SERIAL KILLER MIND

Crime Classification Manual Part II Chapter 10 B 44 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   The provider refused to provide the requested access. Approximately ten minutes after the threat was made, the juvenile and others initiated a denial-of-service attack (classification 513) that succeeded in shutting down a significant portion of the telephone service provider’s Web operations.

  Crime Classification Manual Part II Chapter 10 B 43 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   In June 2005, the juvenile called a second major telephone service provider because a phone that a friend had fraudulently activated had been shut off. In a recorded telephone call, he threatened that if the provider did not provide him access to its computer system, he would cause its Web service to collapse through a denial-of-service attack—that is, an attack designed to ensure that a Web site is so flooded with requests for information that legitimate users cannot access it.

  Crime Classification Manual Part II Chapter 10 B 42 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   In the spring of 2005, the juvenile, using a portable wireless Internet access device, arranged with one or more associates to place a bomb threat to a school in Massachusetts and local emergency services, requiring the response of several emergency response units to the school on two occasions and the school’s evacuation on one.

  Crime Classification Manual Part II Chapter 10 B 41 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   Also in January 2005, an associate of the juvenile set up accounts for the juvenile at a company that stores identity information concerning millions of individuals, allowing the juvenile to look at the identity information for numerous individuals, some of which he used for the purpose of looking up the account information for the victim whose personal information he posted on the Internet.

Crime Classification Manual Part II Chapter 10 B 40 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   He accessed the information stored on this individual’s mobile telephone and posted the information on the Internet. During this same period, the juvenile used his access to the telephone company’s computer system to set up numerous telephone accounts for himself and his friends, without having to pay for the accounts.

  Crime Classification Manual Part II Chapter 10 B 39 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   In January 2005, the juvenile gained access to the internal computer system of a major telephone service provider that allowed him to look up ac- count information of the provider’s customers. He used this system to discover key information about an individual who had an account with the telephone service.

Crime Classification Manual Part II Chapter 10 B 38 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   In August, he logged into the Internet computer system of a major Inter- net service provider (ISP) using a program he had installed on an employee’s computer. This program allowed the juvenile to use the employee’s computer remotely to access other computers on the internal network of the ISP and gain access to portions of the ISP’s operational information.  

  Crime Classification Manual Part II Chapter 10 B 37 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   Investigation The offender’s criminal conduct began in March 2004 when he sent a bomb threat to a Florida school. As a result of this threat, the school was closed for two days, while a bomb squad, a canine team, the fire department, and emergency medical services were called in.

  Crime Classification Manual Part II Chapter 10 B 36 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   Victimology The victims were a Florida school, a major telephone service provider, a school in Massachusetts, and local emergency services, requiring the response of several emergency response units to the school. The victims suffered approximately $1 million in damages.

  Crime Classification Manual Part II Chapter 10 B 35 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N Background CASE STUDY: 540: THREATS VIA THE INTERNET A Massachusetts juvenile committed a series of hacking incidents into Inter- net and telephone service providers; the theft of an individual’s personal information and the posting of it on the Internet; and making bomb threats to high schools in Florida and Massachusetts. All took place over a fifteen- month period.

  Crime Classification Manual Part II Chapter 10 B 34 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   Search Warrant Suggestions The search warrant for the offender’s location should list all computers and all forms of computer storage: disks, data CD-ROMs, DVDs, magnetic tapes, external hard drives, mini-drives (sometimes called memory sticks), flash memory modules, programming documentation, e-mail addresses (possible sources of malignant software creation programs), the computer and all its peripherals, and all program CD-ROMs. The search warrant should also include the offender’s Internet accounts.

  Crime Classification Manual Part II Chapter 10 B 33 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   Investigative Considerations The targeted computers’ logs should be analyzed in an attempt to determine the Internet protocol addresses of the sending computers.

Crime Classification Manual Part II Chapter 10 B 32 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   Common Forensic Findings. The computer of the targeted user will have logs and copies of the threatening messages. The offender’s computer should also have copies of the threats, as well as the user’s computer addresses, e-mail, and Internet protocol.

  Crime Classification Manual Part II Chapter 10 B 31 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   540: THREATS VIA THE INTERNET Defining Characteristics This crime occurs when a computer user is threatened over the Internet. Threats can be delivered by e-mail, instant messaging, and spam. Victimology. The computer user can be threatened with bodily harm, family and friends can be threatened with bodily harm, or the user’s business can be threatened with destruction.

    Crime Classification Manual Part II Chapter 10 B 30 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   : FRAUDULENT INTERNET TRANSACTIONS This crime occurs when a buyer purchases goods at an Internet auction and sends money but never receives the goods purchased. Another type of fraudulent Internet transaction is Web site fraud, also called shopping cart fraud. This crime involves the creation of a URL simi- lar to a legitimate site, and the unsuspecting user is apprised of large savings on the purchase of hard-to-obtain products. Accessing any one of the erroneous Web sites can lead to fraud.

  Crime Classification Manual Part II Chapter 10 B 29 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   Search Warrant Suggestions The search warrant for the offender’s location should list all computers and all forms of computer storage: disks, data CD-ROMs, DVDs, magnetic tapes, external hard drives, mini-drives (sometimes called memory sticks), flash memory modules, programming documentation, e-mail addresses (possible sources of malignant software creation programs), the computer and all its peripherals, and all program CD-ROMs. The search warrant should also include the offender’s Internet accounts.

  Crime Classification Manual Part II Chapter 10 B 28 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   Investigative Considerations The targeted computer should have its hard drive removed and analyzed by special computer software not only to determine the changed data but to search for possible Trojan horse software that tests for data checks and then destroys the corrupted data before they can be analyzed. All computer logs should be analyzed for suspicious activities, and all Internet activity should be searched for illegal access and messages.

  Crime Classification Manual Part II Chapter 10 B 27 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   : BANK FRAUD This crime occurs when money is illegally obtained from one bank account and transferred electronically to another account that is usually in another bank and typically another country. Access to the targeted bank is via the Internet. Wireless connections to the Internet are used to commit crimes, where it is difficult to identify the user.

  Crime Classification Manual Part II Chapter 10 B 26 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   Outcome Jiang was arrested on charges of computer fraud for attempting to gain access to the accounts of numerous subscribers of GoToMyPC.com. He was sentenced to twenty-seven months’ imprisonment, three years of supervised release, and $201,620 in restitution.

  Crime Classification Manual Part II Chapter 10 B 25 A STANDARD SYSTEM FOR INVESTIGATING AND CLASSIFYING VIOLENT CRIMES SECOND EDITIO N   The agents obtained a search warrant and went to Jiang’s home. Four desktops and a laptop whirred in his bedroom, and according to court documents, telltale signs of digital subterfuge were scattered about the room: sticky notes containing bank account numbers, Kinko’s credit card receipts, and books and manuals on hacking.