You are on page 1of 58

Cyber Crime is Getting Organised

Ms Francesca Bosco
Project Officer at the Emerging Crimes Unit
UNICRI
2013 NCSC Conference
!NU!R" 22#23$ 2013 % &OR'( FORUM$ )*E *!+UE
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
2
Agenda

Part 1
0
&ho I am1
0
&hat organise- crime is1
0
&h2 I am here1
0
Internet3 (ata$ )ren-s$ Biases$ (efinitions
0
E45ansion of Organise- C26er Crime

Part 2
0
)he Internet an- its effect on the str/ct/re of Organise-
Crime
0
)he Un-ergro/n- Econom2
0
&ho are the Crimina.s7 Some case st/-ies
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
3
Who I am/Francesca
Project Officer on C26ercrime
Emerging Crimes Unit
)o fin- o/t more3
htt53,,/nicri1it,emerging8crimes,
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
4
Who I am/UNICRI
UNICRI’s main goals:
9
!-:ancing /n-erstan-ing of crime#re.ate- 5ro6.ems
9
Fostering j/st an- efficient crimina. j/stice s2stems
9
S/55orting the res5ect of internationa. instr/ments
an- other stan-ar-s
9
Faci.itating internationa. .a; enforcement
coo5eration an- j/-icia. assistance
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
5
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
6
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
7
Organised crime
!rt12 UN Con:ention against )ransnationa. Organi<e- Crime =UN)OC>
Organi<e- crimina. gro/53
0 str/ct/re- gro/5
0 three or more 5ersons
0 e4isting for a 5erio- of time
0 acting in concert
0 aim of committing3
a> serio/s crime=s> or Con:ention offences
6> to o6tain -irect or in-irect financia. or other materia.6enefit =!rt1 21a>

Serio/s crime =!rt1216>
0 con-/ct -esignate- 62 nationa. .a; as an offence
0 5/nisha6.e 62 a ma4im/m -e5ri:ation of .i6ert2 of at .east fo/r 2ears or a
more serio/s 5ena.t2
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
8
Cyberspace ?
Groing Opport!nities "or =Organised>
Crime
@Organise- crime is a m/.ti06i..ion e/ro 6/siness in E/ro5e
an- it is gro;ing in sca.e1 )he f/rther e45ansion of Internet
an- mo6i.e techno.ogies$ the 5ro.iferation of i..icit trafficAing
ro/tes an- metho-s as ;e.. as o55ort/nities offere- 62 the
g.o6a. economic crisis$ ha:e a.. contri6/te- to the
-e:e.o5ment of a more 5otent threat from organise- crimeB
=Ro6 &ain;right$ (irector of E/ro5o.>1
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
9
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
9
Why I am here
There are already 2 billion users worldwide, and in
the future there could be tens of billions of devices
connected, from phones to fridges to cars.
However, the Internet was not conceived with
security in mind; perhaps, quite understandably,
its creators never imagined how pervasive and
essential it would become.
=Nee.ie Croes Dice#Presi-ent of the E/ro5ean Commission res5onsi6.e for
the (igita. !gen-a8Internet sec/rit23 e:er2oneEs res5onsi6i.it2 FGth M/nich
Sec/rit2 Conference H Fe6r/ar2 2012$ M/nich >
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
10
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
10
In-i:i-/a.s$ 6/sinesses an- Nations are
-e5en-ing more an- more hea:i.2 on -ata
an- s2stems in the :irt/a. ;or.-3

21F 6i..ion Internet /sers ;or.-;i-e1 I2J of
the E/ro5ean 5o5/.ation is on.ine1

212 6i..ion Emai. Users ;or.-;i-e1 1FF 6i..ion
Emai.s 5er -a2$ of ;hich KG1GJ are s5am1

K3F mi..ion N/m6er of ;e6sites =;ith H1
mi..ion a--e- in 2012>1
A# $ome data
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
12
%# $ome trends
Ra5i- gro;th of the @Internet of thingsB$ a high
s5ee- comm/nications net;orA com5ose- of
e.ectronic -e:ices rather than 5eo5.e1

In 2012 on.ine sa.es ;ere estimate- at LIK3
6i..ion =c1 MHI26n>$ com5are- ;ith LKG0 6i..ion
=c1 MH0N6n> in 20111

K 6i..ion mo6i.e 5hone s/6scri6ers1

2FJ of the E/ro5ean 5o5/.ation is estimate-
to access the ;e6 from a mo6i.e 5hone -e:ice1
&or.-;i-e mo6i.e 6anAing is e45ecte- to reach
1 6i..ion 62 201I1
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
13
Internet penetration &'(()&'(&

C/rrent an- Emerging C26ercrime )hreats
ENIS!# )hreat 'an-sca5e
O Cybercrime *hreats contin!ed
ENIS! )hreat 'an-sca5e
*he +ictims

In &'(& it as estimated there ere ,,-
.I//ION 0ictims o" cyber crime#

*hat is abo!t (#, .I//ION 0ictims per
day#

An a0erage o" (1 0ictims per second#

123 o" data breaches are attrib!ted to
organised crime#
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
17
C# $ome biases
C26ercrime estimates are generate- /sing :ario/s
statistica. metho-s$ maAing -iffic/.t to ana.2<e$
Process an- harmoni<e re.e:ant -ata1
)o rea-3
9
Se4$ 'ies an- C26ercrime S/r:e2s$ Microsoft Research
htt5
3,,research1microsoft1com,5/6s,1FNGGK,Se4.iesan-C26ercrimeS/r:e2s15-f
>
9
&h2 2o/ cannot tr/st c26ercrime stats$ Misha +.enn2$ UC
&ire-
=htt53,,;;;1;ire-1co1/A,maga<ine,archi:e,2011,12,i-eas#
6anA,c26ercrime#stats>
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
18
%U* 4e0ery ne technology opens the doors
to ne criminal approaches
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te B!E S"S)EMS$ Organise- Crime in the (igita. !ge
19

*he day money became the "oc!s o" malare
is the day the Internet changed#
Graham Ingram5 A!sC6R* G.
It’s not /I76 the .a"ia5 it I$ a .a"ia r!nning
these operations#
7arim 8i9a:i5 C6O o" Un0eillance
1'3 o" digital crime may no originate in
some "orm o" organised acti0ity#
7enny .c7en:ie5 8ead o" /a 6n"orcement
at %A6 $ystems ;etica
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
20
)he European Convention on Cybercrime (“B/-a5est
Con:entionB$ 231PI12001> -efines c26ercrime in !rtic.es 2#10
on s/6stanti:e crimina. .a; in fo/r -ifferent categories3
1> offences against the confi-entia.it2$ integrit2 an-
a:ai.a6i.it2 =CI!> of com5/ter -ata an- s2stemsQ
2> com5/ter#re.ate- offencesQ
3> content#re.ate- offencesQ
F> offences re.ate- to infringements of co52right an-
re.ate- rights1
International e""ort: Co6 Con0ention
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
21
8ac<ers or###cybercriminals=
/o le0el hac<ers >script)<iddies?

Phishing$ Remote .o;#.e:e. socia. engineering attacAs

Insi-ers

(isgr/nt.e- Em5.o2ees
8igh)le0el5 sophisticated hac<ers5organi:ed crime)
medi!m/high le0el

*o662st *acAers

Unethica. sec/rit2 g/2s =)e.ecom Ita.ia an- Do-afone +reece
Scan-a.s>

Str/ct/re-,Unstr/ct/re- !ttacAs
Ind!stial 6spionage)*errorism

Foreign Es5ionage

*acAti:ists

)errorist +ro/5s

State S5onsore- !ttacAs
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
22
/st a fe; 2ears ago$ most hacAers either acte- for the saAe
of c/riosit2$ for the g.or2 of s5rea-ing a :ir/s the2E- ;ritten$
or han-.e- a.. as5ects of an o5eration from 5hishing to
6/i.-ing faAe ;e6sites to cashing in on the fra/-1
Since then$ c26ercrimina.s ha:e
-isco:ere- !-am Smith1
)he2 s5ecia.i<e$ the2 create
marAets an- a6o:e a..$ the2Ere
entre5rene/ria.1 !n- 6eca/se of
the Internet$ 2o/ get ra-ica.
-istri6/tion of .a6or an- a ra-ica..2
fast a6i.it2 to recr/it sAi..s1
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te B!E S2stems (etica3 Organise-
Crime in the (igita. !ge
23
O activities shifts

Origina. !cti:it2
'oca. n/m6ers gam6.ing
*eroin$ cocaine trafficAing
Street 5rostit/tion
E4tortion of .oca. 6/sinesses
for 5rotection
'oansharAing
Fencing sto.en 5ro5ert2
C/rrent Dersion
Off shore income stream an-
e4tortion -irecte- against
e4isting gam6.ing sites
Internet access to co/nterfeite-
5rescri5tion -r/gs,i..ega.
-r/gs
On.ine 5ornogra5h2 em5ires,
escort sites 6acAe- 62 h/man
trafficAing gro/5s
E4tortion of cor5orations$
Ai-na55ings1
Mone2 .a/n-ering$ 5recio/s
stones$ commo-ities1
)heft of inte..ect/a. 5ro5ert21
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
24
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
24
Why has cybercrime become so per0asi0e=
11 E4treme.2 5rofita6.e1
21 Der2 .o; infrastr/ct/re cost an- rea-i.2 a:ai.a6.e attacA too.s1
31 It hi-es /n-er the c.oaA of anon2mit2$ ;hich is in t/rn 5rocte-
62 man2 go:ernments across the g.o6e1
F1 !s it 6ecomes a more 5rofita6.e in-/str2 it is attracting an
increasing n/m6er of in-i:i-/a.s1
H1 Se5aration 6et;een the 5h2sica. an- :irt/a. ;or.-1
K1 *acAing 5rRt#S#5orter1
I1 Organi<e- c26ercrime gro/5s can con-/ct o5erations ;itho/t
e:er maAing 5h2sica. contact ;ith each other11
C26ercrime -/ring the Recession

C26ercrimina. Tcommo-it2U marAets s/ch
as s/ch as the tra-e of narcortics$
5rostit/tion an- co/nterfeit goo-s ha:e
6een retreating1

In their 5.ace the fra/-$ es5ionage$ an-
.oan sharAing marAets ha:e seen a stea-2
/5rise1

*igh rates of /nem5.o2ment maAe it eas2
for crimina. organisations to recr/it 2o/ng
mastermin-s
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
26
6@ample: 8ac<er0ille in Romania

RVmnic/ DV.cea =Romania> has on.2 a6o/t 120$000 resi-ents$
6/t among .a; enforcement e45erts aro/n- the ;or.-$ it has a
nicAname3 *acAer:i..e1

Internet scammers an- their /n-er.ings ha:e t/rne- it into a
h/6 of internationa. organi<e- crime1 It has 6ecome the
Si.icon Da..e2 of on.ine thie:er21

'ast /.2$ .oca. .a; enforcement$ a.ong ;ith re5resentati:es of
the FBI$ organi<e- a rai- that .e- to 5rison 23 hacAers$
acc/se- of ha:ing mocAe- a tho/san- !mericans for a tota. of
L20 mi..ion1
“But here what else can you do? There is no work. The
government speaks only of crisis and reduction of salaries.
am !" and during #niversity have done nothing but sacrifice$
+eorge$ a citi<en of T*acAer:i..eU1
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
27
Recap

Part 1
0
&ho I am1
0
&hat organise- crime is1
0
&h2 I am here1
0
Internet3 (ata$ )ren-s$ Biases$ (efinitions
0
E45ansion of C26er Crime

Aart &
0
*he Internet and its e""ect on the str!ct!re
o" Organised Crime#
0
*he Undergro!nd 6conomy#
0
Who are the Criminals= $ome case st!dies#
)he &or.- &i-e &e6 an- the
Str/ct/re of Organise- Crime

)he e45ansion of the internet as a form
of comm/nication has ha- t;o
contrasting im5acts on the str/ct/re of
Organise- Crimina. acti:it23
11 It has reinforce- the tra-itiona. c.an Ain-hsi5
ties
21 It has a..o;e- for the formation of more f./i-
forms of crimina. gro/5s
(# $trenghtening *raditional Clans

Socia. Net;orAing offers the 5ossi6i.it23
0
to connect ;ith Tfami.2U an- Tfrien-sU =eg1Nino
S5agn/o.o>
0
to threaten ri:a.s 5/6.ic.2 thro/gh co-e-
messages =eg1)ommaso Bonfar-eci>
0
to maintain ties ;ith the .oca. comm/nities
=eg1 62 -istri6/ting .oca. ra5 songs or
managing the .oca. foot6a.. team>
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
30
&# *he creation o" more "l!id
Organi:ed ;igital Crime)Gro!ps BO;CsC
a> +ro/5 si<e an- -/ration of acti:ities
6> (emogra5hic characteristics an-
geogra5hica. .ocation
c> )25es of acti:ities
So/rce3 Mc+/ire 2012
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
31
aC Gro!p si:e and d!ration o" acti0ities
(igita. en:ironments a/gmente- the e4isting
:arieties of crimina. organi<ations1

M/ch more resi.ient

Sma.. gro/5s can engage in major crimina.
o5erations

'ength of time in co#or-inating acti:ities -oes not
corre.ate ;ith the .ength of association 6et;een
gro/5 mem6ers =i1e1 minor o5erations 6ring high
5rofitsQ transitor2 associations 6ring major re;ar-s>
Most common organi<ationa. 5attern is of
associations 6et;een 3#10 in-i:i-/a.s ;ho o5erate
together for 1 2ear1
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
32
bC ;emographic characteristics D geographical
location

2K#3H 2ear o.-s ha:e 6ecome increasing.2
in:o.:e- in serio/s -igita. crimina. acti:it21

More com5/ter .iterate societ2  m/ch
;i-er 5oo. of in-i:i-/a.s1

(igita. organi<e- crime -ea.s ;ith
g.oca.i<ation (think globally and act locally>
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
33
cC *ypes o" acti0ities

3 .e:e.s of -igita. crime acti:it23 a> c.ose circ.es
of associate- frien-s$ fami.2 an- co..eag/esQ 6>
.oca. neigh6o/rhoo-s an- regionsQ c> g.o6a.
transnationa. mo-a.ities =i1e1 US$ Far East$
&est !frica>1

3 6roa- areas of acti:it23 offen-ing itse.f$
comm/nication an- inte..igence re.ate- acti:it21

Main IC)s too.s /se- are3 USB sticAs$ mo6i.e
5hones$ P2P$ 5ro42 ser:ers$ encr25tion$ DOiP$
SA25e$ &EP Ae2s1
E4am5.e3 C26er Crime an- */man
)rafficAing

Organise- crimina. gro/5s /se s5am$ 5o5#/5s an- socia.
net;orA sites to recr/it their :ictims1

)he s5ammer is often 5ai- on commission$ he ;i..
genera..2 Aee5 F0J of his sa.es1

@Craigs.ist is the sing.e .argest s/orce of 5rostit/tion in
the nation111missing chi.-ren$ r/na;a2s$ a6/se- ;omen
an- ;omen trafficAe- in from foreign co/ntries are
ro/tine.2 force- to ha:e se4 ;ith strangers 6eca/se the2
are 5im5e- o/t on Craigs.istB# )homas 1 (art$ Sheriff of
CooA Co/nt2$ I'1
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
35
Organi:ed crime typologies in cyberspace

*ype A3 acti:ities -irecte- to;ar-s -igita.
en:ironment

*ype %3 acti:ities ;hich s;itch 6et;een an-
across on an- off.ine conte4ts

*ype C3 acti:ities 5re-ominant.2 centre- on
off.ine crimina. 5rojects 6/t ;hich increasing.2
intersect thro/gh -igita. en:ironments1
So/rce3 Mc+/ire 2012
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
36
Organi:ation: e@amples

*ype I: $arms:
Online)
centric/disassocia
ted str!ct!res


*ype II: Cl!stered
8ybrids )
On/O""line
centric)
associated

*ype III:
Aggregates
So/rce3 Mc+/ire 2012
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
37
Organi:ation: "!rther e@amples

*ype I+: 8!bs:
Online)
centric/associated


*ype +: 6@tended
8ybrids

*ype +I:
8ierarchies
So/rce3 Mc+/ire 2012
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
38
Organi:ed cybercrime scheme
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
39
;igital !ndergro!nd economy
@In -igita. /n-ergro/n- econom2
-ata is the i..icit commo-it2 an-
has a monetar2 :a./e1 Sto.en
5ersona. an- financia. information
is retai.e- in this marAet1 )his
-ri:es a range of ne; crimina.
acti:ities$ s/ch as 5hishing$
5harming$ ma.;are -istri6/tion
an- the hacAing of cor5orate
-ata6ases a6.e to .ease net;orAs
of man2 tho/san-s of
com5romise- com5/ters =6otnets>
to carr2 o/t a/to#mate- attacAs1B
=OC)! 20113 51FK>
$hopping /ist
9
“%%o& bot 'ibot() price* #&+,-.(for
the first - customers/$
9
“%arkness (0ptima/ %%o& bot 1TT23
C42 (ping/3 trash3 &567.. threads
price8pack* #&+,-.3 updates*#&+9-3
rebuild*#&+,-$
$il< road: the Undergro!nd Website
Where Eo! Can %!y Any ;r!g Imaginable

)hro/gh a com6ination of anon2mit2
techno.og2 an- a so5histicate- /ser#fee-6acA
s2stem$ Si.A Roa- maAes 6/2ing an- se..ing
i..ega. -r/gs as eas2 as 6/2ing /se-
e.ectronics1

Sma.. se.ection of the 3F0 items a:ai.a6.e for
5/rchase on Si.A Roa- 62 an2one$ right no;3
a gram of !fghani hashQ 1,Gth o/nce of Wso/r
13W ;ee-Q 1F grams of ecstas2Q 1 grams tar
heroin1 =htt53,,ga;Aer1com,HG0K1G3,the#/n-ergro/n-#;e6site#
;here#2o/#can#6/2#an2#-r/g#imagina6.e5hotos,>
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
41
$il< road pict!res
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
42
Case $t!dies:

Organise- c26ercrime as a financia.
enter5rise3
0
Inno:ati:e MarAet UAraine
0
)he R/ssian B/siness Net;orA
0
)he Car-ing O5eration
0
)he Ita.ian Post Office Case
0
Coo6face
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
44
9
Forme- aro/n- 20021
9
200G3 re:en/e estimate- at L1G0 mi..ion1
9
Estimate- to em5.o2 200#H00 staff =*R$ ca.. center
o5erators to -iss/a-e :ictims an- a:oi- cre-it
com5.aints$ ma.;are X scare;are -e:e.o5ers$ etcO> in
UAraine$ In-ia$ an- the Unite- States1
9
Crimina. acti:ities3 Scare;are =or @Ransom;areB$ meant
to frighten /sers into 5ro:i-ing their cre-it car- -ata in
or-er not to .ose their -ata>$ !-;are$ Cre-it Car- Fra/-
=Rese..ing of the cre-it car-s @c/stomersB ;ere
ransome- into 5ro:i-ing to IMU>1 Ear.2 acti:ities inc./-e-
the se..ing of 5irate- me-ia =m/sic$ 5ornogra5h2> an-
soft;are as ;e.. as 5harmace/tica.s s/ch as Diagra1
Case $t!dy:
Inno0ati0e .ar<eting U<raine
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
45
Aroceedings

20103 F1)1C1 5ers/a-es a U1S1 fe-era. j/-ge to
fine IMU an- t;o associate- in-i:i-/a.s L1K3
mi..ion US(1

Fina. or-er =2011>3
htt53,,;;;1ftc1go:,os,case.ist,0I2313I,in-e41shtm

'inAe-in 5rofi.e3
htt53,,;;;1.inAe-in1com,com5an2,inno:ati:e#
marAeting#/Araine =accesse- Ith Ma2 2012>1
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
46
9
(omain names registere- in 200K1
9
200K#200I re:en/e estimate- at L1H0 mi..ion1
9
Base- in St#Peters6/rg =RU>1 O5erate- as a host or
Internet Ser:ice Pro:i-er for i..icit ser:ices s/ch as
chi.- 5ornogra5h2$ ma.;are -istri6/tion$ etcO
9
Crimina. acti:ities3 S5am =estimate- to ha:e 6een
acti:e.2 in:o.:e- ;ith /5 to H0J of ;or.-;i-e s5am
-istri6/tion at their height>$ ma.;are$ 5hishing scams
=estimate- to ha:e 6een 6ehin- /5 to H0J of 5hishing
s5ams thro/gho/t 200I>$ a.. the ;hi.e 5ro:i-ing
hosting ser:ices for other crimina. acti:ities s/ch as
the -issemination of chi.- 5ornogra5h2$ i-entit2 theft$
cre-it car- fra/-$ etc111
Case $t!dy:
R!ssian %!siness Netor<
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
47
RBN
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
48 Y 200G Craig ! Schi..er
R%N Operations
$er0ices: Some e4terna. ser:ices are
/se- 62 RBN an- affi.iates1 )hose
ser:ices can 6e MP re.a2 or NS hosting1
R%N: )his is the core 6/siness of RBN1 It
is /se- to offer *osting for c26ercrime1
Insi-e this 5art$ ;e can i-entif2 the -irect
s/6si-iaries from RBN3 Ne:acon an-
!Aimon1
8osting: )his is the 5art /se- to host
most of RBN 5/6.ic ;e6sites$ to register
RBN -omain namesO *osting an-
registration is a rea..2 strong 5artner for
RBN1 Inci-enta..2$ it co/.- 6e 5ossi6.e that
those t;o 6.ocAs are /n-er the same
com5an21
*elecom: )his is the entit2 ;hich aims at
5ro:i-ing the Internet access1 It seems
that SB)e. has o6taine- from Si.:ernet to
access Saint Peters6/rg Internet
E4change Point =SPBIP>1
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
49
Aroceedings
!..ege- to ha:e -is5erse- =6/t not s/s5en-e-> its
acti:ities as of (ecem6er 2011$ -/e to increasing
attention from internationa. sec/rit2 :en-ors$ me-ia$
an- .a; enforcement1

In 2011 Estonian a/thorities arreste- si4 men$
inc./-ing D.a-imir )sastsin$ 31$ the o;ner of se:era.
Internet com5anies that ha:e 6een c.ose.2
associate- ;ith the ma.;are comm/nit2 for man2
2ears1 )sastsin 5re:io/s.2 hea-e- Est(omains Inc1 a
-omain name registrar that han-.e- the registrations
for tens of tho/san-s of -omains associate- ;ith the
far#f./ng R/ssian B/siness Net;orA1
Case St/-23 TCar-ingU O5eration

FBI esta6.ishe- an /n-ergro/n- car-ing for/m
ca..e- TCar-er ProfitU

*ere 5eo5.e e4change- sto.en i-entities$ cre-it#
car- information an- har-;are to maAe faAe
cre-it,-e6it car-s1 )here ;ere a.so se:era. /sers
se..ing R!)s to access an- acti:ate ;e6cams$
infi.trate 6anA an- com5an2 s2stems an- access
5ersona. acco/nts1

)he o5eration in:o.:e- 13 co/ntries$ .ea- to a
tota. of 2F arrests an- -/ring its co/rse sa:e- US
L 20H MI''ION from fa..ing into the fra/-stersU
han-s1
!efendant "esidence #ge
harges and $a%imum
&enalties
Christian Cangeo5o.$
a,A,a @F0Fm2thB
'a;rence:i..e$
+eorgia
(F
Cons5irac2 to commit access
-e:ice fra/- =I1H 2ears in 5rison>
MarA Ca5are..i$
a,A,a @C/662B
San (iego$
Ca.ifornia
&'
&ire fra/- =20 2ears in 5rison>
!ccess -e:ice fra/- =10 2ears in
5rison >
Ste:en *ansen$ a,A,a
@the6oner1B
Cent/cA2 =in 5rison
in &isconsin>
&2
Fra/- in connection ;ith
i-entification information =H 2ears
in 5rison>
Sean *ar5er$ a,A,a
@Ca6ra4is31FB
!.6/Z/erZ/e$ Ne;
Me4ico
&2
Cons5irac2 to commit access
-e:ice fra/- =I1H 2ears in 5rison>
!.i *assan$ a,A,a @Mr
Ba-oo$B
Mi.an$ Italy &&
Cons5irac2 to commit ;ire fra/- =20 2ears in
5rison>
Cons5irac2 to commit access -e:ice fra/-$
;ith o6ject of 5ossession 1H or more access
-e:ices =Fi:e 2ears in 5rison>
!ggra:ate- i-entit2 theft =);o 2ears
man-ator2 consec/ti:e in 5rison>
!.e4 *ata.a$ a,A,a
@Aoo.[AaAeB
acAson:i..e$
F.ori-a
(F
Fra/- in connection ;ith i-entification
information =Fi:e 2ears in 5rison>
osh/a *icAs$ a,A,a
@O4i-e(o4B
Bron4$ Ne;
"orA
(F
!ccess -e:ice fra/- =10 2ears in 5rison>
Michae. *og/e$ a,A,a
@4Discera.B
)/cson$
!ri<ona
&(
Cons5irac2 to commit com5/ter hacAing =10
2ears in 5rison>
(istri6/tion of ma.;are =10 2ears in 5rison>
'ee ason /esheng$ a,A,a
@i!.ert$B
)oA2o$ Gapan
&2 !ccess -e:ice fra/- =10 2ears in 5rison>
Peter Cetch/m$ r1$ a,A,a
@i;earaM!+NUMB
Pittsfie.-$
Massach/setts
&(
Cons5irac2 to commit access -e:ice
fra/- =I1H 2ears in 5rison>
aran- Moen Romt:eit$
a,A,a @<er0$B a,A,a @<er0iZB
Porsgr/nn$
Noray
&,
!ccess -e:ice fra/- =5ossession 1H
/na/thori<e- -e:ices> =10 2ears in 5rison>
!ccess -e:ice fra/- =affecting transactions ;ith
/na/thori<e- -e:ices> =1H 2ears in 5rison>
!ggra:ate- i-entit2 theft =);o 2ears
man-ator2$ consec/ti:e in 5rison>
Mir Is.am$ a,A,a
@osh)he+o-B
Bron4$ Ne;
"orA
(1
!ccess -e:ice fra/- =10 2ears in 5rison>
!ccess -e:ice fra/- =affecting transactions ;ith
/na/thori<e- -e:ices> =1H 2ears in 5rison>
Case St/-23 )he Ita.ian Post Office

In 2012 the Ita.ian State Po.ice in !ssociation ;ith )he Fra/-
Management S2stem of Poste Ita.iane =)he Ita.ian Post Office>
-etecte- a cre-it fra/- organisation that ha- ro66e- o:er K00
5eo5.e of a55ro4imate.2 M 2 Mi..ion1

)he gro/5 streche- across Ita.2$ Romania an- the Unite- Cing-om1

)he fra/- o5erate- in three 5hases3
11 Phishers create- ;e6sites ;here :ictims ;ere ./re- into
5ro:i-ing their car- an- emai. -etai.s =the site ;orAe- ;ith Post
Office -e6it car-s CartaS\>1
21 )he recr/iters ;o/.- hire thir- 5art2 in-i:i-/a.s to create faAe
-e6it car-s =CartaS\ Car-s> onto ;hich the -etai.s of the :ictims
acco/nt ;o/.- 6e transferre-1
31 Mem6ers of the gro/5 ;o/.- /se the faAe car-s on on.ine
gam6.ing sites the2 create-$ so to -is5erse the sto.en assets1
Procee-ings

)he mem6ers of the organisation ha:e
6een charge- ;ith3
0
!ggra:ate- Crimina. Cons5irac2# !ggra:ate-
62 the Internationa. O5erations
0
Serio/s Cre-it Fra/-
0
B.acAmai.
0
)heft
0
!ccess (e:ice Fra/-
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
55
Case $t!dy: 7oob"ace

Coo6face is a m/.ti#5.atform com5/ter ;orm
that origina..2 targete- /sers of the socia.
net;oring ;e6sites Face6ooA$ M2Sace$ hiH$
Be6o Frien-ster an- );itter1

)he gang ;o/.- ./re its :ictims thro/gh Tse42U
:i-eos1 If one c.icAe-$ he,she ;as asAe- to
/5-ate their F.ashP.a2er an- -irecte- to a
-o;n.oa- 5age1 In rea.it2 the :ictim ;o/.-
-o;n.oa- the Coo6face ma.;are1 )he
ma.;are sent constant =faAe> anti#:ir/s a--s$
the gang ;o/.- 5rofit from /na;are 6/2ers
an- /ns/s5ecting a-:ertisers1
Procee-ings

Face6ooA fina..2 re:ea.e- the names of of
the s/5ects 6ehin- the ;orm in an/ar2
1I 20123 the gro/5 is sometimes referre-
to as !.i Ba6a X Fth Stanis.a: !:-e2Ao as
their .ea-er1
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
57

HU6$*ION$=
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
58
01,22,13
Unite- Nations Interregiona. Crime an- /stice Research Instit/te
58
.s# Francesca %osco
Aro9ect O""icer on
Cybercrime
6merging Crimes Unit
UNICRI
6)mail: boscoI!nicri#it
*han< yo! "or yo!r attention
#!nicri#it
http://!nicri#it/emergingJcrimes/cybercrime/