The Trouble with Tracking from

The Trouble with Tracking
from: newsfactor.com

Federal Bureau of Investigation (FBI) special agent Andrew Black told NewsFactor that law enforcement has the most success when companies or government agencies that have been attacked keep logs that make tracking down a computer intruder less like a game of blind-man's bluff.

However, Black said, tracking the Internet trail of an attacker is not so simple.

"We can do that through the help of the company or agency compromised –- tracking backward through the ISPs (Internet service providers) that have been used by the intruder," he said. "One of the biggest challenges is the fact that a lot of individuals launching these attacks are using accounts they've compromised in the first place."

Exodus vice president of cyber terrorism detection and incident response Charles Neal, a 20-year veteran of the FBI who developed the agency's first cybercrime unit, told NewsFactor that investigators also are challenged by legal requirements.

"You encounter a tremendous burden with subpoenas and search warrants," he said. "And often you find [that who you're after is] just another victim."

Human Help

Neal said one of the most effective techniques in solving cybercrime is the merger of traditional investigative processes with the new technology tools available today.

"There are a number of cybercrimes where you have to marry techniques or evidence to solve the case," said Neal, who managed the FBI's investigation of Mafiaboy, a Canadian attacker convicted of breaking into high-profile online businesses EBay and Yahoo, among others.

"People are still people," Neal said, referring to criminals' tendency to talk about their exploits. "To a large degree, that's the way we solved the Mafiaboy case. That turned out to be the fastest way to track the person down. It's not just a technical issue. We believe in intelligence."

Everyday Tools

Despite the controversy surrounding such technologies as the FBI's Carnivore e-mail snooping software, Neal said law enforcement uses a combination of commercial tools, freeware and proprietary software tools.

He added that much of what is used by law enforcement -- including sniffer programs, tracking and defense tool Web sites -- is also available to the public.

Neal said the FBI's resources put the agency at the forefront of cybercrime-fighting tools, adding that local law enforcement typically does not have the money or time to focus on tools to fight computer crime.

Coming Together

Another challenge of investigating cybercrime is the international reach of the Web, which is steadily adding new users -- and criminals -- around the world, experts said.

"We may be looking for somebody who's not even in our state or country," Black said. "However, the cooperation with various nations has improved. I think everyone recognizes it's a growing problem and it isn't going away."

Neal, citing the cases of Mafiaboy and subsequent high-profile viruses as well as the September 11th terrorist attacks, said he is encouraged by the increased cooperation among law enforcement and the private sector.

"I'm optimistic with the industry that, at last, a high percentage of private industries recognize the need to protect their systems," Neal said.

Cybercrime Savvy

Neal said law enforcement agencies also are getting better at dealing with cybercrime and are putting a higher priority on computer attacks, many of which are direct attempts to profit from stolen information, such as credit card numbers.

"A lot of units have gotten more competent," Neal said.

"Five years ago, the bureau would open a case on a Web defacement," he added. "Typically, they're not going to do that anymore. Now, we're looking for true compromises of systems and evidence that someone's doing something to hurt you. We can catch them if it's worth our effort."

<<Back>>

Other Related Links