Computer fraud case studies
Encyclopedia
Computer fraud is the use of information technology
to commit fraud
. In the United States, computer fraud is specifically proscribed by the Computer Fraud and Abuse Act
, which provides for jail time and fines.
Abdulswamad
Jessica Quitugua Sabatia, a former accounts payable clerk for North Bay Health Care Group, admitted to using her computer to access North Bay’s accounting software without authorization, and in turn issued various checks payable to herself and others. Several of the checks were cashed by Sabatia or deposited into her personal bank account, and some were deposited into the bank accounts of others. She attempted to conceal the fraud by altering the electronic check registers of North Bay to make it appear as if the checks had been payable to the company’s vendors. The fraudulent scheme resulted in losses to North Bay of at least $875,035.
On May 27, 2004, Sabatia, plead guilty to two counts of computer fraud, and faces a maximum sentence of five years in prison and a $250,000 fine
Denial of Service Attack
On January 19, 2001, Dennis was sentenced to six months incarceration; three months in jail and three months of home confinement, followed by one year of supervised release. Additionally, he must allow authorities to monitor his computer activity, and perform 240 hours of community service.
Malicious Systems Admin at UBS
A disgruntled computer systems administrator for UBS PaineWebber was charged with using a "logic bomb" to cause more than $3 million in damage to the company's computer network, and with securities fraud for his failed plan to drive down the company's stock with activation of the logic bomb. Roger Duronio is charged in one count of securities fraud which carries a maximum penalty of 10 years in federal prison and a $1 million fine and one charge of computer fraud which carries a maximum prison sentence of 10 years and a fine of $250,000 or, alternatively, two times the gain made by the defendant or the loss suffered by the victim.
Duronio, who worked at PaineWebber's offices in Weehawken, N.J., planted the logic bomb in some 1,000 of PaineWebber's approximately 1,500 networked computers in branch offices around the country. The logic bomb, which was activated after Durino resigned, deleted files on over 1,000 of UBS PaineWebber's computers. It cost PaineWebber more than $3 million to assess and repair the damage. Duronio also purchased more than $21,000 of "put option" contracts for UBS PaineWebber's parent company, UBS, A.G.'s stock, hoping that the stock would decline in response to the damage caused by the logic bomb. The bomb attack did not have any impact on the price of the stock.
The investigation of Duronio was conducted by the U.S. Secret Service’s Electronic Crimes Task Force with help from UBS PaineWebber.
Robert Duronio
Illegal Data Mining
The owner of Snipermail, a business that distributes advertisements via the Internet to e-mail addresses on behalf of advertisers or their brokers was indicted for conspiracy, unauthorized access of a protected computer, access device fraud, money laundering and obstruction of justice.
It was alleged that Scott Levine and other Snipermail employees illegally accessed a computer database owned and operated by Acxiom Corporation, a company that stores, processes, and manages personal, financial, and corporate data on behalf of its clients. On numerous occasions, Levine and others illegally entered into an Acxiom file transfer protocol (ftp) server and downloaded significant amounts of data. The intrusions were traced back to an internet protocol address that belonged to one of Snipermail’s computers. The downloading of the databases lasted for period of a year and a half and represented 8.2 gigabytes of data. While the stolen data contained personal information about a great number of individuals and could have resulted in tremendous loss if the information were used in a fraudulent way, there was no evidence to date that any of the data was misused in this way.
Acxiom, immediately notified law enforcement upon discovery of intrusions into its system and assisted with the investigation which was conducted by a task force formed the Federal Bureau of Investigation
(FBI) and the United States Secret Service
(USSS).
Scott Levine
The Melissa Worm
David L. Smith, a 31-year old New Jersey
programmer was accused of unleashing the “Melissa
” computer virus, a Visual Basic for Applications
based worm. This virus was propagated by deliberately posting an infected document to an alt.sex usenet newsgroup from a stolen AOL
account. It is believed that Smith named the virus after a stripper he had known in Florida
. He constructed the virus to evade anti-virus software and to infect computers using Microsoft Windows
and Word
programs. The Melissa virus appeared on thousands of email systems on March 26, 1999, disguised as an important message from a colleague or friend. The virus was designed to send an infected email to the first 50 email addresses on the users’ Microsoft Outlook
address book. Each infected computer would infect 50 additional computers, which in turn would infect another 50 computers. The virus proliferated rapidly and exponentially, resulting in substantial interruption and impairment of public communications and services. Many system administrators had to disconnect their computer system from the internet. Companies such as Microsoft
, Intel, Lockheed Martin
and Lucent Technologies
were forced to shut down their e-mail gateways due to the vast amount of email the virus was generating. To date, the Melissa virus is the most costly outbreak, causing more than $400 million in damages to North America
n businesses.
Smith was one of the first persons ever to be prosecuted for writing a virus. He was sentenced to 20 months in federal prison and a fine of $5,000. He was also ordered to serve three years of supervised release after completion of his prison sentence.
The investigation was conducted by members of the New Jersey
State Police High Technology Crime Unit, the Federal Bureau of Investigation
(FBI), the Justice Department’s Computer Crime and Intellectual Property Section, and the Defense Criminal Investigative service.
Once the fraud was discovered, an audit was performed and the report is available at Summerford audit report.
Information technology
Information technology is the acquisition, processing, storage and dissemination of vocal, pictorial, textual and numerical information by a microelectronics-based combination of computing and telecommunications...
to commit fraud
Fraud
In criminal law, a fraud is an intentional deception made for personal gain or to damage another individual; the related adjective is fraudulent. The specific legal definition varies by legal jurisdiction. Fraud is a crime, and also a civil law violation...
. In the United States, computer fraud is specifically proscribed by the Computer Fraud and Abuse Act
Computer Fraud and Abuse Act
The Computer Fraud and Abuse Act is a law passed by the United States Congress in 1986, intended to reduce cracking of computer systems and to address federal computer-related offenses...
, which provides for jail time and fines.
Notable incidents
Unauthorized access at North BayAbdulswamad
Jessica Quitugua Sabatia, a former accounts payable clerk for North Bay Health Care Group, admitted to using her computer to access North Bay’s accounting software without authorization, and in turn issued various checks payable to herself and others. Several of the checks were cashed by Sabatia or deposited into her personal bank account, and some were deposited into the bank accounts of others. She attempted to conceal the fraud by altering the electronic check registers of North Bay to make it appear as if the checks had been payable to the company’s vendors. The fraudulent scheme resulted in losses to North Bay of at least $875,035.
On May 27, 2004, Sabatia, plead guilty to two counts of computer fraud, and faces a maximum sentence of five years in prison and a $250,000 fine
Denial of Service Attack
On January 19, 2001, Dennis was sentenced to six months incarceration; three months in jail and three months of home confinement, followed by one year of supervised release. Additionally, he must allow authorities to monitor his computer activity, and perform 240 hours of community service.
Malicious Systems Admin at UBS
A disgruntled computer systems administrator for UBS PaineWebber was charged with using a "logic bomb" to cause more than $3 million in damage to the company's computer network, and with securities fraud for his failed plan to drive down the company's stock with activation of the logic bomb. Roger Duronio is charged in one count of securities fraud which carries a maximum penalty of 10 years in federal prison and a $1 million fine and one charge of computer fraud which carries a maximum prison sentence of 10 years and a fine of $250,000 or, alternatively, two times the gain made by the defendant or the loss suffered by the victim.
Duronio, who worked at PaineWebber's offices in Weehawken, N.J., planted the logic bomb in some 1,000 of PaineWebber's approximately 1,500 networked computers in branch offices around the country. The logic bomb, which was activated after Durino resigned, deleted files on over 1,000 of UBS PaineWebber's computers. It cost PaineWebber more than $3 million to assess and repair the damage. Duronio also purchased more than $21,000 of "put option" contracts for UBS PaineWebber's parent company, UBS, A.G.'s stock, hoping that the stock would decline in response to the damage caused by the logic bomb. The bomb attack did not have any impact on the price of the stock.
The investigation of Duronio was conducted by the U.S. Secret Service’s Electronic Crimes Task Force with help from UBS PaineWebber.
Robert Duronio
Illegal Data Mining
The owner of Snipermail, a business that distributes advertisements via the Internet to e-mail addresses on behalf of advertisers or their brokers was indicted for conspiracy, unauthorized access of a protected computer, access device fraud, money laundering and obstruction of justice.
It was alleged that Scott Levine and other Snipermail employees illegally accessed a computer database owned and operated by Acxiom Corporation, a company that stores, processes, and manages personal, financial, and corporate data on behalf of its clients. On numerous occasions, Levine and others illegally entered into an Acxiom file transfer protocol (ftp) server and downloaded significant amounts of data. The intrusions were traced back to an internet protocol address that belonged to one of Snipermail’s computers. The downloading of the databases lasted for period of a year and a half and represented 8.2 gigabytes of data. While the stolen data contained personal information about a great number of individuals and could have resulted in tremendous loss if the information were used in a fraudulent way, there was no evidence to date that any of the data was misused in this way.
Acxiom, immediately notified law enforcement upon discovery of intrusions into its system and assisted with the investigation which was conducted by a task force formed the Federal Bureau of Investigation
Federal Bureau of Investigation
The Federal Bureau of Investigation is an agency of the United States Department of Justice that serves as both a federal criminal investigative body and an internal intelligence agency . The FBI has investigative jurisdiction over violations of more than 200 categories of federal crime...
(FBI) and the United States Secret Service
United States Secret Service
The United States Secret Service is a United States federal law enforcement agency that is part of the United States Department of Homeland Security. The sworn members are divided among the Special Agents and the Uniformed Division. Until March 1, 2003, the Service was part of the United States...
(USSS).
Scott Levine
The Melissa Worm
David L. Smith, a 31-year old New Jersey
New Jersey
New Jersey is a state in the Northeastern and Middle Atlantic regions of the United States. , its population was 8,791,894. It is bordered on the north and east by the state of New York, on the southeast and south by the Atlantic Ocean, on the west by Pennsylvania and on the southwest by Delaware...
programmer was accused of unleashing the “Melissa
Melissa
Melissa is a given name for a female child. The name comes from the Greek word μέλισσα , "honey bee" and from μέλι , "honey". Compare Hittite melit, "honey"....
” computer virus, a Visual Basic for Applications
Visual Basic for Applications
Visual Basic for Applications is an implementation of Microsoft's event-driven programming language Visual Basic 6 and its associated integrated development environment , which are built into most Microsoft Office applications...
based worm. This virus was propagated by deliberately posting an infected document to an alt.sex usenet newsgroup from a stolen AOL
AOL
AOL Inc. is an American global Internet services and media company. AOL is headquartered at 770 Broadway in New York. Founded in 1983 as Control Video Corporation, it has franchised its services to companies in several nations around the world or set up international versions of its services...
account. It is believed that Smith named the virus after a stripper he had known in Florida
Florida
Florida is a state in the southeastern United States, located on the nation's Atlantic and Gulf coasts. It is bordered to the west by the Gulf of Mexico, to the north by Alabama and Georgia and to the east by the Atlantic Ocean. With a population of 18,801,310 as measured by the 2010 census, it...
. He constructed the virus to evade anti-virus software and to infect computers using Microsoft Windows
Microsoft Windows
Microsoft Windows is a series of operating systems produced by Microsoft.Microsoft introduced an operating environment named Windows on November 20, 1985 as an add-on to MS-DOS in response to the growing interest in graphical user interfaces . Microsoft Windows came to dominate the world's personal...
and Word
Word
In language, a word is the smallest free form that may be uttered in isolation with semantic or pragmatic content . This contrasts with a morpheme, which is the smallest unit of meaning but will not necessarily stand on its own...
programs. The Melissa virus appeared on thousands of email systems on March 26, 1999, disguised as an important message from a colleague or friend. The virus was designed to send an infected email to the first 50 email addresses on the users’ Microsoft Outlook
Microsoft Outlook
Microsoft Outlook is a personal information manager from Microsoft, available both as a separate application as well as a part of the Microsoft Office suite...
address book. Each infected computer would infect 50 additional computers, which in turn would infect another 50 computers. The virus proliferated rapidly and exponentially, resulting in substantial interruption and impairment of public communications and services. Many system administrators had to disconnect their computer system from the internet. Companies such as Microsoft
Microsoft
Microsoft Corporation is an American public multinational corporation headquartered in Redmond, Washington, USA that develops, manufactures, licenses, and supports a wide range of products and services predominantly related to computing through its various product divisions...
, Intel, Lockheed Martin
Lockheed Martin
Lockheed Martin is an American global aerospace, defense, security, and advanced technology company with worldwide interests. It was formed by the merger of Lockheed Corporation with Martin Marietta in March 1995. It is headquartered in Bethesda, Maryland, in the Washington Metropolitan Area....
and Lucent Technologies
Lucent Technologies
Alcatel-Lucent USA, Inc., originally Lucent Technologies, Inc. is a French-owned technology company composed of what was formerly AT&T Technologies, which included Western Electric and Bell Labs...
were forced to shut down their e-mail gateways due to the vast amount of email the virus was generating. To date, the Melissa virus is the most costly outbreak, causing more than $400 million in damages to North America
North America
North America is a continent wholly within the Northern Hemisphere and almost wholly within the Western Hemisphere. It is also considered a northern subcontinent of the Americas...
n businesses.
Smith was one of the first persons ever to be prosecuted for writing a virus. He was sentenced to 20 months in federal prison and a fine of $5,000. He was also ordered to serve three years of supervised release after completion of his prison sentence.
The investigation was conducted by members of the New Jersey
New Jersey
New Jersey is a state in the Northeastern and Middle Atlantic regions of the United States. , its population was 8,791,894. It is bordered on the north and east by the state of New York, on the southeast and south by the Atlantic Ocean, on the west by Pennsylvania and on the southwest by Delaware...
State Police High Technology Crime Unit, the Federal Bureau of Investigation
Federal Bureau of Investigation
The Federal Bureau of Investigation is an agency of the United States Department of Justice that serves as both a federal criminal investigative body and an internal intelligence agency . The FBI has investigative jurisdiction over violations of more than 200 categories of federal crime...
(FBI), the Justice Department’s Computer Crime and Intellectual Property Section, and the Defense Criminal Investigative service.
Once the fraud was discovered, an audit was performed and the report is available at Summerford audit report.
See also
- Information securityInformation securityInformation security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction....
- Information technology auditInformation technology auditAn information technology audit, or information systems audit, is an examination of the management controls within an Information technology infrastructure. The evaluation of obtained evidence determines if the information systems are safeguarding assets, maintaining data integrity, and operating...
- IT audit resources
- Woman Hacks North Bay Health Care Group
- Former System Admin. Sentenced For Hacking NY Court Web Site
- Cyber Crime - More case studies plus source for the studies described above.
- The Computer Fraud and Abuse Act - Text of the most recent revisions to the Act.
- Computer Security Statistics: Crimes and Penalties