Federal Investigation and Federal Investigation and Prosecution of Computer and Prosecution of Computer and Intellectual Property CrimesIntellectual Property Crimes

Matthew DevlinMatthew DevlinAssistant United States AttorneyAssistant United States Attorney

Computer Hacking and Intellectual Property CoordinatorComputer Hacking and Intellectual Property Coordinator

United States Attorney’s OfficeUnited States Attorney’s Office

Western District of TexasWestern District of Texas

Austin, TexasAustin, Texas

11Nov 2012Nov 2012

OverviewOverview Computer Hacking & Intellectual Property Computer Hacking & Intellectual Property

(CHIP) Program and Network(CHIP) Program and Network

DOJ Computer Crimes & Intellectual Property DOJ Computer Crimes & Intellectual Property Section (CCIPS)Section (CCIPS)

Types of CasesTypes of Cases• Computer CrimesComputer Crimes• Intellectual Property Rights CrimesIntellectual Property Rights Crimes

Working With Victim CompaniesWorking With Victim Companies

22Nov 2012Nov 2012

What is the CHIP Program?What is the CHIP Program? Nationwide CHIP NetworkNationwide CHIP Network

At least one CHIP prosecutor At least one CHIP prosecutor in each of 93 U.S. Attorney’s in each of 93 U.S. Attorney’s OfficesOffices• More than 250 CHIP attorneys More than 250 CHIP attorneys

nationwidenationwide

CHIP Units in 25 U.S. CHIP Units in 25 U.S. Attorney’s OfficesAttorney’s Offices

• Austin/San AntonioAustin/San Antonio• Dallas, San Francisco, Los Angeles, Dallas, San Francisco, Los Angeles,

Sacramento, San Diego, Seattle Sacramento, San Diego, Seattle Denver, New Haven, Tampa, Miami, Denver, New Haven, Tampa, Miami, Atlanta, Chicago, Baltimore, Boston, Atlanta, Chicago, Baltimore, Boston, Detroit, Kansas City, Newark. Detroit, Kansas City, Newark. Brooklyn, New York, Philadelphia, Brooklyn, New York, Philadelphia, Pittsburgh, Nashville, Alexandria, and Pittsburgh, Nashville, Alexandria, and Washington, D.C.Washington, D.C.

33Nov 2012Nov 2012

CHIP ResponsibilitiesCHIP Responsibilities

Prosecute Core OffensesProsecute Core Offenses• Computer CrimeComputer Crime• Intellectual Property Rights OffensesIntellectual Property Rights Offenses

In-house Subject Matter ExpertiseIn-house Subject Matter Expertise• Advice and training to prosecutors and agentsAdvice and training to prosecutors and agents

Outreach: Law EnforcementOutreach: Law Enforcement• Incident ResponseIncident Response• Search Warrants / 2703 ProcessSearch Warrants / 2703 Process• Advice and SupportAdvice and Support

Outreach: CommunityOutreach: Community• Familiarize IP community with law enforcement optionsFamiliarize IP community with law enforcement options

44Nov 2012Nov 2012

Cybercrime.govCybercrime.gov

Public Page Public Page Latest News Latest News

ReleasesReleases Documents & Documents &

ReportsReports Contact InfoContact Info CasesCases

55Nov 2012Nov 2012

IP EnforcementIP Enforcement

National IP Rights Coordination Center (DHS)National IP Rights Coordination Center (DHS)• Multi-agency clearinghouseMulti-agency clearinghouse• FBI, DHS, USPIS, FDA, other agenciesFBI, DHS, USPIS, FDA, other agencies

DOJ CCIPSDOJ CCIPS U.S. Attorney’s Offices – CHIP ProgramU.S. Attorney’s Offices – CHIP Program

Nov 2012Nov 2012 66

DOJ International PresenceDOJ International Presence

Intellectual Property Law Intellectual Property Law Enforcement Coordinator Enforcement Coordinator (IPLEC)(IPLEC)

• Bangkok, ThailandBangkok, Thailand China/Southeast AsiaChina/Southeast Asia

• Sofia, BulgariaSofia, Bulgaria Eastern EuropeEastern Europe

77Nov 2012Nov 2012

International CooperationInternational Cooperation G8 24/7 Network G8 24/7 Network

• 49 countries 49 countries (map, right)(map, right)

• DOJ (CCIPS) is the U.S. point DOJ (CCIPS) is the U.S. point of contactof contact

• Around-the-clock assistance Around-the-clock assistance availableavailable

Council of Europe Convention Council of Europe Convention on Cybercrimeon Cybercrime• Facilitates international Facilitates international

investigation/ prosecution investigation/ prosecution • Minimizes substantive and Minimizes substantive and

procedural obstaclesprocedural obstacles

88Nov 2012Nov 2012

Federal Judicial Districts in Texas

SouthernSouthernDistrictDistrict

HoustonHouston

CorpusCorpusChristiChristi

BrownsvilleBrownsville

LaredoLaredo

McAllenMcAllen

EasternEasternDistrictDistrict

ShermanSherman

TylerTyler

BeaumontBeaumont

LufkinLufkin

WesternWesternDistrictDistrict

El PasoPecos

Midland

Del RioSan Antonio

Austin

Waco

Alpine

NorthernNorthernDistrictDistrict

AmarilloAmarillo

LubbockLubbock

Fort WorthFort WorthAbileneAbilene DallasDallas

San AngeloSan Angelo

99Nov 2012Nov 2012

Computer Crime CasesComputer Crime Cases

Hacking / Unauthorized AccessHacking / Unauthorized Access• Virus/Worm attacksVirus/Worm attacks• Denial of service attacksDenial of service attacks• Theft of data and electronically stored infoTheft of data and electronically stored info

Computer FraudComputer Fraud• PhishingPhishing

Internet Fraud/TheftInternet Fraud/Theft

1010Nov 2012Nov 2012

Cybercrime StatutesCybercrime Statutes

Identity Theft (18 U.S.C. § 1028)Identity Theft (18 U.S.C. § 1028) Aggravated Identity Theft (18 U.S.C. § 1028A)Aggravated Identity Theft (18 U.S.C. § 1028A) Access Device Fraud (18 U.S.C. § 1029)Access Device Fraud (18 U.S.C. § 1029) Computer Fraud and Abuse (18 U.S.C. § 1030)Computer Fraud and Abuse (18 U.S.C. § 1030) CAN-SPAM Act (18 U.S.C. § 1037)CAN-SPAM Act (18 U.S.C. § 1037) Wire Fraud (18 U.S.C. § 1343)Wire Fraud (18 U.S.C. § 1343) Communications Interference (18 U.S.C. § 1362)Communications Interference (18 U.S.C. § 1362) Wiretap Act (18 U.S.C. § 2511)Wiretap Act (18 U.S.C. § 2511) Unlawful Access to Stored Communications (18 U.S.C. § Unlawful Access to Stored Communications (18 U.S.C. §

2701)2701)

1111Nov 2012Nov 2012

Intellectual Property CasesIntellectual Property Cases

Criminal Copyright Infringement Criminal Copyright Infringement • Digital Millennium Copyright ActDigital Millennium Copyright Act

Trademark / Counterfeit Product offensesTrademark / Counterfeit Product offenses• Online PiracyOnline Piracy• Counterfeit Pharmaceuticals Counterfeit Pharmaceuticals

Economic EspionageEconomic Espionage Theft of Trade SecretsTheft of Trade Secrets

1212Nov 2012Nov 2012

IPR Criminal StatutesIPR Criminal Statutes Copyrighted WorksCopyrighted Works

• Criminal Infringement of a Copyright Criminal Infringement of a Copyright (18 U.S.C. § 2319 & 17 U.S.C. § 506) - Up to 5 years(18 U.S.C. § 2319 & 17 U.S.C. § 506) - Up to 5 years

• Trafficking in Counterfeit Labels for Software & Music Trafficking in Counterfeit Labels for Software & Music (18 U.S.C. § 2318) - Up to 5 years(18 U.S.C. § 2318) - Up to 5 years

• Trafficking in Recordings/Videos of Live Musical PerformancesTrafficking in Recordings/Videos of Live Musical Performances(18 U.S.C. § 2319A) - Up to 5 years(18 U.S.C. § 2319A) - Up to 5 years

• Unauthorized Recording of Movies in a TheaterUnauthorized Recording of Movies in a Theater (18 U.S.C. § 2319B) – Up to 3 years (18 U.S.C. § 2319B) – Up to 3 years

• Circumvention of Copyright Protection Systems Circumvention of Copyright Protection Systems (17 U.S.C. §§ 1201-1205) - Up to 5 years(17 U.S.C. §§ 1201-1205) - Up to 5 years

• Unauthorized Reception of Cable Services Unauthorized Reception of Cable Services (47 U.S.C. § 553) - 6 mos (individual use) / 2 years (commercial (47 U.S.C. § 553) - 6 mos (individual use) / 2 years (commercial gain)gain)

1313Nov 2012Nov 2012

IPR Criminal StatutesIPR Criminal Statutes

TrademarksTrademarks• Trafficking in Counterfeit Goods & Services Trafficking in Counterfeit Goods & Services

(18 U.S.C. § 2320) - Up to 10 years(18 U.S.C. § 2320) - Up to 10 years

Trade SecretsTrade Secrets• Economic Espionage Economic Espionage

(18 U.S.C. § 1831) - Up to 15 years(18 U.S.C. § 1831) - Up to 15 years• Theft of Trade Secrets Theft of Trade Secrets

(18 U.S.C. § 1832) - Up to 10 years (corporation - up to $5M (18 U.S.C. § 1832) - Up to 10 years (corporation - up to $5M fine)fine)

• Confidentiality- Protective orders and other actions authorized Confidentiality- Protective orders and other actions authorized (18 U.S.C. § 1835)(18 U.S.C. § 1835)

1414Nov 2012Nov 2012

18 U.S.C. § 183118 U.S.C. § 1831Economic Espionage ActEconomic Espionage Act

(a) In general.(a) In general.--Whoever, intending or knowing that the offense will benefit any foreign government, foreign --Whoever, intending or knowing that the offense will benefit any foreign government, foreign instrumentality, or foreign agent, knowingly--instrumentality, or foreign agent, knowingly--

• (1)(1) steals, or without authorization appropriates, takes, carries away, or conceals, or by fraud, artifice, or steals, or without authorization appropriates, takes, carries away, or conceals, or by fraud, artifice, or deception obtains a trade secret;deception obtains a trade secret;

• (2)(2) without authorization copies, duplicates, sketches, draws, photographs, downloads, uploads, alters, without authorization copies, duplicates, sketches, draws, photographs, downloads, uploads, alters, destroys, photocopies, replicates, transmits, delivers, sends, mails, communicates, or conveys a trade secret;destroys, photocopies, replicates, transmits, delivers, sends, mails, communicates, or conveys a trade secret;

• (3)(3) receives, buys, or possesses a trade secret, knowing the same to have been stolen or appropriated, receives, buys, or possesses a trade secret, knowing the same to have been stolen or appropriated, obtained, or converted without authorization;obtained, or converted without authorization;

• (4)(4) attempts to commit any offense described in any of paragraphs (1) through (3); or attempts to commit any offense described in any of paragraphs (1) through (3); or

• (5)(5) conspires with one or more other persons to commit any offense described in any of paragraphs (1) conspires with one or more other persons to commit any offense described in any of paragraphs (1) through (3), and one or more of such persons do any act to effect the object of the conspiracy,through (3), and one or more of such persons do any act to effect the object of the conspiracy,

shall, except as provided in subsection (b), be fined not more than $500,000 or imprisoned not more than 15 shall, except as provided in subsection (b), be fined not more than $500,000 or imprisoned not more than 15 years, or both.years, or both.

(b) Organizations.(b) Organizations.--Any organization that commits any offense described in subsection (a) shall be fined not more --Any organization that commits any offense described in subsection (a) shall be fined not more than $10,000,000.than $10,000,000.

Nov 2012Nov 2012 1515

18 U.S.C. § 183218 U.S.C. § 1832Theft of Trade SecretsTheft of Trade Secrets

(a)(a) Whoever, with intent to convert a trade secret, that is related to or included in a product that is produced for or Whoever, with intent to convert a trade secret, that is related to or included in a product that is produced for or placed in interstate or foreign commerce, to the economic benefit of anyone other than the owner thereof, and placed in interstate or foreign commerce, to the economic benefit of anyone other than the owner thereof, and intending or knowing that the offense will, injure any owner of that trade secret, knowingly--intending or knowing that the offense will, injure any owner of that trade secret, knowingly--

• (1)(1) steals, or without authorization appropriates, takes, carries away, or conceals, or by fraud, artifice, or steals, or without authorization appropriates, takes, carries away, or conceals, or by fraud, artifice, or deception obtains such information;deception obtains such information;

• (2)(2) without authorization copies, duplicates, sketches, draws, photographs, downloads, uploads, alters, without authorization copies, duplicates, sketches, draws, photographs, downloads, uploads, alters, destroys, photocopies, replicates, transmits, delivers, sends, mails, communicates, or conveys such destroys, photocopies, replicates, transmits, delivers, sends, mails, communicates, or conveys such information;information;

• (3)(3) receives, buys, or possesses such information, knowing the same to have been stolen or appropriated, receives, buys, or possesses such information, knowing the same to have been stolen or appropriated, obtained, or converted without authorization;obtained, or converted without authorization;

• (4)(4) attempts to commit any offense described in paragraphs (1) through (3); or attempts to commit any offense described in paragraphs (1) through (3); or

• (5)(5) conspires with one or more other persons to commit any offense described in paragraphs (1) through (3), conspires with one or more other persons to commit any offense described in paragraphs (1) through (3), and one or more of such persons do any act to effect the object of the conspiracy,and one or more of such persons do any act to effect the object of the conspiracy,

shall, except as provided in subsection (b), be fined under this title or imprisoned not more than 10 years, or both.shall, except as provided in subsection (b), be fined under this title or imprisoned not more than 10 years, or both.

(b)(b) Any organization that commits any offense described in subsection (a) shall be fined not more than $5,000,000. Any organization that commits any offense described in subsection (a) shall be fined not more than $5,000,000.

Nov 2012Nov 2012 1616

Trade SecretTrade Secret (18 U.S.C. § 1839) (18 U.S.C. § 1839)

all forms and types of financial, business, scientific, technical, economic, or all forms and types of financial, business, scientific, technical, economic, or engineering information, including patterns, plans, compilations, program devices, engineering information, including patterns, plans, compilations, program devices, formulas, designs, prototypes, methods, techniques, processes, procedures, formulas, designs, prototypes, methods, techniques, processes, procedures, programs, or codes, whether tangible or intangible, and whether or how stored, programs, or codes, whether tangible or intangible, and whether or how stored, compiled, or memorialized physically, electronically, graphically, photographically, or compiled, or memorialized physically, electronically, graphically, photographically, or in writing if …”in writing if …”

• The owner has taken reasonable measures to keep such information secret - AND –The owner has taken reasonable measures to keep such information secret - AND –

• The information derives independent economic value, actual or potential, from not The information derives independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable through proper means being generally known to, and not being readily ascertainable through proper means by, the publicby, the public

““owner” means the person or entity in whom or in which rightful legal or equitable title owner” means the person or entity in whom or in which rightful legal or equitable title to, or license in, the trade secret is reposed.to, or license in, the trade secret is reposed.

1717Nov 2012Nov 2012

Foreign Instrumentality/AgentForeign Instrumentality/Agent (18 U.S.C. § 1839) (18 U.S.C. § 1839)

““foreign instrumentality” foreign instrumentality” means any agency, bureau, means any agency, bureau, ministry, component, institution, association, or any ministry, component, institution, association, or any legal, commercial, or business organization, corporation, legal, commercial, or business organization, corporation, firm, or entity that is substantially owned, controlled, firm, or entity that is substantially owned, controlled, sponsored, commanded, managed, or dominated by a sponsored, commanded, managed, or dominated by a foreign government;foreign government;

““foreign agent” foreign agent” means any officer, employee, proxy, means any officer, employee, proxy, servant, delegate, or representative of a foreign servant, delegate, or representative of a foreign government;government;

Nov 2012Nov 2012 1818

Confidentiality & Non-DisclosureConfidentiality & Non-Disclosure (18 U.S.C. § 1835) (18 U.S.C. § 1835)

In any prosecution or other proceeding under this In any prosecution or other proceeding under this chapter, the court shall enter such orders and take such chapter, the court shall enter such orders and take such other action as may be necessary and appropriate to other action as may be necessary and appropriate to preserve the confidentiality of trade secrets, consistent preserve the confidentiality of trade secrets, consistent with the requirements of the Federal Rules of Criminal with the requirements of the Federal Rules of Criminal and Civil Procedure, the Federal Rules of Evidence, and and Civil Procedure, the Federal Rules of Evidence, and all other applicable laws. An interlocutory appeal by the all other applicable laws. An interlocutory appeal by the United States shall lie from a decision or order of a United States shall lie from a decision or order of a district court authorizing or directing the disclosure of any district court authorizing or directing the disclosure of any trade secret.trade secret.

Nov 2012Nov 2012 1919

Criminal Enforcement of IPRCriminal Enforcement of IPR

Criminal charges can be brought when there is Criminal charges can be brought when there is willfulwillful or or knowingknowing infringement. infringement.

Criminal cases require a higher burden of proof: Criminal cases require a higher burden of proof: “Beyond a reasonable doubt”“Beyond a reasonable doubt”

Remedies: incarceration, fines, and restitutionRemedies: incarceration, fines, and restitution Common factors affecting whether to charge a criminal Common factors affecting whether to charge a criminal

violation include:violation include:• Organized Criminal InvolvementOrganized Criminal Involvement

• Public Health and Safety ConcernsPublic Health and Safety Concerns

• Commercial Nature of ViolationCommercial Nature of Violation

• Amount of Loss & HarmAmount of Loss & Harm

• Violation of Previous JudgmentViolation of Previous Judgment

2020Nov 2012Nov 2012

Criminal Investigation and Criminal Investigation and Prosecution TeamProsecution Team

Coordinate investigative and legal Coordinate investigative and legal strategystrategy

Focus On Electronic EvidenceFocus On Electronic Evidence• Determine source IP address(es) Determine source IP address(es) • Seize ComputersSeize Computers• Email Search WarrantsEmail Search Warrants

Traditional Investigative Steps Traditional Investigative Steps • Search Warrant / SurveillanceSearch Warrant / Surveillance• Undercover / Confidential informantsUndercover / Confidential informants• Banking / Transaction RecordsBanking / Transaction Records• ConfessionConfession

2121Nov 2012Nov 2012

Why Report Cyber/IPR Crime?Why Report Cyber/IPR Crime?

Perpetrators are organized and large-scale Perpetrators are organized and large-scale violatorsviolators

Anyone can be - and many have been - a Anyone can be - and many have been - a victim . . . and may be again.victim . . . and may be again.

Help prevent future violations & lossesHelp prevent future violations & losses Ensure the costs of engaging in criminal Ensure the costs of engaging in criminal

activities outweigh the benefitsactivities outweigh the benefits Public companies likely must disclose anywayPublic companies likely must disclose anyway The sooner, the betterThe sooner, the better

2222Nov 2012Nov 2012

Why Report?Why Report?

Enforcing IP Rights Can:Enforcing IP Rights Can:• Improve product-related health and safetyImprove product-related health and safety• Foster growth of economic industries Foster growth of economic industries

(software, high tech, etc.)(software, high tech, etc.)• Foster creativityFoster creativity• Create incentive for investmentCreate incentive for investment• Fulfill international treaty obligationsFulfill international treaty obligations

2323Nov 2012Nov 2012

The Criminal Process: The Criminal Process: What to ExpectWhat to Expect

Initial report to law enforcementInitial report to law enforcement• Results of internal investigation?Results of internal investigation?• Loss/Damage valuationLoss/Damage valuation• Civil remedies should always be consideredCivil remedies should always be considered• Sting operation?Sting operation?

LE will use best efforts to minimize disruption to normal business LE will use best efforts to minimize disruption to normal business operationsoperations

Victim cooperationVictim cooperation• Establish Ownership / Unauthorized AccessEstablish Ownership / Unauthorized Access• Identify Counterfeit ProductsIdentify Counterfeit Products• Address Technical Issues Address Technical Issues

Intrusion issuesIntrusion issues Proving trade secretProving trade secret

Evidence gatheringEvidence gathering• GJ subpoenasGJ subpoenas• Search Warrants / 2703 processSearch Warrants / 2703 process• Evidence preservationEvidence preservation

2424Nov 2012Nov 2012

The Criminal Process:The Criminal Process:ProsecutionProsecution

ProsecutionProsecution• Plea negotiationsPlea negotiations• IndictmentIndictment• Notification to victim of significant prosecution eventsNotification to victim of significant prosecution events

DiscoveryDiscovery• Rule 16, FRCrPRule 16, FRCrP• Brady obligationsBrady obligations• Protective OrderProtective Order SentencingSentencing

Loss/Damage amountLoss/Damage amount RestitutionRestitution ForfeitureForfeiture

2525Nov 2012Nov 2012

The Criminal Process:The Criminal Process:Things to Keep in MindThings to Keep in Mind

Pending/anticipated civil litigationPending/anticipated civil litigation Expect public disclosure of the incident(s) at some pointExpect public disclosure of the incident(s) at some point Criminal investigation should not be viewed as a way to Criminal investigation should not be viewed as a way to

develop a civil casedevelop a civil case May have limited disclosure to victim about progress of May have limited disclosure to victim about progress of

criminal investigationcriminal investigation• Privacy Act / FOIAPrivacy Act / FOIA

• Grand jury secrecyGrand jury secrecy

• Sealed court documentsSealed court documents

Once charges are filed, prosecution will move forward Once charges are filed, prosecution will move forward quicklyquickly

2626Nov 2012Nov 2012

Federal Law Enforcement Contacts Federal Law Enforcement Contacts

U.S. Attorney’s OfficeU.S. Attorney’s Officewww.justice.gov/usaowww.justice.gov/usao

U.S. Secret ServiceU.S. Secret Servicewww.secretservice.govwww.secretservice.gov

• Stolen financial dataStolen financial data

U.S. Postal Inspection ServiceU.S. Postal Inspection Servicewww.postalinspectors.uspis.govwww.postalinspectors.uspis.gov

• IPR crimes involving the mailsIPR crimes involving the mails

Drug Enforcement AdministrationDrug Enforcement Administration

www.justice.gov/deawww.justice.gov/dea

• Counterfeit pharmaceuticalsCounterfeit pharmaceuticals

Federal Bureau of InvestigationFederal Bureau of Investigation

www.fbi.govwww.fbi.gov

• Computer intrusions & IP crimesComputer intrusions & IP crimes

• Stolen dataStolen data

• Theft of trade secretsTheft of trade secrets

U.S. Immigration and Customs U.S. Immigration and Customs EnforcementEnforcementwww.ice.govwww.ice.gov

• Counterfeit imported goodsCounterfeit imported goods

U.S. Food & Drug AdministrationU.S. Food & Drug Administration

www.fda.govwww.fda.gov

• Counterfeit pharmaceuticalsCounterfeit pharmaceuticals

Nov 2012Nov 2012 2727