LAS VEGAS- Hackers, virus spreaders, and other computer criminals are hard to catch but easy to convict – mainly because they almost always confess.
So says Jennifer Stisa Granick, a San Francisco-based criminal defense lawyer who specializes in cybercrimes.
Also:
Fear and Hacking in Las Vegas
Def Con: Bring in Da Noise
Inside the Virus Writer's Mind
Her clients include arch-hacker Kevin Poulsen, who in the early 1990s ran riot through Pacific Bell's computer system, electronically swiped a Porsche from a radio station, and evaded pursuing Feds for 17 months before winding up behind bars on a four-year sentence.
Once they are caught, hackers like Poulsen generally confess, in part because of the unformed state of cyberlaw, Granick said Thursday at Black Hat Briefings, an annual cybersecurity conference in Las Vegas.
There are no clear rules on how to measure damage done by a hacker, Granick explained to a roomful of security professionals gathered at the Venetian casino-hotel.
For instance, prosecutors can claim that a hacker who gained access to a list of thousands of credit cards had the potential to steal millions of dollars worth of credit, and so should be charged as if he had executed the theft. The affected company can then add on the cost of restoring its breached system's security.
"Companies come in with these hugely inflated estimates of damages that are like a sword hanging over your head," said Granick. "That scares defendants and attorneys into cutting a deal."
The ephemeral nature of the forensic evidence computer criminals leave behind makes catching them uniquely difficult.
Burglars often leave fingerprints, are seen by eyewitnesses, or trip up and reveal their connection to stolen items. Electronic criminals, however, can mask their identity by forwarding email through anonymous re-mailing servers or through encryption, and what they steal, damage, or just view without authorization can go long unnoticed.
Trusting the digital evidence that exists is tricky, too, since electronic information can so easily be erased or altered. Still, prosecutions of computer crimes are rising, said Granick.
Law enforcement agencies – particularly the Department of Justice, which goes after most cyber-scofflaws – are boosting funding for and training on cybercrimes, she said.
"When you've got more money and better training, you start finding more criminals."
Unlawful possession of credit card information, unauthorized intrusions into Web pages, and sending out viruses are among the most commonly prosecuted transgressions.
However, the nature and severity of crime in cyberspace remains unsettled. "We use breaking and entering a house as a metaphor for breaking and entering into a computer," said Granick. "But they're not the same thing. The law should not reflect the most histrionic fears of people and corporations."
What constitutes a government cybercrime is also in question, particularly when it comes to the limits on law enforcement agencies in monitoring what people do on their home computers.
"This is a new area of law, and new areas of law are often the most ripe for abuse. The standards that we set now, in terms of how these cases are prosecuted and which ones are prosecuted will be with us for a long time," said Granick.
Although she didn't study or use computers extensively before becoming an attorney, the abundance of cybercrime cases making headlines caught the 30-year-old lawyer's attention. The chance to help shape a new field of law, her commitment to civil liberties, "and my generally geeky nature" have likewise spurred on her specialization.
Granick is optimistic that as the public becomes more familiar with the online world, anti-hacker hysteria will subside. The stigma can't get much worse than it is, she figures.
"Hacker, terrorist, pornographer, drug trafficker," she says, reeling off her list of society's most hated criminals. "That's it – the four horsemen of the Apocalypse."
Related Wired Links:
Crackers Call Off 'War'
8.Jan.99
The Not-So-Happy Hacker
16.Dec.98
Rogue Hackers Gallery
4.Sep.98
Kicking Crackers Off the Grid
5.Aug.98
