Dragnet On the Internet

Editors' note: We offer the following article to shed some light on how investigators in one large U.S. city are using technology to fight e-commerce crime.

You pick up your mail at the end of the month, open your credit card statement and instead of the $200 charge at Brooks Brothers you were expecting, you find $1,000 worth of charges in your name from bowties.com. But:

• You don't wear bow ties.
• Some thief has stolen your identity online.

Who can help?

The economic and cybercrime unit of the Philadelphia district attorney's office, that's who.

Formerly known as the Economic Crime Unit, the revamped version, headed by chief Leonard Deutchman, molded with the times when the prosecutors noticed just how much economic crimes and computer crimes overlap.

'Traditionally, the unit has handled complex economic criminal matters, in that no-man's-land between what the police have the capacity to handle and what the federal authorities are interested in pursuing,' Deutchman says.

Deutchman says that when he took over the unit in 1998, he soon realized the crimes he had to prosecute involved more than pure economics:

'It became clear that the line between economic crimes and computer crimes was becoming increasingly blurred.'

District Attorney Lynne Abraham tells a similar tale.

'We noticed more use of computers to commit a variety of offenses,' Abraham says. 'We wanted to see if we could prevent and detect crimes with computers. And it became apparent that one or two people conversant in computers in the office wasn't enough.'

In late 2000, Abraham asked City Council for the funds for equipment and manpower for the expanded unit. City Council agreed.

'This is an enormously productive and growing area of crime that just keeps growing,' she says.

The unit is now at the fullest capacity it's ever been, Deutchman said earlier this year, with eight prosecutors, four detectives and a paralegal.

The most basic economic crime involving computers is embezzlement, Deutchman says:

'Ten years ago, all of a business's records were generated by hand. Now they are all generated by computer.'

In order to prosecute an embezzlement case, the unit has to search the business' computer. Therefore, even if a prosecutor cannot search a computer for the necessary information himself or herself, he or she must understand how the software used works and be able to testify in court about it, Deutchman says.

'For example, someone might argue the ledger has been changed, and the investigator will know whether that can be true,' he says. 'In order to understand the crime, you have to understand how computers work.'

Deutchman says prosecutors in his office tend to fall in one of three categories in terms of their computer knowledge.

First is what is called the 'first responder,' the person serving the warrant, who has to know how to seize the computer without destroying the evidence inside.

The second level is investigative knowledge, or 'computer savvy.' People at this level will at least know what computer forensic tools are available, how the Internet works, what information an Internet service provider would have in its files and whom to call at an ISP to request that certain information be saved.

'This helps in terms of timing, moving warrants and arrests along more quickly,' Deutchman relates.

At the third level are the 'cybergeeks,' the ones who really know the ins and outs of computers and can 'image,' or copy, hard drives.

'You never search a hard drive,' Deutchman says. 'You always image it so as to not lose information.'

For most cases, Deutchman says, investigators need to be at the second level. Only about one or two in the unit are at the third level. Where does Deutchman fall on the scale?

'I would say at the high end of the investigative and low end of the geek,' he says.

Abraham seems a bit more impressed with Deutchman's skills.

'The guy is positively gifted on a computer,' she says. 'He knows the mechanics and the philosophy of the machine. He's lectured in many parts of the country. He's a well-known person.'

Deutchman named identity theft as one of the biggest crimes facing the unit right now.

'It's an outgrowth of e-commerce,' he explains. 'People have always pretended to be someone they're not, but now it's easier because your identity is little more than your name, your Social Security number and maybe your mother's maiden name.'

The problem has grown over the past 5 to 7 years, but it is beginning to lessen somewhat as credit card companies are starting to recognize warning signs, Deutchman reports.

Another major problem is counterfeit checks.

Counterfeiting, according to Deutchman, is a 'direct result' of computer programs and printers available now.

The unit also handles cases of harassment or threats sent over the Internet, forged property deeds, online auction fraud, home inspection fraud and crimes against the environment.

Deutchman has been with the DA's office for 18 years. He started in the appeals division, went through several trial units and spent 6 years in the narcotics department. He was working in the Insurance Fraud Unit when he became chief of the Economic Crimes Unit.

As an English major and math minor at the University of Pennsylvania, Deutchman first learned about computers on his own and through his work in the Narcotics Unit.

'I didn't come to the job with any specialized knowledge. But I always had an interest in computers,' he says. 'My job has taken me to areas where the law and technology interact. I worked in the narcotics unit, which involved a lot of wiretapping, where computers are most used. It's also where technology and the Constitution run up against each other most frequently.'

His knowledge later became more formalized through classes in computer forensics.

Most of the prosecutors in the unit have taken the same courses, he says, but added, 'Many of them are self-taught, too.'

The prosecutors in Deutchman's unit are lucky to have what he says is the only computer lab in a DA's office in the country, as far as he knows.

'[The lab is] an area that has computers and software hooked up so the target computer can have the hard drive copied byte by byte,' Deutchman says. 'Those copies can be searched using forensic software tools. You can recover evidence that's been deleted and then put that evidence into a report form.'

The detectives in the unit built the lab from the ground up, and it allows investigators to search and copy information rapidly.

As for the future of the unit, Deutchman's hopes are simple:

'I would like to continue doing what we're doing and do more of it. There are lots of complex economic criminal cases out there.'

Danielle N. Rodier is a senior reporter for The Legal Intelligencer.

Editors' note: We offer the following article to shed some light on how investigators in one large U.S. city are using technology to fight e-commerce crime.

You pick up your mail at the end of the month, open your credit card statement and instead of the $200 charge at Brooks Brothers you were expecting, you find $1,000 worth of charges in your name from bowties.com. But:

• You don't wear bow ties.
• Some thief has stolen your identity online.

Who can help?

The economic and cybercrime unit of the Philadelphia district attorney's office, that's who.

Formerly known as the Economic Crime Unit, the revamped version, headed by chief Leonard Deutchman, molded with the times when the prosecutors noticed just how much economic crimes and computer crimes overlap.

'Traditionally, the unit has handled complex economic criminal matters, in that no-man's-land between what the police have the capacity to handle and what the federal authorities are interested in pursuing,' Deutchman says.

Deutchman says that when he took over the unit in 1998, he soon realized the crimes he had to prosecute involved more than pure economics:

'It became clear that the line between economic crimes and computer crimes was becoming increasingly blurred.'

District Attorney Lynne Abraham tells a similar tale.

'We noticed more use of computers to commit a variety of offenses,' Abraham says. 'We wanted to see if we could prevent and detect crimes with computers. And it became apparent that one or two people conversant in computers in the office wasn't enough.'

In late 2000, Abraham asked City Council for the funds for equipment and manpower for the expanded unit. City Council agreed.

'This is an enormously productive and growing area of crime that just keeps growing,' she says.

The unit is now at the fullest capacity it's ever been, Deutchman said earlier this year, with eight prosecutors, four detectives and a paralegal.

The most basic economic crime involving computers is embezzlement, Deutchman says:

'Ten years ago, all of a business's records were generated by hand. Now they are all generated by computer.'

In order to prosecute an embezzlement case, the unit has to search the business' computer. Therefore, even if a prosecutor cannot search a computer for the necessary information himself or herself, he or she must understand how the software used works and be able to testify in court about it, Deutchman says.

'For example, someone might argue the ledger has been changed, and the investigator will know whether that can be true,' he says. 'In order to understand the crime, you have to understand how computers work.'

Deutchman says prosecutors in his office tend to fall in one of three categories in terms of their computer knowledge.

First is what is called the 'first responder,' the person serving the warrant, who has to know how to seize the computer without destroying the evidence inside.

The second level is investigative knowledge, or 'computer savvy.' People at this level will at least know what computer forensic tools are available, how the Internet works, what information an Internet service provider would have in its files and whom to call at an ISP to request that certain information be saved.

'This helps in terms of timing, moving warrants and arrests along more quickly,' Deutchman relates.

At the third level are the 'cybergeeks,' the ones who really know the ins and outs of computers and can 'image,' or copy, hard drives.

'You never search a hard drive,' Deutchman says. 'You always image it so as to not lose information.'

For most cases, Deutchman says, investigators need to be at the second level. Only about one or two in the unit are at the third level. Where does Deutchman fall on the scale?

'I would say at the high end of the investigative and low end of the geek,' he says.

Abraham seems a bit more impressed with Deutchman's skills.

'The guy is positively gifted on a computer,' she says. 'He knows the mechanics and the philosophy of the machine. He's lectured in many parts of the country. He's a well-known person.'

Deutchman named identity theft as one of the biggest crimes facing the unit right now.

'It's an outgrowth of e-commerce,' he explains. 'People have always pretended to be someone they're not, but now it's easier because your identity is little more than your name, your Social Security number and maybe your mother's maiden name.'

The problem has grown over the past 5 to 7 years, but it is beginning to lessen somewhat as credit card companies are starting to recognize warning signs, Deutchman reports.

Another major problem is counterfeit checks.

Counterfeiting, according to Deutchman, is a 'direct result' of computer programs and printers available now.

The unit also handles cases of harassment or threats sent over the Internet, forged property deeds, online auction fraud, home inspection fraud and crimes against the environment.

Deutchman has been with the DA's office for 18 years. He started in the appeals division, went through several trial units and spent 6 years in the narcotics department. He was working in the Insurance Fraud Unit when he became chief of the Economic Crimes Unit.

As an English major and math minor at the University of Pennsylvania, Deutchman first learned about computers on his own and through his work in the Narcotics Unit.

'I didn't come to the job with any specialized knowledge. But I always had an interest in computers,' he says. 'My job has taken me to areas where the law and technology interact. I worked in the narcotics unit, which involved a lot of wiretapping, where computers are most used. It's also where technology and the Constitution run up against each other most frequently.'

His knowledge later became more formalized through classes in computer forensics.

Most of the prosecutors in the unit have taken the same courses, he says, but added, 'Many of them are self-taught, too.'

The prosecutors in Deutchman's unit are lucky to have what he says is the only computer lab in a DA's office in the country, as far as he knows.

'[The lab is] an area that has computers and software hooked up so the target computer can have the hard drive copied byte by byte,' Deutchman says. 'Those copies can be searched using forensic software tools. You can recover evidence that's been deleted and then put that evidence into a report form.'

The detectives in the unit built the lab from the ground up, and it allows investigators to search and copy information rapidly.

As for the future of the unit, Deutchman's hopes are simple:

'I would like to continue doing what we're doing and do more of it. There are lots of complex economic criminal cases out there.'

Danielle N. Rodier is a senior reporter for The Legal Intelligencer.