At TEDx Birmingham 2014, one of the presenters asked the audience, “Why is it called cybercrime, but we don’t call the police?” An interesting question — one that begs further investigation.
The person making the inquiry was Gary Warner. I wrote a previous TechRepublic article about his work at the University of Alabama, Birmingham (UAB), and his company Malcovery Security. Warner has this thing about cybercrime, as in, he wants to wipe it out.
During his TEDx talk, Warner refers to a time when his boss was upset that he was spending too much time chasing digital bad guys and that it should not be his concern. Warner’s response:
“The hell it’s not! Computer scientists like me invented the internet and gave it to the world as a gift. Now somebody’s out there trying to destroy what we built, by using the internet to steal our money, our passwords, our secrets, and our documents.”
Shares the pain
Warner, who lives in Alabama, has firsthand experience with cybercrime because someone used his credit card to charge $1,800 at Wal-Mart in California. When Warner found out, he called the police:
“And the official said, ‘Oh, would you like me to do a police report so we can have the bank give your money back?’ No. We want you to take my statement so someone will investigate the crime, catch the criminals, and put them in jail. The official chuckling said, ‘That’s not how it works.'”
Warner then called the San Diego Sheriff’s Department explaining the situation. The person at the sheriff’s office responded:
“We’d be happy to investigate this crime for you Mr. Warner. Tell you what, send me an affidavit saying you or your wife will fly to San Diego at your expense, stay in a hotel for a week, and pay for your own meals if we catch the criminal; because without a witness in the stand, it’s not going to do us any good.”
Warner told the official that would cost more than the $1,800 they originally lost. The official replied, “Right, call your bank. Get the money back.”
That experience solidified Warner’s understanding of why bad guys feel they are immune to any consequences of their crime. Nick Selby of PCWorld interviewed Ed Gibson, former Chief Security Advisor for Microsoft in the UK, about this subject. Gibson offered the following insight:
“If you commit a cybercrime there’s almost no chance you’ll get caught; if caught there’s almost no chance you’ll get prosecuted; get prosecuted and there’s slim chance you’ll get time; get time and there’s no chance you’ll serve anything like the whole ride. Under those conditions, what possible reason would there be not to commit cybercrime?”
Warner agrees: “We built the response to cybercrime where we punish the victim rather than punish the criminal, and we need to change that.”
Do not give up
Warner is not giving up. Between his work at Malcovery Security and at UAB, Warner feels they are making headway:
“We have former students who joined the FBI and the CIA. We have former students employed at Microsoft and PayPal. We’ve got former students all over the world who are fighting cybercrime.”
Warner also put onus on those who use the internet, saying: “It’s your internet too.” To that end, I wanted to repost information introduced in this article about pertinent laws and where to report cybercrimes.
Laws covering cybercrimes
UK: Computer Misuse Act 1990, Communications Act 2003, and Fraud Act 2006
USA: Title 18, United States Code (USC) Section 1030 (Fraud and related activity in connection with computers)
Canada: Criminal Code of Canada, specifically Section 342.1 (Unauthorized Use of a Computer) and Section 430.1 (Mischief in Relation to Data)
Australia: Summary Offences Act, 1953 and Criminal Law Consolidation Act, 1935.
Reporting the crime
UK: In the UK, when a crime occurs, it should be reported to the police. If the crime is serious enough, it may be referred to the Police Central e-Crime Unit.
US: The Department of Justice website contains a contact page for reporting incidents to local, state or federal law enforcement agencies.
Canada: The Royal Canadian Mounted Police is the main agency when it comes to investigating federal statutes, so it is best to start with them.
Australia: The Australian Federal Police website provides advice on whether the Australian State or Territory Police should be contacted.