THE CRIMINOLOGICAL PROFILE & A POSSIBLE SOLUTION THE CRIMINOLOGICAL PROFILE OF THE E- CRIME CRIMINAL AND EMERGING OPPORTUNITIES: DR ALICE MAREE A TASK

THE CRIMINOLOGICAL PROFILE & A POSSIBLE SOLUTION

THE CRIMINOLOGICAL PROFILE OF THE E-CRIME CRIMINAL AND EMERGING OPPORTUNITIES: DR ALICE MAREE

A TASK TEAM E-CRIME COUNTERING STRATEGY: JAC SPIES

THE CRIMINOLOGICAL PROFILE OF THE THE CRIMINOLOGICAL PROFILE OF THE E-CRIME CRIMINAL E-CRIME CRIMINAL

&&EMERGING OPPORTUNITIESEMERGING OPPORTUNITIES

Dr Alice MAREEDr Alice MAREE011 8473159011 8473159

[email protected]@sabric.co.za

• Historical background of Historical background of criminological profilingcriminological profiling

• Different types of profilesDifferent types of profiles

• A criminological profile of the e-crime A criminological profile of the e-crime criminalcriminal

• Emerging opportunities for E-crimeEmerging opportunities for E-crime

STRUCTURE OF PRESENTATIONSTRUCTURE OF PRESENTATION

HISTORICAL BACKGROUND HISTORICAL BACKGROUND

• Lombroso - He compared information such Lombroso - He compared information such as race, age, sex, physical characteristics, as race, age, sex, physical characteristics, education and geographic region about education and geographic region about similar offenders.similar offenders.

• Kretschmer - He classified and labeled Kretschmer - He classified and labeled criminals according to body type, criminals according to body type, personality type and criminal potential.personality type and criminal potential.

• Taylor - The earliest hacker profiles was Taylor - The earliest hacker profiles was compiled before 1990compiled before 1990

THE CRIMINAL OR PSYCHOLOGICAL PROFILE (FBI THE CRIMINAL OR PSYCHOLOGICAL PROFILE (FBI BEHAVIORAL LABORATORY AT QUANTICO)BEHAVIORAL LABORATORY AT QUANTICO)

• Soft-evidence profilingSoft-evidence profiling

• Hard-evidence profilingHard-evidence profiling

CRIMINOLOGICAL PROFILECRIMINOLOGICAL PROFILE

• Individual perspectiveIndividual perspective

• Social contextSocial context

• Criminal eventCriminal event

DIFFERENT TYPES OF PROFILESDIFFERENT TYPES OF PROFILES

This profile is developed by criminologists. This profile is developed by criminologists. The following skills are needed:The following skills are needed:• sound knowledge of criminologysound knowledge of criminology• knowledge of psychology such as issues of knowledge of psychology such as issues of

personality traits and temperamentpersonality traits and temperament• knowledge of sociology focusing on relevant knowledge of sociology focusing on relevant

social issues such as poverty, unemployment, social issues such as poverty, unemployment, collective and deviant behaviourcollective and deviant behaviour

• intensive research on crime and criminal intensive research on crime and criminal behaviourbehaviour

CRIMINOLOGICAL CRIMINOLOGICAL PROFILINGPROFILING

A CRIMINOLOGICAL PROFILE A CRIMINOLOGICAL PROFILE

OF THE OF THE

E-CRIME OFFENDER E-CRIME OFFENDER

INDIVIDUAL CONTEXTINDIVIDUAL CONTEXT

BiologicalBiological::

• There is no indication of biogenetic or There is no indication of biogenetic or psychological devianciespsychological deviancies

• Normal personality typeNormal personality type

• More skinny than fatMore skinny than fat

• Tans are rareTans are rare


PsychodynamicPsychodynamic::

• Crave attention and peer recognition Crave attention and peer recognition from other hackers or friendsfrom other hackers or friends

• Low self-esteem (self assurance Low self-esteem (self assurance surfaces only when with other surfaces only when with other (hackers/crackers) talking about (hackers/crackers) talking about computerscomputers


CognitiveCognitive::• They perceive themselves to be They perceive themselves to be

intelligent, but poor achievers in school.intelligent, but poor achievers in school.• Tend to be easily frustrated by their Tend to be easily frustrated by their

school or work situation if it is not school or work situation if it is not challenging enough for themchallenging enough for them

• Technically skilledTechnically skilled• Fairly cleverFairly clever• Reasonably to highly skilled in Reasonably to highly skilled in

computerscomputers


Rational decision makingRational decision making::

• They do not consider themselves as They do not consider themselves as offenders but “borrowers” or electronic offenders but “borrowers” or electronic freedom fightersfreedom fighters

• Want to punish administrators that are Want to punish administrators that are not security-consciousnot security-conscious

• Creative in rationalising their own Creative in rationalising their own behaviour.behaviour.

• Their guilt feelings are therefore rather Their guilt feelings are therefore rather easily neutralisedeasily neutralised

INDIVIDUAL CONTEXT: INDIVIDUAL CONTEXT: HARD CHARACTERISTICSHARD CHARACTERISTICS

• Age: 15 and 45 (peak 14 and 25)Age: 15 and 45 (peak 14 and 25)• Sex: mainly male although women are becoming Sex: mainly male although women are becoming

increasingly involvedincreasingly involved• Marital status: Mostly young teenage boys – Marital status: Mostly young teenage boys –

obviously unmarried due to their ageobviously unmarried due to their age• Education: high school level; degree level or self-Education: high school level; degree level or self-

educated to an equivalent leveleducated to an equivalent level• Employment: School level, a variety of Employment: School level, a variety of

occupationsoccupations• Criminal record: No previous criminal recordsCriminal record: No previous criminal records

INDIVIDUAL CONTEXT: INDIVIDUAL CONTEXT: SOFT CHARACTERISTICSSOFT CHARACTERISTICS

• Problem solversProblem solvers• CreativeCreative• IndividualisticIndividualistic• ArrogantArrogant• Obsessed by and addicted to computersObsessed by and addicted to computers• Passion for programmingPassion for programming• Sense of power or influenceSense of power or influence• Control freaks in the sense that they love Control freaks in the sense that they love

making complicated things such as making complicated things such as computers do effective stuff for themcomputers do effective stuff for them

SOCIAL SOCIAL CONTEXTCONTEXT

Socioeconomic statusSocioeconomic status::• Middle and upper class familiesMiddle and upper class families• Do have affordable or rather relatively Do have affordable or rather relatively

inexpensive internet accessinexpensive internet accessSocial problemsSocial problems::• Limited use of non-addictive psychedelic Limited use of non-addictive psychedelic

drugs such as cannabis, LSD.drugs such as cannabis, LSD.• Seems to be in general dislike of drugs Seems to be in general dislike of drugs

that make them stupidthat make them stupid

SOCIAL CONTEXTSOCIAL CONTEXT

Interpersonal relationshipsInterpersonal relationships::• Loner except when communicating onlineLoner except when communicating online• Comes from troubled or dysfunctional homesComes from troubled or dysfunctional homes• Fears of being humiliated, unmasked or losing Fears of being humiliated, unmasked or losing

respectrespect• Generally works alone but does socialize normallyGenerally works alone but does socialize normally• Not socially integrated with age-peer groupNot socially integrated with age-peer group• Tend not to engage in peer group behaviours Tend not to engage in peer group behaviours

such as dating school activitiessuch as dating school activities


Dress and appearanceDress and appearance::

• Casual with the emphasis on Casual with the emphasis on comfortable, comfortable, functional, and minimal maintenance. functional, and minimal maintenance.

• Very low tolerance of suits and other ‘business’ Very low tolerance of suits and other ‘business’ attire;attire;

• Not uncommon for hackers to quit a job rather Not uncommon for hackers to quit a job rather than conform to a dress code.than conform to a dress code.

• When they are somehow backed into conforming When they are somehow backed into conforming to a dress code, they will find ways to subvert it, to a dress code, they will find ways to subvert it, for example by wearing absurd novelty ties.for example by wearing absurd novelty ties.

• Appearrance: Long hair, beards, and moustaches Appearrance: Long hair, beards, and moustaches are common.are common.


Communication styleCommunication style::

• Poor person-to-person communication Poor person-to-person communication skillsskills

• Sensitive to nuances of language and Sensitive to nuances of language and precise in their use of it (eg the precise in their use of it (eg the distinction between hackers and distinction between hackers and crackers)crackers)

• Often better at writing than at speaking Often better at writing than at speaking

CRIMINAL EVENTCRIMINAL EVENT

Precursors (motives): Precursors (motives): • Motivated and prepared to accept challengesMotivated and prepared to accept challenges• Excitement and intellectual satisfaction of Excitement and intellectual satisfaction of

hackinghacking• Have plenty of relatively inexpensive time to Have plenty of relatively inexpensive time to

hone hacking skillshone hacking skills• Play on one’s fears of the unknown Play on one’s fears of the unknown • Using their superior knowledge to infiltrate an Using their superior knowledge to infiltrate an

individual’s or a businesses personal securityindividual’s or a businesses personal security• Financial distress as some does have a history of Financial distress as some does have a history of

bad debt bad debt • See it as an opportunity to increase self-esteemSee it as an opportunity to increase self-esteem


Predisposing factors:Predisposing factors:

• A relationship between an e-criminal and A relationship between an e-criminal and victim/business is not required, so therefore victim/business is not required, so therefore the offender does not have to be an the offender does not have to be an employee or ex employee of any employee or ex employee of any business/bankbusiness/bank

• Do not have any real understanding of the Do not have any real understanding of the damage the activities might be causingdamage the activities might be causing

• Doing it in part to boost their own egosDoing it in part to boost their own egos

• Views his/her criminal activities as a gameViews his/her criminal activities as a game


Characteristics of organizations at risk:Characteristics of organizations at risk:• Companies with administrators who are not Companies with administrators who are not

security-conscioussecurity-conscious• Companies with vulnerable serversCompanies with vulnerable servers• Companies with sites housed in hosted Companies with sites housed in hosted

environments in which a single break-in would environments in which a single break-in would make multiple Web sites vulnerablemake multiple Web sites vulnerable

• Not necessarily local Web sites but sites with Not necessarily local Web sites but sites with vulnerabilities irrespective of where the site is vulnerabilities irrespective of where the site is located, it may range across a wide spectrum located, it may range across a wide spectrum of countriesof countries

• Business systems and government agency Business systems and government agency systemssystems

• Frequent users of Internet for electronic Frequent users of Internet for electronic related commerce related commerce

• Universities as a computing environmentUniversities as a computing environment


Characteristics of individuals at risk: Characteristics of individuals at risk:

• Individuals using electronic banking Individuals using electronic banking privately on their personal computersprivately on their personal computers

• Limited/not secured in accordance with Limited/not secured in accordance with the information security measuresthe information security measures


Precipitating factorsPrecipitating factors

• Deficiencies of the administration of Deficiencies of the administration of criminal justice criminal justice

• Increasing sophistication and skills of Increasing sophistication and skills of offenders offenders


Triggering factors:Triggering factors:

• Rationalisation/ neutralisationRationalisation/ neutralisation

• Denial of responsibility Denial of responsibility

• Denial of injury Denial of injury

• Denial of victim Denial of victim

• Condemnation of the condemners Condemnation of the condemners

• Appeal to higher loyalties Appeal to higher loyalties


Opportunity for E-crime Opportunity for E-crime (Will be addressed in (Will be addressed in more detail) based on more detail) based on Routine activity theoryRoutine activity theory

• The availability of The availability of suitable targetssuitable targets or or opportunities: Exploit common weaknesses opportunities: Exploit common weaknesses in the security or target system; Cheap in the security or target system; Cheap internet access at homes; Information internet access at homes; Information technology offer incredible new opportunities technology offer incredible new opportunities for crime for crime

• Absence of capable guardiansAbsence of capable guardians• The presence of The presence of motivated offendersmotivated offenders


The CrimeThe Crime::

• Context specific particulars of the Context specific particulars of the individual criminal cases individual criminal cases

• The criminals scan the information The criminals scan the information and delivery systemsand delivery systems

• Identify vulnerabilitiesIdentify vulnerabilities

• Find means to exploit them.Find means to exploit them.

THE CRIMETHE CRIMEGroupsGroups (r00t3rs) (r00t3rs) • used automated searches to scan wide ranges of IP used automated searches to scan wide ranges of IP

addressesaddresses• searched for vulnerable serverssearched for vulnerable servers• used standard exploits and tools downloaded from used standard exploits and tools downloaded from

the Internetthe Internet• hacked vulnerable servershacked vulnerable serversCrime syndicatesCrime syndicates• Hiring kids - to do hackingHiring kids - to do hacking• Why?Why?• Prosecution - Dolus capax (age); financial Prosecution - Dolus capax (age); financial

implicationsimplicationsIndividualsIndividuals (aKt0r) (aKt0r)• Modus operandiModus operandi – individual victims: – individual victims: • Send programs to victims or users as e-mail Send programs to victims or users as e-mail

messagesmessages• Once those messages are opened,Once those messages are opened,• their identities are stolen (spy ware)their identities are stolen (spy ware)


AftermathAftermath::

The consequences and implications of the The consequences and implications of the conviction of a E-crime offender:conviction of a E-crime offender:

Sentences: Imprisonment 2 – 7 yearsSentences: Imprisonment 2 – 7 years

Restitution $64 900 – $94 000; Probation (2 Restitution $64 900 – $94 000; Probation (2 years)years)

Suspended sentence (4 years); Fine ($100)Suspended sentence (4 years); Fine ($100)

• Suffering of disgraceSuffering of disgrace

• HumiliationHumiliation

• The conviction is a personal calamityThe conviction is a personal calamity

• Prison sentencing is regarded as a sever Prison sentencing is regarded as a sever punishmentpunishment

EMERGING OPPORTUNITIES EMERGING OPPORTUNITIES IN E-CRIMEIN E-CRIME

Three kinds of crime-prone features of e-Three kinds of crime-prone features of e-crime can be identified:crime can be identified:

• The Internet as wild frontier The Internet as wild frontier (lawlessness)(lawlessness)

• Information systems provide Information systems provide opportunities for crimeopportunities for crime

• Information as crime target of e-crime Information as crime target of e-crime

The Internet as wild frontier The Internet as wild frontier (lawlessness)(lawlessness)

• The popular view of the Internet as wild The popular view of the Internet as wild frontier where there is little order, no frontier where there is little order, no law, all are or ought to be free to do and law, all are or ought to be free to do and say what they want – promotes values say what they want – promotes values that cherish an antagonism to any that cherish an antagonism to any authority authority

Information systems provide Information systems provide opportunities toopportunities to

• SStealthtealth• CChallengehallenge• AAnonymitynonymity• RReconnaissanceeconnaissance• EEscapescape• MMultipliedultiplied

(SCAREM Newman & Clarke)(SCAREM Newman & Clarke)

StealthStealth

• sneak completely invisible into the sneak completely invisible into the databases of a bankdatabases of a bank

• take what they want take what they want

• leave no or little trace of their leave no or little trace of their entryentry

ChallengeChallenge

• motive to beat the systemmotive to beat the system

• so much so for theft but being able so much so for theft but being able to brag that they brought down or to brag that they brought down or broke into the systembroke into the system

Anonymity

Internet provides

•a degree of privacy in communications and purchases

•to criminals means of exploiting the system

by enabling them to

•carry out crimes eg bank transfer fraud that require

•intrusions into a system over a long period of time

Reconnaissance

•to the offender to identify suitable targets

•availability of computer programmes

•on the web for download can be employed

•to scan the web for individual computers that are vulnerable to attack

Escape

• Kind of guaranteed:

• Criminal exploits the characteristics of the Internet

• e.g. use others Internet address/computer/ computer environment

Multiplied a single crime

• Additional crimes of more cash or other benefits

• e.g. cracking into corporate or government databases - possibility of crimes such as terrorism, blackmail, credit card fraud as a result of the value embedded in those databases

Information as crime target Information as crime target of e-crimeof e-crime

Kinds of informationKinds of information• Intellectual property (Intellectual property (books, CD, DVD books, CD, DVD

software) software)

• Intelligence (Intelligence (database, credit information, id database, credit information, id of clientsof clients

• Systems (Systems (information systems)information systems) • Services (Services (telephone,banking, medical advice)telephone,banking, medical advice)

Kinds of targetsKinds of targets

• Operational (provide object - money & Operational (provide object - money & access -password ATM card)access -password ATM card)

• Transitional (Plan to steal money, target Transitional (Plan to steal money, target network to gain access to bank accounts)network to gain access to bank accounts)

• Proximate (Scan for vulnerable target)Proximate (Scan for vulnerable target)• Convertible (steal cell phone to use phone Convertible (steal cell phone to use phone

services; steal credit card to purchase services; steal credit card to purchase goods)goods)

• Attractive (High-profile business websites)Attractive (High-profile business websites)• Incidental (virus/worms, more websites, Incidental (virus/worms, more websites,

more users)more users)• Undifferentiated (disrupt network –no Undifferentiated (disrupt network –no

specific object/person)specific object/person)

Elements of consumer productsElements of consumer products that made them vulnerable to that made them vulnerable to theft: theft:

• concealable (move files and hide anywhere concealable (move files and hide anywhere on the Internet), on the Internet),

• removable (copy files, leave original but removable (copy files, leave original but similar),similar),

• available (all info are available on the available (all info are available on the Internet),Internet),

• valuable (data bases of personal valuable (data bases of personal information of customers are valuable to information of customers are valuable to merchants)merchants)

• enjoyable (music and video’s)enjoyable (music and video’s)

• disposable (anything can be sold on the disposable (anything can be sold on the Internet)Internet)

Hacker’s ethicHacker’s ethic

• Access to computers should be unlimited and Access to computers should be unlimited and totaltotal

• All information should be freeAll information should be free• Mistrust authority – promote decentralizationMistrust authority – promote decentralization• Hackers should be judged by their hacking not Hackers should be judged by their hacking not

bogus criteria such as degrees, age, race or bogus criteria such as degrees, age, race or positionposition

• You create art and beauty on a computerYou create art and beauty on a computer• Computers can change your life for the betterComputers can change your life for the better

Levy (Newman & Clarke 2003:71Levy (Newman & Clarke 2003:71

Documents

THE CRIMINOLOGICAL PROFILE & A POSSIBLE SOLUTION THE CRIMINOLOGICAL PROFILE OF THE E- CRIME CRIMINAL AND EMERGING OPPORTUNITIES: DR ALICE MAREE A TASK