2Federal Criminal Defense Lawyers
Submitted at 11:07 AM March 26, 2012
The New York Times on March 26, 2012released the following:“By NICK WINGFIELD and NICOLEPERLROTHSEATTLE — Microsoft employees,accompanied by United States marshals,raided two nondescript office buildings inPennsylvania and Illinois on Friday,aiming to disrupt one of the mostpernicious forms of online crime today —botnets, or groups of computers that helpharvest bank account passwords and otherpersonal information from millions of other computers.With a warrant in hand from a federal judge authorizing the sweep, theMicrosoft lawyers and technical personnelgathered evidence and deactivated Webservers ostensibly used by criminals in ascheme to infect computers and stealpersonal data. At the same time, Microsoftseized control of hundreds of Webaddresses that it says were used as part of the same scheme.The sweep was part of a civil suit broughtby Microsoft in its increasingly aggressivecampaign to take the lead in combatingsuch crimes, rather than waiting for lawenforcement agencies to act. Thecompany’s targets were equipment used tocontrol the botnets, which criminals,known as bot-herders, use for ill intent.Microsoft has a big interest in making theInternet a safer place. Despite inroadsmade by Apple and others in some partsof the technology business, Microsoft’sWindows operating system still runs thevast majority of the computers connectedto the Internet. The prevalence of itssoftware has made Windows the mostappealing target for online criminals, andthe security holes they discover in thesoftware are a persistent nuisance forWindows users.Microsoft’s involvement in what hadbeen considered largely a lawenforcement function — fightingcomputer crime — is the brainchild of Richard Boscovich, a former federalprosecutor who is a senior lawyer inMicrosoft’s digital crimes unit. That groupwatches over fraud that could affect thecompany’s products and reputation.Mr. Boscovich, who handled drug,computer and financial crime cases inMiami in his former job, devised a novellegal strategy to underpin the growingnumber of Microsoft’s civil suits againstbot-herders. Among other things, heargued that the culprits behind botnetswere violating Microsoft’s trademarksthrough fake e-mails they used to spreadtheir malicious software.Mr. Boscovich said the Friday sweep wasmeant to send a message to the criminalsbehind the scheme, whose identities areunknown. “We’re letting them knowwe’re looking at them,” said Mr.Boscovich after participating in thePennsylvania raid, in Scranton.Before Friday’s sweep, Microsoftattacked three botnets in the last couple of years through civil suits. In each case,Microsoft obtained court orders thatpermitted it to seize Web addresses andcomputers associated with the botnetswithout first notifying the owners of theproperty. The secrecy was necessary,Microsoft argued, to prevent criminalsfrom re-establishing new communicationslinks to their infected computers.Some security experts said Microsoft’stactics had been effective, even if they hadnot eradicated the scourge of botnets.“Taking the disruption into the courthousewas a brilliant idea and is helping the restof the industry to reconsider what actionsare possible, and that action is needed andcan succeed,” said Richard Perlotto,director at the Shadowserver Foundation,a nonprofit group that tracks data abouttools used for online fraud and forms of computer crime.Mr. Perlotto and Microsoft said they didnot see civil legal action against peoplewho commit online crime as areplacement for law enforcement action,which can result in much stiffer criminalpenalties. “We equate this to aneighborhood watch,” Mr. Boscovichsaid.Jose Nazario, a senior security researcherat Arbor Networks, an Internet securityfirm, said that Microsoft’s record againstbotnets had been a “mixed bag” and thatsome of its gains were only temporary.After an earlier action against a botnetknown as Waledac, for example, thesoftware behind it was modified slightlyto create a new botnet.“You can take out a botnet, but unless youtake down the coders and put the clientsbehind bars, they’re just going to go aheadand do this again,” Mr. Nazario said.The computers that make up a botnet areusually conscripted without theknowledge of their owners, whounwittingly infect their machines afterclicking on links in legitimate-looking e-mails for things like security updates fromMicrosoft and notices of tax refunds fromthe Internal Revenue Service. Clickingthose links takes users to Web sites thatexploit security holes in their browsers orother programs on their computers.Criminals use the holes to installmalicious programs that siphon personalinformation from the infected computers,like online bank account passwords andcredit card numbers. They can alsoharness the infected machines to sendmillions of e-mail messages to other userson the Internet, including scam messagesthat help propagate the botnet. Sometimesbotnets are rented to clients to send spammessages advertising products likecounterfeit pharmaceuticals.On Friday, Microsoft was attacking itsmost complex target yet, known as theZeus botnets. The creators of Zeus offertheir botnet code for sale to others and,depending on the level of customersupport and customization of the code thatclients require, charge them $700 to$15,000 for the software, Microsoft saidin a lawsuit filed in federal court inBrooklyn on March 19.That, in turn, has resulted in manyvariants of Zeus botnets, making themharder to combat. Most of them are aimedat perpetrating various financial scamsagainst online victims. Mr. Boscovich of Microsoft said he had a “high degree of confidence” that the unnamed culpritsbehind Zeus were in Eastern Europe.To carry out the scams, they have hiredpeople known as money mules to travel todifferent countries, including the UnitedStates, to set up bank accounts so they canreceive transfers of stolen money fromvictims’ accounts, Microsoft said in itscomplaint. Microsoft said that the Zeusbotnets had enabled the theft of more than$100 million from victims since 2007 andthat 13 million computers were infectedwith some form of software associatedwith it.Because of the financial fraud involved,Microsoft rallied support from twofinancial industry associations — theFinancial Services Information Sharingand Analysis Center and the NationalAutomated Clearing House Association— both of which filed court declarationsendorsing Microsoft’s sweep on Friday.Microsoft does not believe the operatorsof the facilities it raided on Friday, whichrent space to clients on computersconnected to the Internet, are in leaguewith the people behind the botnets. Andthose operators said they had no idea thatequipment inside their facilities was beingused to issue commands to Zeus.“It’s very difficult, unless they drawattention to themselves, to pick up on it,”said Joe Marr, chief technology officer of BurstNet Technologies, the facility inScranton that Microsoft entered Friday.Mr. Boscovich said he did not think theFriday sweep would be as big a blow toZeus as Microsoft’s previous actionsagainst botnets, but he said it was just thebeginning of actions aimed at raising the
Federal Criminal
MICROSOFT page 5