462 lines
21 KiB
Plaintext
462 lines
21 KiB
Plaintext
==Phrack Magazine==
|
|
|
|
Volume Four, Issue Forty-Four, File 5 of 27
|
|
|
|
****************************************************************************
|
|
|
|
Computer Cop Prophile
|
|
|
|
by The Grimmace
|
|
|
|
|
|
|
|
The following file is something I thought of and did
|
|
a LOT of research on before writing. It's something that
|
|
I haven't seen in PHRACK and I've been a devout fan of
|
|
this zine since the beginning.
|
|
|
|
The "PHRACK PROPHILES" on hackers and phreakers give
|
|
readers an insight into the movers and shakers of the P/H
|
|
world, but how about a profile or profiles on the
|
|
anti-hacker/phreaker establishment that seems to be
|
|
growing by leaps and bounds lately?
|
|
|
|
In the past years we've seen cops and feds who know
|
|
nothing about computers and/or telephone systems bungle their
|
|
way through search warrants and arrests and have had some good
|
|
laughs at their expense. But now it seems that the "computer
|
|
cops", the feds especially, are putting a big push on training
|
|
agents in the "tricks of the trade" and their conviction rate
|
|
is getting better.
|
|
|
|
The primary source of this training is the Federal Law
|
|
Enforcement Training Center in Glynco, Georgia, where they're
|
|
teaching computer seizure and analysis techniques,
|
|
computer-targeted search warrants, and telecommunications fraud
|
|
investigations. (They're very accommodating about giving out
|
|
information on the phone as long as you tell them you're a
|
|
cop). The FBI Academy in Quantico also has a computer crimes
|
|
course.
|
|
|
|
On the technical side of things, there's an organization
|
|
called IACIS which stands for the International Association
|
|
of Computer Investigative Specialists based in Portland,
|
|
Oregon, and which consists of members of both local law
|
|
enforcement agencies nationwide as well as various and
|
|
sundry federal agencies. This group teaches and certifies
|
|
cops in how to get evidence from computer systems that can't be
|
|
attacked in court (Of course, anything CAN be attacked, but
|
|
getting the evidence squashed is not always a sure thing unless
|
|
the judge is a computerphobe).
|
|
|
|
As much satisfaction as we've gained at the expense of
|
|
the US Secret Service from the Steve Jackson Games case, it's
|
|
widely publicized problems may prove to be a double-edged sword
|
|
hanging over our heads. Law enforcement learned a LOT of lessons
|
|
from mistakes made in that investigation.
|
|
|
|
Like most of you, I've spent a lot of years
|
|
exploring computer systems (usually those belonging to others)
|
|
and personally feel that I've done nothing wrong (know the
|
|
feeling?). I'm sure others across the country also can
|
|
conduct a little socially-engineered reconnaissance and
|
|
get the lowdown on some of the people we NEVER want to see
|
|
knocking on our doors with a sledge hammer in the middle of the
|
|
night.
|
|
|
|
This profile contains information on the ONLY computer
|
|
crime cop I could identify in the Louisville/Jefferson County
|
|
area after calling all the major departments posing as a writer
|
|
for a law enforcement magazine doing a survey. Information
|
|
about him was obtained not only from his department, but from
|
|
sources in the local and federal court systems, Ma Bell
|
|
Security, and the Federal Law Enforcement Training Center. Lt.
|
|
Baker is *not* a potential donor to the CPSR or EFF to say the
|
|
least.
|
|
|
|
I'm currently compiling similar information on other
|
|
law enforcement types in the Secret Service, Columbus Ohio PD,
|
|
Dallas PD, Georgia Bureau of Investigation and members of Ma
|
|
Bell's Data Security Group in Atlanta. Baker was just the
|
|
closest to me so I started with him. If I can get the
|
|
information I've requested, then future submissions will
|
|
also include lesson plans furnished by FLETC on their training
|
|
courses and analysis protocols suggested by the USSS...heh...heh.
|
|
|
|
Yours,
|
|
|
|
The Grimmace
|
|
|
|
|
|
*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*
|
|
COMPUTER-COP PROFILE I
|
|
|
|
LT. BILL BAKER
|
|
|
|
JEFFERSON COUNTY POLICE DEPARTMENT
|
|
LOUISVILLE, KENTUCKY
|
|
|
|
|
|
INFORMATION COMPILED BY:
|
|
|
|
** THE GRIMMACE **
|
|
|
|
*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*
|
|
|
|
|
|
NAME: Bill Baker
|
|
RANK: Lieutenant
|
|
|
|
AGENCY: Jefferson County Police Department
|
|
768 Barret Ave.
|
|
Louisville, Kentucky 40204
|
|
|
|
AGE: 43
|
|
YEARS OF COMPUTER EXP: 13
|
|
|
|
YEARS AS A COP: 18
|
|
YEARS IN COMPUTER/
|
|
TELECOM CRIME: 8
|
|
|
|
TRAINING: Federal Law Enforcement Training Ctr.
|
|
Glynco, Ga.
|
|
- Telecommunications Crime
|
|
Telecom Fraud
|
|
Cellular Fraud
|
|
PBX Fraud
|
|
- Computer Crime
|
|
Illegal Access Crimes
|
|
Computer Crime Inves.
|
|
Seized System Analysis
|
|
|
|
FBI Academy
|
|
Quantico, Va.
|
|
- Computers in Narcotics Investigations
|
|
- Computer Crime Investigations
|
|
|
|
National Intelligence Academy
|
|
Ft. Lauderdale, Fl.
|
|
- Supervising Intelligence Operations
|
|
Surveillance Techniques
|
|
Electronic Tracking
|
|
Electronic Eavesdroping
|
|
Video Evidence Techniques
|
|
- Telephone Systems
|
|
Wiretaps
|
|
Dialed Number Recorders
|
|
Pager/Fax Intercepts
|
|
Technical Telephony Course
|
|
|
|
PREVIOUS ASSIGNMENTS: Patrol
|
|
Criminal Investigations/Burglary
|
|
Criminal Investigations/Homicide
|
|
Crime Prevention
|
|
Special Investigations/Vice-Intel
|
|
|
|
MEMBER: Communications Fraud Control Association
|
|
Washington, D.C.
|
|
|
|
PUBLICATIONS: Various computer/telecommunications
|
|
crime oriented articles for assorted
|
|
law enforcement and computer industry
|
|
magazines (i.e., POLICE CHIEF, DATA TODAY)
|
|
|
|
|
|
Posing as a freelance writer from the "Law Enforcement
|
|
Journal", I made calls to local police agencies all over this
|
|
area asking about their Computer Crime Units and received
|
|
replies ranging from "What are you talking about?" to "Maybe
|
|
FRAUD handles that...hey, Charlie...do the FRAUD guys do
|
|
anything with compoooters?". So much for the Louisville
|
|
Division of Police...no fear there, right?
|
|
|
|
But I decided to push on since Louisville, though not a
|
|
hotbed of phreakers/hackers, IS the latest home of TAP MAGAZINE
|
|
(a la Blitzkrieg BBS and the Predat0r) and has a smattering of
|
|
"hometown" folks engaged in less than legal activities through
|
|
the local phone lines.
|
|
|
|
The call made to the Jefferson County Police got me a
|
|
solid response of "You'll have to talk to Lt. Bill Baker. Hey,
|
|
Charlie, where's Lt. Baker working now?" (This guy is so low
|
|
key his own department doesn't even know where he works!) They
|
|
finally decide he's someplace called "Adam Station" and
|
|
through "various" contacts and a friendly local attorney who
|
|
rarely pays for telephone calls himself, I managed to obtain
|
|
quite a bit of information about Lt. Baker and his obviously
|
|
misguided quest.
|
|
|
|
Lt. Baker is fairly typical of the "new breed" of
|
|
high-tech investigator currently being churned out by the
|
|
various federal training schools. He's aggressive and, from
|
|
talking to other members of his department, thought of as a
|
|
"computer weenie" who was probably a hacker himself before he
|
|
embraced the "dark side" of "the FORCE". (I personally believe
|
|
that this may be more fact than fantasy after talking to him on
|
|
the phone since he seems to know more about phreaking and
|
|
hacking than one would think would be taught in the
|
|
aforementioned federal institutes of higher learning.)
|
|
|
|
I finally managed to speak with Lt. Baker on the phone
|
|
and gave him my "writing about computer crime" rap which he
|
|
bought with little suspicion. The following are excerpts from
|
|
the recording I made of the conversation [comments in brackets
|
|
are mine]:
|
|
|
|
TG: How would you rate the progress of computer and
|
|
telecommunications crime investigations in this area?
|
|
|
|
Baker: There have been some good cases made here, but there's
|
|
still a long way to go. The main problem is that there
|
|
hasn't been a push from local businesses in this area to combat
|
|
these types of crimes. Most of'em don't want to admit they've
|
|
been hit from the outside. If there's no complaints,
|
|
then the departments aren't likely to want to spend the money
|
|
to dig up additional crime, right?
|
|
|
|
TG: Of the hackers you've worked on, what kind of capabilities
|
|
do they have and how good do you think they are?
|
|
|
|
Baker: Well, hackers and phreaks are like any other cross-section
|
|
of a criminal group...there are some that are very good
|
|
and some that are pitiful. The best thing you can say
|
|
about working hacker/phreaker cases is that a lot of them
|
|
catch themselves. They have huge egos and tend to brag
|
|
a good deal about what they've done and how they did it.
|
|
|
|
TG: Does that mean that you don't think a computer crime
|
|
investigator has to be as good as the criminals
|
|
he chases...I mean, because a lot of these people leave
|
|
so many clues behind? How would you rate your ability
|
|
in this field?
|
|
|
|
Baker: Nope...not at all. I think that as technology gets better
|
|
so will the crooks. Let's keep the record straight here.
|
|
Sure, there are bozos out there who read a how-to file in
|
|
an old PHRACK and decide that they have the knowledge
|
|
they need to nuke the phone company or ride a VAX like
|
|
a Hell's Angel rides a Harley. Those are the easy ones.
|
|
The ones who -write- [author's emphasis] the technical
|
|
articles in PHRACK are the ones to worry about. There
|
|
are some stomp-down [??] incredibly knowledgeable
|
|
individuals in circulation blasting away with their modems
|
|
at any target of opportunity.
|
|
|
|
TG: You didn't mention your own ability for investigating
|
|
these people.
|
|
|
|
Baker: (Laughs) Yeah, well...let's say I know enough to get by
|
|
and am smart enough to know that there are no absolute
|
|
experts.
|
|
|
|
TG: How would you comment on the Steve Jackson Games case?
|
|
Do you think the Secret Service set a lot of bad
|
|
precedents?
|
|
|
|
Baker: (Laughs) Noooooooo....sorry, pal. That's been jawed to death
|
|
in every phreak/hack mag, legal journal, and Internet
|
|
newsgroup in existence and I'm not about to stick my
|
|
neck out on that one, OK? I will say that everyone learned
|
|
a lot from that case and I seriously doubt if you'll see the
|
|
same set of problems reoccurring in future cases. Maybe
|
|
the CSPR or EFF hired guns can come up with a new group
|
|
of loopholes, in which case we'll have to find new ways
|
|
to circumvent those attacks.
|
|
|
|
TG: You sound a little critical of the EFF and CSPR efforts
|
|
in their defense of so-called "computer criminals".
|
|
|
|
Baker: Well, I'm sure that they believe in what they're doing.
|
|
They must to invest that much cash and energy. But I
|
|
think there has to be some middle ground agreed upon
|
|
rather than just whining about "all information should
|
|
be free" and "if I can get into your system then I should
|
|
be allowed to look around". I'm not going to launch into
|
|
a diatribe on organizations that I don't agree with. I'm
|
|
simply going to work harder at dotting every "i" and
|
|
crossing every "t" to make my cases more secure. Stealing
|
|
telephone service is a crime, defrauding businesses is a
|
|
crime, gaining unauthorized access into someone else's
|
|
computer system is, in most states, a crime, and even if
|
|
there's no law on the books making it a crime, it's
|
|
wrong.
|
|
|
|
TG: Since by your own statement, you feel that high-tech
|
|
crime investigation is still in its infancy, what groups
|
|
or organizations would you say are in the lead in trying
|
|
to combat this type of crime?
|
|
|
|
Baker: The most significant two I know are the Federal Law
|
|
Enforcement Training Center in Glynco, Georgia, and the
|
|
Communications Fraud Control Association based out of
|
|
Washington, D.C. FLETC [he pronounces it FLET-SEE]
|
|
probably has the finest computer crimes training program
|
|
in the country. They bring in acknowledged experts and
|
|
don't cut the students any slack as far as learning to
|
|
do things correctly and, most importantly, legally. The
|
|
CFCA is the leader in Telecommunications security and
|
|
provide training and assistance to telecom and computer
|
|
companies along with law enforcement agencies all over
|
|
the country.
|
|
|
|
TG: Why do you think so few law enforcement agencies know
|
|
anything about computer crime investigations? Are they
|
|
going to leave the phreaks to the feds?
|
|
|
|
Baker: Nah...I don't think you can simplify it that easily.
|
|
Most departments don't have dedicated computer crime units
|
|
because of lack of funds to support such a unit, lack of
|
|
trained personnel, lack of understanding of the magnitude
|
|
of the problem, fear of increasing their crime stats or
|
|
any combination of those reasons. When I first got into
|
|
this, there weren't any experts. John Maxfield and his
|
|
BOARDSCAN operation got a lot of talk in the hack/phreak
|
|
journals and there were a small handful of others, but
|
|
no real standout authorities. I talked to an awful lot
|
|
of people before I hooked up with Clo Fleming at SPRINT
|
|
Security who helped me a lot.
|
|
|
|
TG: Do you still trade information with SPRINT?
|
|
|
|
Baker: I have contacts with all the major telecom carriers.
|
|
The training I got at FLETC really helped make some valuable
|
|
contacts. But I guess SPRINT and Clo Fleming would be
|
|
my first choice simply because they were willing to help
|
|
me when no one else would. You can't operate in this
|
|
environment without contacts in the OCC's. It can't be
|
|
done and the OCC's [Other Common Carriers] are a lot
|
|
more willing to assist law enforcement now than they
|
|
were in 1985. Of course, the telecommunications industry
|
|
is taking a $4-5 billion hit a year from fraud and that
|
|
has a lot to do with it.
|
|
|
|
TG: Do you subscribe to the hacker/phreaker magazines?
|
|
|
|
Baker: Sure...I subscribe to 2600 and get copies of some
|
|
others. I think PHRACK's probably the best overall,
|
|
but I can't afford the subscription rate they've imposed
|
|
on government agencies since Craig Neidorf took the hit
|
|
for publishing the "golden" E911 document. I've learned
|
|
a ton of stuff over the years from PHRACK and wish it
|
|
were still free, but they have a right to their info
|
|
just like the people who own the systems attacked by
|
|
hackers. It'd be kind of hypocritical for me to rip off
|
|
PHRACK and then turn and prosecute some other guy for
|
|
ripping off information from another source, right?
|
|
|
|
TG: What problems do you foresee in the future in computer
|
|
and telecom crime investigations?
|
|
|
|
Baker: Jeez...why don't you ask me when we'll have world peace
|
|
or something easy? OK, I think we'll probably see the
|
|
larger departments being forced to play catch-up with
|
|
the current trends and always being a little behind in
|
|
this area. I also think you'll see more officers losing
|
|
cases and being sued, a la SJG, until they get the
|
|
specific training required to handle these cases the
|
|
right way. Turning seized systems over to the local
|
|
"computer guy" in the department is going to cost'em in
|
|
the long run because every lawyer who gets one of these
|
|
cases is going to compare it bit by bit with the SJG
|
|
case to see if there's anything there he can use for
|
|
his client's defense.
|
|
|
|
TG: There has been a lot of discussion about whether or not
|
|
computer systems should be seized rather than just
|
|
making copies of the data for evidence. What is your
|
|
policy on equipment seizures when working cases like
|
|
this?
|
|
|
|
Baker: First of all, I don't go on fishing expeditions with
|
|
search warrants. If I have enough to convict a guy then
|
|
I get the warrant. I take everything that's there and
|
|
do the analysis. I've had cases where the defendant has
|
|
requested copies of data he needed for various reasons
|
|
and I've had no problems with furnishing them as long
|
|
as the request is reasonable. I ask for forfeiture of
|
|
the equipment if I can link it to the crime because the
|
|
law says I can. If I can't link the computers, then I
|
|
give them back...simple as that. I think it's kind of
|
|
interesting that most hackers or phreaks will refuse to
|
|
take a guilty plea for a reduced charge, even if I have
|
|
them stone cold and they're looking at a 99.999999%
|
|
chance of conviction in a jury trial, if it means
|
|
they'll lose their equipment in the deal. It makes good
|
|
leverage in certain situations.
|
|
|
|
TG: Did you have any part in Operation Sun-Devil?
|
|
|
|
Baker: Nope. Though I'd have liked to. I was on a lot of the
|
|
systems taken down in Sun-Devil.
|
|
|
|
TG: You said you were on some of the systems busted in the
|
|
Sun-Devil operation, are you still on phreak/hack
|
|
boards and would you name any?
|
|
|
|
Baker: (Laughs a lot) I think I'll pass on naming systems I'm
|
|
on, OK? That'd be cheating. (Laughs again) But I get
|
|
around enough to know what's going on. There are lots
|
|
of investigators out there calling the boards.
|
|
|
|
TG: I appreciate your time, Lt. Baker, and would like to ask
|
|
one last question. What motivates you in these cases
|
|
since the alleged "theft" involves pretty intangible
|
|
property?
|
|
|
|
Baker: Motivation? Hmmmm...I suppose you could say it's the
|
|
chase that motivates me more than the catch, though
|
|
the catch is pretty good, too. These cases tend to
|
|
be more one-on-one than some other types and the
|
|
adversaries can be very good at covering their tracks.
|
|
Hell, I probably have more in common with the people
|
|
I target than they'd like to believe. As for the
|
|
"intangibility" of the stolen goods, well, that's why
|
|
we have court systems, isn't it...to define those
|
|
little details.
|
|
|
|
TG: A lot of computer crime investigators would rather stay
|
|
in the background, but you don't seem to have taken that
|
|
position. Why not?
|
|
|
|
Baker: Well, like anyone involved in anything relatively new,
|
|
as opposed to the old standard type crimes like murder
|
|
and armed robbery, it's to my benefit to have anything
|
|
printed informing people of the problems created by
|
|
this type of activity. We all pay the price for telecom
|
|
fraud, credit card fraud, data loss due to illegal
|
|
access to computers and all the rest. But the people
|
|
involved in these crimes, for the most part, don't
|
|
exhibit the same profiles as the so-called "violent"
|
|
criminals. In fact, I've had some very friendly
|
|
conversations with a number of phreaks and hackers.
|
|
Investigators who have problems would probably have
|
|
them no matter what crimes they were investigating.
|
|
I never assume that I'm smarter than anyone I'm
|
|
chasing and I don't rub their noses in it when I make
|
|
a case. Just like I don't lose sleep when I just can't
|
|
seem to get that last piece of the puzzle and one gets
|
|
away. It's hide-and-seek in cyberspace. Pretty good
|
|
game, actually.
|
|
|
|
For what it's worth, there it is. The interview printed here
|
|
doesn't contain a lot of the bullshit that was thrown back and
|
|
forth during our conversation, just the relevant details which
|
|
tend to give an insight into this guy.
|
|
|
|
Frankly, I was impressed by the fact that he didn't seem
|
|
anything like I had expected after reading horror stories about
|
|
other agencies and investigators. This guy was personable and
|
|
maybe that's an indicator that he's dangerous. Never, ever
|
|
underestimate your opponents -- even if they do sound like
|
|
"good ole boys" and talk to you like you're the best friend
|
|
they ever had. Always remember that COPS INVENTED SOCIAL
|
|
ENGINEERING!
|
|
|
|
My next "computer cop" profile will deal with a rising star in
|
|
the U.S. Secret Service and his connections to the Guidry
|
|
Group, a consulting organization working for the cellular phone
|
|
industry in combating cellular fraud.
|
|
|
|
|
|
|