ASSISTANT AG CALDWELL MAKES SPEECH AT CYBERCRIME 2020 SYMPOSIUM

FROM:  U.S. JUSTICE DEPARTMENT 
Assistant Attorney General Leslie R. Caldwell Speaks at Cybercrime 2020 Symposium
Washington, DCUnited States ~ Thursday, December 4, 2014

Good morning and welcome to the Criminal Division’s inaugural symposium on cybercrime.  Before we start, I would like to thank Dean Treanor and the Georgetown Law Center for being such gracious partners in planning and holding this event.  

I would also like to thank the moderators and panelists for traveling from across the country to contribute their expertise to today’s discussions.  We have assembled an impressive array of experts from the private sector, academia, privacy groups, and all three branches of government, and I am looking forward to the diverse perspectives they will be sharing with us today.

A special welcome and thanks to Troels Orting, our keynote speaker, who has traveled the farthest to be with us today.  Troels is the Director of Europol’s European Cybercrime Center or “EC3,” which is headquartered at the Hague in the Netherlands.  In recent months, the Criminal Division, U.S. Attorneys’ Offices, federal investigators, and private companies have executed some of the most elaborate law enforcement operations ever attempted in the cybercrime arena.  Troels and EC3 have been instrumental to the success of those operations.

You’ll hear more about that in a moment, but I wanted to make sure I expressed my personal appreciation to him and EC3.  I believe that such robust cooperation within the international law enforcement community is the necessary future of cybercrime investigations.  I anticipate that the Department of Justice and EC3 will be allies for years to come.

Today’s symposium is focused on the future of technology and online crime, so I expect that you will be hearing a lot about “change” and “evolution.”  I want to briefly discuss the state of affairs today, and how I see cybercrime evolving over the coming years.

I also want to take this opportunity to talk about changes within the Criminal Division and our evolving efforts to deter, investigate, and prosecute cyber criminals and to protect the country’s computer networks from cyber threats in the first instance.

In that regard, I will highlight two ways in which we are addressing the growing threat:

First, we are mounting increasingly innovative and cooperative, international law enforcement operations to disrupt cyber criminal organizations across the globe;

Second, we are increasing our efforts to prevent cyber attacks by providing resources for our public and private partners to enhance cyber security across the board.  In furtherance of this effort, we are creating a dedicated Cybersecurity Unit within the Criminal Division, which I will discuss more in a moment.

As I mentioned, I will start with a few words about the Internet and technology, how they are influencing the crimes we see today, and how we anticipate they will shape the crimes of tomorrow.

By now it has become obvious not only to those of us who gather at events like this but to the entire world:  the Internet and related technologies have changed the way we work, play, and live.  Everyone in this room is carrying a cell phone, tablet, or some other device that is connected to the Internet right now.  The vast majority of Americans have made technology part of their everyday lives.

This boom in Internet-driven technology brings with it new opportunities for innovation, productivity, and entertainment.  It is helping people connect locally and globally through email, social networking, and various other forms of communication.  It is helping our businesses compete in expanding markets.  It is giving us ready access to a seemingly endless stream of information, resources, and services unlike anything that preceded it.  From big companies to tiny start-ups, innovation is taking place around the world at a dizzying pace.

Unfortunately, there is also a flip side to these advances.  A tool that has become so vital to families, consumers, businesses, and governments was also bound to become a target for criminals.  Not surprisingly, cyber criminals are taking advantage of the same advances in technology to perpetrate more complex and extensive crimes.  Indeed, according to data from the 2013 Norton Report, there will be more than 14,000 additional victims of online crime by the time I have finished this speech.

For the foreseeable future, cybercrime will increase in both volume and sophistication.  By exploiting technology, the most skilled cyber criminals will be capable of committing crimes on a scale that will result in more lost data, greater damage to the security of networks, and greater risk to Internet users.  We are already getting glimpses of this new criminal tide.

Last year, two cyber intrusions targeting the banking system inflicted $45 million in losses on the global financial system in a matter of hours.  Let me emphasize, that figure is not a speculative estimate or a projection.  That is the sum total of money that the perpetrators withdrew from banks around the world by breaking into bank computers and removing limits on the amount of money they could withdraw from ATM machines.  That crime dwarfed the biggest bank heists in U.S. history several times over, and the masterminds never had to worry about security guards, dye-packs, or silent alarms.  In fact, they never had to leave home.

Our dependence on technology is also ushering in a new era of online breaches.  Ever larger networks are processing more consumer data in an effort to make our purchases simpler and less time consuming.  These networks transmit vast amounts of personal and financial data, and enterprising hackers are targeting them to produce data breaches that dwarf anything we’ve seen before.  Individual breaches regularly put at risk the financial information of tens of millions of consumers.  This threatens consumer confidence and has devastating consequences for companies who have fallen victim.  

We have also witnessed the rise of another type of intrusion that causes harms less simple to quantify.  Rather than stealing money or valuable financial data, these breaches have robbed people of their privacy.  Some hackers have become virtual home invaders, using malware to tap into personal webcams located in homes around the world so they can spy on our most intimate moments.  Other hackers have broken into online storage accounts and personal devices to snatch personal photos or communications for money or prurient thrills.

So, how is the Department responding to these new types of online threats and challenges?  In the case of the $45 million dollar cyber heist I mentioned, we were able to promptly find, arrest and prosecute some of those responsible.  Thus far, 13 defendants have been convicted for their participation in the scheme.  The Criminal Division and U.S. Attorneys’ Offices are bringing the lessons of this successful prosecution and others to the investigations of recent breaches that have been in the news.

While arrests and prosecutions are our primary goal, we recognize that it is increasingly common for sophisticated cyber criminals to base themselves overseas in countries where they are not so easily reached.  Consequently, we have adjusted our tactics in two significant ways.  We are engaging in larger, international law enforcement operations to target criminals around the globe.  And, we are acting up front to stop the harm that these cyber criminals are causing, even before we can get them into custody.  A prime example of this has been our approach to “botnets.”

“Botnets” are networks of computers that have been secretly infected by malware and controlled by criminals.  Some botnets are millions of computers strong.  Once created, they can be used without a computer owner’s knowledge to engage in a variety of criminal activities, including siphoning off personal and financial data, conducting disruptive cyber attacks, and distributing malware to infect other computers.

One particularly destructive botnet—called Gameover Zeus—was used by criminals to steal millions of dollars from businesses and consumers and to extort additional millions of dollars in a “ransomware” scheme.  Ransomware is malware that secretly encrypts your hard drive and then demands payments to restore access to your own files and data.  Ransomware called “Cryptolocker” was distributed through the Gameover Zeus Botnet, which infected hundreds of thousands of computers, approximately half of which were located in the United States.  It generated more than $27 million in ransom payments for its creators, including Russian hacker Evgeniy Bogachev, in just the first two months after it emerged.

But through carefully choreographed international law enforcement coordination, we not only identified and obtained a 14-count indictment against Bogachev, but also obtained injunctions and court orders to dismantle the network of computers he used to orchestrate his scheme.  The Justice Department, U.S. law enforcement, numerous private sector partners, and foreign partners in more than 10 countries, as well as EC3, mounted court-authorized operations that allowed us to wrest control of the botnet away from the criminals, disable it, and start to repair the damage it caused.

This afternoon, you will hear from David Hickton, the U.S. Attorney for the Western District of Pennsylvania, whose office worked with CCIPS to spearhead this effort.  This case serves as a model of both international cooperation and our ability to mitigate the damage caused by cyber criminals even before making an arrest.

In another international operation, just a few weeks ago, we targeted so-called “dark market” websites selling illegal goods and services online.  These websites were operating on the “Tor” network, a special network of computers on the Internet designed to conceal the locations of individuals who use it.  The websites we targeted traded in illegal narcotics; firearms; stolen credit card data; counterfeit currency; fake passports and other identification documents; and computer-hacking tools and services.  Using court-authorized legal process and mutual legal assistance treaty requests, the Department, the FBI, and international partners from approximately 16 foreign nations working under the umbrella of EC3 seized over 400 Tor addresses associated with dozens of websites, as well as multiple computer servers hosting these websites.

Once again, international cooperation among the world’s law enforcement agencies was pivotal to the success of this global operation.  And, once again, we were able to disrupt cybercrime in manners other than traditional arrest and prosecution.

In addition to undertaking these innovative international operations and takedowns, the Criminal Division is also re-orienting itself to better address the complex nature of cyber threats on multiple fronts.

High-tech crimes are not new to the Criminal Division.  We have been investigating and prosecuting computer crimes since the Division created the Computer Crime and Intellectual Property Section, or “CCIPS,” in 1996.  As I have already described, CCIPS prosecutors have led complex computer crimes investigations for years, and this work will continue.

Through CCIPS, the Criminal Division has also supported and expanded our U.S. Attorneys’ Offices’ expertise and capacity to tackle the most complex cybercrimes.  CCIPS has worked over the last 12 years to build the Computer Hacking and Intellectual Property or “CHIP” Network with U.S. Attorneys’ Offices across the nation, which is now over 270 prosecutors strong.  That network has fostered a close partnership between CCIPS and the U.S. Attorneys’ Offices in addressing the nation’s most sophisticated computer crimes.  In addition, over the last two years, the CHIP Network was used as the model for the National Security Cyber Specialists’ network, a partnership among the National Security Division, the U.S. Attorneys’ Offices, and CCIPS that focuses on cyber threats to national security.

As the threats increase daily, however, I want to make sure that cyber security is receiving the dedicated attention it requires.  It is important that we address cyber threats on multiple fronts, with both a robust enforcement strategy as well as a broad prevention strategy.  I am, therefore, announcing today the creation of the Cybersecurity Unit within CCIPS.  The Cybersecurity Unit will have responsibility on behalf of the Criminal Division for a variety of efforts we are undertaking to enhance public and private cyber security efforts.

Given the growing complexity and volume of cyber attacks, as well as the intricate rubric of laws and investigatory tools needed to thwart the attacks, the Cybersecurity Unit will play an important role in this field.  Prosecutors from the Cybersecurity Unit will provide a central hub for expert advice and legal guidance regarding the criminal electronic surveillance statutes for both U.S. and international law enforcement conducting complex cyber investigations to ensure that the powerful law enforcement tools are effectively used to bring the perpetrators to justice while also protecting the privacy of every day Americans.  The Cybersecurity Unit will work hand-in-hand with law enforcement and will also work with private sector partners and Congress.  This new unit will strive to ensure that the advancing cyber security legislation is shaped to most effectively protect our nation’s computer networks and individual victims from cyber attacks.

As you know, the private sector has proved to be an increasingly important partner in our fight against all types of online crime, but particularly cyber security-related matters.  Prosecutors from the Cybersecurity Unit will be engaging in extensive outreach to facilitate cooperative relationships with our private sector partners.  This is a fight that the government cannot and will not wage alone.

As just one example of the kind of outreach we can do, earlier this year, we heard concerns expressed by communications service providers about uncertainty over whether the Electronic Communications Privacy Act prohibits sharing certain cyber threat information.  This uncertainty limited the lawful sharing of information that could better protect networks from cyber threats.  In response, we produced a white paper in May to address these concerns and publicly released our analysis of the issue.  We will continue to engage in this open dialogue about emerging issues and to clear roadblocks like this one.

Finally, we will be engaging with the public at-large about cyber security issues.  Over the past several years, but especially this past year, I have noticed a growing public distrust of law enforcement surveillance and high-tech investigative techniques.  This kind of mistrust can hamper investigations and cyber security efforts.  Most of this mistrust, however, comes from misconceptions about the technical abilities of the law enforcement tools and the manners in which they are used.  I hope to engage the public directly on these issues and to allay concerns.

CCIPS already plays an important role in this regard, and I expect that to expand with the Cybersecurity Unit.  CCIPS’s manuals on laws governing searching and seizing computers, electronic surveillance, and prosecuting computer crimes are probably the most comprehensive materials on those topics you will find anywhere.  To ensure transparency and wide access to this helpful information, those manuals are publicly available on CCIPS’s website, cybercrime.gov.  

I would like to start the public dialogue, however, by briefly addressing an overarching misconception:  the apparent belief that privacy and civil liberties are afterthoughts to criminal investigators.  In fact, almost every decision we make during an investigation requires us to weigh the effect on privacy and civil liberties, and we take that responsibility seriously.  Privacy concerns are not just tacked onto our investigations, they are baked in.  Privacy concerns are in the laws that set the ground rules for us to follow; the Departmental policies that govern our investigative and prosecutorial conduct; the accountability we must embrace when we present our evidence to a judge, a jury, and the public in an open courtroom; and in the proud culture of the Department.

We not only carefully consider privacy implications throughout our investigations, but we also dedicate significant resources to protecting the privacy of Americans from hackers who steal our financial and credit card information, online predators that stalk and exploit our children, and cyber thieves who steal the trade secrets of innovative American entrepreneurs.  As just an example our efforts, we recently announced the conviction of a Danish citizen who marketed and sold StealthGenie, a spyware application or “app” that could remotely monitor calls, texts, videos and other communications on mobile phones without detection.  This app was marketed to individuals who wanted to spy on spouses and lovers suspected of infidelity.

Additionally, earlier this year, the FBI and the U.S. Attorney for the Southern District of New York announced charges against the owner of “Blackshades,” which sold the Blackshades Remote Access Tool.  EC3 again played a substantial role in this worldwide takedown, which resulted in the arrests of more than 90 people across the globe.  The Blackshades tool was used by hackers to gain access to victims’ personal computers to secretly steal files and account information, browse personal photos, and even to monitor the victims through their own webcams.  This software tool illustrates one of the scariest capabilities of hackers to date, as the Blackshades product or a similar tool was used by one hacker to secretly capture naked photos of teens and young women, including Miss Teen USA.  The hacker then used the photos to extort his victims—with threats that he would post the photos on the Internet—into sending additional nude photos and videos.

These are just two examples of our work to investigate and prosecute criminals who invade the privacy of unsuspecting citizens.  We hope that continuing to host symposiums like this one—and other outreach efforts—will help combat misconceptions about the Department’s efforts to protect the privacy of Americans.  Outreach allows us to participate in the growing public debate about evolving technology.  The open debate will benefit from the information that we can contribute about how technology is being used by criminals, how we are leveraging technology to investigate and disrupt criminal activity, and how technology can be leveraged in the public and private sectors to enhance cyber security.  Without that information, misconceptions and inaccuracies can take root and hamper enforcement efforts as well as cyber security programs.

Georgetown and the Department designed today’s event to bring diverse viewpoints together.  Our aim is to make sure that a range of perspectives are presented.  Of course, there will be limits to what Department representatives can publicly discuss for a variety of reasons, including the potential of harming an ongoing investigation, the need to protect individuals who are the subjects of investigations, and statutory and Departmental restrictions on disclosure of certain information.  Regardless, we are excited to add our voice to the debate and grateful to Georgetown and to all of you for supporting this event.  We hope it will be the first of many.

Thank you.

COMPUTER HACKER SENTENCED IN CASE INVOLVING ALTERED ACADEMIC RECORDS AND STOLEN CREDIT CARD NUMBERS

FROM:  U.S. JUSTICE DEPARTMENT

Monday, October 27, 2014

Massachusetts Man Sentenced to Four Years in Prison for Computer Hacking Involving Stolen Credit Card Numbers and Altered Academic Records
A Massachusetts man was sentenced to serve four years in prison today for hacking into computer networks around the country – including networks belonging to law enforcement agencies and a local college – to obtain highly sensitive law enforcement data and to alter academic records, as well as for possessing stolen credit and debit card numbers.

Assistant Attorney General Leslie R. Caldwell of the Justice Department’s Criminal Division, U.S. Attorney Carmen M. Ortiz of the District of Massachusetts, Special Agent in Charge Vincent Lisi of the FBI’s Boston Division and Colonel Timothy P. Alben of the Massachusetts State Police made the announcement.

Cameron Lacroix, 25, of New Bedford, Massachusetts, pleaded guilty on June 25, 2014, to two counts of computer intrusion and one count of access device fraud.  Lacroix was sentenced today by U.S. District Judge Mark L. Wolf of the District of Massachusetts.

Lacroix admitted that, between May 2011 and May 2013, he obtained and possessed payment card data for more than 14,000 unique account holders.  For some of these account holders, Lacroix also obtained other personally identifiable information.

Additionally, from August 2012 through November 2012, Lacroix repeatedly hacked into law enforcement computer servers containing sensitive information including police reports, intelligence reports, arrest warrants, and sex offender information.  In one such instance, in September 2012, Lacroix hacked into a computer server operated by a local Massachusetts police department and accessed an e-mail account belonging to the chief of police.

Lacroix, who was a student at Bristol Community College (BCC), also admitted that between September 2012 and November 2013, he repeatedly hacked into BCC’s computer servers and used stolen log-in credentials belonging to three instructors to change grades for himself and two other students.

The case was investigated by the FBI’s Boston Division Cyber Task Force.  The case is being prosecuted by Senior Trial Attorney Mona Sedky from the Criminal Division’s Computer Crime and Intellectual Property Section and Assistant U.S. Attorney Adam Bookbinder of the District of Massachusetts.

The U.S. Attorney’s Office for the Northern District of California has also filed hacking charges against Lacroix.  That case has been transferred to the District of Massachusetts and is before Chief Judge Saris.

POLICE DEPARTMENT COMPUTER NETWORK HACKER PLEADS GUILTY TO HACKING AND CREDIT CARD THEFT

FROM:  U.S. JUSTICE DEPARTMENT 

Monday, June 23, 2014

Massachusetts Man Pleads Guilty to Computer Hacking and Credit Card Theft

A Massachusetts man pleaded guilty today to hacking into computer networks around the country – including networks belonging to law enforcement agencies, a local police department and a local college – to obtain highly sensitive law enforcement data and alter academic records.  He also pleaded guilty to obtaining stolen credit, debit and payment card numbers.

Assistant Attorney General Leslie R. Caldwell of the Justice Department’s Criminal Division, United States Attorney Carmen M. Ortiz of the District of Massachusetts, Special Agent in Charge Vincent Lisi of the FBI’s Boston Division and Colonel Timothy P. Alben of the Massachusetts State Police made the announcement.

On June 2, 2014, Cameron Lacroix, 25, of New Bedford, Massachusetts, was charged by a criminal information with two counts of computer intrusion and one count of access device fraud.  Lacroix entered his guilty plea today before U.S. District Court Judge Mark Wolf of the District of Massachusetts.   He pleaded guilty to both counts in the information and agreed to serve a four-year prison sentence.

According to the plea agreement, b etween May 2011 and May 2013, Lacroix obtained and possessed payment card data for more than 14,000 unique account holders.   For some of these account holders, Lacroix also obtained other personally identifiable information, including the account holders’ full names, addresses, dates of birth, social security numbers, email addresses, bank account and routing numbers and lists of merchandise the account holders had ordered.

Lacroix also admitted to hacking into a computer server operated by a local Massachusetts police department in September 2012, and then accessing an e-mail account belonging to its chief of police.   Additionally, Lacroix admitted to repeatedly hacking into law enforcement computer servers containing sensitive information including police reports, arrest warrants, and sex offender information, between August 2012 and November 2012.   Lacroix also admitted to using stolen credentials to access and change information in the servers of Bristol Community College on multiple occasions between September 2012 and December 2013.

Judge Wolf set Lacroix’s sentencing for Oct. 27, 2014.

The case was investigated by the FBI Boston Division Cyber Task Force.   The case is being prosecuted by Senior Trial Attorney Mona Sedky from the Criminal Division’s Computer Crime and Intellectual Property Section and Assistant U.S. Attorney Adam Bookbinder of the District of Massachusetts.   The Department of Justice and the U.S. Attorney’s Office would like to thank Bristol Community College for its cooperation during this investigation.

HACKER SENTENCED FOR ROLE IN SCHEME TO SELL ACCESS TO COMPUTER NETWORKS

FROM:  U.S. JUSTICE DEPARTMENT 
Thursday, December 12, 2013
Pennsylvania Man Sentenced to 18 Months in Prison for Hacking into Multiple Computer Networks

A Pennsylvania man was sentenced to serve 18 months in prison for his role in a scheme to hack into computer networks and sell access to those networks.

Acting Assistant Attorney General Mythili Raman of the Justice Department’s Criminal Division and U .S. Attorney Carmen M. Ortiz of the District of Massachusetts made the announcement after sentencing by U.S. District Judge Mark Wolf in the District of Massachusetts on Dec. 11, 2013.

Andrew James Miller, 23, of Devon, Pa., pleaded guilty to conspiracy and computer fraud on Aug. 26, 2013.   According to court documents, from 2008 to 2011, Miller remotely hacked into a variety of computers located in Massachusetts and elsewhere, and, in some instances, surreptitiously installed “backdoors” into those computers.   These “backdoors” were designed to provide future administrator-level, or “root,” access to the compromised computers.

Miller obtained login credentials to the compromised computers.   He and his co-conspirators then sold access to these backdoors, as well as other login credentials.   The access sold by Miller and his co-conspirators allowed unauthorized people to access various commercial, education and government computer networks.   Miller attempted to sell access for $50,000 to two supercomputers at the Lawrence Livermore Laboratory in Oakland, California, that were part of the National Energy Research Scientific Computing Center.

The case was investigated by the FBI and prosecuted by Senior Trial Attorney Mona Sedky of the Criminal Division’s Computer Crime and Intellectual Property Section and Assistant U.S. Attorney Adam Bookbinder of the U.S. Attorney’s Office for the District of Massachusetts.