Finding, catching cybercriminals isn’t getting any easier

Most people are familiar with frustration from repeated robocalls and scam artist calls. Federal and local enforcement officials investigate the cybercrimes that target Arkansans, but despite the assistance, they are having a hard time arresting and prosecuting the perpetrators.

Between 2015 and 2016, more than 500,000 Americans reported being a victim of cybercrime, totaling losses of more than $2 billion, according to annual reports from the Federal Bureau of Investigation’s (FBI) Internet Crime Compliant Center. The same reports show more than 2,000 victims were Arkansans, reporting a loss of more than $8 million.

During that time, Arkansas Attorney General Leslie Rutledge assisted in making 11 arrests and closing more than nine cases related to cybercrimes, according to statistics from the AG’s website. However, those arrests were made by the Arkansas Internet Crimes Against Children Task Force for crimes related to child pornography and child endangerment.

Robocalls and other scams are low-hanging fruit for cybercriminals and hackers, but reports show they represent a large portion of cybercrime. In a typical week, the Arkansas AG’s office gets roughly 1,000 calls and several hundred emails reporting some form of scam or cybercrime, according to information from the AG’s office.

Few of the cases have any victim restitution, unless the victim can work with their credit card company or bank to retrieve the stolen funds and change the compromised information.

“It is very difficult to investigate these cases when the perpetrators are from out of the country,” Rutledge told the Northwest Arkansas Business Journal. “That is why education and prevention is the No. 1 key to avoid being taken advantage of.”

CRIMINALS IN DISGUISE
Public information officers from Sebastian, Washington and Benton County sheriff’s offices have reported zero arrests for perpetrators of cyber scams. County officials tend to work with state and federal authorities to apprehend online grifters, said Sgt. Shannon Jenkins with the Benton County Sheriff’s Office.

“We are seeing more and more of these kinds of cases going around,” Jenkins said. “Some of these cases may be local.  People will hear about this kind of thing and then try it around the area they live. We have several open investigations, and many are being worked with other organizations like Homeland Security.”

Jenkins added it is hard to spot the differences between local scammers and those in other countries because of the technology thieves use. High-tech swindlers commonly conceal their identity with free and open network software known as The Onion Router, or Tor, said Dale Thompson, a network security expert and professor of computer science and computer engineering at the University of Arkansas.

“They have a bunch of servers where people volunteer time, and you can route traffic through them,” Thompson said. “Every few minutes it changes the IP address to make it look like you are sitting in Afghanistan or Russia or Germany … so your IP address stays hidden.”

An IP address is a unique identifier for any machine connecting to a network. Tor allows users to hide their IP address and remain mostly anonymous. Internet fraudsters cover their tracks further with TAILS, or The Amnesic Incognito Live System, Thompson continued. TAILS is an operating system that uses random access memory (RAM), rather than read-only memory (ROM). This means it can be operated from a USB or jump drive without ever being recorded on the computer’s hard disk, further obfuscating the trail of evidence leading to them.

The programs are used to help computer con artists better “spoof” their victims. Spoof is a term that means disguising identity to appear as someone else, Thompson said. Most types of spoofing are illegal. The Truth in Caller ID Act prohibits using misleading or inaccurate caller ID information with the intent to defraud, cause harm or wrongly obtain anything of value, according to information provided from the Federal Communication Commission (FCC). As long as the court cannot prove that intent, spoofers can mislead victims with little to no consequence.

Even if scammers do not spoof their victims, police sometimes have trouble getting information from the companies that provide the internet connection, said officer Phillip Pevehouse with the Sebastian County Sheriff’s Office.

“Forensic investigation just looks up the IP address, and we sometimes can’t get past that because some internet service providers don’t have the reports or the information on the account,” Pevehouse said. “There are a lot of moving parts to internet addresses and service providers … most people only think of the big ones like AT&T or Cox, but there are a bunch of them that are out there.”

In July 2017, Rutledge joined 29 other states by signing a letter to the Federal Communications Commission (FCC) urging the organization to adopt new rules and policies that allow phone companies to block illegal robocalls, spoofed calls and calls that come from invalid numbers, unassigned numbers and blocked numbers. The AG’s office reported in November 2017 that it successfully persuaded the FCC to allow phone companies to adopt the new rules and procedures.

REPORTING IS ESSENTIAL
Rutledge’s office recently issued a warning to Arkansans about being spoofed on social media by hackers who use friends’ and relatives’ profiles to solicit financial help. Scammers, though, do not always disguise themselves as someone close to the victim, said officer Jay Cantrell with the Washington County Sheriff’s Office. Many people reported being spoofed by people posing as IRS and local law enforcement offices, Cantrell said.

“They even act like they are the sheriff’s office and get names of the officers and use them,” said Kelly Cantrell, public information officer of Washington County Sheriff’s Office. “They use this to target people to say you missed jury duty, or they have a warrant, and try to get them to pay right away over the phone or they will be arrested.”

She said she was called by someone pretending to be her husband, Jay Cantrell, and demanding she pay fines over the phone or receive jail time. She told the scammer he did not sound anything like her husband.

Even without arrests being made, the reports taken by law enforcement officials can help the larger state and federal organizations catch perpetrators, the Cantrells explained. Each report given to local law enforcement provides more information to help narrow the search, but some are too embarrassed to report falling for the scams, Kelly Cantrell said. This means vital information is lost because of the victims’ apprehension to report.

Authorities on all levels from municipal to federal government offer tips and tricks to better secure online information and how to avoid being conned. Their websites and social media pages list the most recent and relevant scams in the area, as well as ways to prevent them.