The Crooks Aren t Here Pursuing White-Collar Crime in a Foreign Country Pauline Roberts Special Agent (Retired) FBI
Agenda First steps to take when a victim is defrauded How to identify and follow the trail of clues to locate and identify the criminal How to follow the money Roles of international law enforcement Interpol Europol Eurojust United Stated Department of Justice
Cybercrime Is Worldwide In 21 st century it is inevitable If it happened online it is probably an international crime. Essential to understand the clues you receive from forensic examiners or corporate IT.
Internet Protocol Address: Where Was He Sitting When He Did It? Unique number identifying a machine connected to the internet Version 4 IP address: 46.254.129.4 Newest versions: 2001:db8:0:1234:0:567:8:1 Researching tell you the internet service provider (ISP) IP addresses are not static Formal request to the ISP Establish who has access to the computers
When the Criminal Lives Online Servers and Web Hosting Web hosting is a service
Cloaks of Anonymity: Proxy Servers and Bulletproof Hosting Proxy servers stand in front of a server that is holding the information you want Anonymity is one of the primary reasons for using proxies Bulletproof hosting are bad-guy fronts opperating as proxies Compromised servers, zombie servers are other cloaks: unwitting servers
Internet Crime Complaint Center (IC3) www.ic3.gov Use to find what the latest online schemes are www.ic3.gov/crimeschemes.aspx
FBI Fusion Units Goal of this unit Investigate significant crime Identify who How they are doing it Where they are located Build evidence for a prosecutable case Identify subjects in foreign countries Prepare referral packages of complaints and evidence Perfom undercover
Common International Online Frauds ATM skimming, Cash Trapping and Card Cloning Merchandising and Employment Schemes / Business Opportunity Schemes Automated Clearing House (ACH) Bank Transfers Internet Extortion
24/7 Point of Contact Person or office who can be contacted by law enforcement investigators Assist on cyber information from ISPs such as Yahoo Google AOL Assists from domain registers, Web hosting service providers and online merchants ebay, Amazon, etc. Each country has an officially designated 24/7 point of contact (POC)
Following the Money and Anti-Money Laundering (AML) Until funds are converted to cash there is either a paper or electronic funds transfer trail to follow Move the money as far away from the victim as possible Change the identity and source of funds
Egmont Group Countries routinely share information about suspicious financial activities Written agreements set the common rules for exchanging information about suspicious banking and financial activities Privacy concerns Each member country is part of the Egmont Group of Financial Intelligence Units (FIU) 120 counties are members producing and sharing suspicious activity reports
Financial Intelligence Units (FIU) In most countries FIUs operate within the Ministry of Finance Analyze what banks are reporting Refer potential cases to police and prosecutors and foreign counterparts In USA suspicious activity information is collected by the Financial Crimes Enforcement Network (FinCen)
Does the Crook Have a Bank Account In Your Country? Can We Get His Bank Records? Local police scan the country s banks to identify accounts held by a suspect This is not possible in USA Chex Systems, Inc. is a network of many banks and financial institutions who report information to each other About customers who mishandle accounts Or try to repeatedly open accounts at different banks
Bank Secrecy Laws Strong laws protecting the privacy of bank customers Search warrant obtained after proving to a judge why secrecy should be lifted Advisable to work with prosecutor in each country where accounts are located.\
Currency Transaction Reports (CTRs) If You Are on the Trail of Cash Most countries require reports of large cash transactions CTRs can come from Customs declarations Transactions just below or over $10,000 Money flows just below the reporting threshold are called structuring or smurfing and is illegal in the USA CTRs can be obtained through a country s FIU
Layering Money launder s technique for obscuring a money trail Virtual labyrinth of transactions Requires the support of a prosecutor to unravel
Prosecutive Interest Guidelines for the minimum size loss a fraud case must have to pursue criminally Who will prosecute? Jurisdiction.
Criminal Forfeiture In the USA is usually handled by prosecutors who are pursuing the primary criminal case Burden of proof for asset forfeiture is on prosecutor in USA In some countries it is on defendant Prove where his money came from
Who Do I Turn To For Help Abroad? How Do I Contact Them? US Federal law enforcement have agents assigned around the world Role is to share information with FIUs, asset forfeiture inspectors, police, and prosecutors outside USA Work in partnership to gather evidence, testimony, arrest suspects, and freeze and seize assets in USA Assist those aboard doing the same in the USA for cases being prosecuted abroad Work to deconflict cases that may overlap
Iterpol / Europol / Eurojust Exchanging Information on Cross-Border Crime Interpol: Information exchange network 190 countries share police information Databases serve as a private Internet for police Red Notices: tell police around the world that a suspect is wanted in a particular country for arrest and extradition Analysts review emerging trends in fraud and other crimes www.interpol.int/psgapp/educational/crime-prevemtion.html
Iterpol / Europol / Eurojust Exchanging Information on Cross-Border Crime Europol: Functions like Interpol but exchanges among 27 countries of European Union (EU) Combats organized crime and fraud affecting Europe Cooperates with non EU countries including Balkans Cooperates with organizations including the European Antifraud Office (OLAF), European Central Bank (ECB), European Commission, European Police College (CEPOL) Operated the European Cyber Crime Center (EC3)
Iterpol / Europol / Eurojust Exchanging Information on Cross-Border Crime Eurojust: Functions like Europol Information exchange is between prosecutors and court officials European Arrest warrants are valid throughout the 27 EU member states
Extradition & Mutual Legal Assistance Treaties Legal timeframes and procedures are established by extradition treaties signed and ratified by individual countries Extradition requests are formal packages of official documents Mutual Legal Assistance Treaties (MLAT) establish police cooperation, how to conduct investigations and can be limiting Occasionally may not provide the kind of speed or techniques which might be optimal in a fraud case
How to Get Admissible Evidence from Another Country? In USA if evidence is obtained in a manner legal in another country it is admissible Some certified documents from the US may not be admissible until apostilled (certified) Hague Convention Abolishing the Requirements for Legalization for Foreign Public Documents Signed by all EU member states
Conclusion
Questions?
Thank You Pauline Roberts Special Agent (Retired) FBI