Even though there are big headlines about computer crime, nearly everyone who works in the computer industry knows that the crimes making these headlines are a tiny fraction of the crimes that are committed. Many companies resist pursuing legal recourse for fear of the damage that the publicity of the crime might cause the company. They understand that there is an inequity between how physically committed crimes and computer crimes are prosecuted. Companies also know that successful prosecution is difficult and time-consuming and they often feel that the perpetrators get a mere slap on the wrist, given the damages they cause.
It has been noted that if a bank is robbed by someone with a gun, the criminal will be hunted to the ends of the earth with whatever means necessary. But if a bank is robbed by someone with a computer, it is likely that the bank will not even acknowledge that a crime has been committed in order to avoid the publicity. Here are some statistics that illustrate the point. [56]
[56] Tartaglia, John, "Introduction to Network Security," Computer Security Institute's Conference, 9 November 1993.
-
The average armed robber will get $2,500 to $7,500 with the risk of being shot and killed .
-
Fifty to 60 percent of armed robbers will be caught and 80 percent of those will be convicted and sentenced to an average of five years of hard time.
-
The average computer criminal will get $50,000 to $500,000 with a risk of being fired or going to jail.
-
Ten percent of those computer criminals that are discovered are caught, with only 15 percent of those caught being reported to authorities.
-
Over 50 percent of these reported never go to trial due to a lack of evidence or a desire to avoid publicity.
-
Fifty percent of those who do go to trial are convicted and sentenced to five years of easy time.
However, things are changing. More laws are being written which address computer crime directly. Law enforcement agencies are becoming trained in the processes necessary to investigate computer crimes. The punishment for computer crimes is increasing. Companies are realizing that the publicity from prosecuting a computer crime, if handled correctly, can be very positive. It provides a forum for the company to show that it is being proactive and protecting its customers. It is improving its security ” activities which its competitors may not be doing ” and saving its customers money, by reducing losses due to crime.
It is imperative that we, as an industry, and you, as a corporate representative, be willing to prosecute computer criminals. Today, very few computer criminals pay for their crimes and most of them know the chances of punishment are slim. Increased prosecution and its surrounding publicity may make some potential computer criminals drop their plans.
If you are interested in pursuing any type of investigation or legal prosecution, you should first discuss the activity with your organization's management and legal counsel and notify any appropriate law enforcement agencies (in accordance with any policies or guidelines at your site) to see if they want to pursue an investigation.
Keep in mind that unless one of the parties involved contacts law enforcement, any efforts to trap or trace the intruder may be to no avail. You should contact law enforcement before attempting to set a trap or tracing an intruder.
For legal advice, it is recommended that you consult with your legal counsel. Your legal counsel can provide you with legal options (both civil and criminal) and courses of action based on your organization's needs.
Before you get started in your recovery, your organization needs to decide if pursuing a legal investigation is an option.
Criminal Charges
Criminal courts deal with issues of violations of the law. In the U.S., there are federal, state, and local courts to address federal, state, and local laws. Computer crime laws exist in each of these jurisdictions. Cooperation between the organizations which investigate and prosecute at each of these levels is required for smooth legal recourse.
It is up to you how you want to pursue this incident. You may want to secure your systems or to contact law enforcement to investigate the case.
U.S. sites interested in an investigation can contact their local Federal Bureau of Investigation (FBI) field office. Non-U.S. sites may want to discuss the activity with their local law enforcement agency to determine the appropriate steps that should be taken with regard to pursuing an investigation.
Civil Remedies
Civil courts address issues where financial harm has been done. If the victim is able to show to the satisfaction of juries and judges that he or she was financially damaged, then the judge or jury may settle their claim from the resources of the defendant, which may include future resources. If the jurisdiction allows, the judge may demand that the defendant pay actual restitution to the victim, recovering his or her losses. In the case of a civil suit, damages may be more than actual, with the court ordering the defendant to pay punitive damages to the victim as a means of punishment. In a case where damage is done to an individual or company, even if the person is criminally charged, it is still possible to proceed with civil processes. Although sometimes it requires more legal involvement, both tracks may be pursued with the victims receiving restitution from a criminal's sentence and a financial settlement as part of a civil suit.
