SERIAL KILLER MIND

  Crime Classification Manual Part II Chapter 10 B 36 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   Victimology The victims were a Florida school, a major telephone service provider, a school in Massachusetts, and local emergency services, requiring the response of several emergency response units to the school. The victims suffered approximately $1 million in damages.

  Crime Classification Manual Part II Chapter 10 B 35 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N Background CASE STUDY: 540: THREATS VIA THE INTERNET A Massachusetts juvenile committed a series of hacking incidents into Inter- net and telephone service providers; the theft of an individual’s personal information and the posting of it on the Internet; and making bomb threats to high schools in Florida and Massachusetts. All took place over a fifteen- month period.

  Crime Classification Manual Part II Chapter 10 B 34 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   Search Warrant Suggestions The search warrant for the offender’s location should list all computers and all forms of computer storage: disks, data CD-ROMs, DVDs, magnetic tapes, external hard drives, mini-drives (sometimes called memory sticks), flash memory modules, programming documentation, e-mail addresses (possible sources of malignant software creation programs), the computer and all its peripherals, and all program CD-ROMs. The search warrant should also include the offender’s Internet accounts.

  Crime Classification Manual Part II Chapter 10 B 33 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   Investigative Considerations The targeted computers’ logs should be analyzed in an attempt to determine the Internet protocol addresses of the sending computers.

Crime Classification Manual Part II Chapter 10 B 32 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   Common Forensic Findings. The computer of the targeted user will have logs and copies of the threatening messages. The offender’s computer should also have copies of the threats, as well as the user’s computer addresses, e-mail, and Internet protocol.

  Crime Classification Manual Part II Chapter 10 B 31 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   540: THREATS VIA THE INTERNET Defining Characteristics This crime occurs when a computer user is threatened over the Internet. Threats can be delivered by e-mail, instant messaging, and spam. Victimology. The computer user can be threatened with bodily harm, family and friends can be threatened with bodily harm, or the user’s business can be threatened with destruction.

    Crime Classification Manual Part II Chapter 10 B 30 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   : FRAUDULENT INTERNET TRANSACTIONS This crime occurs when a buyer purchases goods at an Internet auction and sends money but never receives the goods purchased. Another type of fraudulent Internet transaction is Web site fraud, also called shopping cart fraud. This crime involves the creation of a URL simi- lar to a legitimate site, and the unsuspecting user is apprised of large savings on the purchase of hard-to-obtain products. Accessing any one of the erroneous Web sites can lead to fraud.

  Crime Classification Manual Part II Chapter 10 B 29 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   Search Warrant Suggestions The search warrant for the offender’s location should list all computers and all forms of computer storage: disks, data CD-ROMs, DVDs, magnetic tapes, external hard drives, mini-drives (sometimes called memory sticks), flash memory modules, programming documentation, e-mail addresses (possible sources of malignant software creation programs), the computer and all its peripherals, and all program CD-ROMs. The search warrant should also include the offender’s Internet accounts.

  Crime Classification Manual Part II Chapter 10 B 28 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   Investigative Considerations The targeted computer should have its hard drive removed and analyzed by special computer software not only to determine the changed data but to search for possible Trojan horse software that tests for data checks and then destroys the corrupted data before they can be analyzed. All computer logs should be analyzed for suspicious activities, and all Internet activity should be searched for illegal access and messages.

  Crime Classification Manual Part II Chapter 10 B 27 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   : BANK FRAUD This crime occurs when money is illegally obtained from one bank account and transferred electronically to another account that is usually in another bank and typically another country. Access to the targeted bank is via the Internet. Wireless connections to the Internet are used to commit crimes, where it is difficult to identify the user.

  Crime Classification Manual Part II Chapter 10 B 26 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   Outcome Jiang was arrested on charges of computer fraud for attempting to gain access to the accounts of numerous subscribers of GoToMyPC.com. He was sentenced to twenty-seven months’ imprisonment, three years of supervised release, and $201,620 in restitution.

  Crime Classification Manual Part II Chapter 10 B 25 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   The agents obtained a search warrant and went to Jiang’s home. Four desktops and a laptop whirred in his bedroom, and according to court documents, telltale signs of digital subterfuge were scattered about the room: sticky notes containing bank account numbers, Kinko’s credit card receipts, and books and manuals on hacking.

  Crime Classification Manual Part II Chapter 10 B 24 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   Investigation Federal authorities, with logs of GoToMyPC used on the victim’s computer, traced the attacking computer by its Internet protocol address, first to the company providing it cable modem service and then to a specific Queens address. With GoToMyPC’s help, federal agents found that at least nine other customer accounts had been used by the same suspicious computer.

  Crime Classification Manual Part II Chapter 10 B 23 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   The victim then manually regained control of his PC, terminated the computer session, and contacted officials of Neteller in order to direct them to close the unauthorized Neteller account that had been opened in his name.

  Crime Classification Manual Part II Chapter 10 B 22 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   Afterward, he observed his computer access a Web site known as www.neteller.com, an online payment transfer service, and observed an account in his name being opened at Neteller, without his authorization. A short time later, the victim observed his computer accessing the Web site for the American Express Corporate card and, using information stored on his computer, saw his computer attempt to access his card account file.

  Crime Classification Manual Part II Chapter 10 B 21 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N Victimology Jiang’s alleged fraud came to light after a subscriber of GoToMyPC, who was at home, heard his personal computer turn on without any action on the subscriber’s part and then observed the cursor of the PC moving around the screen and files on the PC being accessed and opened as if by remote control.

  Crime Classification Manual Part II Chapter 10 B 20 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   Jiang obtained these users’ passwords and usernames by installing computer software for this purpose at a Kinko’s in Manhattan. He then used these passwords and usernames in attempts to gain access to those subscribers’ personal computers in order to obtain credit card and other in- formation stored on those computers.

  Crime Classification Manual Part II Chapter 10 B 19 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N CASE STUDY: 533: INTERNET FRAUD Background Juju Jiang, operating from his home in Flushing, New York, and using a computer program designed to record computer passwords and usernames, attempted to gain access to the computer accounts of approximately fifteen subscribers of GoToMyPC, a company that offers individuals the ability to remotely access their personal computers from any computer connected to the Internet.

  Crime Classification Manual Part II Chapter 10 B 18 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   Outcome All six defendants were charged with conspiring to commit mail fraud by causing Ingram Micro to ship computer equipment based on the false pretenses that the equipment was ordered by legitimate customers. In addition, Mateias, Tinubu, Finley, Crisovan, and Long were charged with mail fraud.

  Crime Classification Manual Part II Chapter 10 B 17 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   Investigation Ingram Micro became suspicious of orders from clients that were not consistent with their previous orders. The FBI, working with Romanian law enforcement, was able to trace the fraudulent orders to Mateias.

  Crime Classification Manual Part II Chapter 10 B 16 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   The defendants in the United States would either sell the equipment and send the proceeds to Mateias, or they would repackage the equipment and send it to Romania. Mateias and his co-conspirators allegedly fraudulently ordered more than $10 million in computer equipment from Ingram Micro. However, Ingram Micro was successful in intercepting nearly half the orders before the items were shipped

  Crime Classification Manual Part II Chapter 10 B 15 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   When Ingram Micro blocked all shipments to Romania in early 1999, Mateias recruited Olufemi Tinubu, Valeriu Crisovan, Jeremy Long, and Warren Bailey from Internet chatrooms to provide him with U.S. addresses to use as mail drops for the fraudulently ordered equipment. Crisovan, Tinubu, Finley, and Long recruited others, including high school students, to provide additional addresses and to accept the stolen merchandise.

  Crime Classification Manual Part II Chapter 10 B 14 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   Forensic Findings The offenders were a group of six men led by Calin Mateias who was located in Romania; the others were located in the United States. Mateias began hacking into Ingram Micro’s online ordering system in 1999. Using information obtained from his illegal hacking activity, Mateias bypassed Ingram’s online security safeguards, posed as a legitimate customer, and ordered computer equipment to be sent to Romania.

  Crime Classification Manual Part II Chapter 10 B 13 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N CASE STUDY: 533: INTERNET FRAUD Background and Victimology The offenders attempted to steal more than $10 million in computer equipment from Ingram Micro, a large electronics distributor in Santa Ana, California.

  Crime Classification Manual Part II Chapter 10 B 12 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   533: INTERNET FRAUD Criminals use the computer to create credit card fraud, bank account fraud, and even counterfeit passports.

  Crime Classification Manual Part II Chapter 10 B 11 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   532: CHILD PORNOGRAPHY The availability of child pornography over the Internet has turned into a multibillion-dollar business. (See Chapter Twelve.)