Professional Documents
Culture Documents
Informant Vol 9 No 3 - 2012 Fall PDF
Informant Vol 9 No 3 - 2012 Fall PDF
C
of Directors
hairman
Northeast Mountain
Mid-Atlantic Southeast
Midwest West
The mission of the National White Collar Crime Center (NW3C) is to provide training, investigative support and research to agencies and entities involved in
the prevention, investigation and prosecution of economic and high-tech crime. NW3C is a non-profit organization serving more than 4,000 member agencies
in all 50 states, four U.S. territories and 15 countries. Membership in NW3C is free.
Advocate for
NW3C Law Enforcement
A
s you can see from the scope of forcement. We also provide information
the articles in this issue of the about our new partnership with X1 Dis-
Informant, law enforcement covery and updates about existing part-
Executive Staff continues to face significant challeng- nerships with other agencies and entities
es in the ever-increasing number and that support law enforcement, such as the
Don Brackman, Director
Ken Brooks, Deputy Director types of economic and cybercrime that Internet Crimes Against Children Task
Dave Cummings, Deputy Director are committed every day. Because these Forces (ICAC), the National Institute of
Mark Gage, Deputy Director crimes impact every aspect of life in the Standards and Technology (NIST), and
Mary-Ellen Kendall, General Counsel United States, state, local and tribal law the West Virginia Cyber Crime Coop-
enforcement officers are on the front erative (WV3C).
Editorial Staff lines in the battle to protect their com- In addition to the challenges facing
Kim Williams, Manager munities from fraud. law enforcement in protecting their com-
Beth Singer, Senior Writer and Editor NW3C’s mission is to provide train- munities, we must always be aware of
Ty Bowers, Print and Multi-Media ing, research, and investigative support the dedicated men and women who gave
Content Coordinator to assist law enforcement in address- their lives in the performance of their du-
Lindsey Bousfield, Graphic Designer ing economic and cybercrime. As part ties. Unfortunately, August is now the
of NW3C’s ongoing efforts to support deadliest month this year with eighteen
Other Contributors law enforcement, this issue features in- law enforcement officers killed in the line
Nicole Stiles, Curriculum Developer formation and tips on crimes involving of duty. Please take a moment to read the
April Wall-Parker, Curriculum Developer the theft of intellectual property, prepaid names of our fallen heroes in this issue
cards, social media, online gaming, smart and reflect on their sacrifices for all of us.
Contact Us phones and identity theft, school sys- Even as we face cultural and eco-
On the Internet: www.nw3c.org tem embezzlement, and Internet–related nomic changes, NW3C will continue to
Member Services: 804-967-6210 frauds and scams. We also highlight the live up to its mission to serve state, lo-
membership@nw3c.org key contributions to NW3C and the State cal and tribal law enforcement agencies
of West Virginia that have been made by nationwide by expanding our support
Investigative Support: 800-221-4424, ext. Glen B. Gainer, III, State Auditor for West services and resources in order to keep
3520 Virginia and Chairman of NW3C’s Board law enforcement at the cutting-edge of
Training: 877-628-7674, ext. 2234 of Directors. the latest methods in training and white
IC3: 800-251-3221 To help law enforcement identify, collar crime investigations. NW3C is
www.ic3.gov investigate, and prosecute cybercrime, fortunate to have enthusiastic and hard-
https://icsis.nw3c.org NW3C has developed the training cours- working employees who truly believe in
es and forensic tools that are described our mission, and Board of Directors who
in the article discussing the services our unselfishly dedicate their time and talent
Computer Crime Section staff can pro- to help guide the organization.
vide to law enforcement agencies. I welcome your comments and ideas
Since its inception, NW3C has on how NW3C can work with your
Search: NationalWhiteCollarCrime worked to develop partnerships with law agency. I may be reached at dbrackman@
enforcement agencies, educational insti- nw3c.org or 877-628-7674.
tutions and the private sector that enable
NW3C to offer additional cutting-edge Don Brackman
resources as they are needed by law en- Director, NW3C
@NW3CNews
This project was supported by Grant No. 2011-BE-BX-K002 awarded by the Bureau of Justice Assistance. The Bureau of Justice Assistance is a component of the Office of Justice Programs,
which also includes the Bureau of Justice Statistics, the National Institute of Justice, the Office of Juvenile Justice and Delinquency Prevention, the Office for Victims of Crime, and the Office of
Sex Offender Sentencing, Monitoring, Apprehending, Registering, and Tracking. Points of view or opinions in this document are those of the author and do not necessarily represent the official
position or policies of the U.S. Department of Justice. The National White Collar Crime Center (NW3C) is the copyright owner of this document. This information may not be used or reproduced
in any form without express written permission of NW3C. For questions or additional information, please contact Kimberly Williams, Communications Manager at 1-800-221-4424 ext. 3320
or kwilliams@nw3c.org. NW3CTM, IC3® and ICSISTM are trademarks of NW3C, Inc. and may not be used without written permission.
© 2012. NW3C, Inc. d/b/a the National White Collar Crime Center. All rights reserved. Bureau of Justice Assistance
U.S. Department of Justice
WWW.NW3C.ORG 3
Remembering Our
Fallen Heroes*
April - August 2012
6 Glen B. Gainer, III: Advocate for Law Enforcement Collaboration and Training
22 Theft and Money Laundering: Welcome to the Dark Side of Prepaid Cards
Who We Are
NW3C, a non-profit membership organization dedicated to supporting law enforcement in the prevention, investigation
and prosecution of economic and high-tech crime, has been continuously funded through competitive grants for over three
decades. NW3C’s membership consists of law enforcement agencies from all 50 states and four continents.
WWW.NW3C.ORG 5
NW3C Feature
“Being a part of the early days of NW3C was so inspiring to me personally and
professionally because it brought together this group of talented and forward-
thinking people that really set the stage for the NW3C that exists today. The
infectious synergy of this organization is why I’m still involved. NW3C has driven
me to do more in my office because of the collaboration that happens.”
G
len B. Gainer, III, West Virginia State Auditor state millions of dollars while enhancing fraud preven-
and Chairman NW3C’s Board of Directors, tion and increasing accountability. The State Purchas-
has proven to be a loyal and dedicated ser- ing Card Program, recognized by VISA International as
vant to the state of West Virginia. In his own words, “one of the nation’s best,” has also improved relations
Auditor Gainer chose a career in public service simply
because he cares about people and their communities.
Prior to being elected West Virginia’s 19th State Audi-
tor in November 1992, Auditor Gainer worked with
the state Treasurer’s Office and the state Department
of Energy. As State Auditor, a position he has held for
two decades, Auditor Gainer serves as the state’s offi-
cial bookkeeper, Chief Inspector and Supervisor over
Public Offices, Securities Commissioner and over-
sees law enforcement activity within these areas. He
recognizes the importance of being in tune with the
community, which is evidenced by his prolific public
outreach and his exhibited passion for protecting the
financial well-being of the citizens in his state.
Among the many successful programs Auditor
Gainer has implemented during his time in office, the
West Virginia State Purchasing Card Program stands
West Virginia State Auditor and NW3C Board of
out. This initiative streamlined the payment process by
Directors Chairman Glen Gainer (left) visits with
bringing all state agencies into one program, saving the
NW3C Director Don Brackman.
WWW.NW3C.ORG 7
NW3C Feature
training we can do, the more we are helping state and port we receive from BJA ensures the needs of state,
local law enforcement, which in turn, helps the citi- local and tribal law enforcement and regulatory agen-
zens of our state,” explained Auditor Gainer. cies are met. I really do see NW3C as law enforcement’s
Technology has enabled agencies to utilize the Internet number one advocate and their number one resource,”
for web-based training and webinars. This type of train- said Auditor Gainer.
ing has increased in popularity because of reduced agency Auditor Gainer explained, “As a nation, we need to be
budgets and the practicality and convenience of receiving more proactive in preventing white collar crime. We need
the training without leaving the office. It is also an attrac- to make financial corporations more accountable to the
tive alternative for agencies that do not necessarily have public and there needs to be stronger laws and penalties
the resources (financial and personnel) to obtain needed imposed for those who are not good citizens. For those
training. Auditor Gainer notes, “In the state of West Vir- of us working in public service, protecting those we rep-
ginia we have a lot of small agencies that may only have resent is our passion because they are our neighbors, our
one person – they have to be there to serve the people of friends, and we are tied to each other.”
their jurisdiction but at the same
time they still need training.”
While face-to-face training
“We are out there with the boots on the
is optimal, there clearly is a need ground and know what they need. The
for both modalities. NW3C will
continue to offer a wide variety
continued support we receive from BJA
of face-to-face training while ensures the needs of state, local and trib-
also increasing the number of
web-based training opportuni- al law enforcement and regulatory agen-
ties to meet the needs of today’s cies are met. I really do see NW3C as law
law enforcement community.
Law enforcement and regu- enforcement’s number one advocate and
latory agencies will always face
challenges, especially with white
their number one resource.”
collar crime. There will always
be a need for more personnel, equipment and resourc- Through his many years of outstanding service
es. NW3C should be one of those valuable resources. and implementation of programs that work, it is clear
Building relationships is the key to success. NW3C’s that Auditor Glen Gainer is committed and dedicated
partnerships with Department of Justice (DOJ) com- to the state of West Virginia and the National White
ponents, such as the Bureau of Justice Assistance (BJA) Collar Crime Center. Both entities are very fortunate
and the Office of Juvenile Justice and Delinquency Pre- to have his full support and leadership. He credits his
vention (OJJDP), are the reason why NW3C can fulfill success to the philosophy, “Don’t look at things how
its mission to be a resource for state, local and tribal law they are, look at things as you want them to be. Don’t
enforcement. “We are out there with the boots on the be afraid to venture in new directions and create new
ground and know what they need. The continued sup- frameworks for the future.”
Explorethe
Explore New NW3C
the New NW3C Website
Website
igation and
1 -
1 > Better organiz ation and t
ITA > Updated cont
> Integration wi
ite combined with main site
nw3c.org
WWW.NW3C.ORG 9
NW3C Members
S
everal law enforcement agencies worked together to solve a credit card fraud case in Clayton, MO. Robert
Page from Massachusetts was suspected of having traveled to St. Louis several times in 2010 to take credit
cards from health club lockers and then use them to purchase electronics.
The Clayton Police Department, the U.S. Secret Service, the St. Louis Metropolitan Police
Department and the Town and Country Police Department collaborated on the case and
Page pleaded guilty to credit card fraud and conspiracy to commit credit card fraud.
Page was sentenced to five years in prison and will have to pay $38,000 in restitution.
Two co-defendants were ordered to pay restitution as well. Jonathan Vendituoli has been
ordered to pay more than $88,000, while Kevin Cooney has been ordered to pay nearly
$50,000 in restitution.
At the time, Clayton police Chief Tom Byrne said the two were suspected of having broken into lockers at
Wellbridge Athletic Club and Spa.
Rhode Island Attorney General Fighting Medicaid Fraud and Patient Abuse
Rhode Island Office of the Attorney General
Pawtucket (RI) Police Department
A
ttorney General Peter Kilmartin is urging the public and patients to report Medicaid fraud and patient abuse with a new
online complaint form that will be directed to the Attorney General’s Medicaid Fraud Control and Patient Abuse Unit.
The Attorney General’s Medicaid Fraud Control and Patient Abuse Unit recently completed a two month investiga-
tion into a home health care fraud case, and with the assistance of detectives from the Pawtucket Police Department, the suspect,
Medeline Hernandez, was arrested on felony charges and arraigned.
The investigation into this fraud case was initiated by a referral from the Rhode Island Department of Human Services. The
Medicaid Fraud Control and Patient Abuse Unit enforces the laws pertaining to fraud in the state Medicaid program and prose-
cutes cases of abuse, neglect or mistreatment of patients in all state healthcare facilities. The Unit’s attorneys, auditors, investigators
and health care professionals employ a multidisciplinary approach to combat health care fraud and patient abuse.
Attorney General Kilmartin submitted legislation to the Rhode Island General Assembly that would require national back-
ground checks and certification of personal care assistants in an effort to reduce home health care fraud and to protect those who
are in need of that type of care.
T
he Milwaukee Police Department was recently featured in a Smithsonian.com blog (posted by Rachel Nuwer) highlighting
its new and innovative website. This website tackles crime in a state-of-the-art way.
The blog describes it as “a first-of-its-kind site for any U.S. law enforcement agency.” It stated “the unit invites citizens
to engage with the police through the web interface in order to prevent crime and stay informed.” The Milwaukee Journal Sentinel
also reported that the Department eliminated its weekly press briefings, and will post current investigation information, crime
statistics and videos on the site for accuracy and easy access for both journalists and the community.
The website includes live streams of crime rates, profiles of officers, most wanted lineups and memorials to fallen heroes. Break-
ing news is updated around the clock, and 3-D images create a visual effect that adds depth and movement to some photos featured
on the site. This new site can be found at www.milwaukeepolicenews.com.
Tennessee Department of Safety & Homeland Security Announces New Identity Crimes Unit
Tennessee Department of Safety & Homeland Security
T
he Tennessee Department of Safety & Homeland Security Commissioner Bill Gibbons announced the formation of
a new investigative unit to combat the increase in identity theft and related crimes in
Tennessee. The newly formed Identity Crimes Unit is comprised of employees from
three divisions of the Department: Tennessee Highway Patrol, Office of Homeland Security and
Driver Services Division.
“Identity crimes are a growing part of our crime problem, and many local law enforcement
agencies struggle with investigating these cases. In addition, the Highway Patrol has specific au-
thority under state law to investigate identity theft. There are obvious homeland security concerns
with such crimes, and many identity crimes relate to driver licenses. So, we see it as a great op-
portunity for all three divisions of the Department—our state troopers, homeland security agents,
and driver license examiners—to work together as a team,” Gibbons stated in a release.
Local news reported that the Identity Crimes Unit will provide support to local law enforce-
ment upon request, but will consider several factors to determine the level of involvement. Some of these factors include fraudulent
use of a driver’s license; a nexus to homeland security issues; cooperation of victims; violation of Tennessee’s felony theft law; the
number, financial amount and frequency of transactions; and referral from a federal agency. Investigators and staff assigned to the
Identity Crimes Unit have been training for months to increase skills in the area of identity crimes and collect best practices for
this type of investigating from other states.
The Unit has created a resource kit for identity theft victims and has linked it to www.tn.gov/safety. Investigators will also par-
ticipate in programs and events to encourage identity theft awareness, distribute educational materials to safeguard against identity
crimes, and encourage the public to take proactive steps to reduce the debilitating impacts of identity crimes.
WWW.NW3C.ORG 11
NW3C Training
R
obert Hartnett asked for a show of hands: How “The test of counterfeiting is it has to be popular and
many in the room were paid largely with tax dol- it has to be worth something,” Hartnett told law enforce-
lars? In the room full of state, local and federal law ment in Des Moines. “These are parasites. They need
enforcement personnel, every hand was raised. host companies.”
The show of hands was yet another reason why every Hartnett scattered a number of items – sports jerseys,
law enforcement professional in that training room in Des purses, accessories, prescription pills, shoes – throughout
Moines, IA should care about intellectual property (IP) crime, the room prior to the training. He asked participants to
said Hartnett, a private investigator specializing in IP crime survey the items and determine which ones they thought
investigations and a retired Richmond (VA) Police Depart- were fakes and which ones they believed to be genuine ar-
ment detective. IP crime hurts local communities and gov- ticles. Few could distinguish real from fake.
ernments. The people who sell counterfeit sports jerseys, “This isn’t traditional junk anymore,” Hartnett said. “It’s
luxury goods, consumer electronics or medicine do not just no longer easy to tell.”
harm consumers and businesses, but they also cost local com- Hartnett urged law enforcement in the room to con-
munities jobs and deprive them of valuable tax revenue. sult experts as they built IP crime cases. “Don’t be your
More than 30 members of Iowa law enforcement – most- own expert,” he said. Collaboration with other agencies,
ly veteran officers from local police and sheriffs’ departments investigators and businesses can prove vital when bring-
– attended a July 24 session of “Fake Products, Real Crime: ing a case to court and a
Intellectual Property Theft,” a training program presented by perpetrator to justice.
NW3C and the National Attorneys General Training and Re- Organization and
search Institute (NAGTRI). Collectively, those who attended planning are also crucial
the training in Des Moines had hundreds of years of experi- to conducting IP investi-
ence investigating many types of crime. However, none had gations, Detective Bailey
experience pursuing IP crime investigations. told the group. IP crimes
For most of the day, attendees heard from Hartnett and rarely occur in isolation.
Scott Bailey, a Chesterfield County (VA) Police Department Perpetrators usually are
detective, on how to spot IP violations, conduct investiga- involved in other forms Image courtesy of Robert Hartnett
tions and collect evidence. of financial crime and Price and location can determine
At its core, intellectual property theft is nothing new. fraud. “Always ask yourself: whether an item is real or counter-
NAGTRI Program Director Judith McKee jokingly referred Where are you going with feit. High-end luxury goods and
clothing do not sell for bargain
to it as the “second-oldest profession” in the world. Citing this investigation? How big
prices or in flea markets, swap
a historical account, McKee said a scientific comparison of is it? Who’s involved?” meets or gas stations.
wine bottles dating to 27 B.C. showed that a Gallic merchant Above all else, Bailey
counterfeited the markings of a popular vintage produced by reminded them: “Docu-
the Roman Senator Cassius and passed it off as his own. ment. Document. Document.”
The U.S. Chamber of Commerce puts the global value Near the end of the day, participants were given vari-
of pirated consumer goods and counterfeits at $650 billion ous details from a real-life IP crime case and tasked with
annually. The U.S. loses $58 billion annually on copyright determining how they might investigate it. The goal of the
violations alone. exercise was to get these law enforcement professionals to
Increasingly, violent criminals – gang members, drug pursue an IP crime as they would any other case. “What is
dealers, organized crime figures – engage in IP theft be- a counterfeit [item] after all?” Bailey asked them. “It’s con-
cause they see it as a low-risk/high-reward proposition. traband, like narcotics.”
But how can a local police department or sheriff ’s office The NW3C/NAGTRI IP crime training continues
begin to investigate these types of crimes? What should in- throughout the country, with multiple courses planned
vestigators look for? How can they spot counterfeit goods? into 2013. To learn more about the training, go to http://
Hartnett and Bailey sought to answer these questions and www.nw3c.org/training/financial-crimes/65.
many more during the training session.
[sad
n n
Columbus,OH - 10/ 19/12
Orange Beach,AL - 1 1/8/ 12
St. Charles Parish,LA - 11/ 13/12
-?L' Tampa,FL - 12/5/ 12
Topeka,KS - 1/8/ 13
Charleston, SC - 1/ 18/ 13
MW www.nw3c.org
NA T I O N A L W HI T E C OL L A R C R I M E CENTER C I NAGTI I
Ir7 National Association
;Attorneys General
ww Questions? Call an-sus-era
- -
This project was supported by Grant No. 2010 DB-BX.C076 and 2010.DB BX-K092 awarded by the Bureau of Justice Assistance. The Bureau of Justice As-
sistance is a component of the Office of Justice Programs,which also includes the Bureau of Justice Statistics, the National Institute of Justice,the Office
of JuvenNe Justice and Delinquency Prevention, the Office for Victims of Crime,and the Office of Sex Offender Sentencing,Monitoring,Apprehending, Reg-
istering, and Tracking. Points of v iew or opinions in this document are those of the author and do not necessarily represent the official position or policies
of the U.S. Department of Justice.The National White Collar Crime Canter (NW3C) Is the copyright owner of this fact sheet This Information may not be
used or reproduced Inany form without the express written permission of NW3C. NW3C"', IC3e, and ICSIS"' are trademarks of NW3C,Inc. and may not be
used without permission.
Bureau of Justice Assistance
Y.S. Department of Justice 0 2012 NW3C ,Inc. dlblaf the National While Collar Crime Center. All rights reserved.
WWW.NW3C.ORG 13
NW3C Insider
O
n July 9, 2012, Kristen said she was proud of the work that was accomplished
Mahoney was sworn towards GOCCP’s goal to provide safe neighborhoods
in as the new Deputy for citizens and families across the state.
Director for Policy at the Bureau Mahoney has served as Chief of the Technical Ser-
of Justice Assistance (BJA). Prior vices Division of the Baltimore Police Department, as a
to this appointment, she served Senior Policy Advisor in the Community Oriented Po-
as the Executive Director of the licing Services Office and as the State Administrative
Governor’s Office of Crime Con- Agent for Byrne Justice Assistance Grant funds. She has
trol and Prevention (GOCCP) also worked with staff in BJA’s Programs, Planning, and
for the State of Maryland and as Policy Offices and understands the importance of BJA’s
President of the National Crimi- work to the communities the agency serves.
nal Justice Association. Having worked at the local, state and federal levels
Throughout her career, Mahoney has proven to be a of government, Mahoney brings a lot of knowledge, ex-
strong advocate of state, local and tribal efforts to improve pertise and criminal justice policy experience to BJA.
criminal justice programs in communities across the “NW3C congratulates Kristen Mahoney on her new ap-
country. While managing the GOCCP, Mahoney assisted pointment to BJA. Her leadership and extensive experi-
Maryland Governor Martin O’Malley in implementing ence will provide valuable guidance and support not only
effective crime-fighting strategies to help state and local for NW3C and other BJA partners, but also for state, lo-
law enforcement impact crime; resulting in significant cal and tribal law enforcement throughout the country,”
reductions in the state’s violent crime rate and property said NW3C Director Don Brackman.
crime rate. On her departure from GOCCP, Mahoney
I
often have students and inves- larger, we tend to see patterns where none actually exist
tigators ask me what is the best (a well-documented psychological phenomenon). If we
strategy to use when conduct- go with Option 1, by its very nature, we risk committing
ing an examination and analysis the error of confirmation bias and most certainly pro-
of digital evidence. Is it better to vide opposing legal counsel with ammunition to chal-
assume that person X did it and lenge the validity of our conclusions or expert opinion.
search for evidence to support this, Until machines take over the world and all of our
or should one assume that person tasks are fully automated, we will always have bias. Bias
X is innocent and search for evi- is part of the human condition. We cannot operate with-
dence that supports this investigative hypothesis? The third out it. It is highly unlikely that any investigator will not
option usually mentioned assumes nothing and we go in have some preconceived notions that could possibly
with no prior expectations. This third option, while appeal- impact what they focus on. This bias can occur subcon-
ing to the rhetoric of “let the evidence decide the truth” (or sciously. So how do we navigate this potential minefield?
some other equally philosophical quip) is not realistic. It is One answer is to approach an investigation in a very sci-
very rare that we do not know some of the backstory of the entific manner. This leaves us with Option 2. Assume the
investigation prior to conducting an examination and anal- person is innocent and try to prove this hypothesis. I use
ysis. There is just too much potential evidence on today’s the term hypothesis because, to me, when we conduct
storage devices to go in blind as we will soon become over- an examination and analysis we are in fact conducting
whelmed with investigative “noise.” The examination and an experiment and testing educated guesses as to what
analysis process has evolved into a more surgical, targeted we will find. The investigator then conducts the exami-
approach due to this “big data” problem. nation and analysis looking for evidence that exonerates
That leaves us with really only two practical approach- the person/suspect. If we find evidence to conclusively
es: 1) Search for evidence that confirms the person did it support the hypothesis of innocence, we have our find-
– they are guilty and 2) Search for evidence that proves ing. If, on the other hand, we find no evidence to support
the person is innocent. However, one of these choices is a that the person is innocent we have failed to support our
potential minefield. If we proceed using Option 1 we can tested hypothesis and we now look for evidence to fur-
easily fall into the trap of succumbing to confirmation ther validate that the person is guilty. We should not just
bias. The concept of confirmation bias as an error in the jump to the conclusion that the absence of evidence that
forensic sciences has been debated and studied for some someone is innocent is proof they are guilty.
time now. The overall consensus is that confirmation bias As digital evidence becomes commonplace in our
can lead to invalid and erroneous conclusions. investigations, so too will the challenges and criticisms
Simply defined, confirmation bias is the tendency historically leveled at forensic sciences. Being aware of
for people to focus on information or data that supports of such challenges as confirmation bias, is a crucial step
their hypothesis and ignore contradictory information. in effectively dealing with them. Once an investigator
This is very similar to having “tunnel vision” when con- acknowledges that there is the potential of confirmation
ducting an investigation. Latent fingerprint analysis, bias, he or she can be sensitive to this error and follow
questioned document analysis and arson investigations processes or methods, such as the one described here, to
(to name but a few) have been highlighted by critics as reduce them.
being examples of where confirmation bias has led to the Practically and scientifically, the correct answer to
conviction of near conviction or a person who was later our question is Option 2, until the evidence supports
found to be innocent. Digital forensics, given the huge shifting to Option 1, and, as always document, docu-
amount of data to be examined, is also fertile ground for ment and then document some more.
this error. As the amount of data we examine becomes
WWW.NW3C.ORG 15
NW3C Insider
X
1 Discovery, a port NW3C for spearheading this training to local, state
leader in software and federal law enforcement,” says John Patzakis, Presi-
solutions for so- dent and CEO of X1 Discovery. “This partnership couples
cial media and website the world-class training operation of NW3C with the best
evidence search and col- available website and social media collection and analysis
lection, along with the Na- software in X1 Social Discovery to better serve law enforce-
tional White Collar Crime ment and the broader digital investigation community.”
Center (NW3C), have announced a strategic partner- This curriculum will provide best practices and new
ship to provide fee-based training to local, state and methods to collect, search, preserve and manage social
federal law enforcement agencies worldwide, as well as media evidence from social media networking sites and
to legal, corporate discovery and risk professionals. The other websites in a scalable, instantaneous and forensi-
partnership will focus on promoting best practices and cally sound manner.
advanced techniques for website and social media evi- Participants will learn about:
dence collection and analysis, based upon the X1 Social • Specific cases involving critical social media and
Discovery software.
TM
website data, as well as YouTube® video capture;
Data generated from social networks is relevant to just • How to collect and index thousands of social me-
about every criminal and civil legal matter and must be rou- dia items in minutes;
tinely addressed by law enforcement, regulatory agencies, • How to identify key metadata unique to social
law firms and corporate risk professionals. In a recent Lex- media; and
isNexis® survey of 1200 law enforcement professionals fo- • Ways to better authenticate social media evidence
cusing on the rising prominence of social media evidence, in a safe and defensible manner.
67 percent of respondents believed social media evidence The X1 Social Discovery software is designed to ef-
helps solve crimes more quickly. However, the respondents fectively address social media content from the leading
also pointed to lack of training and technical familiarity as social media networking sites such as Facebook®, Twit-
preventing their more widespread access to social media ter®, LinkedIn® as well as webmail, website crawling and
evidence. The NW3C and X1 Dis-
covery partnership is geared toward This partnership provides cutting edge support and
addressing this compelling need.
training for Internet and social media investiga-
“The National White Collar
Crime Center is pleased to partner tions and new curriculum for law enforcement and
with X1 Discovery to help provide corporate professionals covering advanced tech-
law enforcement and corporate niques for the effective analysis of evidence from
investigators with the necessary social networking and Internet sites.
training and tools to combat child
exploitation, financial fraud, drug
trafficking and other illegal activities involving the direct or YouTube® video capture. Unlike archiving and image cap-
indirect use of social media and the Internet,” stated Don ture solutions, X1 Social Discovery provides for a “matter-
Brackman, Director of NW3C. “A key part of our mandate centric” workflow and defensible chain of custody from
at NW3C is to identify, assess and validate new and cut- search and collection through production in searchable
ting-edge digital investigation technologies that uniquely native format, while preserving critical metadata not pos-
address a compelling need for the law enforcement com- sible through image capture, printouts or raw data archi-
munity, and X1 Social Discovery clearly fits that bill.” val of RSS feeds.
“The prevalence of social media evidence is exploding For more information about this training program,
in criminal and civil cases alike and we applaud and sup- please visit www.nw3c.org or call 877-628-7674.
T
he State of the States Cybercrime Consortium Attorney General’s Office said. “I have been amazed at
began 11 years ago as an offshoot of the Asso- the work these students are doing. Some have worked
ciation of State Criminal Investigative Agencies. on actual cases and assisted with apprehensions.”
The first meeting was held in Cleveland, OH, and was Each state presented an overview of their cyber
arranged by the Ohio Bureau of Criminal Investigation, programs and shared successes and lessons learned
Georgia Bureau of Investigation, Florida Department in a very open, honest and trusted forum. Success-
of Law Enforcement (FDLE), and others. Subsequent ful programs as well as innovative ideas and solutions
meetings were held in several locales across the nation. were shared and discussed, resulting in new partner-
This past May, representatives from 43 states and ships and cyber programs.
Puerto Rico attended this invi-
tation-only, Bureau of Justice
Assistance-sponsored meeting, Successful programs as well as innovative
in the suburban Washington, ideas and solutions were shared and dis-
D.C. area. Those attending in-
cussed, resulting in new partnerships and cy-
cluded law enforcement officers
from state agencies who are re- ber programs.
sponsible for managing their
agency’s computer crime/digital
forensics programs. “When you put 50 people in one room to discuss
Universities recognized nationally as cyber leaders a topic, the conversation evolves, questions are asked,
having close working relationship with their state’s crimi- and everyone benefits,” Special Agent Kinch said.
nal justice community, presented at this year’s meeting. Mike Phillips, FDLE Assistant Special Agent in
Dr. Sudhir Aggarwal, Professor of Computer Science Charge, spoke about a number of FDLE projects in-
with Florida State University, demonstrated a password- cluding state-wide responder training and the FDLE
cracking algorithm and cracking methodology developed Cell Phone Data Collection Kiosk System. This sys-
by his students. Dr. Sujeet Shenoi, Professor of Computer tem makes the hardware and software available, along
Science at the University of Tulsa, briefed the group on with detailed instructions for its use, to officers who
work his students have done in the area of cell phone fo- need data from cell phones. Making the kiosk sys-
rensics and damaged-device data recovery. tem available throughout the state has saved the FDLE
The cybercrime prevention field is growing dramati- Computer Forensic Unit hundreds of hours of work.
cally and young adults, who have grown up with com- “We are looking to implement the forensic kiosk
puters, are creating tools and ideas that enhance law en- in New Mexico after learning about it at the meet-
forcement’s ability to apprehend cyber criminals. ing,” Special Agent Kinch said. She also explained
“The presenters from academia have done incredible how she left the meeting with information on new
work with password cracking, hacking and more that re- forensic software and connections to a network of
ally benefit law enforcement and were on hand to share experts that she can reach out to if she needs ideas
this information,” Special Agent Lois Kinch, New Mexico or support.
WWW.NW3C.ORG 17
NW3C Profile
W
hen law enforcement personnel look to boost collect data from cell phones, GPS-enabled devices and
their computer forensic and high-tech crime the popular suite of Apple® products (iOS® devices like the
investigative skills, they turn to NW3C’s Com- iPod Touch®, iPhone® and iPad®).
puter Crime Section (CCS). The newly developed Cybercop 215 (Apple® iDevice
With a training curriculum that caters to every skill Forensics) course is designed to help law enforcement
level – from frontline officers to analysts and forensic ex- better understand these devices and how to gather data
aminers – and a team of expert instructors, NW3C is well- from them for investigations. The course shows investi-
positioned to bolster law enforcement’s capacity to handle gators and examiners how to use forensically sound tools
the increasingly complex forms and varieties of digital evi- and techniques to analyze potential evidence from iOS®
dence found at today’s crime scenes. (Apple’s operating system) devices, including informa-
In the last five years alone, CCS has provided training tion from built-in applications, as well as popular third-
to nearly 26,000 law enforcement professionals nationwide. party applications.
NW3C also recently entered
“The section as a whole draws experience from a into a strategic partnership with X1
very diverse set of backgrounds — the military, po- Discovery to help provide law en-
forcement and corporate investiga-
lice, technology and government. If anybody needs tors with the necessary training and
help with anything related to digital evidence, they tools to combat child exploitation,
give us a call.” financial fraud, drug trafficking and
other illegal activity involving the
“We’re the premier provider of digital forensics train- direct or indirect use of social media and the Internet. A
ing in the country,” said NW3C Computer Crime Special- new training curriculum, developed through this partner-
ist Nick Newman. “The section as a whole draws experi- ship, will provide best practices and new methods to col-
ence from a very diverse set of backgrounds – the military, lect, search, preserve and manage social media evidence
police, technology and government. If anybody needs help from social media networking sites and other websites in
with anything related to digital evidence, they give us a call.” a scalable, instantaneous and forensically sound manner.
Not only does CCS provide free training and technical
support, the Section has also developed forensic tools that
it distributes to law enforcement free of charge. Addition-
ally, CCS has formed several key partnerships within the
law enforcement and private sector communities, to con-
tinually seek out new and innovative ways to stay ahead of
the technological curve. CCS continues to offer training to Internet Crimes
High-Quality Training Against Children (ICAC) investigators as well. ICAC units
must investigate some of the most heinous crimes target-
NW3C computer crime courses are organized into two ing our most vulnerable population. NW3C has been a
primary tracks – Cyber Investigation and Cyber Forensics. leader in providing these specialized units with the skills
Cyber Investigation courses were developed to address the and capabilities required to combat these crimes.
needs of first-responders who identify, and at times, seize The Section also trains law enforcement professionals
digital devices. The Cyber Forensics courses were devel- to deliver some of NW3C’s entry-level computer crime
oped to suit the needs of investigators who analyze and courses, a turn-key program that has helped expand the
process data. number of officers and investigators NW3C can reach
In recent years, NW3C has expanded its Computer with its curriculum.
Crime curriculum to address some of the newest trends
in digital forensics, especially the need for investigators to
T
he advent of social media has generated a valuable Friendster®, a social gaming site — with a strong following
resource of information and data for investigations in Asia. People from different countries flock to different
and intelligence. But the question is: How do in- types of online communities, he said.
vestigators scour through thousands of sites to get the in- Cohen then discussed the challenges and information
formation that will support their cases? necessary to conduct an undercover investigation through
social media. It can be a challenge as it is easy for criminals
to glean information and discover where you are and who
you are if you do not have a well laid out plan before hand.
“You need to prepare for an undercover case on social
media just as you would for working undercover on the
street,” Cohen said. He explained further, if your Facebook
page doesn’t have pictures, friends and a real “identity” on
social media, it can make it easy to spot that your persona
is not real.
It may not always be necessary to go undercover online
and engage gang members or child predators. One of the
great benefits of social media is open-source intelligence.
Which refers to intelligence collected from publicly avail-
Darrell McGraw, West Virginia Attorney General; Don Brack- able sources.
man, NW3C Director; First Sergeant Chris Casto, West Vir- Cohen used an example of a Facebook profile to show
ginia State Police; Shelley Moore Capito, West Virginia Con- that even though he was not friends with the person, he
gresswoman; Glen Gainer, West Virginia State Auditor; and could still gather data from the information that was made
Chief Timothy P. Deems, Beckley Police Department support- public.
ed the outreach and were on hand to discuss the importance of He showed several other profiles and looked at simi-
training like this for law enforcement.
larities and connections. Cohen pointed out names and
On August 16 more than 150 law enforcement person- acronyms used to describe activities that are connected
nel came to see Indiana State Police Lt. Chuck Cohen’s pre- with child pornography like “PTHC” and “Vul Gnuoy.”
sentation, “Online Social Media and Criminal Investiga- An Internet Crimes Against Children (ICAC) investiga-
tions” at NW3C’s Outreach Training event in Beaver, WV. tor, Cohen explained: “P-T-H-C” means pre-teen hardcore
NW3C partnered with the Beckley Police Department and and “Vul Gnuoy” is young luv spelled backwards. When in-
the Raleigh County Sheriff ’s Office to present this program. vestigating pedophiles it’s helpful to know the terms.
“I brought half of my Department here. We have already
used Facebook® to apprehend suspects, but there is so much
more to learn,” Clendenin Police Chief David Brinckman, said.
An 18-year veteran with the Indiana State Police, Cohen
is the commander of the Special Investigation and Criminal
Intelligence Section and also serves as the Indiana Internet
Crimes Against Children (ICAC) task force commander.
Cohen started the program with an overview of social
media and the vast world it encompasses. With more than
955 million active users on Facebook alone, the world of
social media can be overwhelming and intimidating.
Cohen used his knowledge of the medium to break
down the most popular sites like YouTube® (which has more
Chuck Cohen, a self-proclaimed “geek with a gun,” shares his
than 3 billion views per day) and other less-known sites like
knowledge and experience on social media investigations.
P
repaid cards are not just a convenient gift anymore.
As with any type of payment system, prepaid cards
are being utilized for much darker purposes by
criminals. From theft to money laundering, authorities
are realizing the vulnerabilities prepaid cards pose when
it comes to criminal activity.
A good example of this is a 2010 case where a trio in
Baltimore, MD used prepaid cards to pay for advertise-
ments posted on Craigslist for sexual services, and used
fake names and identifiers for the cards to conceal their
activities. The group ultimately pleaded guilty to pros-
titution, drug conspiracy, sex trafficking, enticement to
travel in interstate commerce to engage in prostitution
and interstate transportation for prostitution, according
to a news release from U.S. Immigration and Customs
Enforcement (ICE).
In another case from 2010, Dubai asked the U.S. Fed-
eral Bureau of Investigation (FBI) to look into prepaid
cards issued by Meta Financial Group’s Metabank, a re-
gional American bank. These prepaid cards were used by
suspected Israeli agents to cover their tracks when they
assassinated a commander of the Palestinian militant
group Hamas.
The anonymity factor has proven to be a problem when
it comes to prepaid cards and criminal activity. However,
times are changing and, with the ink barely dry on the pa-
per, Financial Crimes Enforcement Network’s (FinCEN)
newly written rules are making it more difficult for crim-
inals to hide. FinCEN issued its final rule to amend the
Bank Secrecy Act (BSA) Regulations to include prepaid
access as a money services business in July 2011, with a
compliance date of March 31, 2012. Along with tradition-
al banks, money service businesses are now required to
have an Anti-Money Laundering (AML) program, which
requires them to file currency transaction reports (CTR)
and suspicious activity reports (SAR) on these cards.
22 INFORMANT: FALL 2012
“One of the foundations of having a good AML pro- $10,000 or more in cash must declare it; however, prepaid
gram is to know your customer. First of all, your customer cards are exempt from this regulation. Therefore, money
has to be who they say they are and you need to know what is easily disguised, transported and transferred using pre-
kind of activity to expect from this customer,” says Steve paid cards thus making the origin, ownership and crimi-
Hudak, Chief of Public Affairs at FinCEN. The idea is that nal nature of “dirty” money hard to trace.
collecting information, maintaining records and filing re- In a press release from October 2011, FinCEN “pro-
ports will help law enforcement to conduct criminal inves- posed adding certain tangible prepaid access devices to the
tigations and provide regulatory agencies with the ability list of monetary instruments to be reported when trans-
to monitor noncompliance. ported in or out of the United States.” This proposal would
FinCEN receives millions of CTR and SAR records include things such as prepaid cards, certain gift cards and
each year, which they review and maintain in a database. cell phones. The final rule is under development.
Federal, state and local law enforcement agencies can ac- ICE reported that authorities in New Mexico have en-
cess this BSA data through a secure web connection after countered instances where hundreds of prepaid cards were
their agency has entered into a Memorandum of Under- found concealed in a compartment similar to those used
standing with FinCEN. FinCEN provides training and to conceal cash, drugs and other contraband. ICE also re-
monitoring to ensure that the BSA information is properly ports customs authorities in Jamaica requested assistance
used, disseminated and kept secure. with hundreds of U.S. issued prepaid cards found in mail
“Law enforcement can go into our database and enter from the United States. These particular brands of cards
an account number, Social Security number, phone num- have been associated with advance-fee scams which pri-
ber, name or whatever bit of information they have. They marily target elderly U.S. citizens.
can then follow the trail through our database and discov- Open-loop cards provide more opportunities for
er connections that they otherwise would not have known criminal schemes as these cards can be used virtually
were there,” says Hudak. anywhere. Not only can these cards be cloned and used
Many money services began implementing the Fin- to make purchases, but criminals have also found them
CEN rules prior to the March 2012 date. To comply with an easy alternative to scamming consumers out of their
these new rules, customers may be required to show photo money. Once criminals convince consumers to put mon-
identification at the time of the card purchase or provide ey onto a prepaid card and share the serial number with
identifying information to activate the card such as a So- them, funds can easily be drained from the account. Ac-
cial Security number and address. cording to the Better Business Bureau, these are some
To understand the prepaid card world it is important common ways consumers are scammed:
to differentiate between the two types of prepaid cards. • Consumers are asked to pay advance-fees on bo-
Prepaid cards come in two forms: closed-loop cards and gus loans with a prepaid card;
open-loop cards. Both types of cards are susceptible to • Consumers are told they have won a prize but first
criminal activity. Closed-loop cards are gift cards or must provide payment via a prepaid card; and
phone cards for a specific store. They are usually sold • Consumers are told they can purchase heavily dis-
in preset denominations and additional value cannot be counted items or services but must pay for it using
added. Open-loop cards are network branded cards such a prepaid card.
as Visa, MasterCard, Discover or American Express. One example of this happened in Milwaukee, WI. A
These can be used at multiple locations and some allow man received a phone call from someone he thought was
cash withdrawals at ATMs. a customer representative from a satellite television com-
FinCEN’s new rule sets limits on both open-loop and pany. This person told the man for $430, he could receive
closed-loop cards. Closed-loop prepaid access (includ- his current services plus premium channels for an entire
ing in-store credit for merchandise returns) is regulated year, which was a considerable discount. The caller told
if more than $2,000 can be associated with the prepaid ac- the man he must use a prepaid card to pay the amount. In
cess device or vehicle on a given day. Low-value, ($1,000 the end, the discounted services were just a scam and the
or less) open-loop prepaid access is regulated if it can be man was out $430.
used internationally, transferred between or among other There are several ways money is placed on open-loop
persons within the prepaid program or reloaded by a non- prepaid cards. Some of the ways money is transferred
depository (nonbank) source. onto an open-loop card include:
To keep track of the prepaid cards crossing the border, • Using cash, credit card, etc. at local merchants that
FinCEN is trying to change the border regulations. Cur- sell prepaid cards;
rent regulations require anyone crossing the border with • Using a bank account transfer;
WWW.NW3C.ORG 23
‘Where There’s a Will,
• Using a credit card or PayPal® transfer;
• Purchasing a reload card such as the Visa Green There’s a Way’: Criminals
Dot MoneyPak® and then transferring money
from the reload card onto the prepaid debit card Find Ways to Benefit
either online or by phone; and
• Direct deposit from employers or government. from Department Store
One highly publicized case involving prepaid cards
and government payments of tax refunds occurred in Gift Cards
D
2011 in Tampa, FL. Commonly referred to as “Operation epartment store gift cards at the checkout coun-
Rainmaker,” this year-long investigation by local and fed- ter might seem worthless to most people, but not
eral law enforcement resulted in the uncovering of a $130 to a criminal. One technique used by criminals
million loss to taxpayers, hundreds of fraudulent tax re-
involves stealing gift cards off store racks before any mon-
turns and dozens of arrests. Police, unaware the scam was
ey has been put on them. The criminal then uses an elec-
being conducted, noticed drug dealers had disappeared
tronic card reader/writer to copy the information from
from Tampa street corners. Also, routine traffic stops were
one gift card to another, making an identical copy. Then
yielding an array of unusual items found in vehicles, such
they take the card back to the store for unsuspecting cus-
as laptop computers and Green Dot credit cards.
The scam involved criminals obtaining someone’s iden- tomers to purchase. Once money is added to the card, the
tity, filing a tax return online and receiving the tax refund criminal can then go on a shopping spree with someone
with a prepaid debit card, check or direct deposit. During else’s money.
a six-month span, police recovered nearly $10 million in A 22-year-old man in Beaverton, OR used this very
tax refund debit cards. scam, and in less than two weeks stole more than $7,000
If law enforcement comes across prepaid cards in their from gift cards at a Fred Meyer store. In another case in
investigations, it is important to know records are available. Plano, TX, a 30-year-old man took gift cards from a lo-
To understand prepaid cards better, Kevin Bleckley, Fin- cal Walmart. Instead of cloning the card, he recorded the
CEN Senior Intelligence Research Specialist, says it is es- 16-digit numbers on the card; used a razor blade to re-
sential to know the typical life cycle of a prepaid card such veal the secret PIN number and then returned the cards
as: the card is purchased, loaded with money, products are to Walmart. The man then contacted the 800 number on
purchased, money is reloaded and so on. “During any phase the back of the card to find out if any balance had been
of the natural life cycle of that prepaid card, information is added. When money was added, he would go to Walmart’s
being collected,” Bleckley says. website and buy items to pick up at the store.
There are, typically, three entities involved with open- While department store cards, otherwise known as
loop prepaid cards. The merchant that sells the card, the closed-loop cards, typically are not used in money laun-
program manager (such as Green Dot) and the issuing dering, there are exceptions. A scheme uncovered by a
bank. If you look on the back of the card, you can usually U.S. Immigration and Customs Enforcement (ICE) and
find a contact for the program manager or issuing bank. Internal Revenue Service (IRS) joint investigation revealed
The issuing bank is typically the entity that holds the re- a co-conspirator was paid by criminal organizations with
cords. But, if law enforcement can find no issuing bank to gift cards issued by U.S. retailers. The gift cards were then
contact, they use the first six digits on the card (BIN num-
used to purchase mobile phone cards, which were smug-
ber) to ascertain which bank issued the card.
gled into Mexico and sold for a profit.
Time will tell if the FinCEN regulations are effectively
“Closed-loop cards can also be used like cash if you
deterring criminal misuse. After the regulations have been
have a stack of them with enough value,” says Steve Hu-
in place for 18 months, Cindy Baltierra, Regulatory Policy
dak, Chief of Public Affairs at Financial Crimes Enforce-
Officer and co-author of the prepaid access rulemaking,
says, FinCEN research will determine the effectiveness of ment Network (FinCEN). “They are easier to hide than
the new rule. “We will look back to see if there are areas cash and contain more value per square inch than cash, so
left unaddressed or areas where we have been arduous in they are easier to move in some respects.”
requirements set forth. It helps to determine if what we FinCEN recently amended the Bank Secrecy Act
intended to do is actually what the rule has done among (BSA) Regulations to include prepaid access as a money
all the affected parties.” services business. Within this rule, closed-loop is not to
exceed $2,000 maximum value associated with a prepaid
access device, such as a card.
I
n observance of National Fraud Awareness Week, web-based approach to
Nov. 11 - 17, NW3C is collaborating with Franklin managing high-profile
University, the Ohio Ethics Commission, Ohio In- criminal investiga-
spector General and Ohio Investigators Association to tions, called the Virtual
present a two-day training conference in Columbus, OH Referral Presentation
on Nov. 7 - 8. (VRP), where all of the
The Targeting Fraud – Safeguarding Integrity Confer- information is acces-
ence will explore a wide spectrum of topics related to the sible at the click of the
investigative process of uncovering fraud. mouse.
The conference sponsors received approval for 16 • How to Develop a Successful Social Media Strat-
hours of Continuing Professional Education (CPE) cred- egy. Dionne Waugh, of the Richmond (VA) Police
it from the Accountancy Board of Ohio and 13 hours of Department, will cover the benefits of new social
Continuing Legal Education (CLE) credit by the Ohio Su- media and how to protect and guide an agency to
preme Court for this training. effectively share its message.
The following eight sessions will be presented during • Ohio Ethics Law: What We Need to Know. Susan
the course of the two-day conference: Willeke of the Ohio Ethics Commission will present
• Lessons Learned from the Cuyahoga County Cor- timely information regarding the restrictions in the
ruption Investigation. Ann Rowland, Assistant Ohio Ethics Law and related statutes that pertain to
U.S. Attorney, and FBI agents R. Michael Massie all public sector employees and private sector parties
and Christine C. Oliver, will review the investigative who are regulated or do business with public offices.
strategy leading to the prosecution of over 60 public • The Electronic Communications Privacy Act (ECPA)
officials, including former Cuyahoga County Audi- – Obtaining Electronic Evidence from the Internet.
tor Frank Russo and Commissioner Jimmy Dimora. Matthew Kall, Assistant U.S. Attorney, will review
• Malicious Website Investigation. Nick Newman, types of court processes required for government
a Computer Crime Specialist from NW3C reveals investigators to obtain various forms of electronic
the statistics and technical aspects of phishing and evidence from Internet Service Providers under the
Internet fraud, including how to recognize danger- Electronic Communications Privacy Act (ECPA) in-
ous websites. cluding connection logs, content of emails and GPS
• National Intellectual Property Rights Coordina- data.
tion Center – Its Mission and Role. Jon Ruttencut- • Enhanced Methodology of Case Summaries. An-
ter will address intellectual property theft and the drea Fausnaugh will discuss her experience as a
multi-billion-dollar impact it has on the U.S. econo- criminal analyst at the Ohio Inspector General’s Of-
my, health, safety, and national security. fice in developing charts and diagrams to synthesize
• Crime Fighting in the Virtual World. Rick Wells, information collected during the course of investiga-
an investigator for the Ohio State Highway Patrol, tions. Criminal analysts need to be able to navigate
will explore how technology can serve as a means an overwhelming amount of readily available infor-
to make criminal cases easier to understand, man- mation to identify patterns, break down complex
age and prosecute. Investigator Wells has created a data and create easy-to-understand presentations.
?MSER 7-8, ?p
Date: November 7 & 8, 2012
ov j Location: Ohio Department of Transportation, 1980 West Broad Street, Auditorium,
? ?
Columbus, OH 43223
Cost: $125
Continental breakfast and afternoon break refreshments will be provided during the conference. Lunch cost
will be the responsibility of each attendee (on-site cafeteria available).
CP
9?
?6 For more information and a schedule that includes presentation topics and speakers,
UA
DING
go to http://watchdog.ohio.gov/Conference.aspx
WWW.NW3C.ORG 25
Embezzlement - Another Problem
Facing Our School Systems
By Kristin D. Koontz, CFE
M
onica Foote, a member of the Ozark City (AL) money. My life’s a mess and I just made it worse.” Even
Board of Education, embezzled $97,000 from though Foote admitted to taking the money, prosecutors
the local school system. This growing issue fac- needed evidence of the embezzlement to indict and then
ing school systems all over the country impacts the ability of try Foote.
teachers and adminis- Prosecutors were
trators to provide a The proliferation and severity of embezzlement concerned that a
quality education to has brought this issue to the attention of law judge or jury may
our students. sympathize with
The amount stolen enforcement officials nationwide, who must Foote’s personal and
in Ozark City rep- now determine the best way to investigate and financial situation,
resents only a small prosecute these crimes. which could adverse-
percentage of the to- ly affect the outcome
tal funds embezzled of the trial. Foote
by employees from comes from a well-
school systems na- known and respect-
tionwide. A recent ed family within the
news search uncov- community. She is
ered several exam- also an elderly, wid-
ples: owed mother who
• Gayle White, adopted a child with
a high school special needs.
secretary The State of Ala-
from An- bama Examiner of
chorage, AK, Public Accountants
faced charges conducted an audit
on two separate occasions for stealing. She embez- of the Ozark City Board of Education. Examiners con-
zled more than $100,000 from area schools. cluded that Foote embezzled approximately $97,000 from
• Benefits specialist Angela Potter from Greene the school board. Additionally, she filed $5,364.81 in false
County, NC was convicted of embezzling almost travel claims with the State of Alabama. Following the
a half-million dollars from the local school system. audit, prosecutors subpoenaed Foote’s personal bank re-
• In Lynwood, CA, Lynwood Unified School Dis- cords. These included records from her checking account,
trict’s former Chief Business Officer, William statements for all lines of credit and documents relating
Douglas Agopian, is facing charges for embezzling to her loans. Foote was indicted on the following charges:
over $700,000 in public funds. use of public position for personal gain; theft of property,
The proliferation and severity of embezzlement has first degree; theft of property by deception, first degree;
brought this issue to the attention of law enforcement of- and conversion of public revenue.
ficials nationwide, who must now determine the best way The Office of the Attorney General reached out to the
to investigate and prosecute these crimes. National White Collar Crime Center’s (NW3C) Investi-
Ozark City Case: From Beginning to End gative Support Section for analytical assistance with this
case. NW3C accepted the case and assigned two analysts
The Ozark City Board of Education brought the ac- to the investigation. The prosecutors set the following
tions of its Chief Financial Officer Monica Foote to the at- goals: demonstrate Foote’s spending habits, show how
tention of local law enforcement. Its financial institution Foote used school funds to cover personal expenditures
became suspicious of several checks written to Foote. The when her account would otherwise be overdrawn, identify
School Superintendent and board’s attorney confronted all incoming funds into Foote’s account, locate all checks
Foote about the checks. Foote immediately admitted to received from the school system, and generate products to
taking the money saying, “Well, I’m broke. I needed the demonstrate NW3C’s findings.
WWW.NW3C.ORG 27
Smart
Phones
and
Identity
Theft
By Sanjeev Shah, FCA, CFE NW3C Guest Contributor
W
e love our smart phones. Whether it’s an An- Threats and Security
droid®, iPhone® or Blackberry®, we just cannot Your smart phone’s knowledge, if not protected, is a
get enough of the technology - plugging in, up- potential risk to your security and privacy. The ultimate
dating our Facebook® status, checking our email, listening question to ask: Is my privacy and security at risk? One
to or streaming music from a playlist - wherever we are, has to secure the phone by passcode, antivirus software
whenever we desire. We can book a flight, hotel and rental and software updates. Mobile malware is a rising threat to
car while having coffee at Starbucks®. privacy and security. It is a program especially created to
Seriously, smart phones have changed our lives and wreak havoc on your phone. Once installed on your device,
most of us have no idea what we ever did without them. it disrupts the phone’s system to gain access to the device’s
But 3G and 4G technology open us up to a new world of operating system (OS) and takes over the phone to gather
identity theft, as well. Our iPhone may or may not store stored information. Mobile malware may infiltrate through
credit card information directly, but all the sites we view au- mobile applications, web-browsing and text messages.
tomatically log us in where our card information is stored. Here are some of the risks which occur when using a
Our Droid is connected directly to our Facebook account smart phone.
and merges data from multiple sources into a single con- • Phones are easily stolen or lost;
tact list. Our Blackberry automatically accesses our email at • Phones are associated with and linked to a specific
work as well as home, keeping us productive and in touch user for billing and account purposes, particularly
with our personal lives at the same time. What informa- when GPS is enabled;
tion received via email would we rather not see fall into the • While moving in and out of Wi-Fi service areas,
wrong hands? you also move in and out of firewalls and secure
We are putting more information on our phones and hotspots; and
using it for mobile banking, including depositing checks. • Some apps used are unsafe, which can enable phish-
With the rise in credit card monitoring and sophisticated ing attacks.
policing by credit card companies, identity thieves are in- Be careful while on an open Wi-Fi network: If you
creasingly targeting users of smart phones and social me- connected to a public network before, your phone can
dia, where consumers have a tendency to be less cautious. connect automatically to the same open Wi-Fi network.
About 65-70 percent of the users do not have password pro- Identity thieves will use this environment to snatch credit
tection for their phones. card information or user names and passwords to start an
People should not let their guard down. The challenge attack. The safest course of action is not to enter sensitive
we have is criminals often change faster than everyday con- data on a public network.
sumers. If your phone was stolen a few years ago, the thief “Shred” smart phone’s data: If your phone is stolen,
could make prank calls and read your text messages. Today, all the information on it is valuable to an identity thief. To
that person can destroy your social life and your finances. overcome this, cell phone security applications are more
WWW.NW3C.ORG 29
IC3 Alerts
FAKE POLITICAL SURVEY OFFERS fer “free” credit services such as credit CITADEL MALWARE DELIVERS
FREE CRUISE scores and credit monitoring. Custom- REVETON RANSOMWARE IN AT-
I C3 has been notified of a scam involv- ers reported being charged a monthly TEMPTS TO EXTORT MONEY
O
ing telephone calls conducting a mul- service fee. However, the terms of the n May 30, 2012, IC3 released
tiple-choice “political survey.” Following agreement advised that the “free” re- the following PSA to warn con-
the survey, the recipients are told they port only lasts for a limited time. At sumers about a new Citadel malware
won a free cruise to the Bahamas. After the end of the free term, the website platform used to deliver ransomware,
providing a website address for legiti- used the customer’s supplied finan- named Reveton:
macy, the caller requests the “winner’s” cial information to charge a monthly The ransomware lures the victim to
email address for notification purposes membership service fee ranging from a drive-by download website, at which
and credit card information to cover $19.95 to $29.95. time the ransomware is installed on
port fees. The website has very limited The terms and agreement from the the user’s computer. Once installed,
information, but does contain a few website states the following: the computer freezes and a screen is
photos, testimonials and a “Caribbean “For Subscription Services which displayed warning the user they have
Line” banner, in an attempt to convince include a free-trial period, if you do violated United States federal law. The
visitors it is legitimate. not cancel your free trial within the free message further declares the user’s IP
trial period, you will be charged at the address was identified by the Comput-
ONLINE PHONE BOOK monthly rate in effect at that time for er Crime & Intellectual Property Sec-
I C3 has received several complaints the Subscription Services for which you tion as visiting child pornography and
regarding a phone book website. enrolled. Your debit or credit card (in- other illegal content.
Complainants reported that anyone cluding, if applicable, as automatically To unlock their computer the user
could post other individuals’ informa- updated by your card provider follow- is instructed to pay a $100 fine to the
tion. Some reported being verbally bul- ing expiration or change in account US Department of Justice, using pre-
lied, receiving uncensored comments, number) will continue to be charged paid money card services. The geo-
or having false accusations posted each month at the applicable monthly graphic location of the user’s IP address
about them. Personal information that rate unless and until you cancel the determines what payment services are
can be listed on the website includes: Subscription Services.” offered. In addition to the ransomware,
full name, unlisted cell phone num- The website, according to the Better the Citadel malware continues to oper-
bers, email addresses, direct links to a Business Bureau (BBB), has been given ate on the compromised computer and
person’s private Facebook® account and an F rating by the BBB for the following can be used to commit online banking
any other information or photos some- reasons: and credit card fraud.
one wants to add. The website also al- • 1037 complaints filed against
lows users to anonymously call anyone the business. EXPOSING BAD CLIENTS IN THE
listed on the site directly from the web, • 8 complaints filed against the ESCORT COMMUNITY
I
as well as track them with GPS. business that were not resolved. C3 has received several complaints
• 17 serious complaints filed regarding an escort website. Com-
FREE CREDIT SERVICE WEBSITE against the business. plainants report their identities were
The victims then received extortion made. The email contains a link to Sample Fake email:
emails from subjects offering to re- “check-in” online for the flight, a fake
move the information from the web- confirmation code, and flight details. From: US Airways - Reservations
site for a fee. This scam is extremely The phishing scam is deceiving be- [mailto:reservations@myusairways.
detrimental to victims on a personal cause it looks authentic, even includ- com]
and professional level. Some victims ing the US Airways logo. Sent: Wednesday, April 04, 2012 9:51
reported their marriages and reputa- The Better Business Bureau post- AM
tions have been damaged. ed information from US Airways
The website disclaimer states in- that reminds customers that official Subject: [BULK] Confirm your US air-
dividuals named on this website emails often include personal infor- ways online reservation.
provided their information freely to mation such as names and Dividend
Importance: Low
verify and confirm their identity for Miles numbers. However, their web
the purpose of making arrangements check-in emails will not contain a You can check in from 24 hours and
to meet and spend time with a paid name, but will have a valid confirma- up to 60 minutes before your flight (2
companion. The website also states tion code that will either be alphanu- hours if you’re flying internationally).
they are located outside the United meric or all letters. Then, all you have to do is print your
States and Europe, and they do not boarding pass and go to the gate.
have to respond to any subpoena If you receive the email:
(court order) from these countries. We are committed to protecting your
• Check any links by hovering your
privacy. Your information is kept pri-
US AIRWAYS PHISHING EMAIL mouse pointer over the link to
vate and confidential. For information
CONTAINING MALWARE identify the URL. A legitimate
about our privacy policy visit usair-
link will have a URL with “usair-
Training Online
TM
Get the information and skills you need to extract investigative leads and case-related infor-
mation from the IC3 database.
The Internet Complaint Search and Investigation System (ICSIS) training is now available online.
The course gives you an expanded knowledge of the database and introduces you to tools
that can be used to build cases during investigations and much more.
To obtain access to the ICSIS online training, please contact IC3 Manager Kathryn Malbon Rinker
at kmalbonrinker@nw3c.org. Or to learn more about the ICSIS training, go to:
www.nw3c.o rg/training/specialty-tra ining
www.nw3c.org/training/specialty-training
WWW.NW3C.ORG 31
National White Collar Crime Center
www.nw3c.org
10900 Nuckols Road, Suite 325 5000 NASA Blvd., Suite 2400
Glen Allen, VA 23060 Fairmont, WV 26554
(800) 221-4424 (877) 628-7674
• It is clear the professionals who respond to scenes where people are victimized in our
communities are themselves, particularly over time, subject to the impact of traumatic
stress. It is key to identify this stress and how it affects the everyday lives of law enforce-
ment. Also, understanding the latest research and ways to combat this stress can help
keep law enforcement healthy and on the job.
• The Social Media and Internet Law Enforcement (Smile) Conference was held this past
September and law enforcement from around the world gathered to discuss best prac-
tices, share ideas on how they can use social media to improve law enforcement, en-
gage citizens and prevent and solve crime.
Find us on
Facebook
Search: @NW3CNews
NationalWhiteCollarCrime
32
NAT IONA L WH IT E COLLAR C RIM E CENTE R