FBI Cyber Division

Last updated

Cyber Division
Federal Bureau of Investigation - Cyber Division.svg
Emblem of the Cyber Division
Active2002–present
(21–22 years)
Country United States
Agency Federal Bureau of Investigation
Part of Criminal, Cyber, Response, and Services Branch
Headquarters J. Edgar Hoover Building
Washington, D.C.
AbbreviationCyD [1]
Commanders
Current
commander
Assistant Director Bryan A. Vorndran [2]

The Cyber Division (CyD) is a Federal Bureau of Investigation division which heads the national effort to investigate and prosecute internet crimes, including "cyber based terrorism, espionage, computer intrusions, and major cyber fraud." This division of the FBI uses the information it gathers during investigation to inform the public of current trends in cyber crime. It focuses around three main priorities: computer intrusion, identity theft, and cyber fraud. It was created in 2002. [3]

Contents

[4] In response to billions of dollars lost in cyber-crimes, that have had devastating impact on the United States' economic and national security, the FBI created a main "Cyber Division at FBI Headquarters to "address cyber crime in a coordinated and cohesive manner." Branching out from there, specially trained cyber squads have been placed in 56 field offices across the United States, staffed with "agents and analysts who protect against computer intrusions, theft of intellectual property and personal information, child pornography and exploitation, and online fraud." Due to internet threats around the world, the FBI has developed "cyber action teams" that travel globally to help in "computer intrusion cases" and gather information that helps to identify cyber crimes that are most dangerous to our national security.

[4] Keeping the focus not only on national security but also on threats to citizens of the United States, the FBI has long been focused on identity theft, which is a growing concern for American citizens. Since fiscal year 2008 through the middle of fiscal year 2013, the number of identity theft related crimes investigated by the Bureau across all programs have resulted in more than 1,600 convictions, $78.6 million in restitutions, $4.6 billion in recoveries, and $6.8 billion in fines.

High priority is given to investigations that involve terrorist organizations or intelligence operations sponsored by foreign governments, which FBI calls "national security cyber intrusions". [4] The Cyber Division has primary responsibility for the FBI's efforts to counter national security–related cyber intrusions. [5] The Cyber Division priorities in rank order are:

(a) cyber intrusions;
(b) child sexual exploitation;
(c) intellectual property rights; and
(d) internet fraud. [4]

FBI Cyber Division works through the National Cyber Investigative Joint Task Force (NCIJTF) and cyber investigative squads located in each FBI field office. [4] Since 2008, NCIJTF is the primary American agency responsible for coordinating cyber threats investigations, and liaisons with Central Intelligence Agency (CIA), Department of Defense (DOD), Department of Homeland Security (DHS), and National Security Agency (NSA). [6]

A large number of cases investigated by the Cyber Division come from the Internet Fraud Complaint Center (IFCC), which in 2002 received about 75,000 complaints. [6] [ needs update ]

Some cases that the Cyber Division has investigated included: dismantling a ring of criminals using malware to redirect users to rogue DNS servers (Operation Ghost Click); [7] taking down a botnet based on Coreflood trojan used for fraud; [8] taking down a group responsible for robbing over 2,000 ATMs at once; [9] taking down a group of about 100 involved in phishing (Operation Phish Phry); [10] and taking down of the DarkMarket cyber crime forum used by criminals. [11]

Organization

See also

Related Research Articles

<span class="mw-page-title-main">Computer security</span> Protection of computer systems from information disclosure, theft or damage

Computer security is the protection of computer software, systems and networks from threats that can lead to unauthorized information disclosure, theft or damage to hardware, software, or data, as well as from the disruption or misdirection of the services they provide.

<span class="mw-page-title-main">Cybercrime</span> Type of crime based in computer networks

Cybercrime encompasses a wide range of criminal activities that are carried out using digital devices and/or networks. These crimes involve the use of technology to commit fraud, identity theft, data breaches, computer viruses, scams, and expanded upon in other malicious acts. Cybercriminals exploit vulnerabilities in computer systems and networks to gain unauthorized access, steal sensitive information, disrupt services, and cause financial or reputational harm to individuals, organizations, and governments.

Internet security is a branch of computer security. It encompasses the Internet, browser security, web site security, and network security as it applies to other applications or operating systems as a whole. Its objective is to establish rules and measures to use against attacks over the Internet. The Internet is an inherently insecure channel for information exchange, with high risk of intrusion or fraud, such as phishing, online viruses, trojans, ransomware and worms.

The Australian High Tech Crime Centre (AHTCC) are hosted by the Australian Federal Police (AFP) at their headquarters in Canberra. Under the auspices of the AFP, the AHTCC is party to the formal Joint Operating Arrangement established between the AFP, the Australian Security Intelligence Organisation and the Computer Network Vulnerability Team of the Australian Signals Directorate.

Rizon is an Internet Relay Chat (IRC) network. The IRC network itself ranks number 5 among the largest IRC networks. Rizon is popular with many anime fansubbing groups who work online, many of whom provide their content through XDCC via IRC bots in their distribution channels. It is also used by many users of eRepublik as a means of communication. File sharing of other copyrighted material such as Warez is also common in some channels on the network.

Computer fraud is the use of computers, the Internet, Internet devices, and Internet services to defraud people or organizations of resources. In the United States, computer fraud is specifically proscribed by the Computer Fraud and Abuse Act (CFAA), which criminalizes computer-related acts under federal jurisdiction and directly combats the insufficiencies of existing laws. Types of computer fraud include:

Operation: Bot Roast is an operation by the FBI to track down bot herders, crackers, or virus coders who install malicious software on computers through the Internet without the owners' knowledge, which turns the computer into a zombie computer that then sends out spam to other computers from the compromised computer, making a botnet or network of bot infected computers. The operation was launched because the vast scale of botnet resources poses a threat to national security.

<span class="mw-page-title-main">Internet Crime Complaint Center</span> Division of the FBI for Internet activity

The Internet Crime Complaint Center (IC3) is a division of the Federal Bureau of Investigation (FBI) concerning suspected Internet-facilitated criminal activity. The IC3 gives victims a convenient and easy-to-use reporting mechanism that alerts authorities of suspected criminal or civil violations on the Internet. The IC3 develops leads and notifies law enforcement agencies at the federal, state, local and international level. Information sent to the IC3 is analyzed and disseminated for investigative and intelligence purposes to law enforcement and for public awareness.

<span class="mw-page-title-main">Department of Defense Cyber Crime Center</span> United States defense organization

The Department of Defense Cyber Crime Center (DC3) is designated as a Federal Cyber Center by National Security Presidential Directive 54/Homeland Security Presidential Directive 23, as a Department of Defense (DoD) Center Of Excellence for Digital and Multimedia (D/MM) forensics by DoD Directive 5505.13E, and serves as the operational focal point for the Defense Industrial Base (DIB) Cybersecurity program. DC3 operates as a Field Operating Agency (FOA) under the Inspector General of the Department of the Air Force.

<span class="mw-page-title-main">Computer Crime and Intellectual Property Section</span> United States federal law enforcement agency

The Computer Crime and Intellectual Property Section (CCIPS) is a section of the Criminal Division of the U.S. Department of Justice in charge of investigating computer crime and intellectual property crime. They are additionally responsible for prosecuting privacy invasions by criminals such as hackers, cyberstalkers, and purveyors of mobile spyware, and specializing in the search and seizure of digital evidence in computers and on networks.

Zeus is a Trojan horse malware package that runs on versions of Microsoft Windows. It is often used to steal banking information by man-in-the-browser keystroke logging and form grabbing. Zeus is spread mainly through drive-by downloads and phishing schemes. First identified in July 2007 when it was used to steal information from the United States Department of Transportation, it became more widespread in March 2009. In June 2009 security company Prevx discovered that Zeus had compromised over 74,000 FTP accounts on websites of such companies as the Bank of America, NASA, Monster.com, ABC, Oracle, Play.com, Cisco, Amazon, and BusinessWeek. Similarly to Koobface, Zeus has also been used to trick victims of technical support scams into giving the scam artists money through pop-up messages that claim the user has a virus, when in reality they might have no viruses at all. The scammers may use programs such as Command prompt or Event viewer to make the user believe that their computer is infected.

Avalanche was a criminal syndicate involved in phishing attacks, online bank fraud, and ransomware. The name also refers to the network of owned, rented, and compromised systems used to carry out that activity. Avalanche only infected computers running the Microsoft Windows operating system.

Cyber crime, or computer crime, refers to any crime that involves a computer and a network. The computer may have been used in the commission of a crime, or it may be the target. Netcrime refers, more precisely, to criminal exploitation of the Internet. Issues surrounding this type of crime have become high-profile, particularly those surrounding hacking, copyright infringement, identity theft, child pornography, and child grooming. There are also problems of privacy when confidential information is lost or intercepted, lawfully or otherwise.

There is no commonly agreed single definition of “cybercrime”. It refers to illegal internet-mediated activities that often take place in global electronic networks. Cybercrime is "international" or "transnational" – there are ‘no cyber-borders between countries'. International cybercrimes often challenge the effectiveness of domestic and international law, and law enforcement. Because existing laws in many countries are not tailored to deal with cybercrime, criminals increasingly conduct crimes on the Internet in order to take advantages of the less severe punishments or difficulties of being traced.

The Criminal, Cyber, Response, and Services Branch (CCRSB) is a service within the Federal Bureau of Investigation (FBI). The CCRSB is responsible for investigating financial crime, white-collar crime, violent crime, organized crime, public corruption, violations of individual civil rights, and drug-related crime. In addition, the Branch also oversees all computer-based crime related to counterterrorism, counterintelligence, and criminal threats against the United States.

<span class="mw-page-title-main">European Cybercrime Centre</span>

The European Cybercrime Centre is the body of the Police Office (Europol) of the European Union (EU), headquartered in The Hague, that coordinates cross-border law enforcement activities against computer crime and acts as a centre of technical expertise on the matter.

<span class="mw-page-title-main">Microsoft Digital Crimes Unit</span> Internet security organization

The Microsoft Digital Crimes Unit (DCU) is a Microsoft sponsored team of international legal and internet security experts employing the latest tools and technologies to stop or interfere with cybercrime and cyber threats. The Microsoft Digital Crimes Unit was assembled in 2008. In 2013, a Cybercrime center for the DCU was opened in Redmond, Washington. There are about 100 members of the DCU stationed just in Redmond, Washington at the original Cybercrime Center. Members of the DCU include lawyers, data scientists, investigators, forensic analysts, and engineers. The DCU has international offices located in major cities such as: Beijing, Berlin, Bogota, Delhi, Dublin, Hong Kong, Sydney, and Washington, D.C. The DCU's main focuses are child protection, copyright infringement and malware crimes. The DCU must work closely with law enforcement to ensure the perpetrators are punished to the full extent of the law. The DCU has taken down many major botnets such as the Citadel, Rustock, and Zeus. Around the world malware has cost users about $113 billion and the DCU's jobs is to shut them down in accordance with the law.

Operation Tovar was an international collaborative operation carried out by law enforcement agencies from multiple countries against the Gameover ZeuS botnet, which was believed by the investigators to have been used in bank fraud and the distribution of the CryptoLocker ransomware.

The following outline is provided as an overview of and topical guide to computer security:

<span class="mw-page-title-main">Carding (fraud)</span> Crime involving the trafficking of credit card data

Carding is a term of the trafficking and unauthorized use of credit cards. The stolen credit cards or credit card numbers are then used to buy prepaid gift cards to cover up the tracks. Activities also encompass exploitation of personal data, and money laundering techniques. Modern carding sites have been described as full-service commercial entities.

References

  1. Garrity, Robert J. (February 13, 2004). "FBI's Role in the Process of Preventing the Entry of Terrorists into the U.S." FBI. Retrieved August 16, 2022.
  2. "Bryan A. Vorndran". Federal Bureau of Investigation . Retrieved August 16, 2022.
  3. "FBI's Ability to Address the National Security Cyber Intrusion Threat" (PDF). justice.gov. p. 2.
  4. 1 2 3 4 5 Cyber Crime, p. 2 ()
  5. FBI's Ability to Address the National Security Cyber Intrusion Threat, p. ii (PDF)
  6. 1 2 Michael Kraft; Edward Marks (February 2, 2012). U. S. Government Counterterrorism: A Guide to Who Does What. CRC Press. pp. 173–174. ISBN   978-1-4665-1629-8 . Retrieved December 28, 2012.
  7. "FBI — International Cyber Ring That Infected Millions of Computers Dismantled". Federal Bureau of Investigation. Archived from the original on June 30, 2012. Retrieved December 28, 2012.
  8. "FBI — Botnet Operation Disabled". Federal Bureau of Investigation. Archived from the original on January 16, 2013. Retrieved December 28, 2012.
  9. "FBI — 2,100 ATMs Hit at Once". Federal Bureau of Investigation. November 8, 2008. Retrieved December 28, 2012.
  10. "FBI — Operation 'Phish Phry'". Federal Bureau of Investigation. September 29, 2011. Retrieved December 28, 2012.
  11. "FBI — Dark Market Takedown". Federal Bureau of Investigation . Retrieved December 28, 2012.