Cyber police stymied by hackers’ anonymity
Published 5:00 am Wednesday, June 8, 2011
- Sony Corp., targeted since April by hacker attacks that have compromised more than 100 million customer accounts, is investigating two new possible intrusions.
WASHINGTON — Hardly a month has gone by this year without a multinational company such as Google, EMC Corp. or Sony disclosing it’s been hacked by cyber intruders who infiltrated networks or stole customer information. Yet no hacker has been publicly identified, charged or arrested.
If past enforcement efforts are an indication, most of the perpetrators will never be prosecuted or punished.
“I don’t have a high level of confidence that they will be brought to justice,” said Peter George, chief executive of Fidelis Security Systems Inc., a data protection consulting firm whose clients include IBM, the U.S. Army and the Department of Commerce. “The government is doing what they can, but they need to do a lot more.”
In the United States, the FBI, the Secret Service and other law enforcement agencies are confronting a massive crime wave that’s highly organized and hard to combat with traditional methods. The hacker organizations are well-funded and global, eluding arrest except in the rarest of cases.
Attacks are coming from organized crime groups based in Eastern Europe and Russia, from industrial spies in China and from groups such as LulzSec, whose members appear to reside mostly in the U.S. and Europe and seem more interested in publicity than in making a profit from their crimes.
LulzSec took credit for hacking into Nintendo’s computers, an intrusion the Kyoto, Japan-based company disclosed Sunday, describing it as unsuccessful. Last week it was Google, which revealed an attempted hack, originating in China, into the Gmail accounts of U.S. government officials, military personnel and journalists. Days before that, it was military contractor Lockheed Martin, which said its network had been penetrated by an unknown intruder.
LulzSec said Friday it also had attacked the Atlanta chapter of InfraGard, an information-sharing organization of companies that is affiliated with the FBI to thwart cyber crime.
“We are facing a very innovative crime, and innovation has to be the response,” Gordon Snow, FBI assistant director of the cyber division, said in an interview at the agency’s Washington headquarters before news of the InfraGard breach broke. “Given enough money, time and resources, an adversary will be able to access any system. Companies need to understand that.”
Pablo Martinez, who heads up cybercrime efforts at the Secret Service, compared the current challenge to early efforts the U.S. made to combat drug cartels in the 1980s.
“What the Secret Service has to do is take the successful model that we introduced in South America to defeat some of that stuff and incorporate it in what we do in cyber,” he said.
That would require substantial international law enforcement cooperation and intelligence sharing, said Martinez, whose agency has jurisdiction over bank cyber crime.
In the meantime, the attacks are taking a rising toll on companies and even government agencies, raising concerns about whether the FBI and other enforcement units can handle what appears to be an increasing surge of cyber-criminal conduct, dating back almost two years.
“These are turning points we’re witnessing,” said Anup Ghosh, founder of the Fairfax, Va.-based cyber security firm Invincea Inc. and a former Pentagon cyber scientist. “What you’re seeing is the loss of the U.S.’s competitive position on a global scale,” he said.
Law enforcement is hampered by the borderless nature of the Internet and by sophisticated methods used by attackers, cyber experts said.
“If you are looking at the Google systems that are being hacked from a country like China, there is no ability to track those activities back to individuals,” said Nicholas Percoco, head of Trustwave Corp.’s SpiderLabs.
A spokesman for China’s foreign ministry said Thursday that blaming the country for the hacking of Google customer accounts is “unacceptable” and added that the Chinese government disapproves of and punishes Internet hacking.
“I can go into a Starbucks in Chicago, break into a system in Bulgaria, and use that system to launch an attack on Google so that it looks like it’s coming from there,” Percoco said.
Attackers deliberately base their operations in countries that provide limited law enforcement cooperation with the U.S. or where long-standing relationships between agencies don’t exist. Prominent examples include Ukraine, Romania, Russia and China, U.S. officials said.
“I can talk to the Ukraine all day and even identify who is responsible, but that doesn’t mean they are going to jail,” said E.J. Hilbert, a former FBI cyber investigator who is president of the New York City-based cyber-security firm Online Intelligence.
The Justice Department, FBI and Secret Service say they have allocated more resources to the fight against cyber crime. Each can point to some successes. Last fall, the Justice Department announced the arrest of 39 individuals in Operation Trident Breach, a takedown of a $70 million international bank-fraud ring that used computer worms to steal account information.
U.S. agents only arrested the so-called money mules responsible for setting up bogus bank accounts designed to move stolen money abroad. They weren’t able to detain any of the kingpins they believed had organized the crime spree from the safety of Eastern Europe.
One of the most successful U.S. prosecutions followed the indictment of Albert Gonzalez in August 2009 on charges related to the theft of 130 million credit card numbers from Heartland Payment Systems Inc., the Princeton, N.J.-based payment processor. Gonzalez, a Miami resident who worked as a federal informant and admitted that he led an international right, was later sentenced to 15 to 25 years in prison. Other members of his gang, believed to be located in Russia or Eastern Europe, haven’t been charged in the case, U.S. officials said.
Snow cited the recent Justice Department dismantling of the Coreflood botnet, a network of more than 2 million infected computers that was used by Russian cyber thieves to steal financial information. The operation was the first time U.S. authorities had targeted command-and-control servers used to direct such botnets. Snow said it showed law enforcement is now taking some innovative approaches.
“I don’t think it’s right to conclude that because there are not a lot of arrests that law enforcement is not doing its job,” he said.