While cyber-criminals operate in a world without borders, the law enforcement community does not, making a proposed update to computer fraud and abuse laws more essential than ever, a senior Secret Service official told a Senate banking committee today.
“The increasingly multi-national, multi-jurisdictional nature of cyber crime cases has increased the time and resources needed for successful investigation and adjudication,” said Pablo A. Martinez, deputy special agent in charge, Criminal Investigative Division of U.S. Secret Service, in testimony before the Senate Committee on Banking, Housing, and Urban Affairs.
Calling jurisdictional limitations “one of the main obstacles that agents investigating transnational crimes encounter,” Martinez said that the Secret Service believes that “to fundamentally address this issue, appropriate levels of liaison and partnerships must be established with our international law enforcement counterparts.”
Martinez lent support for a White House National Security Council strategy to combat transnational organized crime. The strategy calls for applying “all elements of national power to protect citizens and U.S. national security interests from the convergence of 21st century transnational criminal threats.”
“As large companies have adopted more sophisticated protections against cyber-crime, criminals have adapted as well by increasing their attacks against small and medium-sized businesses, banks, and data processors,” Martinez said in testimony before the committee, which is led by Chairman Sen. Tim Johnson (D-SD) and Ranking Member Richard Shelby (R-AL).
“Unfortunately, many smaller businesses do not have the resources to adopt and continuously upgrade the sophisticated protections needed to safeguard data from being compromised. The increasing level of collaboration among cyber-criminals raises both the complexity of investigating these cases and the level of potential harm to companies and individuals.”
As the original guardian of the nation’s financial payment systems, the Secret Service has a long history of protecting American consumers, industries and financial institutions, Martinez said.
“In 2010, the Secret Service’s unique multifaceted approach to combating cyber crime led to the arrest of over 1,200 suspects for cyber crime related violations and the examination of 867 terabytes of data, which is roughly the equivalent of 867,000 copies of the Encyclopedia Britannica. These investigations involved over $500 million in actual fraud loss and prevented approximately $7 billion in additional losses. As a result of our efforts, the Secret Service is recognized worldwide for our innovative approaches to detecting, investigating and preventing cyber crimes,” Martinez said.
Recognizing the complexities of fighting cross border crimes, the Secret Service has been collaborating with a wide range of law enforcement and other organizations familiar with computer sciences. As a part of these efforts, and in effort to share information in a timely and effective manner, Martinez said, the Secret Service collaborates with National Protection and Programs Directorate’s (NPPD) United States Computer Emergency Readiness Team (US-CERT) and has personnel detailed to the following DHS and non-DHS entities:
• NPPD’s Office of the Under Secretary;
• NPPD’s National Cyber Security Division (US-CERT);
• NPPD’s Office of Infrastructure Protection;
• National Cybersecurity and Communications Integration Center (NCCIC)
• DHS’s Science and Technology Directorate (S&T);
• FBI National Cyber Investigative Joint Task Force (NCIJTF);
• Each FBI Joint Terrorism Task Force (JTTF), including the National JTTF;
• Department of the Treasury – Terrorist Finance and Financial Crimes Section
• Department of the Treasury – Financial Crimes Enforcement Network (FinCEN);
• Central Intelligence Agency;
• Department of Justice, International Organized Crime and Intelligence Operations Center;
• Drug Enforcement Administration’s Special Operations Division
• EUROPOL; and
• INTERPOL
Currently, the Secret Service operates 23 offices abroad, each having regional responsibilities to provide global coverage. “The personal relationships that have been established in those countries are often the crucial element to the successful investigation and prosecution of suspects abroad,” he said.
A central component of the Secret Service’s cyber-crime investigations is its Electronic Crimes Special Agent Program (ECSAP), which is comprised of nearly 1,400 Secret Service special agents who have received at least one of three levels of computer crimes-related training.
These agents are deployed in more than 98 Secret Service offices throughout the world and have received training in forensic identification, preservation and retrieval of electronically stored evidence, he said.
Martinez cited a “2011 Data Breach Investigations Report” conducted by Verizon, with cooperation by the Secret Service and the Dutch High Tech Crime Unit, which identified two noticeable trends in cybercrime over the past couple of years. They involved the ongoing targeting of retail Point of Sale (POS) systems as well as the compromise of online financial accounts, often through malware written explicitly for that purpose, with subsequent transaction fraud involving those accounts.
The report also indicates that there has been noticeable increase in account takeovers that result in fraudulent transfers from the victim’s account to an account under the control of the perpetrator. This increase can be directly tied to the continued rise of malware variants created to capture login credentials to financial websites
Last spring, the Administration released its proposal to address the cybersecurity needs of our country. The legislative package proposed by the Administration addresses key improvements for law enforcement.
The proposal also includes additional measures to protect consumers against identity theft by standardizing and simplifying the current patchwork of state laws that govern reporting of breaches of personally identifiable information and requiring businesses to notify affected individuals and the government if the business suffers a breach.
In a separate hearing Wednesday, the Justice Department warned a Senate Judiciary Committee that inside attacks could go unpunished if Congress gives into public interest group concerns and opts to change anti-hacking laws in ways that tend to protect computer users who breach Web terms of service agreements, according to a Government Executive report. The 1986 Computer Fraud and Abuse Act, which is expected to be updated as part of a larger cybersecurity overhaul, currently allows the government to convict people who have violated rules set by employers or service providers for surfing the Web.