The_Breifing_April_2012 - National White Collar Crime Center

The BriefingApril2012NW3CBoard of DirectorsChairmanGlen B. Gainer, IIIWest Virginia StateAuditor’s OfficeDirector of NW3CDon BrackmanNon-Regional DirectorsJim HoodMississippi Office of theAttorney GeneralJack HorneckerFremont CountySheriff’s Office, WYBill WilliamsLos Angeles PoliceDepartment, CARegional DirectorsGreat LakesLarry TurnerIndiana State PoliceMid-AtlanticMike BrownBedford CountySheriff’s Office, VAMidwestKen NixClayton PoliceDepartment, MOMountainTom JarvieGreen River PoliceDepartment, WYNortheastChristopher CottaRhode Island Office ofthe Attorney GeneralSouth CentralTom McCormickLouisiana Departmentof JusticeSoutheastCorbett LewisSouth Carolina LawEnforcement DivisionWestSean RooneyCalifornia Departmentof CorporationsAJustice Department and FBI Raise Awareness ofDisaster Fraud Hotlinerecent release fromthe Departmentof Justice, the FBI andthe National Centerfor Disaster Fraud(NCDF) highlightsthe need to be awareof disaster fraud andcall the NCDF hotlineat 866-720-5721 to reportsuspected fraudulentactivity pertaining to recentdisasters.With the many recent tornadoesthroughout the Midwest and hurricane seasonfast approaching, there is likely to bean increase in this type of fraudulent activity.The NCDF hotline helps people avoidbecoming victims of scams. The hotline isstaffed by a live operator 24 hours a day, sevendays a week, for the purpose of reporting suspectedscams being perpetrated by criminals inthe aftermath of disasters.The Department of Justice and the FBIwant to remind the public to verify informationabout anyone soliciting donations on behalf of disastervictims before giving money. Solicitationscan originate from emails, websites, door-to-doorcollections, mailings and telephone calls.Those who would like to donate shouldadhere to the following tips:• Do not respond to any unsolicited (spam)incoming emails, including clicking linkscontained within those messages, becausethey may contain computer viruses.• Be skeptical of individuals representingthemselves as surviving victims or officialsasking for donations via email or socialnetworking sites.• Beware of organizations with copycatnames similar to, but not exactly, the sameas those of reputable charities.• Rather than following a purported link toa website, verify the existence and legitimacyof non-profit organizations by utilizingvarious Internet-based resources, suchas search engines.• Be cautious of emails that claim to show picturesof the disaster areas in attached files,because the files may contain viruses. Onlyopen attachments from known senders.• To ensure that contributions are receivedand used for intended purposes, make donationsdirectly to known organizationsrather than relying on others to make thedonation on your behalf.• Do not be pressured into making contributions;reputable charities do not use coercivetactics.• Do not give your personalor financial informationto anyone whosolicits contributions.Providing such informationmay compromiseyour identity andmake you vulnerableto identity theft.Avoid cash donationsif possible. Pay by debit orcredit card, or write a checkdirectly to the charity. Do notmake checks payable to individuals.• Be aware that legitimate charities do notnormally solicit donations via money transferservices.• Know that most legitimate charitiesmaintain websites ending in .org ratherthan .com.In addition to raising public awareness,the NCDF is the intake center for all disaster relieffraud. Therefore, if you observe that someonehas submitted a fraudulent claim for disasterrelief, or any other suspected fraudulentactivities pertaining to the receipt of governmentfunds as part of disaster relief or cleanup,please contact the NCDF.If you believe that you have been a victimof fraud by a person or organization solicitingrelief funds on behalf of tornado victims, orif you discover fraudulent disaster relief claimssubmitted by a person or organization, contactthe NCDF by phone at (866) 720-5721, fax at(225) 334-4707 or email at disaster@leo.gov.You can also report suspicious email solicitationsor fraudulent websites to the InternetCrime Complaint Center (IC3) at www.ic3.gov.1

NW3C offers an interactive Internet ComplaintSeach and InvestigationSystem (ICSIS) training course to providelaw enforcement with the skillsthey need to extract investigative leadsand case-related information from theInternet Crime Complaint Center (IC3)database. Now, the ICSIS course is alsoavailable online, providing a convenientway for law enforcement to receive stepby-stepinstruction on using this valuable tool.The course gives students an expanded knowledgeof the database and introduces them to tools they can useto build cases. Students learn how to search the databaseICSIS Training Onlinefor relevant complaints. They will also learn how to buildcase files for individual investigative use, aswell as for shared use with others who havesimilar leads. Students are also introducedto both internal email usage within the systemand direct analytical support optionsoffered by IC3.To obtain access to the ICSIS onlinetraining, please contact IC3 SupervisorTerri Shaffer at tshaffer@nw3c.org. To learnmore about the ICSIS training, go to www.nw3c.org/ocr/courses_desc.cfm?cn=ICSIS, or contact NW3C ProgramServices Specialist Mel Joiner at mjoiner@nw3c.org.NW3C Success Story: Operation CheckmateCase Name: OperationCheckmateAgency: The U.S. Secret Service,The U.S. PostalInspection Service andNW3CAssistant U.S. AttorneyTimothy Belevetz (SouthernDistrict of Virginia) recentlycommended NW3Cenforcement analysts KathrynMalbon Rinker and Cindy Willamsonfor their contributionto the successful prosecutionof 12 defendants in connectionwith a nationwide identity theftring. Dubbed “Operation Checkmate,”this investigation uncoveredlosses of more than $1.5 million.In 2008, the U.S. Secret Serviceand the U.S. Postal InspectionService began the investigation intothis identity theft ring and collectedthousands of pages of bank records,NW3C Enforcement Analysts Cindy Williamson andKathryn Malbon Rinkerwire transfer receipts, flight recordsand surveillance photographs. Investigatorsgave the data to Rinker andWilliamson, who then analyzed it foreach participant in the scheme. Thisanalysis allowed the agents and prosecutorsto quickly review the evidencethat supported charges against eachindividual and link conspiratorsin this extensive scheme. Rinkerand Williamson compiled this informationand developed spreadsheetsthat quantified the loss attributedto the criminal actionsof each defendant.According to a statementby Belevetz, “These spreadsheetswere indispensible tools duringthe plea negotiations with defensecounsel during the sentencingphase of each defendant’s case.”The sentences for the two leadersin the scheme were 200 and136 months in prison. Belevetzalso stated, “Rinker and Williamsonconsistently turned the informationthey were given around quickly andprovided clear and well-organizedanalysis.” Their professionalism andexpertise in this field have been recognizedbefore, as both were recipientsof the United States Attorney’s OfficePublic Service Award in 2010.2 Membership Newsletter April 2012

Scam AlertBrowser Bot InfectionWhat happens when your webbrowser becomes the “bot?”A look at a current Trojan infectioncampaign similar to the infamousZeus malware makes open-sourceWeb browser users a bit nervous.The open-source browser cannow function like a bot and acceptcommands. It can process the contentof the current page where it is located,redirect the user, halt the loading ofparticular pages, steal passwords, runexecutables and even kill itself. Unfortunately,the kill function is a bitexcessive and deletes critical systemfiles, which in turn prevents usersfrom logging in properly.The way it builds the maliciouscode into the open-source browser isnotable, because it uses the design ofthe browser against itself. In the past,researchers have seen a threat createa malicious extension. Users wouldhave to disable that particular add-on,which would eradicate the threat. Forthis particular piece of malware, thisis not the case. Since it is a component,it does not appear as an add-onin the browser’s Add-ons Manager inthe same manner as other extensionsand plug-ins. Furthermore, due to thedesign of the open-source browser,the Trojan will reinstall every time thebrowser establishes a connection tothe Internet.To read about scam alerts orget more information about IC3, visitwww.ic3.gov.Social SleuthingSocial media has become astaple in the lives of millions.Everyday people share statusupdates, pictures, videos andmore. All of this information hasled to a Web that is filled withuser-generated content. Thisnew Web or Web 2.0 is moreaccessible and is constantly fedby its users. People’s willingnessto publicly share informationhas also provided a valuableresource for law enforcement.However, there are some things to consider when scouringthrough social media for clues.More than 70 percent of law enforcement officialsuse social media for investigative purposes, according to arecent survey by the International Association of Chiefs ofPolice (IACP). The information gathered via social mediacan prove valuable for solving cases and getting convictions.A search through social media can tell the whereabouts ofa person, the mindset they were in during a certain timeframe and, in some cases, even show pictures or video of acrime taking place.However, once this information is gathered it mustbe validated. Just because someone’s Facebook page showsthat they “checked in” at Starbucks® does not prove they wereactually the ones who did. Others can check in for them,passwords can be shared and accounts can be hacked. Recentcases using social media evidence have been dismissedby judges who understand that some information gatheredthrough social media cannot be validated beyond a reasonabledoubt.This does not mean this information isn’t valuable,it just means it needs to be corroborated or backed up withmore concrete evidence. Some of the more concrete evidencethat can be found via socialmedia may come from identifyinggeotag information embedded inpictures, finding friends or connections,and following trends or patternsin what is shared online. Thisinformation may not be the smokinggun (unless it is one of thosefamous YouTube videos of a crimebeing committed), but it can be thekey to breaking the case.Not only are law enforcement agenciesusing social media to gather informationfor current cases, but some are being proactiveand using social media to monitor trends and informationthat may lead to criminal or terrorist activity. Monitoring socialmedia and even looking at people’s sites for informationhas become a legal gray area. If the information is public, itis available for investigative use, but privacy organizationslike the American Civil Liberties Union and other groupsare looking at law enforcement’s use of social media with acritical eye, and in some cases publicly decrying its use.It is important for investigators to know the varioussocial media outlets, to understand which ones are public,like Twitter, and which ones can be private, like Facebook,and also to have contacts with social media companies sothat they can work directly with them to gather content andinformation. IACP has created the Center for Social Media(www.iacpsocialmedia.org) as a resource on the topic. Also,NW3C has partnered with IACP to offer social media trainingfor law enforcement. To learn more about the training,contact Bob Hopper, Computer Crime Manager for NW3Cat rhopper@nw3c.org.Be sure to watch for the spring edition of NW3C’sInformant magazine, which will feature more stories and informationon social media.Membership Newsletter April 20123

Officer Steven GreenMobile Police Department, ALSergeant Michael MayMonongalia County Sheriff ’sDepartment, WVGreat LakesAuburn Hills Police Department, MIEuclid Police Department, OHNorth Lebanon Township PoliceDepartment, PARising Sun Police Department, INUpper Moreland Township Police, PAWeatherly Police Department, PAMid-AtlanticEddyville Police Department, KYFulton County Sheriff ’s Office, KYMaysville Police Department, KYMunfordville Police Department, KYVirginia Department of Motor Vehicles -Enforcement Division, VAMidwestBrooklyn Police Department, WICalhoun County Sheriff ’s Office, ILForest Lake Police Department, MNGlendale Heights Police Department, ILLoves Park Police Department, ILMurphysboro Police Department, ILSturtevant Police Department, WIPublic Websitewww.nw3c.orgMembership Websitehttps://members.nw3c.orgRemembering Our Member Agencies’Heroes Killed in the Line of Duty*February 2012Trooper Tony RadulescuWashington State Patrol, WADetective David WhiteClay County Sheriff ’s Office, FLFebruary 2012 New MembersMountainFort Morgan Police Department, COMarana Police Department, AZNortheastBerlin Police Department, NJConcord City Prosecutor’s Office, NHErie County Sheriff ’s Office, NYSea Girt Police Department, NJSouth CentralAlabama Alcoholic Beverage Control Board -Law Enforcement Division, ALArab Police Department, ALCentre Police Department, ALUniversity of Oklahoma Health SciencesCenter Police Department, OKSoutheastLamar County Sheriff ’s Office, GAMadison County Sheriff ’s Department, GAPalmetto Police Department, FLSylvester Police Department, GAWestBeverly Hills Police Department, CA2012 NW3C Scheduled Training Classeshttp://www.nw3c.org/resources/the_briefing.cfmContact Information for NW3C ServicesMember Servicesmembership@nw3c.org804-967-6210Investigative Support800-221-4424, ext. 3520*Source: www.odmp.org(as of April 10, 2012)Training877-628-7674, ext. 2234IC3www.ic3.govhttps://icsis.nw3c.org800-251-3221UpcomingMortgage FraudTraining ClassesAs part of a larger collaborativeBJA effort, NW3Cis offering mortgage fraudtraining for investigatorsand prosecutors. The 2-1/2day courses are available inthe following locations:• Indianapolis, INMay 1 - 3, 2012• Hillsborough, NJJune 5 - 7, 2012• Buffalo Grove, ILAugust 1 - 3, 2012• Carson City, NVSeptember 11 - 13, 2012For more information orto register:http://www.nw3c.org/ocr/courses_desc.cfm?cn=Mortgage FraudThe Winter 2012Informant NowOnlineClick the link below to readin-depth articles on IdentityTheft, learn more abouthow you can benefit fromprograms like PerpHoundand much more!www.nw3c.orgFollow NW3C@NW3CNewsBureau of Justice AssistanceU.S. Department of JusticeThis project was supported by Grant No. 2010-BE-BX-K023 awarded by the Bureau of Justice Assistance. The Bureau of Justice Assistance is a component of the Office of Justice Programs, which also includes the Bureau of Justice Statistics, theNational Institute of Justice, the Office of Juvenile Justice and Delinquency Prevention, the Office for Victims of Crime, and the Office of Sex Offender Sentencing, Monitoring, Apprehending, Registering, and Tracking. Points of view or opinions inthis document are those of the author and do not necessarily represent the official position or policies of the U.S. Department of Justice. The National White Collar Crime Center (NW3C) is the copyright owner of this document. This informationmay not be used or reproduced in any form without express written permission of NW3C. For questions or additional information, please contact Kimberly Williams, Communications Manager at 1-800-221-4424 ext. 3320 or kwilliams@nw3c.org.NW3C TM , IC3® and ICSIS TM are trademarks of NW3C, Inc. and may not be used without written permission.© 2012. NW3C, Inc. d/b/a the National White Collar Crime Center. All rights reserved.Search:NationalWhiteCollarCrimeCenter4