs, 178
e-mail spoofing/phishing, 163–164 investigative techniques, 178–179
fraudulent tickets, 164 purpose and goals of, 178
sham offers or investment schemes, 163 Exploit kit, 179–181
Encryption, 165–166 Angler, 181
and ciphertext, 165 Blackhole, 180–181
companies’ use of, 165 definition of, 179–180
and criminal investigations, 166 Magnitude, 181
definition of, 165 Mpack, 180, 270–271
end-to-end encryption, 166 NeoSploit exploit kit, 180
and malware, 166 Nuclear Pack, 180
and plaintext, 165 purpose of, 179–180
and ransomware, 166 simplicity of, 180
terrorists’ and criminals’ use of, 165 uses of, 180
End user license agreement, WebAttacker kit, 180
167–170 Whitehole, 181
and consumer ownership rights, 167
definition of, 167 Federal Bureau of Investigation, 183–186
legal issues, 169 CardersMarket investigation, 184
text and terms of, 168 Cyber Division, xxiii, 130, 184, 185, 276
Index 473

history of, 183 hacks and targets, 193–194

Internet Fraud Complaint Center (later history and origins of, 193
Internet Crime Complaint Center), impact of, 194–195
xxii, 184 Patrick, Neal, 194–195
and Levin, Vladimir, 183 Phil Donahue Show appearance, 194
National Infrastructure Protection Winslow, Timothy, 194, 195
Center, xxii, 110, 183–184, 221 Wondra, Gerald, 194
National Intellectual Property Rights Fraud, 195–197
Coordination Center (FBI), 71, 290 compromised business e-mail addresses,
and Operation Innocent Images, xxi, 196
183, 293–294 as cybercrime, 196
and Operation Marco Polo, 184–185, 296 definition of, 195
and Operation Shrouded Horizon, 185, false online presences, 196
300–301 and Fortnite, 196–197
purpose and scope of, 183 general criminalization of, 195
and San Bernardino shooting specific criminalization of, 195
investigation, 185
Federal Information Security Management Gambling, 199–201
Act of 2002, 186–188 definition of, 199
and FISMA Reform (2014), 187 fairness issues, 200
impact of, 187 fantasy sports, 200
provisions of, 186–187 games of chance versus games of skill,
Financial crimes, 188–190 199–200
common elements of, 188 online gambling, 199
costs of, 189 state laws, 199
definition of, 188 GameOver Zeus botnet, 201–202
and digital trails, 188–189 and Bogachev, Evgeniy Mikhailovich,
methods of attack, 189–190 201–202
Firewall, 190–192 and Cryptolocker malware, 201
advanced firewalls, 190–191 history of, 201
basic firewalls, 190 and Operation Tovar, 201
definition of, 190 purpose and uses of, 201
and government censorship, 191 Gates, Bill. See Microsoft and Microsoft
“Great Firewall of China,” 191 Windows
hardware, 191 Gauss malware, 108–109
intrusion prevention systems (IPSs), globalHell (gH), 202–203
190–191 costs and harm from, 203
purpose of, 190 and Gregory, Patrick, 202–203
software, 191 and illegal conference calling “bridges,”
Flame malware, 108–109 202–203
Florida Computer Crime Act of 1978, investigation and arrests, 203
192–193 members, 203
history and origins of, 192 targets of, 202, 203
provisions of, 192–193 Gray-hat hackers, 441–442
414s, 193–195
and Computer Fraud and Abuse Act, 195 Hacker and hacking, 205–209
FBI investigation of, 194 effects, 207–208
The 414s: The Original Teenage Hackers hacker subculture, 206–207
(documentary), 195 white hat and black hat hackers, 206
474 Index

Hacking for Girlies, 420–421 and cybercrime investigations, 222–223

Hacktivism, 209–211 history and creation of, 222
Anonymous, xxiv, xxv, xxvi, 9–12, 26, and Operation Marco Polo, 223
64, 112, 138–139, 210–211, 246– purpose of, 222
247, 267, 403, 411 Insurance, 224–227
and criminality, 209–210 cost of cyber insurance, 224–225
Cult of the Dead Cow, xix, xxii, 210, 407 first-party insurance, 226
definition of, 209 history of cyber insurance, 224
history of, 210 premiums and coverage, 225–226
Operation Payback, 10, 210 third-party insurance, 226
techniques of, 209 International issues, 227–230
Hate crime, 211–214 China, 227–228
definitions of, 211–212 crimes versus acts of war, 228
hate speech compared with, 212–213 criminal extradition, 228–229
state laws against, 212 Russia, 228
U.S. incidence statistics, 212 United States, 228
Health care, effects on, 214–215 Internet Fraud Complaint Center (later
electronic medical records, 214–215 Internet Crime Complaint Center),
growth of health-care cybercrime, 214 xxii, 184
and Health Insurance Portability and Interpol, 230–231
Accountability Act (HIPA), 215 cybercrime investigations, 231
MedStar Health attack, 215 founding of, 230
personal information breaches and headquarters, 230
identity theft, 214 history of, 230
Hijacking, 216–217 purpose of, 230–231
acting hijacking, 216–217
browser hijacking, 216 Keystroke monitoring, 233–235
definition of, 216 definition of, 233
man in the middle attack, 216 hardware, 234
passive hijacking, 216 legality issues, 233
pharming, 216 protection measures, 234
Holder, Eric, 15, 149, 223, 404 and Rene v. G.F. Fishers, Inc., 233
software, 234
Identity theft, 219–220 and United States v. Scarfo, 233
basic theft compared with, 219 uses of, 233
definition of, 219
incidence statistics, 219 Legion of Doom, 237–238
major data breaches, 220 and Abene, Mark (Phiber Optik), 3,
offline protection measures, 219 237–238, 257, 258
online protection measures, 219–220 and Gelormine, Vincent Louis (Lex
ILOVEYOU virus, 221–222 Luthor), 237
copycat viruses, 221 and Goggans, Chris (Erik Bloodaxe),
federal response to, 221–222 237–238, 257–258
history and origins of, 221 and Masters of Deception, 237–238
Immigration and Customs Enforcement, and Operation Sun Devil, 238
222–224 Legislation, 239–240
child exploitation cases, 222–223 CAN-SPAM Act, xxiv, 8, 40–42, 239,
child victim identification program, 223 240, 389
Cyber Crime Center, 222–223 and child pornography, 239
Index 475

Computer Fraud and Abuse Act, 63–67, types, 249–253

195, 239 viruses, 251
Cybersecurity Workforce Assessment worms, 249–250
Act, 100–101, 240 Manning, Chelsea, 254–257
Digital Millennium Copyright Act, 70, arrest and imprisonment, xxv, xxvii, 255
131–133, 172, 239, 239 and Assange, Julian, xxx, 15, 16, 256
Electronic Communications Privacy Act, and Chaos Computer Club, 50
239, 307 commutation of sentence, xxix, 255, 443
history of cybercrime legislation, 239 early years and family, 254
types of, 239–240 leaked documents, 120, 255, 443, 445
and WarGames (film), 239 military career, 255
Levin, Vladimir, xxi, 183, 240–241 public opinion of, 256, 443–444, 445
Lizard Squad, 242–243 refusal to testify, 256
FBI investigations and arrests, 242 Senate campaign, 255–256
ISP Cox Communications phishing and Snowden, Edward, 380
attack, 242 and WikiLeaks, 50, 246, 255–256,
Malaysia Airlines website attack, 242 443, 445
and Omari, Vinnie, 242 Masters of Deception, 257–259
2014 Christmas Day hack, 242 and Abene, Mark (Phiber Optik),
Lloyd, Timothy, 243–244 3, 237–238, 257, 258
arrest and trial of, xxiii, xxiv, 243–244 indictments, 258
logic bomb attack by, 243 and Ladopoulos, Eli (Acid Phreak),
Logic bomb, 244–246 257–258
and coordinated attacks, 245 and Legion of Doom, 257–258
definition of, 244 origins of the name, 257
keystroke monitor paired with, 244–245 and Sitra, Paul (Scorpion), 257–258
timing advantages of, 245 trial and sentencing, 258
uses of, 244–245 and United States v. Lee, 258
LulzSec, 246–248 Melissa worm, 259–260
and Cleary, Ryan (ViraL), 58, 247–248 history and origins of, 259
and Davis, Jake (Topiary), xxvi, 58, 247 investigation and arrest, 259–260
high-profile attacks, 246–247 release of, 259
members, 247–248 and Smith, David Lee, 259–260
and Monsegur, Hector (Sabu), 246, 247 Microsoft and Microsoft Windows
motto and origin of the name, 246 and Back Orifice, 210
targets of, 247–248 and Bitcoin, 31
and blue-hat hackers, 442
Malware, 249–254 and Bolek Trojan, 45
advanced persistent threat, 252 and Code Red worm, 59–60
bots, 251 and data sovereignty, 121
Easter egg, 252–253 and Drink or Die pirated software,
e-mail scams, 252 149–150
exploits, 251 and Flame malware, 108
keylogger and spyware, 252 Gates, Bill, xxiv
Koobface, 250 and ILOVEYOU virus, 221
law enforcement responses, 253–254 increased security, xxiv
phishing, 252 and Koobface worm, 250
ransomware, 249 and Melissa worm, 259
Trojan horses, 251–252 and Nimda, 284
476 Index

Microsoft and Microsoft Windows (Continued) popularity of, 270

and Operation Aurora, 291 purpose of, 270
and Plankton malware, 323
and Prism NSA surveillance program, Nakamoto, Satoshi, xxv, xxvi, 30, 88,
338, 342, 353–354, 381 273–275
and Storm botnet, 398–399 anonymous inventor of Bitcoin, 273
support for CAN-SPAM Act, 41 separation from Bitcoin, 274
support for open-source projects, 289 speculations regarding identity of, 274
Trusted Computing Initiative, 253 Natanz nuclear facility (Iran). See Opera-
and typosquatting, 103 tion Olympic Games
and WannaCry malware, 352 National Cyber Investigative Joint Task
and Welchia worm, 440–441 Force, 275–276
Windows Genuine Advantage criticisms of, 276
Notifications, 394 founding of, 275
Xbox, 103, 242 Operation Clean Slate, 276
Microsoft v. United States, 121 purpose of, 275–276
Mitnick, Kevin, 260–262 National Cybersecurity Alliance, 276–278
Ark hack, xviii Champion program, 278
arrests and imprisonment, xix, xxi, xxiii, and cybersecurity education, 277
80, 260, 261–262 Data Privacy Day, 277
and cracking, 80 National Cyber Security Awareness
Digital Equipment Company hack, xix, Month, 277
80, 261 newsletter, 278
early years, 260 purpose of, 276–277
media appearances, 262 “Stop. Think. Connect” program, 277
Pacific Bell attack, 80, 260, 261 National Cybersecurity and Critical
published works, 262 Infrastructure Protection Act of 2013,
and United Loan Gunmen, 420 278–279
Money laundering, 262–265 definition of cyber incident, 278–279
and Bitcoin, 263–264 history and origins of, 278
definition of, 262–263 and McCaul, Michael, 278
and Liberty Reserve, 263–264 provisions of, 279
methods of, 263 National Infrastructure Protection Center,
and Vinnik, Alexander, 264 xxii, 110, 183–184, 221
Morris, Robert Tappan, 265–266 National Institute of Standards and
co-founder of Viaweb, 266 Technology Cybersecurity
early years, 265 Framework, 280–281
first person indicted under Computer Framework Core, 280
Fraud and Abuse Act, 266 Framework Implementation, 280
Morris worm, 265–266 Framework Profile, 280
Motives, 266–270 history and origins of, 280
entertainment, 268 and Obama, Barack, 280
espionage, 267 voluntary nature of, 281
financial gain, 266–267 News Corp hacking, 281–284
hacktivism, 268 criminal charges and convictions,
ideology, 267–268 282–283
retaliation, 267 impact and repercussions, 283
MPack, 180, 270–271 of public figures, 281–282
and Dream Coders, 270 of soldiers, 282
Index 477

Nimda, 284–285 freeware compared with, 289

first appearance of, 284 and licensing, 290
harm from, 285 shareware compared with, 289
protection measures, 285 Operation Apothecary, 290–291
source of, 284 background and history of,
spread of, 284–285 290–291
North Korea, 285–288 international reach, 291
and censorship, 286 results, 291
and cryptocurrencies, 287 Operation Aurora, 291–293
cyberattack capabilities, 286 as advanced persistent threat, 4
internet scheme, 286 and Eldergroup, 291
sanctions against, 286 goal of, 292
Sony Pictures Entertainment hack, and Google, 291–293
xxviii, 177, 287, 386–388 launch of, xxv, 291
as victim of state-sponsored name of, 291
attacks, 287 results, 291, 292
spread of malware, 292
Obama, Barack targets of, 291
Anonymous attack against, 11 and U.S. Foreign Intelligence
and Clinton, Hillary, 445 Surveillance Court documents, 292
commutation of sentence for Chelsea and zero-day vulnerability, 291
Manning, xxix, 255, 443 Operation Innocent Images, 293–295
creation of Cyberspace Policy Review and case of missing child (George
Committee, 61 Burdynski), xxi, 183, 293–294
on cybercrime, 331 and encryption, 294
and Cybersecurity Enhancement Act of and Federal Bureau of Investigation, xxi,
2014, 98 183, 293–294
and Cybersecurity Workforce and Innocent Images National
Assessment Act of 2015, 100 Initiative, 294
and Einstein 3, 158 and Kowalski, James, 293–294
and Executive Order 13636, 280 launch of, xxi, 183, 294
and Federal Information Security and Leak, Stephen, 293–294
Modernization Act of 2014, 187 and Lynch, Joseph, 293
and Operation Olympic Games, results, 294
297–298 Operation Marco Polo, 295–297
and Personal Data Notification and background and history of, 295–296
Protection Act, 311 and Bitcoin, 146, 296
and sanctions against North Korea, 387 and Bridges, Shaun, 146, 296
and Snowden, Edward, 380 and Der-Yeghiayan, Jared, 295–296
and Sony Pictures Entertainment hack, and Federal Bureau of Investigation,
387, 427 184–185, 296
and USA Freedom Act, 307 and Force, Mark, 146, 295–296
Onion Router, The. See Tor (The Onion launch of, 295
Router) results of, 296
Open-source, 289–290 and Silk Road, 146, 147, 233,
corporate support for, 289 295–296, 371
and cryptography, 88 and Ulbricht, Ross (Dread Pirate
definition of, 289 Roberts), 146–147, 295–296
and Equifax breach, 175 United States v. Ulbricht, 296
478 Index

Operation Olympic Games, 297–298 and spyware, 304

background and history of, 297 and Trojan horse, 305
and Bush, George W., 297 Peer-to-peer (P2P) file-sharing, xxii, 36,
as cyberwarfare, 111 69–70, 160
discovery of, 298 Pen register, 306–308
first known case of cybersabotage, 297 definition of, 306
and Flame malware, 108 and Electronic Communications Privacy
launch of, xxiv, 297 Act, 307
and Obama, Barack, 297–298 and FBI investigation of Michael
purpose and goal of, 297 Cohen, 308
results of, 298 and Smith v. Maryland, 307–308
and Stuxnet worm, xxv, 111, 228, 298, trap and trade device, 306
305, 327, 400, 427, 432, 458 triggerfish and stingrays, 306
as zero-day attack, 458 and USA PATRIOT Act, 307
Operation Phish Phry, 299–300 wiretap compared with, 306, 308
and Electronics Crimes Task Force, 299 People’s Liberation Army Unit 61398,
and Lucas, Joseph, 299 308–310, 326–327
and Merzi, Nicole Michelle, 299 cyberattacks, 309–310
results of, xxv, 299–300 cyberespionage methods of, 309
Operation Robin Hood, 411 members, 309–310
Operation Shrouded Horizon, 300–302 purpose of, 309
and Darkode (online black market), U.S. indictments, xxviii, 309–310
185, 300–301 Personal Data Notification and Protection
and Federal Bureau of Investigation, Act of 2017, xxx, 310–313
185, 300–301 first proposal, 310–311
and Gudmunds, Johan Anders, 301 and Langevin, James R., 310–311
and Guidry, Rory, 300–301 and Obama, Barack, 311
launch of, 300 provisions, 311–312
and Placek, Daniel, 300, 301 second proposal, 311–312
results of, 301 Personally identifying information,
313–315
Password, 303–304 collection methods, 313–314
definition of, 303 cybercriminal uses of, 313–314
guessing passwords, 304 definition of, 313
and keystroke monitors, 303 and phishing, 313–314
and observation of victims, 303–304 protection measures, 314
and phishing, 303 and scavenging, 314
protection measures, 304 Pharming, 315–316
and sniffers, 303 attacks on DNS servers, 315–316
and social engineering, 303 definition of, 315
Payload, 304–306 and malware, 315
and bots, 305 protection measures, 316
definition, 304 and typosquatting, 315
financial gain, 304 Phishing, 316–318
financial harm, 305 definition of, 316
and logic bombs, 305 and e-mail, 317
physical and property damage, 305 protection measures,
remote computer control, 305 317–318
and rootkits, 305 success rates of, 317
Index 479

Phreaker, 318–319 Poulsen, Kevin, 328–329

and blue boxes, 318–319 aka Dark Dante, 328
definition of, 318 Arpanet hack, 328
Draper, John (Captain Crunch), arrest and sentencing of, xx, 329
144–145, 318 as black-hat hacker, 33
Engressia, Joe, 144, 170–171, 318 FBI search for, 328–329
history of, 318 journalism career, 329
and Masters of Deception, 257 KIIS-FM attack, xx, 328
Mitnick, David, 80, 261–262 and SecureDrop, 329
and modern communication technology, University of California Berkeley
319 hack, 328
Piggybacking, 320–321 President and cybercrime, 330–333
definition of, 320 Bush, George W., 330–331
methods of, 320 Clinton, Bill, 330
physical piggybacking, 320–321 and 9/11 attacks, 330
protection measures, 321 Obama, Barack, 331
Pile, Christopher, 321–322 Trump, Donald, 331–332
aka “Black Barron,” 321 Pretty Good Privacy, 333–335
arrest of, 321–322 as freeware, 334
and Pathogen and Queeg viruses, 321 investigation of, xxi, 334
and SMEG malware, 321 legitimate and criminal uses of, 333–334
victims and harm, 322 public attitudes toward, 334
Plankton, 322–324 purpose of, 333
and Google, 322–323 and Zimmerman, Philip, xx, 333–334
and Jiang, Xuxian, 322–323 Prevention, 335–337
spread of, 322–323 attack and incident response plans, 336
as spyware, 322–323 bank statements, 336
as Trojan horse, 323 children’s internet use, 337
Pokémon Go, 324–326 consistent enforcement, 337
and beacons, 324 employee access, 336
and cyber threats, 326 firewalls and virus protection
and distracted driving, 326 software, 335
and GPS spoofing, 325, 392 information sharing, 336–337
and physical threats, 325–326 international measures, 337
and sex crimes, 325 passwords, 335–336
and theft of phones, xxix, 324–325 public awareness of internet safety, 335
Political uses, 326–328 public Wi-Fi, 336
and Ghost Squad, 327 recognition of fake e-mails, 336
government employment, 326–327 reporting suspicious activity, 336
and Internet Research Agency Prism, 338–340
(Russia), 327 and FISA, 338–339
and People’s Liberation Army Unit and NSA, 338–339, 342, 353, 381
61398, 326–327 purpose of, 338, 339
political agendas, 327 and Snowden, Edward, 17, 121, 177,
and Russia’s Main Intelligence 228–229, 338–339, 342, 353–354,
Directorate of the General Staff 380–381
(GRU), 327 and technology companies, 338
and Syrian Electronic Army, 327 and Tempora (United Kingdom),
tacit government approval, 327 338–339
480 Index

Privacy, 340–344 Rootkit, 357–358

Ashley Madison breach, 341–342 application-level rootkits, 357
and financial gain, 341 bootkits, 358
personal identifying information, categories of, 357–358
340–342 definition and purpose of, 357
privacy rights and investigations, 342 kernel-level rootkits, 357–358
protection measures, 342–343 Russia, 358–362
Profits from cybercrime, 344–346 cyberattacks against other countries,
lack of reporting, 344 359–360
and small companies, 344 Infraud Organization, 358–359
statistics, 344–345 Internet Research Agency (IRA), 327,
Public domain, 346–347 360, 424–425
Creative Commons, 347 Main Intelligence Directorate of the
definition of, 346 General Staff (GRU), 228, 268, 327,
examples of works in, 347 359, 425
and expiration time periods, 346–347 misinformation campaigns, 360
and images, 346 Russian Business Network (RBN), 359,
and intellectual property rights, 346 362–363, 399
and waivers of intellectual property as target of cyberattacks from other
rights, 347 countries, 361
Punishment, 347–349 Russian Business Network, 362–363
civil law, 348 and bulletproof hosting, 362
and easy of cybercrime, 348 history and creation of, 362
sentencing challenges and guidelines, 348 prosecution of, 362–363
unique cybercrimes, 348
website regulations, 348–349 Scavenging, 365–366
Putin, Vladimir, 327, 424 by cybercrime investigators, 366
data scavenging, 365
Ransomware, 351–353 definition of, 365
Cryptolocker, 352 forms of, 365
CryptoWall, 352 physical scavenging, 365
cyberextortion, 351 Secret Service, 366–368
definition of, 351 CardersMarket investigation, 366–367
growth of, 351 and cryptocurrency, 367
protection measures, 352 founding of, 366
success rates, 351 international investigations, 367
Reputation, effects on, 353–355 National Computer Forensic Institute, 367
and commission of cybercrime, 354 protection of U.S. president, 367–368
corporations, 353–354 roles of, 366, 367–368
and doxing, 353 Sexting, 368–370
individuals, 353 consequences of, 369–370
public opinion on, 353 definition of, 368–369
and revenge porn, 353 incidence statistics, 369
and sextortion, 353 state laws against, 369
Revenge porn, 355–357 Silk Road, 370–372
criminalization and statutes, 355 and Bitcoin, 371
definition of, 355 history and origins of, 370
and sextortion, 356 and Operation Marco Polo, 146, 147,
and social media, 355–356 233, 295–296, 371
Index 481

purpose and ideology of, 370–371 examples of hacks, 383

See also Dread Pirate Roberts (Ulbricht, and phishing, 383
Ross) and pretexting, 383
Silk Road 2.0, 147, 179, 371 Social media, 383–386
Silk Road 3.0, 117, 371 and criminal evidence, 385
Simulation, 372–373 definition and features of, 383–384
definition of, 372 and direct fraud, 384
Quantum Dawn simulations, 372 Facebook, 384
training uses, 372 history of, 384
vulnerability tests, 372–373 and indirect fraud, 384
Skimmer, 373–375 non-financial crimes, 385
definition of, 373 and political protest, 385
digital skimmers, 375 Six Degrees, 384
growth in use of, 374 Sony Pictures Entertainment hack,
protection measures, 374–375 386–388
shimmers, 374 and North Korea, xxviii, 177, 287,
types of, 373–374 386–388
Smart card, 375–378 and Obama, Barack, 387, 427
chip-based cards, 376 Spam, 388–390
definition of, 375 CAN-SPAM Act, xxiv, 8, 40–42, 239,
government identification cards, 377 240, 389
payment cards, 376 criminal repercussions of, 389
privacy concerns, 377 definition of, 388
and shimmers, 376 first examples of, 388–389
use in health-care industry, 376 history of, 388–389
use in public transit, 376–377 origin of the term, 388
Sniffer, 378–379 types of, 389
definition of, 378 Spoofing, 390–393
legitimate uses, 378 caller ID spoofing, 390–391
protection measures, 378–379 definition of, 390
and Tor, 378–379 e-mail spoofing, 390
voice sniffer algorithm (Amazon), 379 GPS spoofing, 392
Snowden, Edward, 379–382 IP spoofing, 391–392
disclosure of NSA information, 17, 121, Spyware, 393–396
177, 228–229, 338–339, 342, and adware, 394
353–354, 380–381 definition of, 393
early years, 379 government use of, 393–394
hired by Booz Allen, 380 individuals’ use of, 394
hired by CIA, 379 law enforcement use of, 394–395
and Prism program, 338–339, 342, State actor, 396–398
353–354, 381 and Constitutional rights, 397–398
public opinion of, 381 cyberattacks by state actors, 396
in Russia, 17, 381 definition of, 396
Social engineering, 382–383 law enforcement officers, 397
and access to restricted areas and nonstate actor compared with, 396–397
accounts, 382–383 Storm botnet, 398–399
and access to victim’s information, 382 definition of, 398
and baiting, 383 purpose of, 398
definition of, 382 and Russian Business Network, 399
482 Index

Stuxnet 2005 Coventry, England, swatting case,

as advanced persistent threat, 4 405–406
and Duqu malware, 108 2017 Wichita swatting case, 405
first discovery of, xxv, 298 Symantec, 407–408
and Flame malware, 108 acquisitions, 407–408
purpose and target, 432 Certus Corporation acquisition, 407
and Supervisory Control and Data founding of, 407
Acquisition, 400 L0phtCrack password auditing system,
See also Operation Olympic Games 407
Supervisory Control and Data Acquisition, LifeLock acquisition, 408
400–401 Norton Internet Security, 407
background and history, 400 Peter Norton Computing Company
cyberattacks against, 400–401 acquisition, 407
and Stuxnet worm, 400 Q&A, 407
U.K. water treatment plant attack sale of Veritas Technologies to Carlyle
(2016), 400–401 Group, 408
See also Operation Olympic Games Sygate acquisition, 407
Superzapping, 401–402 Symantec Endpoint Protection, 407
criminal and unauthorized Syrian Electronic Army, 409–410
superzapping, 401–402 Agha, Ahmad Umar, 410
definition, 401 and al-Assad government, 327, 409
and IBM Superzap program, 401–402 Dardar, Firas, 410
origins of the term, 401 and Facebook, 409
purpose and targets, 401–402 and hacktivism, 268
regulation and security against, 402 history and origins of, 409
Swartz, Aaron, 402–404 membership, 409–410
Aaron’s Law, 65, 404 Romar, Peter, 410
arrest, charges, and plea bargain offer, website vandalism and DDoS attacks, 409
64–65, 403
cocreator of Demand Progress, 403 TeaMpoisoN, 411–412
and DoS attack against Department of and Anonymous, 411
Justice, 403 Blair, Tony, web server hack, 411
downloading of JSTOR articles, disbanding of, 412
64, 402, 403 Facebook hack, 411
family and education, 402–403 Hussain, Junaid, 411, 412
and Holder, Eric, 404 “MLT” (former member), 411–412
and Jottit, 403 and Operation Robin Hood, 411
opposition to Stop Online Piracy Act, 403 United Nations hack, 411
and Progressive Change Campaign The Onion Router. See Tor (The Onion
Committee, 403 Router)
and SecureDrop, 65, 404 Tools, 412–414
suicide, 65, 402, 404 botnet, 413
Swatting, 404–406 categories, 412–413
against celebrities, 406 combinations of software and hardware,
costs of, 406 413
dangers of, 405 computer, 413
definition, 404 computer virus, 412
incidence of, 406 costs of, 413
origin of the term, 404–405 criminal use of legitimate tools, 412–413
Index 483

definition of cybercrime tool, 412 on Manning, Chelsea, 256

hardware tools, 413 meme of, xxix, 143
keystroke monitor, 413 New World Hacking attack on, 139
pen register, 413 and U.S. presidential election
ransomware, 412 interference (2016), 424, 425
skimmer, 413
sniffer, 412–413 Uber hack, 417–418
software tools, 412–413 accusations of cover-up against Uber,
See also individual tools 417–418
Tor (The Onion Router), 414–415 May 2014 Uber driver hack, 417
and the dark web, 118 origins of the term, 417
and European Cybercrime Center, 179 procedure, 417
and financial crimes, 188–189 2016 Uber user hack, 417
hidden devices, 414 Ulbricht, Ross. See Dread Pirate Roberts
illegitimate purposes, 414 (Ulbricht, Ross)
initial version of, xxiv, 414 Union Dime Savings Bank theft, 419
legitimate purposes, 414 cybercrime lessons from, 419
role of U.S. government, 414–415 discovery of, 419
and sniffers, 378–379 and Steffen, Roswell, 419
and virtual private networks, 342, 430, United Loan Gunmen, 420–421
431 ABC attack, 420
Tor Project, 147 Associated Press attack, 420
TorMarket, 147 C-Span attack, 420
TorrentLocker, 352 Drudge Report attack, 420
Trojan horse, 415–416 and Hacking for Girlies, 420–421
Back Orifice, xxii, 210 NASDAQ attack, 420
Back Orifice 2000, 210 United States Cyber Command, 421–422
and backdoors, 23 creation of, 421
Carberp, xxv, xxvii, 26, 44–45 headquarters, 421
and credit card fraud, 84 mission of, 421–422
definitions of, 251–252, 415–416 oversight, 421
element of deception, 416 and 2017 DDoS attack on North Korea’s
and e-mail phishing, 163 RGB, 287
and firewalls, 191 Unlimited operation, 422–424
first use of malware term, xviii, 415 definition of, 422
law enforcement responses, 253 procedure, 422–423
mythological origin of the term, 415 2011 American Red Cross prepaid debit
and Operation Aurora, 291 card scheme, 423
and payload, 305 2013 Oman prepaid debit card scheme,
and Plankton malware, 322–323 423
as type of malware, 251–252 2012 United Arab Emirates prepaid
virus compared with, 432 debit card scheme, 423
and Zeus (botnet attack), 36 U.S. presidential election interference,
Trump, Donald 2016, 424–426
and Anonymous, 12 and Assange, Julian, 17, 425, 444–445
and Cohen, Michael, 308 and Clinton, Hillary, 139, 228, 327,
on cybercrime, 331–332 360, 424, 425, 444–445
and Cybersecurity and Infrastructure computer network attacks, 139, 228,
Security Agency, 97 327, 360, 425
484 Index

U.S. presidential election interference and Trojan horse, 191

(Continued) use statistics, 431
and Facebook, 424 Virus, 431–432
indictments, 425 Code Red, 432 (See also Code Red)
and Internet Research Agency (IRA), computer worms compared with,
327, 360, 424–425 432, 450
and Podesta, John, 425, 445 definition of computer virus, 431
and Putin, Vladimir, 327, 424 origin of the term, 431–432
and Russia’s Main Intelligence purpose of, 432
Directorate of the General Staff Stuxnet, 432 (See also Operation
(GRU), 228, 327, 425 Olympic Games)
social media misinformation campaign, Trojan horse compared with, 432
360, 424 Zeus, 432 (See also GameOver Zeus
spear phishing, 425 botnet)
Special Counsel Investigation (Robert S. Vulnerability, 433–435
Mueller), 424, 425 buffer overflow, 434
and Trump, Donald, 424, 425 and Cybersecurity Information Sharing
and Twitter, 424 Act of 2015, 434
and WikiLeaks, xxix, 17, 425, 444–445 definition of, 433
disclosure, 434–435
Vandalism, 427–428 hardware vulnerabilities, 433
changes to Wikipedia entries, 427 hidden bypass, 434
damage from cybervandalism, 427 human vulnerabilities, 433–434
definition of, 427 software vulnerabilities, 433
to physical property, 427–428 and technological advances, 434
psychological damage from, 428
2014 Sony Pictures hack, 427 War dialer, 437–438
Victims of cybercrime, 428–430 and benevolent hackers, 438
blaming victims, 429 definition of, 437
college students, 429 detection of, 437–438
costs to, 428–429 and ethics, 438
and cyberbullying, 429 harm from, 438
impact on, 428–429 legality of, 437
older victims, 429 origin of the term, 437
reporting cybercrimes, 429 Wardriving, 438–440
social media users, 429 beneficial uses, 439
Virtual private network, 430–431 and ethics, 439
advantages and disadvantages, 431 harm from, 439
and cybercriminals, 430 history and origins of, 439
and the dark web, 118 origins of the term, 439
definition of, 430 warchalking, 439
and financial crimes, 188 WarGames (film), 123, 194, 239, 261,
and governments, 430–431 437, 439
purpose and uses of, 342, 430 Welchia worm, 440–441
and sniffers, 378 and definition of malware,
and spoofing, 391–392 440–441
and Tor (The Onion Router), harm from, 440
342, 430, 431 history and origins, 440
Index 485

original design intent, xxiv, 440, 451 identity theft, 448

response to Blaster worm, 440 revenge porn, 449
White-hat hackers, 441–442 romance schemes, 449
and blue-hat hackers, 442 short-term and long-term harm, 449
Calce, Michael, 39 social media, 447–448
definition of, 441 stalking, 448
and “do no harm” ethic, 441 statistics, 447
and gray-hat hackers, 441–442 Worm, 450–451
“MLT” (former TeaMpoisoN member), 412 benevolent purposes, 451
and penetration testing, 441 definition of, 450
and simulation, 372 harm from, 451
WikiLeaks, 442–447 purposes and processes,
British National Party leaks, 141 450–451
Climategate (Scientology leaks), 15, 444 and self-replication, 451
and ethnics, 177 viruses compared with, 432, 450
founding of, xxiv, 15, 443 See also Code Red; Melissa worm;
Guantanamo Bay leaks, 15, 444 Nimda; Welchia worm
and Operation Avenge Assange
(Anonymous), xxv, 10, 138, 210 Xbox. See Microsoft and Microsoft Win-
and PayPal, xxv, 10, 138, 210 dows
public opinion on, 443–444, 445
purpose and goals of, 442 Youth and cybercrime, 453–455
Sony leaks, 444 cyberbullying, 453
and U.S. presidential election media piracy, 453–454
interference (2016), xxix, 17, 425, response from law enforcement, 454
444–445 sexting, 454
“WikiSecrets” (Frontline segment), 246 youth as offenders, 454
See also Assange, Julian youth as victims, 453–454
Windows software. See Microsoft and Mi-
crosoft Windows Zero-day attacks, 457–458
Wiretapping. See Pen register definition of, 457
Women, effects on, 447–450 gray market, 457
and age, 447 half-day attacks, 458
cyber theft, 448 markets, 457
defamation, 448 mitigation of damage from, 458
e-mail, 448 success of, 458
hate speech, 448 white market, 457
human trafficking and sex trade, zero-day market, 457
448–449 See also Operation Aurora
About the Authors

NANCY E. MARION received her PhD in political science from the State Univer-
sity of New York, and completed her JD from the University of Akron in December
2019. She is currently a professor of Political Science with a joint appointment in
Criminal Justice, serving as chair for both departments at the University of Akron.
Her research revolves around the relationship of politics and criminal justice and
how the two fields interact with each other. She is the author of many books and
articles that examine the interplay of these fields.

JASON TWEDE received his PhD in Criminal Justice from the University of North
Dakota and his JD from Thomas M. Cooley Law School. He currently works as an
assistant professor in the Department of Sociology, Social Work, and Anthropology
at Utah State University, Tooele campus. Prior to pursuing a career in academia,
Jason worked as a prosecutor in Navajo County, Arizona. He worked on and
prosecuted a wide array of criminal matters, though his work primarily focused
on drug crimes—including drug interdiction and legal issues regarding medical
marijuana—and arson.
Jason’s background as a prosecutor has largely shaped his research. His primary
focus has been on the history of prosecution in the United States, in particular the
transition from private to public prosecution and the ramifications that transition
has on the criminal justice system today. The research takes a critical approach,
emphasizing how the interests of the socioeconomically advantaged have shaped
this transition. His research has also included other legal transitions in the United
States, such as the ongoing transition regarding the legalization of medical mari-
juana. This research likewise emphasizes how the interests of the socioeconomi-
cally advantaged have shaped this transition.

Electrical Installation Level 5 Learning Guide
No ratings yet
Electrical Installation Level 5 Learning Guide
76 pages
Ransomware and Cybercrime
No ratings yet
Ransomware and Cybercrime
199 pages
MATH 5 - Q1 - Mod1 PDF
78% (49)
MATH 5 - Q1 - Mod1 PDF
25 pages
Pediatric Demyelinating Diseases of The Central Nervous System and Their Mimics
100% (1)
Pediatric Demyelinating Diseases of The Central Nervous System and Their Mimics
338 pages
2018 Handbook of Research On Information and Cyber Security in The Fourth Industrial Revolution
No ratings yet
2018 Handbook of Research On Information and Cyber Security in The Fourth Industrial Revolution
674 pages
Handbook of Internet Crime 9781843929338 1843929333 9781843925248 - Compress
No ratings yet
Handbook of Internet Crime 9781843929338 1843929333 9781843925248 - Compress
673 pages
Ethical Hacking Techniques and Countermeasures For Cybercrime Prevention (Nabie Y. Conteh)
No ratings yet
Ethical Hacking Techniques and Countermeasures For Cybercrime Prevention (Nabie Y. Conteh)
187 pages
Lab Manual On Bug - Bounty
No ratings yet
Lab Manual On Bug - Bounty
30 pages
Early Method of Detecting Deception
100% (2)
Early Method of Detecting Deception
6 pages
Computer System Architecture - Morris Mano (1) - Pfu79k3tv14e238u9o4r794
No ratings yet
Computer System Architecture - Morris Mano (1) - Pfu79k3tv14e238u9o4r794
517 pages
Scania Parts List
100% (4)
Scania Parts List
2 pages
FCIE V17a Sample Paper
No ratings yet
FCIE V17a Sample Paper
21 pages
Ghosh, Turrini - 2010 - Cybercrimes A Multidisciplinary Analysis PDF
No ratings yet
Ghosh, Turrini - 2010 - Cybercrimes A Multidisciplinary Analysis PDF
415 pages
CS Configuration Document Ace V1.0
100% (5)
CS Configuration Document Ace V1.0
106 pages
10 Minute Tips
0% (1)
10 Minute Tips
8 pages
Matthew N. Dark Web. A Guide To Dealing With The Dark Spot On The Deep Web 2022
No ratings yet
Matthew N. Dark Web. A Guide To Dealing With The Dark Spot On The Deep Web 2022
54 pages
FTRE Brochure
No ratings yet
FTRE Brochure
36 pages
The Secret of DarkWeb
0% (1)
The Secret of DarkWeb
18 pages
Divinity Activation Mantras Empowerment
0% (2)
Divinity Activation Mantras Empowerment
2 pages
20160720-Cyber Primer Ed 2 Secured
100% (1)
20160720-Cyber Primer Ed 2 Secured
100 pages
PYQ DEMO COMBO PYQ BANK All Odisha Previous Year Subject Wise Topic Wise 20000 Questions Answer PDF
100% (1)
PYQ DEMO COMBO PYQ BANK All Odisha Previous Year Subject Wise Topic Wise 20000 Questions Answer PDF
51 pages
Cybercrime Prevention
100% (1)
Cybercrime Prevention
157 pages
Think Like A Criminal
No ratings yet
Think Like A Criminal
10 pages
General Description: ISO 17987/LIN 2.x/SAE J2602 Transceiver
100% (1)
General Description: ISO 17987/LIN 2.x/SAE J2602 Transceiver
24 pages
Ethical Hacking My Seminar Report
50% (2)
Ethical Hacking My Seminar Report
22 pages
BitcoinForensics ATutorial
No ratings yet
BitcoinForensics ATutorial
18 pages
Cybersecurity Introduction
No ratings yet
Cybersecurity Introduction
152 pages
EHEv1 Module 05 Social Engineering Techniques and Countermeasures
No ratings yet
EHEv1 Module 05 Social Engineering Techniques and Countermeasures
43 pages
Cyber Terrorism Best Practices Analysis
No ratings yet
Cyber Terrorism Best Practices Analysis
21 pages
Native Corn Recipes
100% (3)
Native Corn Recipes
115 pages
CRM Section Two
No ratings yet
CRM Section Two
4 pages
Live Hacking Like A MVH - Frans Rosen PDF
No ratings yet
Live Hacking Like A MVH - Frans Rosen PDF
110 pages
Dark Side of The Internet
0% (1)
Dark Side of The Internet
273 pages
CESC Summative Test No.2
No ratings yet
CESC Summative Test No.2
4 pages
11 Footprinting Whois
No ratings yet
11 Footprinting Whois
50 pages
SQL Injection IIS
100% (1)
SQL Injection IIS
53 pages
Cyber Crime An Overview
No ratings yet
Cyber Crime An Overview
12 pages
Types of Computer Forensics Technology
100% (1)
Types of Computer Forensics Technology
20 pages
Soumya Ranjan Dash - Es20913
No ratings yet
Soumya Ranjan Dash - Es20913
1 page
ANONYMOUS SUDAN - Security Bulletin - 230728 - 073314
100% (1)
ANONYMOUS SUDAN - Security Bulletin - 230728 - 073314
6 pages
Going Darker: Challenge of Dark Net Terrorism
100% (1)
Going Darker: Challenge of Dark Net Terrorism
13 pages
THEONE ? Sentence Improvement Pre 4th Oct Level Up Your English
No ratings yet
THEONE ? Sentence Improvement Pre 4th Oct Level Up Your English
145 pages
Cyber Security at Airports PDF
No ratings yet
Cyber Security at Airports PDF
6 pages
Essentials of Cyber Security
100% (1)
Essentials of Cyber Security
1 page
API FR - INR.RINR DS2 en Excel v2 2917298
No ratings yet
API FR - INR.RINR DS2 en Excel v2 2917298
74 pages
Dark Web Outline-2
100% (1)
Dark Web Outline-2
5 pages
Philips 37pfl7605h CH Q552.1e-La
No ratings yet
Philips 37pfl7605h CH Q552.1e-La
184 pages
Hands-On Ethical Hacking and Network Defense
100% (2)
Hands-On Ethical Hacking and Network Defense
28 pages
Topic 4 - Cyber Crime Ecosystem - DR Ram Kumar G
No ratings yet
Topic 4 - Cyber Crime Ecosystem - DR Ram Kumar G
60 pages
Master Port Scanning With Nmap
100% (1)
Master Port Scanning With Nmap
2 pages
Catalogo Bujías Gauss
No ratings yet
Catalogo Bujías Gauss
32 pages
ReportPdfResponseServlet - 2024-12-20T111226.809
No ratings yet
ReportPdfResponseServlet - 2024-12-20T111226.809
9 pages
Evaluation Final
No ratings yet
Evaluation Final
3 pages
Module III Cyber Crime PPT Final
No ratings yet
Module III Cyber Crime PPT Final
50 pages
SC9b - Homework
No ratings yet
SC9b - Homework
6 pages
Safe Work Procedure
No ratings yet
Safe Work Procedure
2 pages
All About Bohol
No ratings yet
All About Bohol
5 pages
Lift Manuals - Manuale Delle Parti - CHASSIS, MAST, OPTIONS & INTERNAL HOSING - PDF Tav 4 Ver
No ratings yet
Lift Manuals - Manuale Delle Parti - CHASSIS, MAST, OPTIONS & INTERNAL HOSING - PDF Tav 4 Ver
3 pages
Cybercrime Classification and Characteristics: Submitted By:-Syed Saif Ali Zaidi
No ratings yet
Cybercrime Classification and Characteristics: Submitted By:-Syed Saif Ali Zaidi
11 pages
Detect Sqli Attacks in Web Apps Using NV PDF
No ratings yet
Detect Sqli Attacks in Web Apps Using NV PDF
13 pages
02 Reconnaissance Techniques
No ratings yet
02 Reconnaissance Techniques
34 pages
Network Security and Firewall - ClearOS
No ratings yet
Network Security and Firewall - ClearOS
41 pages
Cyber Crime and Digital Forensics-Unit-I
No ratings yet
Cyber Crime and Digital Forensics-Unit-I
31 pages
The NGINX Real-Time API Handbook
No ratings yet
The NGINX Real-Time API Handbook
26 pages
Dark Web
No ratings yet
Dark Web
23 pages
Shadow Nexus - Cap Sheet White Paper
No ratings yet
Shadow Nexus - Cap Sheet White Paper
3 pages
Cyber Security All Questions
No ratings yet
Cyber Security All Questions
22 pages
Bright Planet Occupy Software
No ratings yet
Bright Planet Occupy Software
41 pages
Advantages: Anonimity Freedom of Speech Political Activism Knoweldge Amazing Individual
No ratings yet
Advantages: Anonimity Freedom of Speech Political Activism Knoweldge Amazing Individual
8 pages
Ethical Hacking 12-Sept
No ratings yet
Ethical Hacking 12-Sept
13 pages
Open Source Intelligence:: Access All Intelligence, in All Languages, All The Time
No ratings yet
Open Source Intelligence:: Access All Intelligence, in All Languages, All The Time
17 pages
Privacy and Big Data: Making Ends Meet
No ratings yet
Privacy and Big Data: Making Ends Meet
11 pages
Assembling Cakes: o o o o o o o
No ratings yet
Assembling Cakes: o o o o o o o
9 pages
Seminar: Hacking
No ratings yet
Seminar: Hacking
33 pages
Current - Syllabus - 0112301 - Cyber Security Law and Policy
No ratings yet
Current - Syllabus - 0112301 - Cyber Security Law and Policy
5 pages
Cse Instructor Materials Chapter1
No ratings yet
Cse Instructor Materials Chapter1
38 pages
Power Point Presentation ON Honey Pots
No ratings yet
Power Point Presentation ON Honey Pots
13 pages
Classification: Computer Crime, or Cybercrime, Refers To Any Crime That Involves A
No ratings yet
Classification: Computer Crime, or Cybercrime, Refers To Any Crime That Involves A
7 pages
Final Group Project On Hacking
No ratings yet
Final Group Project On Hacking
30 pages
Extent of Cyber Crimes Around The World
No ratings yet
Extent of Cyber Crimes Around The World
12 pages
Dark Net
No ratings yet
Dark Net
17 pages
Room Tariff: Special Rates On Continental Plan (CPAI)
No ratings yet
Room Tariff: Special Rates On Continental Plan (CPAI)
4 pages
Title of Paper - Bending-Axis Effects On Load-Moment (P-M) Interaction Diagrams For Circular Concrete Columns Using A Limited Number of Longitudinal Reinforcing Bars
No ratings yet
Title of Paper - Bending-Axis Effects On Load-Moment (P-M) Interaction Diagrams For Circular Concrete Columns Using A Limited Number of Longitudinal Reinforcing Bars
8 pages
Dark Web Top 5 Reasons-Ds PDF
No ratings yet
Dark Web Top 5 Reasons-Ds PDF
4 pages
Cybercrime Definition: Computer Crime Research Center
No ratings yet
Cybercrime Definition: Computer Crime Research Center
7 pages
Literature Survey On DDOS
No ratings yet
Literature Survey On DDOS
4 pages
Ultimate Penetration Testing with Nmap: Master Cybersecurity Assessments for Network Security, Monitoring, and Scanning Using Nmap (English Edition)
From Everand
Ultimate Penetration Testing with Nmap: Master Cybersecurity Assessments for Network Security, Monitoring, and Scanning Using Nmap (English Edition)
Travis DeForge
No ratings yet
Advanced Cybersecurity Strategies: Navigating Threats and Safeguarding Data
From Everand
Advanced Cybersecurity Strategies: Navigating Threats and Safeguarding Data
Adam Jones
No ratings yet
Cuckoo Malware Analysis
From Everand
Cuckoo Malware Analysis
Digit Oktavianto
No ratings yet
Certified Ethical Hacker C.E.H v11 Exam Prep And Dumps
From Everand
Certified Ethical Hacker C.E.H v11 Exam Prep And Dumps
Byte Books
No ratings yet