EFF Says Lavabit Subpoena Violates Constitution

   (EFF) - 10/27/2013 - Federal law enforcement officers compromised the backbone of the Internet and violated the Fourth Amendment when they demanded private encryption keys from the email provider Lavabit, the Electronic Frontier Foundation (EFF) argues in a brief submitted Thursday afternoon to the US Court of Appeals for the Fourth Circuit. In the amicus brief, EFF asks the panel to overturn a contempt-of-court finding against Lavabit and its owner Ladar Levison for resisting a government subpoena and search warrant that would have put the private communications and data of Lavabit's 400,000 customers at risk of exposure to the government.
   For nearly two decades, secure Internet communication has relied on HTTPS, a encryption system in which there are two keys: A public key that anyone can use to encrypt communications to a service provider, and a private key that only the service provide can use to decrypt the messages.
   In July, the Department of Justice demanded Lavabit's private key—first with a subpoena, then with a search warrant. Although the government was investigating a single user, having access to the private key means the government would have the power to read all of Lavabit's customers' communications. The target of the investigation has not been named, but journalists have noted that the requests came shortly after reports that NSA whistleblower Edward Snowden used a Lavabit email account to communicate.
   "Obtaining a warrant for a service's private key is no different than obtaining a warrant to search all the houses in a city to find the papers of one suspect," EFF Senior Staff Attorney Jennifer Lynch said. "This case represents an unprecedented use of subpoena power, with the government claiming it can compel a disclosure that would, in one fell swoop, expose the communications of every single one of Lavabit's users to government scrutiny."
   EFF's concerns reach beyond this individual case, since the integrity of HTTPS is employed almost universally over the Internet, including in commercial, medical and financial transactions.
   "When a private key has been discovered or disclosed to another party, all users' past and future communications are compromised," EFF Staff Technologist Dan Auerbach said. "If this was Facebook's private key, having it would mean unfettered access to the personal information of 20 percent of the earth's population. A private key not only protects communications on a given service; it also protects passwords, credit card information and a user's search engine query terms."
   Initially, Levison resisted the government request. In response, a district court found Lavabit in contempt of court and levied a $5,000-per-day fine until the company complied. After Levison was forced to turn over Lavabit's key, the certificate authority GoDaddy revoked the key per standard protocol, rendering the secure site effectively unavailable to users.
   Since Lavabit's business model is founded in protecting privacy, Levison shut down the service when it no longer could guarantee security to its customers.
   "The government's request to Lavabit not only disrupts the security model on which the Internet depends, but also violates our Constitutional protections against unreasonable searches and seizures," EFF Staff Attorney Hanni Fakhoury said. "By effectively destroying Lavabit's legitimate business model when it complied with the subpoena, the action was unreasonably burdensome and violated the Fourth Amendment."
   The deadline for the government's response brief is Nov. 12, 2013.
   For EFF's full amicus brief, see: https://www.eff.org/document/lavabit-amicus

   Source: Electronic Frontier Foundation

IC3: Internet Crime Complaints Top 300,000 in 2011

   FAIRMONT, WV — 5/14/2012 - The Internet Crime Complaint Center (IC3) recently released the 2011 Internet Crime Report—an overview of the latest data and trends of online criminal activity.
   According to the report, 2011 marked the third year in a row that the IC3 received more than 300,000 complaints. The 314,246 complaints represent a 3.4 percent increase over 2010.
   The reported dollar loss was $485.3 million.
   As more Internet crimes are reported, IC3 can better assist law enforcement in the apprehension and prosecution of those responsible for perpetrating Internet crime.
   In 2011, IC3 received and processed, on average, more than 26,000 complaints per month. The most common complaints received in 2011 included FBI-related scams—schemes in which a criminal poses as the FBI to defraud victims—identity theft, and advance-fee fraud. The report also lists states with the top complaints, and provides loss and complaint statistics organized by state. It describes complaints by type, demographics, and state. 
   “This report is a testament to the work we do every day at IC3, which is ensuring our system is used to alert authorities of suspected criminal and civil violations,” said National White Collar Crime (NW3C) Center Director Don Brackman. “Each year we work to provide information that can link individuals and groups to these crimes for better outcomes and prosecution of cases.”
   Acting Assistant Director of the FBI’s Cyber Division Michael Welch said, “Internet crime is a growing problem that affects computer users around the world and causes significant financial losses. The IC3 is an efficient mechanism for the public to report suspicious e-mail activity, fraudulent websites, and Internet crimes. These reports help law enforcement make connections between cases and identify criminals.”
   IC3 is a partnership between the Federal Bureau of Investigation, the NW3C, and the Bureau of Justice Assistance. Since its start in 2000, IC3 has become a mainstay for victims reporting Internet crime and a way for law enforcement to be alerted of such crimes. IC3’s service to the law enforcement community includes federal, state, tribal, local, and international agencies that are combating Internet crime.
   Source: Federal Bureau of Investigation

Charges Filed in Massive Internet Fraud Scheme

   (RPC) - 4/22/2012 - Preet Bharara, the United States Attorney for the Southern District of New York, announced on April 20 the extradition of Anton Ivanov from Estonia to face charges of conspiracy to commit wire fraud and computer intrusion, among other offenses. The charges relate to the alleged operation of a massive and sophisticated Internet fraud scheme that infected with malware more than four million computers located in over 100 countries. The malware secretly altered the settings on infected computers enabling Ivanov and the six other charged defendants – Vladimir Tsastsin, Timur Gerassimenko, Dmitri Jegorov, Valeri Aleksejev, Konstantin Poltev, and Andrey Taame – to digitally hijack Internet searches and re-route computers to certain websites and advertisements.

   The defendants subsequently received millions of dollars in fees as a result of unintended visits to these websites and ads by users of infected computers. The malware also prevented the installation of anti-virus software and operating system updates on infected computers, leaving those computers and their users unable to detect or stop the defendants’ malware, and exposing them to attacks by other viruses.
   Ivanov, an Estonian citizen, was arrested in Estonia on November 8, 2011, when the Indictment against him was unsealed. He arrived in the Southern District of New York on April 20 and was presented and arraigned before U.S. Magistrate Judge Debra Freeman.
   Bharara stated: “ Operating from thousands of miles away, this defendant and his co-conspirators allegedly concocted a diabolical scheme that infected millions of computers and victimized legitimate advertisers and websites alike. Cyber crime is a grave and constant threat that is international in its scope and requires international solutions. The arrests in this case and today’s extradition of this defendant are emblematic of the kind of international cooperation that is required to fight this threat. We are committed to fighting and winning this battle .”
   The following allegations are based on the Indictment and other court documents previously filed in Manhattan federal court:
   From 2007 until October 2011, Ivanov, Tsastsin, Gerassimenko, Jegorov, Aleksejev, Poltev, and Taame controlled and operated various companies that masqueraded as legitimate publisher networks (the “Publisher Networks”) in the Internet advertising industry. The Publisher Networks entered into agreements with ad brokers under which they were paid based on the number of times that Internet users clicked on the links for certain websites or advertisements, or based on the number of times that certain advertisements were displayed on certain websites. Thus, the more traffic that went to the advertisers’ websites and display ads, the more money the defendants earned under their agreements with the ad brokers. The defendants fraudulently increased the traffic to the websites and advertisements that would earn them money and made it appear to advertisers that the Internet traffic came from legitimate clicks and ad displays on the defendants’ Publisher Networks when, in actuality, it had not.
   To carry out the scheme, the defendants and their co-conspirators used what are known as “rogue” Domain Name System (“DNS”) servers, and malware (“the Malware”) that was designed to alter the DNS server settings on infected computers. Victims’ computers became infected with the Malware when they visited certain websites or downloaded certain software to view videos online. The Malware altered the DNS server settings on victims’ computers to route the infected computers to rogue DNS servers controlled and operated by the defendants and their co-conspirators. The re-routing took two forms that are described in detail below: “click hijacking” and “advertising replacement fraud.” The Malware also prevented the infected computers from receiving anti-virus software updates or operating system updates that otherwise might have detected the Malware and stopped it. In addition, the infected computers were also left vulnerable to infections by other viruses.

   When the user of an infected computer clicked on a search result link displayed through a search engine query, the Malware caused the computer to be re-routed to a different website. Instead of being brought to the website to which the user asked to go, the user was brought to a website designated by the defendants. Each “click” triggered payment to the defendants under their advertising agreements. This click hijacking occurred for clicks on unpaid links that appeared in response to a user’s query as well as clicks on “sponsored” links or advertisements that appeared in response to a user’s query – often at the top of, or to the right of, the search results – thus causing the search engines to lose money. For example:

•  When the user of an infected computer clicked on the domain name link for the official website of Apple-iTunes, the user was instead taken to a website for a business unaffiliated with Apple Inc. that purported to sell Apple software.
• When the user of an infected computer clicked on the domain name link for the official government website of the Internal Revenue Service, the user was instead taken to the website for H&R Block, a major tax preparation business.

   Using the DNS Changer Malware and rogue DNS servers, the defendants also replaced legitimate advertisements on websites with substituted advertisements that triggered payments to the defendants. For example:

• When the user of an infected computer visited the home page of the Wall Street Journal, a featured advertisement for the American Express “Plum Card” had been fraudulently replaced with an ad for “Fashion Girl LA.”
• When the user of an infected computer visited the Amazon.com website, a prominent advertisement for Windows Internet Explorer 8 had been fraudulently replaced with an ad for an email marketing business.

   In conjunction with the arrests in Estonia on November 8, 2011, authorities in the United States obtained a court order to implement a remediation plan to minimize any disruption of Internet service to the users of computers infected with the Malware. This remediation was necessary because the dismantling of the defendants’ rogue DNS servers – to which millions of computers worldwide had been redirected – would potentially have caused all of those computers, for all practical purposes, to lose access to websites. As part of that order, the defendant’s rogue DNS servers have been replaced with legitimate ones administered by the Internet Systems Consortium (“ISC”), a not-for-profit entity, for a limited period of 120 days. A subsequent order extended the period of operation for another 120 days, ending on July 9, 2012.
   Ivanov, 27, of Tartu, Estonia, faces a maximum sentence of 85 years in prison in connection with the charges in the Indictment.
   Estonian nationals Tsastsin, Gerassimenko, Jegorov, Aleksejev, and Poltev were also arrested in November 2011, and are in custody in Estonia. The last defendant, Taame, who is a Russian national, remains at large.
   The case against all seven defendants was scheduled to be heard before U.S. District Judge Lewis A. Kaplan.
   Bharara praised the outstanding investigative work of the Federal Bureau of Investigation, National Aeronautics and Space Administration-Office of the Inspector General, and the Estonian National Police and Border Guard Board. He also thanked the Office of International Affairs in the U.S. Department of Justice’s Criminal Division for its assistance with the extradition.
   This case is being handled by the Office’s Complex Frauds Unit. Assistant U.S. Attorneys Sarah Lai, James Pastore, and Alexander Wilson are in charge of the prosecution.
   The charges and allegations contained in the Indictment are merely accusations, and the defendants are presumed innocent unless and until proven guilty.

   Source: Financial Fraud Enforcement Task Force

Cybercrime Complaints Suggest Threat is Growing

By Steve Rensberry
rensberrypublishing.com 

   (RPC) - 11/16/10 - Hitting number 2 million on the cybercrime complaint meter is just one piece of evidence pointing to the growth of online crime, a newly released report from the Internet Crime Complaint Center suggests.
   In an announcement made this week, the center said that it had hit the new high after reaching complaint number 1 million in 2007, seven years after it was formed in early 2000.
   "It took half that time to receive the 2 millionth complain, which illustrates the IC3's increased visibility and the continued growth of cybercrime," the announcement says.
   All told, the IC3 has served as the sounding board for 757,016 complaints in the past 10 years, which it has referred to the appropriate authorities for investigation. It pegs the total financial loss at $1.7 billion.
   "Many complaints involved identity theft, such as loss of personally identifying data, and the unauthorized use of credit cards or bank accounts," the report says.
   But as broad as the criteria is for what constitutes a crime, judging the actual extent of it may be difficult.
   Security software giant Symantec released a study in September that suggested virtually the same thing -- that Internet crime was going gonzo.
   Even with the obvious vested interest, the Symantec study did carry some degree of balance, pointing to malware attacks as the largest and most common form of Internet crime. Given that it is the nature of most malicious software, malware in particular, to replicate and distribute itself automatically, apart from human hands, it may be prudent not to deem each infected computer as a distinct and separate crime. For purposes of definitive trend analysis, the verdict may still be out.
   The full 2010 Cybercrime Report from Symantec is available here: http://www.symantec.com/redirects/norton/norton_com/cybercrimereport/
   The Internet Crime Complaint Center report is available here: http://www.ic3.gov/media/default.aspx
   Still, Symantec does have a point to make, as it states in its preface to the report:
   "Cybercrime has become a silent global digital epidemic," it says. "This disturbing truth is uncovered by this new ground-breaking study into the dangers, financial cost and emotional fallout of unprotected and unethical life online."
   There is also the issue of just how very easy it is to commit crime online. Ordinary people who would never consider taking something that does not belong to them while in a physical store, will and do engage in online piracy -- partly because of the anonymity but largely because of the simply ease in which it can be done. Copy. Paste. Click. Download. It's gone beyond simple.
   The Internet Crime Complaint Center is jointly operated by the FBI and the National White Collar Crime Center.

For further reading:
Internet Crime Complaint Center
Cybercrime is Rampant Around the World, Says Study
Looks To Good To Be True
Cybercrime and Intellectual Property