Register Tuesday | March 19 | 2019

The Invisible Criminals

Enforcing the law in Toronto's virutal underground

Forget what you learned about the mob from The Sopranos. These days, crime lords aren’t just packing heat, they’ve got laptops too. Over the past ten years, technology has gradually taken over almost every aspect of the criminal enterprise. It has helped to unite rival gangs and streamline their various operations, from gambling to money laundering to pornography. Many larger cartels have private IT (information technology) divisions, and one report from Criminal Intelligence Service Canada notes that the Hells Angels even have their own Webmaster.

Nonetheless, the phrase “cyber crime” still seems somewhat peculiar. After all, how many crimes are named after their weapon of choice? We don’t have “‘hammer’ crime or ‘car’ crime,” notes Sam McQuade, a former police officer who studies today’s cutting-edge criminals in his capacity as assistant professor of criminal justice at the Rochester Institute of Technology. Our present terminology, he believes, suggests we are still catching up to the full implications of the global village.

“In about 1909, if you check major American newspapers, a good number of headlines featured the phenomenon of ‘auto banditry.’ In those days, the horseless carriage and the electric streetcar were being replaced by the automobile as a means of getaway. It was a rage and a sensation.

“Today we have ‘cyber crime’ … In a sociological sense, the early telegraphers were the equivalent to the hacker subculture of today. They had their own way of creating signals just as hackers would have their own code signature.”

Robbing and thieving ain’t what it used to be. Drug traffickers now use the Global Positioning System (GPS) to keep tabs on drug shipments, bikers have replaced hand signals with digital walkie-talkies, drawing software can now make convincing counterfeit passports and driver’s licences, and laptops are used to override a car’s satellite security system.

Then there’s “phishing,” a technique where spammers send email purporting to be from a bank or online auction house. “It will request your account information…, PIN number from your bank card, user names and passwords,” notes detective Larry Gagnon, a constable with the Peel Regional Police’s Technological Crimes Unit and a vice-president of the international chapter of the High Technology Crime Investigation Association. Phishing emails contain links to official-looking websites that trick “pigeons” (unsuspecting victims) into giving out highly sensitive information.

A well-known phishing variation is the infamous West African email scam: Victims are asked to open a bank account with a “good faith” deposit so a “refugee” can transfer his “millions” out of his country—at which point the account is promptly emptied by the scammer. It’s not unusual for the RCMP to receive a thousand to fifteen hundred referrals a week just on the West African scam.

Even worse, perhaps, are fake miracle cures. “It’s a reflection of the economic climate,” says Staff Sergeant Lou Morissette of the Royal Canadian Mounted Police’s Major Frauds and Identity Theft section. “Many are down on their luck, and criminals are very good at targeting weakness. We’ve seen cancer scams where a husband whose wife is dying of the disease will receive a message about a cancer cure and he’ll send the family fortune.”

Even buying in person has its risks. Gagnon’s forensic lab holds various electronic theft devices known as “skimmers” or “CC grabbers”—souped-up debit card machines that steal a person’s PIN and password. CC grabbers can store hundreds of numbers, which the culprits later download and resell. One set of thieves, says Gagnon, “got a hold of a debit card reader, gutted it, put their own chips in it and remanufactured the device,” then installed it in stores, restaurants and various other locations across Canada.

“The machine would respond in an ordinary fashion and approve the transaction, but no actual transaction would take place,” explains Gagnon. “There was no way to tell the difference between a regular debit card terminal and the fraudulent one because the workmanship was of high quality.” If you are ever uncertain about a debit card reader, Gagnon advises, enter an incorrect PIN number: if the transaction is approved, then the terminal is a fake.

“Once in a while I am amazed by a radical technological innovation [used] for abusive purposes,” says McQuade. “Technology is always evolving and there’s always an imaginative few daring and courageous criminals who figure out ways to abuse technology. There’s no reason to believe it will stop evolving as long as we keep introducing new forms of technology to society.”

Prosecuting cyber crime is next to impossible. “What the criminals try to do is splinter jurisdictions,” says Morissette. “Obviously, if you’re committing a crime completely in Toronto, that might be easy for Toronto police to grapple with, but when these [email] solicitations come through several servers, it’s harder for police to tackle that in the conventional sense.”

The question of jurisdiction is not a minor one. Because the roadmaps of the Internet bear little resemblance to real-life geography, emails sent from one Canadian address to another can travel through two or more countries before reaching their domestic target. Obtaining warrants and securing evidence from other countries takes precious time and money away from a case, and can require an international effort.

“We have to engage other law enforcement partners in other countries to assist us because we don’t have the jurisdiction to investigate there,” says Susheel Gupta, a prosecutor and adviser on computer crime with the Department of Justice in Ottawa. “We may have to bring witnesses from overseas, which adds to the cost. Organized criminals are not restricted by budgets as we are.”

“It’s like the New York City police officer who’s asked why there’s so much graffiti on the subway walls: ‘Paint technology is ahead of solvent technology,’” says Graeme Jannaway, managing director of security-consulting firm Jannaway & Associates. Adds Kimberly S. Keller, an assistant professor of criminal law at the University of Texas at San Antonio, “Because the computer industry changes so quickly, by the time a checking system is developed, it is obsolete. Law lags behind science.”

Fortunately, says McQuade, only a small number of miscreants—the Bonnie and Clydes and Baby Face Nelsons of cyberspace—push the envelope all the time.

“The vast majority of criminals tend not to be very imaginative.”