By Edward Carter1 ©2002 by Edward Carter icon

By Edward Carter1 ©2002 by Edward Carter

Скачати 82.62 Kb.
НазваBy Edward Carter1 ©2002 by Edward Carter
Розмір82.62 Kb.

Examining Cybercrime: Tactics for Investigation and Prosecution

By Edward Carter1

©2002 by Edward Carter

Understanding the distinction between the different forms of cybercrime and the different motives of cybercrime perpetrators is valuable, but this only represents half of the equation for law enforcement.2 The successful investigation and prosecution of cybercriminals represents the other half of that equation. This articles examines some tactics that are used to investigate cybercrime, some strategies used for prosecuting cybercrime, and looks at three cases which illustrate how the strategy and tactics discussed here were actually employed.

When reading this article it is important to keep in mind the significant differences between the American criminal justice system and the criminal justice systems of continental Europe and consider how those differences both drive and may affect the use of the strategies discussed here. To help the reader understand these differences this article briefly discusses the salient features of the American criminal justice system.

^ 1. Salient Features of the American System of Criminal Justice

The American system of criminal justice3 is an adversarial system in which the burden of proof is on the prosecutor to prove the defendant guilty beyond a reasonable doubt. In the American justice system the prosecutor is an agent of the state charged with doing justice, but during trial he is merely an advocate whose arguments and whose witnesses, including law enforcement witnessess, are entitled to no greater weight than those of the defense.

An important feature of American constitutional law is that defendants have the right to confront the witnesses against them in court. This means that both police and civilian witnesses must appear in court and testify and that defendants have the right to cross examine them. All witnesses must testify in front of the trier of fact, whether that trier of fact is a judge or jury.4

It is also important to note that the United States Constitution, as well as the constitutions of each of the states, create governments that consist of three branches and allocate specific powers to each branch.5 Under a constitutional principle called the separation of powers doctrine, no branch of government can exercise a power vested in another branch.6 This principle has important consequences for the American justice system.

Because enforcing the law and initiating prosecution is considered to be an executive branch function the American judiciary has no role in deciding what crimes to investigate, what charges to bring, or even who to charge.7 Thus, under American law a judge has no power to order a prosecutor to bring a criminal charge and has no power to terminate a criminal prosecution by refusing to grant the prosecutor’s motion to nolle prosequi.8 The result is that the American prosecutor has discretion in deciding whether to initiate a criminal prosecution, discretion in deciding what charges to bring and against whom, and discretion to terminate a criminal prosecution.

In the United States neither prosecutors nor police can require witnesses or others to answer questions or produce evidence during a criminal investigation.9 When witnesses or others refuse to answer police questions or refuse to produce records or other physical evidence needed in a criminal investigation, the prosecutor must obtain subpoenas from a grand jury. The grand jury is a creation of twelfth century English common law that continues to play an important role in American criminal investigations. The grand jury is a body consisting of 16 private citizens impaneled by a court.10 Notwithstanding that the grand jury is empaneld by a court, the grand jury is not a part of the judicial branch of government. The grand jury has the power to issue subpoenas requiring witnesses to appear before it and answer questions posed by its members and by the prosecutor or to appear and produce documents or other physical evidence.11

The prosecutor’s role with respect to the grand jury is one of legal advisor and presenter of evidence to support his request for subpoenas. Grand jury proceedings are secret and a witness’ refusal to appear can result in an arrest warrant being issued for the witness by a judge. A refusal to answer questions before the grand jury or a refusal to produce records or other evidence sought by the grand jury, assuming that no constitutional or evidentiary privilege is applicable, will result in the witness being jailed until he testifies or produces the evidence sought. A judge decides all claims of privilege, but only after the witness appears and asserts a privilege as to the questions asked or evidence required to be produced.

^ 2. Tactics Used in Cybercrime Investigations

Following the paradigm the Illinois Attorney General’s Office developed for the investigation of financial crimes, the Office encourages law enforcement officers to contact prosecutors as early in the cybercrime investigation as possible. The reason for is that it is believed that a team approach in which investigators and prosecutors work together on an investigation is the most efficient way to investigate cybercrime and and the best way to ensure a successful prosecution of the cybercrime perpetrator. When an investigator contacts the Financial Crimes Unit of the Illinois Attorney General’s Office about the investigation of a possible cybercrime the matter is assigned to a prosecutor who will be responsible for the case from that point through either a decision not to prosecute or, if prosecution is initiated, through to verdict and sentencing.

This practice is in marked to contrast to the investigation of violent crimes where the police in most instances do the entire investigation without contacting the prosecutor and only contact him when the investigation is completed. At least in the realm of cyber and economic crimes it is believed that that traditional method of criminal investigation is inadequate. Cyber and ecnomic crimes often involve subtle legal and evidentiary issues and, absent prosecutorial consultation, law enforcement agents may spend time investigating some matters that are legally immaterial and not investigating other matters that are. Moreover, law enforcement agents are seldom versed in the principles of property law and agency law that frequently underlie many cybercrimes.12

The investigation of cybercrimes often involves using the whole panoply of investigative tools. This can mean the use of search warrants for records and search warrants for computers or computer data, grand jury subpoenas for testimony or records, overhear orders in which a judge authorizes a cooperating witness or a law enforcement officer working in an undercover capacity to surreptitiously record conversations with the targets of the investigation, and sometimes grants of immunity from prosecution. Use of these investigative tools all require involvement of the prosecutor.

In the case of search warrants the prosecutor must prepare a petition for a search warrant and prepare the search warrant itself. The petition for a search warrant is executed under oath by a law enforcement officer or a private citizen. The prosecutor presents the petition to a judge who must determine if the petition states facts sufficient to conclude that there is probable cause to believe that a crime has been committed and probable cause to believe that evidence of the crime, the fruits of the crime, or the instrumentalities used in the commission of the crime will be found at the location described in the petition.

In the case of overhears, the same procedure is followed as for search warrants except that the judge must determine whether the petition presents probable cause to believe that a felony has or is about to be committed and that there is probable cause to believe that a conversation with a particular person will elicit evidence relating to the crime.

In Illinois search warrants must be executed within 96 hours of issuance and overhear orders are usually good for no more than ten days. When applied to cyber search warrants the 96 hour rule means that the computer or data must be seized within the 96 hour time period. The rules does not require that the computer files by viewed within that time.13 Viewing the seized files can be done any time after seizure. Upon application of the prosecutor to the issuing judge, the overhear order may be extended for additional periods of time.

Plea negotiations between the prosecution and the defense are an accepted practice in American law and are regulated by court rules.14 Plea negotiations often result in an agreement between the defense and the prosecution in which the prosecution agrees to recommend a particular sentence and often to dismiss certain charges in return for a plea of guilty by the defendant. The plea agreement often includes a provision under which the defendant agrees to provide evidence against others involved with him in perpetrating the crime.15 A typical cooperation agreement requires the defendant to give full and truthful testimony at any trial, hearing, grand jury proceeding or administrative proceeding and to fully and truthfully answer questions posed to him by law enforcement agents.

One additional tool available to the prosecutor is a grant of immunity. Under American law no person can be compelled to testify against himself in a criminal proceeding. The term criminal proceeding includes grand jury proceedings which mean, for example, that accomplices can assert this privilege to avoid testifying against others, if by doing so they will incriminate themselves. Under American law prosecutors have the authority to grant use immunity to a witness.16 While a judge must sign the immunity order, the law is clear that when a prosecutor presents a judge with a petition for use immunity the judge cannot refuse to grant it.17 Once use immunity is given, the witness’ privilege against self-incrimination is vitiated and he must answer the questions posed to him.18 The immunity order does not provide the witness with immunity from prosecution for perjury.

^ 3. Strategies Used to Prosecute Cybercrimes

There are a number of different criminal statutes used to prosecute cybercrime. Each of these statues have certain advantages and disadvantages which the prosecutor must consider before initiating prosecution. This section of the article discusses some of these considerations.

The Theft statute is useful in cybercrime prosecutions because it defines two types of theft, unauthorized control theft and theft by deception. The former type of theft, which is what is commonly understood as embezzlement, is valuable when the perpetrator legitimately has control over the victim’s property and, with the intent to permanently deprive the victim of the property’s use or benefit, he exercises control over the property contrary to the limits of his authority. The other form of Theft covered by the statute is theft by deception. This offense applies whenever, with the intent to permanently deprive the owner of the use or benefit of his property, a perpetrator obtains that property from the owner through a knowing false representation. Under the Theft statute it makes no difference how the false impression is created so that if a computer is used to create the false impression as in an Internet fraud scheme or through the use of e-mail, the offense of Theft can be used to charge the perpetrator or perpetrators.

With both forms of Theft the prosecution must prove the intent to permanently deprive beyond a reasonable doubt. In order to prove that intent the prosecutor will, in many cases, look for a pattern of several takings before accepting a case for prosecution. This may mean that to bolster proof of the intent to permanently deprive the victim will be approached by law enforcement about letting the suspect engage in additional, but surveilled, misappropriations.

Because the seriousness of the crime of Theft is determined by the value of the property taken, this creates another reason for law enforcement to allow the perpetrator to engage in additional thefts: greater losses allow prosecution of the perpetrator for a more serious offense.19 Whether or not to allow additional thefts to take place to enhance the charge is a prosecutorial decision. In this regard, one advantage of a Theft prosecution is that when, with a single intention and design, multiple thefts are committed against the same victim, as long as at least one of the thefts occurred within the statute of limitations, all earlier thefts committed as part of that design whose prosecution would otherwise be barred by the statute of limitations can be charged in one indictment.20

While one of the advantages of charging Theft is the ability to aggregate the thefts from the same victim, the offense of Theft also has certain disadvantages. The primary disadvantage of the charge of Theft is that when there are multiple victims the offense must be charged separately as to each victim and there can be no aggregation with respect to all victims. This is a considerable disadvantage when the crime is a wide-ranging computer fraud scheme with multiple victims in different locations across the state. This can mean charging the perpetrator in multiple counties and having multiple trials.

The crime of Computer Fraud to some extent addresses the disadvantages of prosecuting cybercrime under the Theft statute. There are two forms of the crime of Computer Fraud: 1) accessing a computer, program, or data for the purpose of executing or devising a scheme to defraud and 2) accessing a computer etc. for those purposes and obtaining property, money, or services in connection with a scheme to defraud.21 While there are not many precedents construing the computer fraud statute, it appears, and it is the position of the author, that because the crime is accessing a computer as part of a scheme to defraud, one charge with respect to the entire scheme and all the victims can to be brought22 and, if money, property, or services are obtained through the scheme, the value of all the money, property, or services can be aggregated to determine which level of felony has been committed.

One disadvantage of this statute is that it is unclear whether a charge can be brought against a perpetrator who accesses a computer outside the territorial jurisdiction of the State of Illinois. While it seems clear that Illinois, as any other sovereign state, can exercise criminal jurisdiction over those who commit offenses outside of its territorial jurisdiction when those offenses take effect within its borders,23 it not clear that Illinois has exercised that jurisdiction in the computer fraud statute.

The third offense that is frequently used to prosecute cybercrime is the offense of Wire Fraud. This offense makes it a crime to use the telecommunications system, whether it is by wireless transmission, traditional copper wire transmission, or fiber optic transmission in connection with a scheme to defraud. Because one of these mediums of transmission is used in almost every cyberfraud, this statute is easily applied to cyber fraud schemes. The Wire Fraud statute is particularly useful for cybercrime prosecutions because it specifically anticipates the possibility that the perpetrator may be located outside of Illinois and thus invokes the power of Illinois as a sovereign state to punish extra-territorial offenders. The one disadvantage of prosecuting under the statute is that without regard to the size of the financial loss caused by the fraud scheme, it is a single level felony.

The fourth offense that is often used to prosecute cybercrime, at least where the computer is used to make counterfeit documents is the offense of Forgery. The offense of Forgery is committed when, with the intent to defraud, a perpetrator knowingly makes a document apparently capable of defrauding another.24 With the updating of the definition of the term “document” in the forgery statute so that it includes electronic records as that term is defined in the Electronic Commerce Security Act25 the offense of Forgery can be used to prosecute perpetrators who use scanners or computers to counterfeit paper documents or who simply use a computer to generate false electronic records. The later is particularly useful in cases where entire transactions are done with electronic records, such as false health care billings to insurance companies.

Finally, for the intrusion types of offenses, the crime of Computer Tampering is available. This offense is designed especially to address the non-larcenous intrusions into computer systems that are usually committed by hackers, hacktavists, and cyberanarchists. This statute makes it an offense merely to access a computer without authority and to access a computer without authority and alter or destroy any program or data.

^ 4. Exemplative Cases

This section of the article exams three prosecutions for the purpose of illustrating how the investigative tools and statutes discussed above were successfully used in specific cybercrime investigations and prosecutions.

A. The Terrell Felton Case

Terrell Felton was an employee of the Illinois Department of Public Aid, a state agency responsible for, inter alia, distributing welfare money to the poor. One program that the agency administered involved emergency short term financial aid. Felton was a staff employee who had no authority to dispense funds for that program. While employed at the agency Felton discovered a flaw in its recipient account control program. This flaw allowed Felton to access closed emergency fund cases and cause checks to be issued on those accounts. Felton ultimately was able to refine his scheme so that the checks issued on the accounts were actually issued and sent to names and addresses of persons other than those shown on the closed accounts. This allowed Felton to direct checks to several friends and relatives who actually cashed them. No checks were ever issued by Felton to himself.

Suspicion that the agency was the victim of a cybercrime was raised through a fluke when a Public Aid employee happened to notice activity on a closed account and brought the matter to the attention of a supervisor. The investigator assigned contacted the Attorney General’s Office which assigned a financial crimes prosecutor to work with the investigator. At that point no one knew how much money had been taken or even who had taken it. Computer records indicated that Felton’s password had been used at a computer terminal in a Chicago office of the agency and that from this terminal data in the agency’s computer in Springfield, Illinois, the state capital and headquarters of the agency, had been altered so that a small check had been issued on a closed account.

The initial problem was to identify the perpetrator, a major problem in almost all cybercrimes. While the agency’s computer records showed that someone using the suspect’s password had accessed the computer from a terminal in the office where Felton worked, this alone did not constitute sufficient evidence that Felton had accessed the computer, particularly the government has the burden of proving the defendant guilty beyond a reasonable doubt. Just as importantly, with this state of the evidence, had the case been charged, Felton would have been able to testify that he did not access the computer at those times, that someone else must have used his password, and there would be no evidence to refute that testimony. Another problem was that at that point the amount of money suspected of having been taken was barely enough to make the crime a felony.

The prosecutor, in consultation with the case agent, decided that some type of surveillance camera should be installed in the agency’s Chicago office and that the perpetrator, whomever it was, should be allowed to take an amount of money in excess of $10,000 so that any resulting prosecution would be for a more serious felony. Both actions required the approval of the victim agency’s director. The prosecutor contacted the director and obtained consent to install a surveillance camera in the ceiling above the computer terminal and agreement to allow a sum in excess of $10,000 to be taken.

Installation of the camera and videotape changing were done after regular business hours. Once installed, whenever Felton or anyone else used the terminal to access the Springfield based computer, the camera would record them at the terminal and show the date and time of their use on the video tape. Over a period of approximately three months the camera recorded Felton using the terminal at the same date and time the computer in Springfield showed that Felton’s password had been used at the surveilled terminal to access the computer and cause the issuance of unauthorized checks.

The names and addresses of the persons to whom the checks were issued were recorded and the Sangamon County grand jury26 issued subpoenas to each of the payees of the checks. These subpoenas were not served until the $10,000 threshold was exceeded.

During this period investigators reviewed the closed files for checks that were issued using Felton’s password. This review revealed that during a period of approximately four years more than $300,000 in checks had been issued on closed accounts using Felton’s password.

When the check that put the surveilled theft amount over $10,000 was issued several things happened simultaneously. Investigators intercepted the check and confronted Felton at his office in Chicago with all of the checks he issued during the surveillance and with the checks that had been issued on closed accounts with his password. During the confrontation Felton made a number of highly incriminating admissions, but denied causing the transfer of the entire $300,000. Following the interview Felton was released.27 During and after the interview agents served grand jury subpoenas on the check recipients and on the currency exchanges where the checks were cashed.28

When the subpoenaed witnesses appeared in Springfield, it became clear that they were little more than unwitting dupes who cashed the checks for Felton and retained only a small portion of the check proceeds for themselves. These witnesses, however, provided an additional link to Felton and the money and could place most of the proceeds into Felton’s hands.

Once the grand jury work was completed the prosecutor faced a decision about where to bring charges and what charges to bring. The prosecutor decided that since the false electronic data was received in Springfield and the checks were issued from Springfield that charges could be brought there. Because Springfield is a much smaller city than Chicago it was believed that the case would be treated more seriously there than in Chicago. The prosecutor ultimately decided to charge Felton with Theft over $100,000 and Computer Fraud over $50,000, the most serious forms of both crimes.29

Because Felton’s thefts occurred over a four year period and were committed against the same victim, the prosecutor charged the Theft as occurring on numerous occasions during the period, thus allowing aggregation of the amounts and the charging of takings that otherwise would have been barred by Illinois’ three year statute of limitations. The prosecutor also included a count of Theft over $10,000 to cover the thefts committed by Felton during the period when Felton was surveilled. This was done to ensure that if for any reason Felton was acquitted on the overall Theft charge that he might at least be convicted on the thefts that were captured on videotape. All the Theft counts charged Felton with unauthorized control theft.

Ultimately Felton entered into a plea agreement in which he pleaded guilty to the charge of Theft over $100,000 in return for the prosecution’s agreement to nolle prosequi the other charges and recommend a prison sentence of no more than seven years. Under the agreement the judge would decide the prison term after a sentencing hearing.30 The Sangamon County judge assigned to the case sentenced Felton to the seven years recommended by the government and ordered Felton to pay restitution to the state. The restitution order has the effect of a civil judgment and created a lien on all of Felton’s property.

^ B. The Corrupt Revenue Collector

The Department of Revenue is the tax collection agency for the State of Illinois and employs, among others, tax collectors who have access to taxpayers’ accounts and investigators who investigate criminal violations of the state’s tax laws. In one case a taxpayer with a significant tax liability contacted the Department of Revenue to report that a revenue collector had solicited her for a bribe in return for which he would alter the Department’s computerized tax records to show no tax due.

Revenue investigators contacted the Attorney General’s Office which assigned a prosecutor to work the case. The prosecutor and the investigator decided that the best evidence would be to catch the tax collector on tape soliciting and accepting the bribe. The investigator contacted the taxpayer to see if she would be willing to meet with the collector and wear a listening device to capture her conversation with him. Once she consented the prosecutor obtained an overhear order and worked with the investigator to devise a plan for the meeting. The investigator then worked with the taxpayer on what amounted to a script for both the meeting and for a pre-meeting phone conversation.

As part of the plan the investigator had the taxpayer contact the collector and set a meeting date at the taxpayer’s place of business. During this phone conversation, which was monitored, the taxpayer told the collector that she had the money, but that when she paid him she expected to be given some type of printout that showed her delinquent tax account with a zero balance. The collector agreed to this and agreed to a meeting on a Sunday morning.

Prior to the Sunday morning meeting, revenue agents obtained and marked the cash that was to be used to pay the bribe. On that morning revenue agents wired the taxpayer with a listening device and placed themselves in an room adjacent to the office where the meeting was to take place. The agents stationed themselves in the adjacent room primarily for security of the taxpayer. If anything went wrong the agents would be able to enter the office almost immediately. Revenue agents were also posted outside the place of business in a surveillance van which recorded the conversation transmitted by the body wire on the taxpayer’s person.

At the Sunday meeting, pursuant to the operational plan discussed with the taxpayer, the taxpayer engaged the tax collector in a conversation that essentially recapped the bribe solicitation. During this portion of the meeting the collector acknowledged that he had solicited the bribe and confirmed the amount of the bribe. The taxpayer then showed the tax collector the money and told him before she gave it to him she wanted evidence of the zero balance. The tax collector then tendered the taxpayer a computer print out showing a zero balance on her business’ tax account. Pursuant to the plan, the taxpayer then asked the tax collector how he was able to zero out the balance. The collector explained how he accessed the agency’s computer and how he was able to alter the data. Following up on that, as a way of trying to determine if anyone else was involved, the taxpayer remarked that if the collector had to share the money with anyone else, it seemed like a lot of risk for a small amount of money. The collector advised the taxpayer that it was too risky to work with anyone and he did everything by himself. The entire conversation was captured on tape.

When the taxpayer gave the money to the collector, he was allowed to exit the building. Once on the street revenue agents stopped the collector and asked if they could talk to him. If he refused, the revenue agents would have simply arrested him.31 Instead, he agreed to talk to the agents who then interviewed him at the taxpayer’s place of business. Initially, the collector denied any wrongdoing, but after agents played the tape of the conversation, the collector complained about being underpaid and admitted to soliciting the bribe.

The collector was charged with Computer Fraud (altering data in a computer as part of a scheme to defraud) and with Bribery (In Illinois the offense of Bribery includes not only giving a bribe, but also soliciting or accepting a bribe.). The collector eventually pleaded guilty as part of a plea agreement that involved dismissal of one charge and sentencing on the other. The collector was sentenced to a term of imprisonment under the agreement.

A further consequence for both the tax collector and Felton was that both government employees lost their pensions. In the case of Felton, who was a longtime government employee, forfeiture of his pension was a significant financial loss.

^ C. The Mortgage Fraud Scheme

The United States government operates a mortgage loan insurance program that enables low income people to obtain mortgage loans from commercial mortgage brokers who resell the mortgages to lenders who actually fund the loans. Under this program, if the borrower defaults on the loan the government pays the unpaid balance and forecloses on the mortgaged property. The government then resells the foreclosed property to try recoup its loss. This program is operated by the Department of Housing and Urban Development (HUD).

In one case several employees who worked at a branch office of a mortgage broker conspired to engage in a mortgage fraud scheme that utilized computers. To operate the scheme the employees created fictitious persons who would purchase the foreclosed properties and used the financial identity of real persons to purchase the property from the fictitous buyers. The purchase and resale would take place simultaneously so that the conspirators were always able to make the initial transaction a cash deal that would actually be funded by part of the proceeds from the resale. In nine transactions this scheme netted the perpetrators in excess of one million dollars.

To make the scheme work the property had to be resold at a higher price. To effect the resale at the higher price the conspirators used the services of an appraiser who would overvalue the property to justify a high sale price and a high mortgage amount for the second purchase. The conspirators created all of the documents necessary to qualify the purported mortgage loan applicant for the loan: payroll check stubs of purported employers of the mortgage applicants were created to show current employment and sufficient current income, forms referred to as “W-2" forms were created to show a history of employment and sufficient earning for the previous three years,32 bank statements were created to show savings from which the downpayment could be made, and false picture identifications33 were created for use at the closings.34

All of the documents used in the scheme were created with the use of a computer. Some of the documents were scanned into the computer and altered to reflect the information desired. This was done with the bank statements and identification cards. Other documents were simply created using a computer. This was done with the payroll check stubs and forms W-2.

The scheme was discovered when police executed a search warrant on a vehicle in connection with an unrelated crime and a brief case was found which contained multiple identity cards for the same person together with business cards for the mortgage broker. At this point HUD was notified and it identified a number of loans that had been originated at the mortgage broker’s branch office that had gone into foreclosure. Investigators from HUD and state investigators then contacted the Attorney General’s office.

Following contact with the Attorney General’s Office, the prosecutor assigned opened a grand jury investigation. Initially the grand jury subpoenaed all of the loan documents for each of the delinquent mortgage loans. Because these loans had been re-sold the documents were in possession of companies in different parts of the United States. Records were also subpoenaed from the mortgage broker. At this point an employee contacted investigators through an attorney and indicated he had information, but would not divulge it without some assurance that he would not be prosecuted. The prosecutor decided to give the witness a proffer letter. In a proffer letter the prosecutor agrees that nothing the witness says will be used against him in any criminal trial. Under the terms of the proffer letter should the witness ever testify contrary to what he says during his proffer the proffered statements can be used against him.35

Once he had the proffer agreement the witness disclosed that he was the person who created the false documents on the computer. He also identified who it was that told him what information to enter into the computer and how much they paid him to do it. With this information the prosecutor asked the grand jury to subpoena witnesses for testimony. One of the witnesses was the appraiser. In the grand jury the appraiser asserted his privilege against self-incrimination. Because the appraiser did not want to cooperate, the prosecutor obtained a grant of immunity for the appraiser. Once given immunity the appraiser, who had not been told that the computer operator was cooperating, corroborated the computer operator, and implicated the branch manager and two other employees.

Using this information and the information from the backs of the loan proceeds checks investigators were able to trace the flow of the loan proceeds through several different bank accounts36 to an account controlled by the branch manager and one controlled by one of the branch employees. The grand jury also issued subpoenas to the purported employers of the loan applicants. Most of the employers knew nothing of the scheme and never employed the purported mortgage applicant.37 One of the purported employers of several of the purported applicants turned out to be one of the perpetrators of the scheme.

The grand jury also subpoenaed the attorney who handled several of the real estate transactions for the purported sellers. The attorney did not want to appear before the grand jury and threatened to invoke his privilege against self-incrimination. The attorney did advise the prosecutor that he would be willing to meet with and be interviewed by investigator. To avoid litigation over the privilege issue and the possibility of having to grant immunity to obtain evidence from the attorney, the prosecutor agreed to waive the attorney’s appearance before the grand jury and directed investigators to interview him.

During the meeting with investigators, the attorney advised that he never actually met with the sellers who he believed he represented. In all instances, he said, he was told they were out of town and as a result he dealt with them through agents located in Chicago. When shown a photo array the persons he picked out as the agents of his purported clients were the branch manager and the one branch employee.

The investigation resulted in the indictment of four persons on charges of computer fraud (using a computer a part of a scheme to defraud and obtaining money through that scheme), forgery (making counterfeit documents), three counts of theft over $100,000 (one lender was victimized with five fraudulent mortgage applications, another with three fraudulent applications, and a third with one fraudulent application. The loss suffered by each lender exceeded the $100,000 threshold), and one count of Conspiracy.38 Conspiracy was charged so that the entire scheme and all of the offenses and defendants could be tried together in one case. Ultimately one of the defendants agreed to plead guilty, testify against his coconspirators, and provide information to and testimony for the federal government about a different fraud scheme in which he and others were involved.

1 Edward Carter is an Assistant Attorney General for the State of Illinois (USA) and Supervisor of Financial Crimes Prosecution for the Illinois Attorney General’s Office. Prior to being named Supervisor of Financial Crimes Prosecution, Mr. Carter was a prosecutor in the Revenue Prosecutions Unit of the Illinois Attorney General’s Office where he prosecuted various types of tax crimes, including the largest Motor Fuel Tax fraud prosecution in Illinois history, the largest Use Tax fraud prosecution in Illinois history, and, after Illinois became a party, the first prosecution in the United States under the International Fuel Tax Agreement. Mr. Carter is a graduate of Illinois Institute of Technology/Chicago-Kent College of Law. The views expressed in this article are those of the author and do not necessarily reflect the views of the Attorney General of Illinois.

2 This is the second in a series of two articles about cybercrime. In the first article the author examined the different forms of cybercrimes and the different types of cybercrime perpetrators. Both articles are based on a lecture given by the author for the National University of Internal Affairs in Kiev, Ukraine, on October 15, 2002.

3 The American legal system is based on the English common law system. The United States constitution as well as the constitutions of the American states actually contain as constitutional rights many of the procedural rights of defendants that existed in English common law at the time of the American Revolution. The substantive criminal law of the United States and of the American states is also based on concepts of English common law. Despite the universal codification of substantive criminal law in the United States, several states continue to recognize common law crimes.

4 Under American Constitutional law and under English common law defendants have an absolute right to a trial by jury. Only the defendant can waive that right and in the absence of a waiver by the defendant the criminal trial will be by a jury. The Anglo-American jury is the judge of the facts and decides which witnesses are credible and which are not and resolves all controverted issues of fact. In the Anglo-American system the judge decides all questions of law and instructs the jury as to the law. As part of the judge’s instructions to the jury the judge will tell the jury what propositions must be proved beyond a reasonable doubt and that in order to find the defendant guilty the jury must find each of those propositions to have been so proved. The jury consists of twelve persons and with the exception of a few American states the jury’s verdict must be unanimous. If the jury is unable to reach a unanimous guilty or not guilty verdict the jury is said to be “hung” and the defendant can be retried. If the defendant is found “not guilty” the defendant cannot be retried for the same offense, even if evidence obtained later would conclusively show that he is guilty of committing that crime.

5 The three branches of government are the legislative, executive, and judicial branches.

6 While the separation of powers doctrine is only implied in the United States Constitution, it is a recognized constitutional principle.^ Miller v. Franch 530 US. 327 (2000). The separation of powers doctrine is actually written into the constitutions of some of the states. See, Ill. Const. 1970, Art. II, Sec. 1, “The legislative, executive, and judicial branches are separate. No branch shall exercise powers properly belonging to another.”

7 ^ United States v. Edmundson, 792 F.2d 1492 (9th Cir. 1986)

8 See, People v. Covelli, 415 Ill. 79 (1953) (A refusal by a court to grant the prosecutor’s motion to nolle prosequi violates the separation of powers doctrine.). A nolle prosequi is a motion by a prosecutor in which the prosecutor dismisses a pending prosecution.

9 Judges have no role in the investigatory stage because under American constitutional law investigation is an executive branch function. Until a defendant is charged there is no case on which a judge can act.

10 The decision to empanel a grand jury is the prosecutor’s decision.

11 In most states and in federal criminal practice the grand jury is also the body that hears evidence presented by the prosecutor through witnesses and based on that evidence has the power to charge a defendant with a crime. When a grand jury brings a charge this charge is called an indictment or a true bill. While the prosecutor usually decides against whom an indictment will be sought and what the charges will be, the grand jury has the power to indict other persons and charge offenses other than those sought by the prosecutor. The grand jury, of course, can refuse to indict by returning what is called a “no bill.” Once an indictment is voted it is returned before a judge who then issues an arrest warrant for the newly charged defendant.

12 This is similar in the situation in economic crimes where often times whether conduct is criminal is determined by civil law concepts of agency and fiduciary duties, concepts with which criminal investigations are usually unfamiliar.

13 ^ United States v. Hernandez, 183 F.Supp2d 468 (D. Puerto Rico 2002).

14 See, Ill. S. Ct. Rule 402.

15 In some cases the prosecutor and the attorney for the target of an investigation will negogiate a plea agreement prior to the initiation of prosecution. When a pre-indictment plea agreement has been negotiated, the case is brought like any other criminal prosecution and at the first appearance before a judge the prosecutor simply announces that a plea agreement has been reached and advises the court of its terms.

16 Ryan v. C.I.R., 568 F2d 531 (7th Cir. 1977).

17 ^ United States v. Leyva, 513 F2d 774 (5th Cir. 1975).

18 The grant of use immunity does not bar prosecution of the witness. Instead, it simply bars the government from using the witness’ statements and any evidence obtained from those statements against the witness in any prosecution.

19 Under Illinois law a series of thefts perpetrated against the same victim in furtherance of a single intention or design may be charged as one offense and the loss aggregated to produce a more serious level of Theft. Ill. Comp. Stat., Ch. 720, §111-4 (c).

20 ^ People v. Curoe, 97 Ill. App. 3d 258 (1st Dist. 1981).

21 The first form of Computer Fraud is a single, low level felony. The second form of Computer Fraud is a felony offense the seriousness of which is determined by the value of the money, property, and services obtained by the scheme.

22 When an offense is committed several times over a period of days, months, or years Illinois law allows the offense to be charged in one indictment in which the date of the offense is stated as being between on or about one certain date and on or about another certain date

23 International law recognizes five separate bases on which a sovereign can exercise jurisdiction over persons who engage in criminal conduct outside of the sovereign’s borders. See, ^ United States v. Roberts, 1 F. Supp. 2d 601 (E.D. La. 1998). One of the bases of extra-territorial jurisdiction is the objective territorial principle. Under this principle a sovereign can exercise extra-territorial jurisdiction over conduct committed by foreigners outside the sovereign’s territory when those acts produce substantial detrimental effects within the sovereign’s borders. Roberts, id at 607; Hanks v. State, 13 Tex. Ct. Crim.App. 289 (1882).

24 People v. Young, 19 Ill. App. 3d 455 (4th Dist. 1974).

25 See, Ill. Comp. Stat., Ch. 720, §5/17-3(c). The Electronic Commerce Security Act, Ill. Comp. Stat., Ch. 5, §175/1-101 et. seq., defines an electronic record as a record generated, communicated, received, or stored by electronic means for use in an information system or for transmission from one information system to another. Ill. Comp. Stat. Ch. 5, §175/5-105.

26 The city of Springfield, Illinois is located in Sangamon County. In Illinois each county has the power to empanel a grand jury. Whether and when to empanel a grand jury is a decision of the county prosecutor.

27 Investigators could have arrested Felton, but the prosecutor directed that Felton not be arrested. The decision to release Felton without arresting him was based on two considerations: 1) If Felton was arrested the prosecutor would have to file charges or order Felton released. If charges were filed by the prosecutor, the prosecutor could no longer use the grand jury to gather evidence and at that point no one was sure who else might be involved or if anyone else in the agency might be involved and 2) Experience has shown that a better case can be made when the prosecutor makes a decision on what charges to seek after having had an opportunity to review all of the investigator’s reports and all of the evidence gathered. Delaying indictment until that point allows the prosecutor to make a final determination as to whether additional evidence might be needed and how that evidence can be acquired This practice ensures that the case is ready for trial the day it is charged.

28 The currency exchange subpoenas sought identifying information about the persons who presented the checks and, because many currency exchanges have surveillance cameras that monitor transactions, also required production of any such tapes.

29 The Illinois statute creating the crime of Wire Fraud was being considered by the legislature while the Felton investigation was being conducted. Thus, though Felton’s conduct certainly would constitute the crime of Wire Fraud, this offense did not yet exist in Illinois. Though the Illinois Wire Fraud statute did not become effective until January 1, 2000, there has long been a federal crime of Wire Fraud. The federal statute, however, for constitutional reasons requires proof that the electronic message crossed state lines, something that did not occur in the Felton case.

30 American judges are never bound by the prosecutor’s plea agreement. Judges may reject such agreements. Plea agreements take two basic forms: one where the agreement contemplates the recommendation of a particular sentence which judges usually follow or one where there is no agreement as to a specific period of incarceration and the parties agree to a sentencing hearing at which the prosecutor will ask for a sentence no greater than some certain period of incarceration, e.g. 7 years.

31 As part of the operational plan approved by the prosecutor no stop would have been made if the tax collector had indicated that he had an accomplice. In that event the plan was to allow the collector to go and see if he met with the accomplice to split the money and effect the arrest at that time.

32 These are forms that every employer is required by law to provide to their employees. The forms show the employees total earning from the employer for the year and are filed by the employee with his annual federal income tax returns.

33 The photo identifications created usually purported to be identity cards issued by the purported employer. In a few instances false government identification documents were created.

34 The term “closing” is used to describe the meeting at which the property purchaser appears, signs the loan documents, and endorses the loan proceeds check to the seller to effect the purchase of the property and at which the seller either personally or through an agent delivers the deed to the property. This usually occurs at the office of a title insurance company that acts as an agent of the lender to handle the transaction. In this case, the conspirators usually hired people for $500 to appear at the closings as the purported borrower and sign the mortgage documents. Who actually posed as the borrowers was never determined.

35 There is no express statutory authority which allows the prosecutor to give a proffer letter. A proffer letter is simply a private agreement between the prosecutor and a witness. Should the beneficiary of a proffer letter testify at any trial the prosecutor is required to divulge the terms of the proffer agreement to the defense. In virtually every case, at trial, the prosecutor will elicit from such a witness the terms of the proffer agreement.

36 These accounts were held in fictitious names or in the name of a corporation.

37 As part of the scheme one of the perpetrators prepared false employment verifications for some of the purported loan applicants. These verifications purported to be executed by the employers.

38 The Conspiracy charge was what is called a multiple object conspiracy. That means that the defendants conspired to commit several crimes or what are called target offenses. In this case the target offenses were Computer Fraud, Theft, and Forgery.


By Edward Carter1 ©2002 by Edward Carter iconIts Perpetrators1 By Edward Carter

By Edward Carter1 ©2002 by Edward Carter iconEdward Wiszniowski

By Edward Carter1 ©2002 by Edward Carter iconМонография Волгоград «Парадигма»
Макаров 1990; Попов 2005 и пр.), но и в работах по национализмоведению и исторической энтологии (см.: Андерсон 2001, Вердери 2002,...
By Edward Carter1 ©2002 by Edward Carter iconДокументи
1. /2002-2006/русс. вариант/1.0. Неорганическая химия 2002-2006.doc
2. /2002-2006/русс....

By Edward Carter1 ©2002 by Edward Carter iconДокументи
1. /NMON-1239.doc
2. /dodatok1.docx
By Edward Carter1 ©2002 by Edward Carter iconДокументи
1. /metod_rek_zhurnal/7.орчхн.вимоги математика.doc
2. /metod_rek_zhurnal/Jurnal_V_IX.pdf
By Edward Carter1 ©2002 by Edward Carter iconДокументи
1. /doc/Exp/Solutions/10 клас/Розвязок експеремент 10кл - 2.doc
2. /doc/Exp/Solutions/10...

By Edward Carter1 ©2002 by Edward Carter iconДокументи
1. /doc/Exp/Solutions/10 клас/Розвязок експеремент 10кл - 2.doc
2. /doc/Exp/Solutions/10...

By Edward Carter1 ©2002 by Edward Carter iconСабинина А. Л
Машиностроение и техносфера XXI века // Сборник трудов международной научно-технической конференции в г. Севастополе 9-15 сентября...
By Edward Carter1 ©2002 by Edward Carter iconСписок рекомендованої літера тури кодекс України про адміністративні правопорушення: За станом на 25. 02. 2002
Кодекс України про адміністративні правопорушення: За станом на 25. 02. 2002 р. / Україна, Верховна Рада — X.; Одіссей, 2002. — 256...
Додайте кнопку на своєму сайті:

База даних захищена авторським правом © 2000-2013
При копіюванні матеріалу обов'язкове зазначення активного посилання відкритою для індексації.
звернутися до адміністрації