| Brought to you by |
 |
Computer Crime Research Center | www.crime-research.org |
| Brought to you by |
|
Computer Crime Research Center | www.crime-research.org |
2002
CRIMINAL
CHARACTERISTIC OF CRIMES COMMITTED IN THE BANKING SYSTEM
BY USING UP-TO-DATE INFORMATION TECHNOLOGIES
Government vital activity banking
system which deals with accumulating, dividing and using governmental and
private funds is the most attractive for individual criminals and especially
organized criminal groups. The most financial swindles of different kinds
accomplished more often during various bank operations are committed now in this
system.
To function normally economy needs to
have a reliable, stable and developed banking system where banks will implement
payments, extend credits to their clients in proper time, provide with services
in securities operations and so on, and so forth. If the bank financial position
is “swayed”, the financial standing of hundreds of bank clients can give a lurch
as well.
The annual growth in the bank offense
amount increases the size of loss caused by these crimes. Data for 1997-1998
prove that more than 75% of all losses inflicted by the financial criminality
only fall on the commerce bank field of business. (1)
Offenses committed in the banking
system or by using it can be attributed to the most dangerous economic crimes
since their negative influence is not only reflected on the bank itself but also
the many other subjects of the economical activity and the financial system of
the government at large.
Sums that are drawn from the banking
accounts of the depositors and the resources of the banks themselves by applying
computer systems reach especially great extents. Crime, which covers corpus
delicti provided by the Criminal Code of Ukraine in Clauses 190 “Fraud”, 200
“Illegal act with transfer bills, payment cards and other means of access to the
banking accounts, equipment for their manufacture”, 361 “Illegal interference
with the work of electronic computers, systems and computer nets”, 362 “Larceny,
misappropriation, extortion or possession of the computer information by
swindling or abusing official position”, 363 “Violation of operating rules for
electronic systems”, can be attributed to this kind of criminal activity.
Early 90-s the global society
computerization was initiated in Ukraine that did not become only a factor of
the scientific-and-technological progress but also entered work, everyday life,
science, education and culture. Computers became indispensable man help.
Today our country has sufficiently
developed system of electronic communication, which cannot be absolutely
reliable and protected. Such a situation gives criminals a possibility to get an
access to the computer information systems to conduct illegal manipulations with
mercenary motives. The society computerization results in increasing the amount
of computer crimes and their weight depending on the sums used in the total part
of the material costs in comparison with the ordinary offenses.
The object of the criminal trespass
depending on the kind of a crime is not the same. The criminal trespasses in the
bank sphere are determined by the criminal-and-legal indication depending on the
circumstances by the clauses of different chapters from the Criminal Code of
Ukraine: 1.Offenses against property – “Fraud” (190); 2.Offenses in the sphere
of economic activity – “Illegal acts with transfer bills, payment cards,
equipment for their manufacture and other means of access to the banking
accounts” (200); 3.Offenses in the sphere of using electronic computers, systems
and computer nets – “Illegal interference with the work of the electronic
computers, systems and computer nets” (361); “Larceny, misappropriation,
extortion and possession of the computer information by swindling or abusing
official position” (362); “Violation of the operating rules for automated
electronic systems”(363); (2). Funds of the government or private firms,
enterprises and persons in the Ukrainian or foreign currency, goods and property
as well are the object of these criminal trespasses.
The methods of committing banking
offenses are very different. Let us examine the crimes committed by using modern
information technologies: counterfeit and application of the plastic payments
cards and computer banking information.
For the last years the Ukrainian
market of the bank technologies traversed a path from the initial stage of
computerization – realizing the most simple banking operations on the base of
the personal computers, to the valuable automated banking systems, which meet
the most exacting modern requirements. The international systems of payment are
being introduced.
The modern state of the information
systems and electronic technique allows introducing the most delicate and
interesting technologies. One of them is so called "e-money".
The mutual interest of the government
and the owners of the plastic cards stipulated the appearance and spread of
plastic payments means. It is one of the ways for the government to reduce the
needs in ready money mass.
The emitters recurrently inform the
organizations, which accept cards, about the numbers of cards declared null and
void, stolen, lost or forged. The list of the numbers of such cards is called
“stop-list”. When using a card, it is checked for the validity of its details by
the “stop-list” and with the reading unit. (3)
Hackers are a real danger for the
bank industry of plastic payment means. When using special software they can
determine and then sell the numbers of valid accounts of the credit cards and
also extend passwords, identification numbers, credit and other personal
information through computer nets, thereby helping criminals to obtain illegal
access to the credit offices and computer systems of the financial
establishments.
But counterfeit is the most dangerous
threat for the payment systems with using bank plastic cards. This kind of
offenses is developed the most dynamically and creates great difficulties when
researching and calculating losses. Criminals use the numbers of the valid cards
and their owners even do not guess it.
Theft in the bank activity with using
electronic computers or computer nets is broadly extended now. This kind of
theft is characterized with that the criminals abused their official position to
get unlawful access to the computer information of the financial character,
concentrated in the electronic centers of the banking establishments, revealed
the flaws in the activity of the inspection services and carry out the criminal
operations with the information obtained from the electronic computers and data
carriers.
Today there are four groups of
principal means of committing computer crimes:
1.Information piracy: direct and
electromagnetic
2.Unauthorized access to information:
“computer boarding”, “mystification”, “disguising”, “changeable choice”, “by
tail”, “emergency”, “after fool”, “breakthrough”, “hatch”, “storehouse without
walls”, “system gawks”.
3.Manipulation with information:
“Trojan hobbled hoarse”, “Trojan wooden doll”, data substitution, code
replacement, computer virus, “salami”, “logical bomb”, “asynchronous attack”,
modeling, “kite”, “trap with bite”.
4.Obtaining and using information
with criminal purpose: larceny of software, equipment by means of computer
operations, theft of money by means of gaining confidential codes, computer
remittance, manipulation with computer or introducing alterations to the
program. (4)
Commitment of these crimes is
preceded by the certain preparation, the character of which depends on the level
of connection of the wrongdoers with the activity of the bank electronic center.
The unauthorized persons think over the ways of access to the computer systems,
try to find out the program passwords and keys. The programmers, operators and
other officials of the computer center and other bank departments who prepare
such a swindle choose the most favorable circumstance to commit it and can set
up a false firm with the settlement account to transfer drawn money, etc.
In the main, criminal action consists
of conducting contact operations of the wrongdoers with the electronic computers
or machine carriers, drawing necessary information or money from the e-accounts
of the bank clients, possessing it or transferring it to the accounts of the
“false” organizations.
Restoring the initial program that
underwent some changes in the process of criminal access to the bank computer
information conceals such an offense. Highly skilled experts who may breach the
bank software depending on its level of access can do this.
Situation created by criminals to
commit these crimes first of all is formed under the influence of different
misunderstanding, contradictory, undeveloped regulations in our legislation,
some insufficiently considered decisions and inadequately elaborated mechanism
of realizing decisions in the field of bank activity.
The circumstance is favorable for
swindlers who use plastic payments cards when “stop-lists” are not send in time
to the organizations which accept these cards and the persons who take and check
these cards at the commercial and other facilities are careless.
The situation of the lax control for
maintaining the established order of professional work in the electronic bank
nets and the insufficient protection of computer systems favor the mercenary
crimes dealing with using information electronic systems. Here criminals apply
favorable conditions already objectively formed for them more often than those
specially created by them. Even the insufficiently considered
organizational-and-administrative decisions can favor such plundering.
Criminal.
Psychology of profit-seekers,
dealers, liking for profit, striving for quick accumulation of wealth by any
means without taking into consideration that their actions can cause at times
serious losses to the economy of Ukraine is peculiar to most of them.
Persons who commit these crimes have
comparatively high level of education.
Persons who commit theft by means of
using computer bank systems should be referred to the specific category of these
wrongdoers.
Defining persons who commit computer
offenses it is necessary to mark the main distinction, and namely: very many
people ranged from highly skilled specialists to amateurs are involved in the
electronic criminality.
Home and foreign researches make it
possible to paint a portrait of a typical computer, electronic criminal, that is
a proper profile of this social type: he is average 30 years old, by education –
an engineer in the field of electronics and mathematics, or programmer, but
there are some cases when the criminals never had any technical experience.
Besides they are not on the books at IAA and do not have criminal past at
all.
According to Computer Criminality
Research Center males are five times oftener the subjects of crimes committed by
means of using high technologies. The most criminals have full or incomplete
higher technical education (53,7%), another full or incomplete higher education
(19,2%). Persons aged from 30 to 45 (46,5%) and from 16 to 30 (37,8%) as well
prevail among them. (5)
From a position of human
psychophysical characteristics it is a desired official, a bright, thinking,
creative person, who knows his business and is ready to accept a technical
challenge. They always occupy senior posts and are equipped with special
knowledge and the newest technologies, have an access to the banking computer
systems.
At the same time they are afraid of
losing their authority or certain status within the limits of a social group, or
being mocked at the work.
It should be taken into consideration
that at this stage the computer crimes in the bank system are committed mostly
in an organized way. It is explained by that the organized criminal groups,
which have wide influence, can transfer money to the foreign bank accounts
without any problems, or “launder” it through false firms in order to legalize
and bring it into circulation later on.
These criminals are notable for
concentration and diligence, their actions are refined, cunning and accompanied
with excellent disguising. Outwardly the behavior of those people do not differ
from the social rules established in the society. More frequently they do not
only have special skills in making use of electronic computers, their devices
but also can apply bank program passwords and keys, use their expert knowledge
to falsify programs by means of altering correct output data. They are usually
operation officials who occupy various posts, programmers and computer
operators. Computer crimes with mercenary motives are also committed by so
called “hackers” (possessed programmers) who are chiefly young people well
technically and professionally trained to work with electronic computers and
draw up computer programs. (3)
Researches show that mainly bank
officials: programmers, engineers, and operators who are users or service
personal of electronic computers (41,9%) can obtain a direct unauthorized access
to the electronic computers, systems or computer nets. Almost twice less the
other bank officials (20,2%) can gain such an access, and in 8,6% of cases the
crime was committed by the officials that had been dismissed, 22,5% - an
unauthorized access is obtained by a stranger. (5)
“Hackers” – computer rowdies who
enjoy penetrating into smb. else’s computer. They are capital experts on
information technology. By means of telephones and home computers they are
connected to the nets, which transmit information linked nearly with all big
computers that operate in the field of economy and banking activity.
First hacker’s aim can be only a
sporting interest, connected with solving a difficult problem of “breaking”
protection of program product or creating computer virus only to please their
self-admiration or just make a fun. Hackers are notable for a high
professionalism in combination with specific computer fanaticism. It is
necessary to underline that the lack of evident unlawful intents features the
criminals of this group. Practically all their actions are taken to show their
intellectual faculties.
Professional criminals who act with
obvious mercenary motive and have steady criminal experience are the most
dangerous threat for the sphere of banking activity. Crimes that bear serial,
continuous character are always concealed. More often the members of the
organized criminal groups are highly skilled experts with higher mathematical,
engineering and technical or economical education who are equipped with special
technique. Most of the especially unsafe crimes in public offices such as
misappropriation of money means to the particularly large extents committed by
applying computing machinery fall on the share of this group of criminals.
They work either at the offices
against which they act or outside them, alone or with accomplices. Some of them
are weakly equipped and other have expensive, prestige and powerful computer
systems.
Revealing traces.
The biggest difficulty is to establish a fact of committing a computer crime in
the banking system. It is explained by that outwardly the fact of committing a
computer crime and its display in the environment is more modest than when
burglarizing a grocery store or quite insignificant. Outwardly you cannot see an
obvious loss of property inflicted by the electronic criminal. For example,
unlawful copying out information more often remains entirely unrevealed,
introducing a virus into computer is more often put down to the unintentional
error of the user who could not “reveal” it when contacting with inner computer
world.
Mechanism of committing offenses
connected with automated systems of processing information is often hidden from
the victims. Besides the fact of the information leakage can be disguised by
means of electronic devices at the normal course of events before it is
revealed.
Very often executive officers obliged
to ensure computer security are not interesting in revealing fact of crime
commitment. Acknowledgement of the fact of unauthorized access to the system,
which is under their jurisdiction, puts under doubt their professional
proficiency; weakness of computer security measures undertaken by the
administration can result in serious internal complications.
As for the suffered banks their
officials are not interesting at all in registration of those crimes but on the
contrary try to conceal them studiously. Since making public the fact of
committing criminal actions against bank computer will be negatively reflected
on the authority of the establishment and can result in losing clients (only in
8,2% of cases the victims appeal to the law-enforcement agencies, and in other
cases there are only internal investigations). (5)
The result of it is that the
reluctance to inform about a crime, deliberately concealing it, favors putting
obstacles in the way of revealing criminal traces which are insufficient enough
as they are. But if the damaged party informs the law-enforcement bodies about
committed crime the team of inquiry arrives on site of an accident and inspects
it to reveal traces of the offense.
In particular all the computers of
the banking establishments are equipped with the unauthorized access warning
systems which fix all the attempts of this kind. Suffice it to enter a proper
command and computer will display all the information. But a criminal can
penetrate into another computer by finding weak points in the system protection;
in this case the unauthorized access will not be fixed. In spite of prudence
when working with information sometimes there remain traces: accidentally erased
information or program confusion, which could occur when improper command is
used. If money were drawn from the bank, making more detailed inspection will
reveal the inflicted loss of property.
The officials, persons who know
operating conditions very well and can use the possibilities of this system with
mercenary purposes, mainly commit the lion’s share of computer crimes in the
bank system. There are very few those people in every establishment so crime
traces can remain on their working places. They are CD-ROMs, floppies where the
criminal save necessary information, copies, notes on sheets of paper
(passwords, codes).
Unfortunately electronic criminals
commit nearly all the crimes in the daytime at the work when they are engaged in
their official activity and you can do nothing with it. The only way out is to
improve the protection system and restrict an access to the information on the
system operating conditions. The less informed, the less suspected.
Circumstances that are subject to
specifying in a process of investigating banking crimes, independently of their
type are mainly determined on the base of their criminal characteristic and by
taking into consideration an evidential matter.
The first group
of these circumstances is connected with establishing all the main circumstances
of the crime case to be investigated: an object of criminal trespass; means of
commitment and mechanism (all stages) of criminal action, situation of
committing it (place, time, specification of financial operations, conditions
for performing and checking them, other local and surrounding conditions that
accompany actions to be investigated), other circumstances that influence on the
motives of actions; character and extent of the caused losses (harmful
consequences); individual peculiarities of the suspected; availability or lack
of indications of the organized criminal group activity (if it is determined and
the suspected are its members). It is important to ascertain (if a crime had
some episodes) the whole period during which the crimes were committed, and all
the circumstances of committing it. Revealing the enumerated circumstances
usually creates the necessary factual base for bringing an accusation.
The second group
of circumstances combines facts that
confirm guilt of the accused, and motives of committing a crime, including
determining extent and nature of circumstances that aggravate or mitigate the
punishment.
The third group
of circumstances – conditions that favor committing a crime (imperfection of
legal regulation of applicable operations, shortcomings of applicable rules of
conducting operations, poor automation of payment transactions, etc.)
The fourth group of circumstances bears largely a criminal character and is aimed to reveal data that help to determine sources of main and additional information on the case. The process of determining circumstances of the group includes: verification of investigation versions, which have arisen; verification and assessment of actual data that formed the basis for criminal assessment of the action to be investigated (information about means, mechanism and circumstance of committing a crime), and also revealing and assessing the extent of the inflicted loss, means of disposal of stolen property and valuables purchased with drawn money.