federal investigation and prosecution of computer and intellectual property crimes matthew devlin...
TRANSCRIPT
Federal Investigation and Federal Investigation and Prosecution of Computer and Prosecution of Computer and Intellectual Property CrimesIntellectual Property Crimes
Matthew DevlinMatthew DevlinAssistant United States AttorneyAssistant United States Attorney
Computer Hacking and Intellectual Property CoordinatorComputer Hacking and Intellectual Property Coordinator
United States Attorney’s OfficeUnited States Attorney’s Office
Western District of TexasWestern District of Texas
Austin, TexasAustin, Texas
11Nov 2012Nov 2012
OverviewOverview Computer Hacking & Intellectual Property Computer Hacking & Intellectual Property
(CHIP) Program and Network(CHIP) Program and Network
DOJ Computer Crimes & Intellectual Property DOJ Computer Crimes & Intellectual Property Section (CCIPS)Section (CCIPS)
Types of CasesTypes of Cases• Computer CrimesComputer Crimes• Intellectual Property Rights CrimesIntellectual Property Rights Crimes
Working With Victim CompaniesWorking With Victim Companies
22Nov 2012Nov 2012
What is the CHIP Program?What is the CHIP Program? Nationwide CHIP NetworkNationwide CHIP Network
At least one CHIP prosecutor At least one CHIP prosecutor in each of 93 U.S. Attorney’s in each of 93 U.S. Attorney’s OfficesOffices• More than 250 CHIP attorneys More than 250 CHIP attorneys
nationwidenationwide
CHIP Units in 25 U.S. CHIP Units in 25 U.S. Attorney’s OfficesAttorney’s Offices
• Austin/San AntonioAustin/San Antonio• Dallas, San Francisco, Los Angeles, Dallas, San Francisco, Los Angeles,
Sacramento, San Diego, Seattle Sacramento, San Diego, Seattle Denver, New Haven, Tampa, Miami, Denver, New Haven, Tampa, Miami, Atlanta, Chicago, Baltimore, Boston, Atlanta, Chicago, Baltimore, Boston, Detroit, Kansas City, Newark. Detroit, Kansas City, Newark. Brooklyn, New York, Philadelphia, Brooklyn, New York, Philadelphia, Pittsburgh, Nashville, Alexandria, and Pittsburgh, Nashville, Alexandria, and Washington, D.C.Washington, D.C.
33Nov 2012Nov 2012
CHIP ResponsibilitiesCHIP Responsibilities
Prosecute Core OffensesProsecute Core Offenses• Computer CrimeComputer Crime• Intellectual Property Rights OffensesIntellectual Property Rights Offenses
In-house Subject Matter ExpertiseIn-house Subject Matter Expertise• Advice and training to prosecutors and agentsAdvice and training to prosecutors and agents
Outreach: Law EnforcementOutreach: Law Enforcement• Incident ResponseIncident Response• Search Warrants / 2703 ProcessSearch Warrants / 2703 Process• Advice and SupportAdvice and Support
Outreach: CommunityOutreach: Community• Familiarize IP community with law enforcement optionsFamiliarize IP community with law enforcement options
44Nov 2012Nov 2012
Cybercrime.govCybercrime.gov
Public Page Public Page Latest News Latest News
ReleasesReleases Documents & Documents &
ReportsReports Contact InfoContact Info CasesCases
55Nov 2012Nov 2012
IP EnforcementIP Enforcement
National IP Rights Coordination Center (DHS)National IP Rights Coordination Center (DHS)• Multi-agency clearinghouseMulti-agency clearinghouse• FBI, DHS, USPIS, FDA, other agenciesFBI, DHS, USPIS, FDA, other agencies
DOJ CCIPSDOJ CCIPS U.S. Attorney’s Offices – CHIP ProgramU.S. Attorney’s Offices – CHIP Program
Nov 2012Nov 2012 66
DOJ International PresenceDOJ International Presence
Intellectual Property Law Intellectual Property Law Enforcement Coordinator Enforcement Coordinator (IPLEC)(IPLEC)
• Bangkok, ThailandBangkok, Thailand China/Southeast AsiaChina/Southeast Asia
• Sofia, BulgariaSofia, Bulgaria Eastern EuropeEastern Europe
77Nov 2012Nov 2012
International CooperationInternational Cooperation G8 24/7 Network G8 24/7 Network
• 49 countries 49 countries (map, right)(map, right)
• DOJ (CCIPS) is the U.S. point DOJ (CCIPS) is the U.S. point of contactof contact
• Around-the-clock assistance Around-the-clock assistance availableavailable
Council of Europe Convention Council of Europe Convention on Cybercrimeon Cybercrime• Facilitates international Facilitates international
investigation/ prosecution investigation/ prosecution • Minimizes substantive and Minimizes substantive and
procedural obstaclesprocedural obstacles
88Nov 2012Nov 2012
Federal Judicial Districts in Texas
SouthernSouthernDistrictDistrict
HoustonHouston
CorpusCorpusChristiChristi
BrownsvilleBrownsville
LaredoLaredo
McAllenMcAllen
EasternEasternDistrictDistrict
ShermanSherman
TylerTyler
BeaumontBeaumont
LufkinLufkin
WesternWesternDistrictDistrict
El PasoPecos
Midland
Del RioSan Antonio
Austin
Waco
Alpine
NorthernNorthernDistrictDistrict
AmarilloAmarillo
LubbockLubbock
Fort WorthFort WorthAbileneAbilene DallasDallas
San AngeloSan Angelo
99Nov 2012Nov 2012
Computer Crime CasesComputer Crime Cases
Hacking / Unauthorized AccessHacking / Unauthorized Access• Virus/Worm attacksVirus/Worm attacks• Denial of service attacksDenial of service attacks• Theft of data and electronically stored infoTheft of data and electronically stored info
Computer FraudComputer Fraud• PhishingPhishing
Internet Fraud/TheftInternet Fraud/Theft
1010Nov 2012Nov 2012
Cybercrime StatutesCybercrime Statutes
Identity Theft (18 U.S.C. § 1028)Identity Theft (18 U.S.C. § 1028) Aggravated Identity Theft (18 U.S.C. § 1028A)Aggravated Identity Theft (18 U.S.C. § 1028A) Access Device Fraud (18 U.S.C. § 1029)Access Device Fraud (18 U.S.C. § 1029) Computer Fraud and Abuse (18 U.S.C. § 1030)Computer Fraud and Abuse (18 U.S.C. § 1030) CAN-SPAM Act (18 U.S.C. § 1037)CAN-SPAM Act (18 U.S.C. § 1037) Wire Fraud (18 U.S.C. § 1343)Wire Fraud (18 U.S.C. § 1343) Communications Interference (18 U.S.C. § 1362)Communications Interference (18 U.S.C. § 1362) Wiretap Act (18 U.S.C. § 2511)Wiretap Act (18 U.S.C. § 2511) Unlawful Access to Stored Communications (18 U.S.C. § Unlawful Access to Stored Communications (18 U.S.C. §
2701)2701)
1111Nov 2012Nov 2012
Intellectual Property CasesIntellectual Property Cases
Criminal Copyright Infringement Criminal Copyright Infringement • Digital Millennium Copyright ActDigital Millennium Copyright Act
Trademark / Counterfeit Product offensesTrademark / Counterfeit Product offenses• Online PiracyOnline Piracy• Counterfeit Pharmaceuticals Counterfeit Pharmaceuticals
Economic EspionageEconomic Espionage Theft of Trade SecretsTheft of Trade Secrets
1212Nov 2012Nov 2012
IPR Criminal StatutesIPR Criminal Statutes Copyrighted WorksCopyrighted Works
• Criminal Infringement of a Copyright Criminal Infringement of a Copyright (18 U.S.C. § 2319 & 17 U.S.C. § 506) - Up to 5 years(18 U.S.C. § 2319 & 17 U.S.C. § 506) - Up to 5 years
• Trafficking in Counterfeit Labels for Software & Music Trafficking in Counterfeit Labels for Software & Music (18 U.S.C. § 2318) - Up to 5 years(18 U.S.C. § 2318) - Up to 5 years
• Trafficking in Recordings/Videos of Live Musical PerformancesTrafficking in Recordings/Videos of Live Musical Performances(18 U.S.C. § 2319A) - Up to 5 years(18 U.S.C. § 2319A) - Up to 5 years
• Unauthorized Recording of Movies in a TheaterUnauthorized Recording of Movies in a Theater (18 U.S.C. § 2319B) – Up to 3 years (18 U.S.C. § 2319B) – Up to 3 years
• Circumvention of Copyright Protection Systems Circumvention of Copyright Protection Systems (17 U.S.C. §§ 1201-1205) - Up to 5 years(17 U.S.C. §§ 1201-1205) - Up to 5 years
• Unauthorized Reception of Cable Services Unauthorized Reception of Cable Services (47 U.S.C. § 553) - 6 mos (individual use) / 2 years (commercial (47 U.S.C. § 553) - 6 mos (individual use) / 2 years (commercial gain)gain)
1313Nov 2012Nov 2012
IPR Criminal StatutesIPR Criminal Statutes
TrademarksTrademarks• Trafficking in Counterfeit Goods & Services Trafficking in Counterfeit Goods & Services
(18 U.S.C. § 2320) - Up to 10 years(18 U.S.C. § 2320) - Up to 10 years
Trade SecretsTrade Secrets• Economic Espionage Economic Espionage
(18 U.S.C. § 1831) - Up to 15 years(18 U.S.C. § 1831) - Up to 15 years• Theft of Trade Secrets Theft of Trade Secrets
(18 U.S.C. § 1832) - Up to 10 years (corporation - up to $5M (18 U.S.C. § 1832) - Up to 10 years (corporation - up to $5M fine)fine)
• Confidentiality- Protective orders and other actions authorized Confidentiality- Protective orders and other actions authorized (18 U.S.C. § 1835)(18 U.S.C. § 1835)
1414Nov 2012Nov 2012
18 U.S.C. § 183118 U.S.C. § 1831Economic Espionage ActEconomic Espionage Act
(a) In general.(a) In general.--Whoever, intending or knowing that the offense will benefit any foreign government, foreign --Whoever, intending or knowing that the offense will benefit any foreign government, foreign instrumentality, or foreign agent, knowingly--instrumentality, or foreign agent, knowingly--
• (1)(1) steals, or without authorization appropriates, takes, carries away, or conceals, or by fraud, artifice, or steals, or without authorization appropriates, takes, carries away, or conceals, or by fraud, artifice, or deception obtains a trade secret;deception obtains a trade secret;
• (2)(2) without authorization copies, duplicates, sketches, draws, photographs, downloads, uploads, alters, without authorization copies, duplicates, sketches, draws, photographs, downloads, uploads, alters, destroys, photocopies, replicates, transmits, delivers, sends, mails, communicates, or conveys a trade secret;destroys, photocopies, replicates, transmits, delivers, sends, mails, communicates, or conveys a trade secret;
• (3)(3) receives, buys, or possesses a trade secret, knowing the same to have been stolen or appropriated, receives, buys, or possesses a trade secret, knowing the same to have been stolen or appropriated, obtained, or converted without authorization;obtained, or converted without authorization;
• (4)(4) attempts to commit any offense described in any of paragraphs (1) through (3); or attempts to commit any offense described in any of paragraphs (1) through (3); or
• (5)(5) conspires with one or more other persons to commit any offense described in any of paragraphs (1) conspires with one or more other persons to commit any offense described in any of paragraphs (1) through (3), and one or more of such persons do any act to effect the object of the conspiracy,through (3), and one or more of such persons do any act to effect the object of the conspiracy,
shall, except as provided in subsection (b), be fined not more than $500,000 or imprisoned not more than 15 shall, except as provided in subsection (b), be fined not more than $500,000 or imprisoned not more than 15 years, or both.years, or both.
(b) Organizations.(b) Organizations.--Any organization that commits any offense described in subsection (a) shall be fined not more --Any organization that commits any offense described in subsection (a) shall be fined not more than $10,000,000.than $10,000,000.
Nov 2012Nov 2012 1515
18 U.S.C. § 183218 U.S.C. § 1832Theft of Trade SecretsTheft of Trade Secrets
(a)(a) Whoever, with intent to convert a trade secret, that is related to or included in a product that is produced for or Whoever, with intent to convert a trade secret, that is related to or included in a product that is produced for or placed in interstate or foreign commerce, to the economic benefit of anyone other than the owner thereof, and placed in interstate or foreign commerce, to the economic benefit of anyone other than the owner thereof, and intending or knowing that the offense will, injure any owner of that trade secret, knowingly--intending or knowing that the offense will, injure any owner of that trade secret, knowingly--
• (1)(1) steals, or without authorization appropriates, takes, carries away, or conceals, or by fraud, artifice, or steals, or without authorization appropriates, takes, carries away, or conceals, or by fraud, artifice, or deception obtains such information;deception obtains such information;
• (2)(2) without authorization copies, duplicates, sketches, draws, photographs, downloads, uploads, alters, without authorization copies, duplicates, sketches, draws, photographs, downloads, uploads, alters, destroys, photocopies, replicates, transmits, delivers, sends, mails, communicates, or conveys such destroys, photocopies, replicates, transmits, delivers, sends, mails, communicates, or conveys such information;information;
• (3)(3) receives, buys, or possesses such information, knowing the same to have been stolen or appropriated, receives, buys, or possesses such information, knowing the same to have been stolen or appropriated, obtained, or converted without authorization;obtained, or converted without authorization;
• (4)(4) attempts to commit any offense described in paragraphs (1) through (3); or attempts to commit any offense described in paragraphs (1) through (3); or
• (5)(5) conspires with one or more other persons to commit any offense described in paragraphs (1) through (3), conspires with one or more other persons to commit any offense described in paragraphs (1) through (3), and one or more of such persons do any act to effect the object of the conspiracy,and one or more of such persons do any act to effect the object of the conspiracy,
shall, except as provided in subsection (b), be fined under this title or imprisoned not more than 10 years, or both.shall, except as provided in subsection (b), be fined under this title or imprisoned not more than 10 years, or both.
(b)(b) Any organization that commits any offense described in subsection (a) shall be fined not more than $5,000,000. Any organization that commits any offense described in subsection (a) shall be fined not more than $5,000,000.
Nov 2012Nov 2012 1616
Trade SecretTrade Secret (18 U.S.C. § 1839) (18 U.S.C. § 1839)
all forms and types of financial, business, scientific, technical, economic, or all forms and types of financial, business, scientific, technical, economic, or engineering information, including patterns, plans, compilations, program devices, engineering information, including patterns, plans, compilations, program devices, formulas, designs, prototypes, methods, techniques, processes, procedures, formulas, designs, prototypes, methods, techniques, processes, procedures, programs, or codes, whether tangible or intangible, and whether or how stored, programs, or codes, whether tangible or intangible, and whether or how stored, compiled, or memorialized physically, electronically, graphically, photographically, or compiled, or memorialized physically, electronically, graphically, photographically, or in writing if …”in writing if …”
• The owner has taken reasonable measures to keep such information secret - AND –The owner has taken reasonable measures to keep such information secret - AND –
• The information derives independent economic value, actual or potential, from not The information derives independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable through proper means being generally known to, and not being readily ascertainable through proper means by, the publicby, the public
““owner” means the person or entity in whom or in which rightful legal or equitable title owner” means the person or entity in whom or in which rightful legal or equitable title to, or license in, the trade secret is reposed.to, or license in, the trade secret is reposed.
1717Nov 2012Nov 2012
Foreign Instrumentality/AgentForeign Instrumentality/Agent (18 U.S.C. § 1839) (18 U.S.C. § 1839)
““foreign instrumentality” foreign instrumentality” means any agency, bureau, means any agency, bureau, ministry, component, institution, association, or any ministry, component, institution, association, or any legal, commercial, or business organization, corporation, legal, commercial, or business organization, corporation, firm, or entity that is substantially owned, controlled, firm, or entity that is substantially owned, controlled, sponsored, commanded, managed, or dominated by a sponsored, commanded, managed, or dominated by a foreign government;foreign government;
““foreign agent” foreign agent” means any officer, employee, proxy, means any officer, employee, proxy, servant, delegate, or representative of a foreign servant, delegate, or representative of a foreign government;government;
Nov 2012Nov 2012 1818
Confidentiality & Non-DisclosureConfidentiality & Non-Disclosure (18 U.S.C. § 1835) (18 U.S.C. § 1835)
In any prosecution or other proceeding under this In any prosecution or other proceeding under this chapter, the court shall enter such orders and take such chapter, the court shall enter such orders and take such other action as may be necessary and appropriate to other action as may be necessary and appropriate to preserve the confidentiality of trade secrets, consistent preserve the confidentiality of trade secrets, consistent with the requirements of the Federal Rules of Criminal with the requirements of the Federal Rules of Criminal and Civil Procedure, the Federal Rules of Evidence, and and Civil Procedure, the Federal Rules of Evidence, and all other applicable laws. An interlocutory appeal by the all other applicable laws. An interlocutory appeal by the United States shall lie from a decision or order of a United States shall lie from a decision or order of a district court authorizing or directing the disclosure of any district court authorizing or directing the disclosure of any trade secret.trade secret.
Nov 2012Nov 2012 1919
Criminal Enforcement of IPRCriminal Enforcement of IPR
Criminal charges can be brought when there is Criminal charges can be brought when there is willfulwillful or or knowingknowing infringement. infringement.
Criminal cases require a higher burden of proof: Criminal cases require a higher burden of proof: “Beyond a reasonable doubt”“Beyond a reasonable doubt”
Remedies: incarceration, fines, and restitutionRemedies: incarceration, fines, and restitution Common factors affecting whether to charge a criminal Common factors affecting whether to charge a criminal
violation include:violation include:• Organized Criminal InvolvementOrganized Criminal Involvement
• Public Health and Safety ConcernsPublic Health and Safety Concerns
• Commercial Nature of ViolationCommercial Nature of Violation
• Amount of Loss & HarmAmount of Loss & Harm
• Violation of Previous JudgmentViolation of Previous Judgment
2020Nov 2012Nov 2012
Criminal Investigation and Criminal Investigation and Prosecution TeamProsecution Team
Coordinate investigative and legal Coordinate investigative and legal strategystrategy
Focus On Electronic EvidenceFocus On Electronic Evidence• Determine source IP address(es) Determine source IP address(es) • Seize ComputersSeize Computers• Email Search WarrantsEmail Search Warrants
Traditional Investigative Steps Traditional Investigative Steps • Search Warrant / SurveillanceSearch Warrant / Surveillance• Undercover / Confidential informantsUndercover / Confidential informants• Banking / Transaction RecordsBanking / Transaction Records• ConfessionConfession
2121Nov 2012Nov 2012
Why Report Cyber/IPR Crime?Why Report Cyber/IPR Crime?
Perpetrators are organized and large-scale Perpetrators are organized and large-scale violatorsviolators
Anyone can be - and many have been - a Anyone can be - and many have been - a victim . . . and may be again.victim . . . and may be again.
Help prevent future violations & lossesHelp prevent future violations & losses Ensure the costs of engaging in criminal Ensure the costs of engaging in criminal
activities outweigh the benefitsactivities outweigh the benefits Public companies likely must disclose anywayPublic companies likely must disclose anyway The sooner, the betterThe sooner, the better
2222Nov 2012Nov 2012
Why Report?Why Report?
Enforcing IP Rights Can:Enforcing IP Rights Can:• Improve product-related health and safetyImprove product-related health and safety• Foster growth of economic industries Foster growth of economic industries
(software, high tech, etc.)(software, high tech, etc.)• Foster creativityFoster creativity• Create incentive for investmentCreate incentive for investment• Fulfill international treaty obligationsFulfill international treaty obligations
2323Nov 2012Nov 2012
The Criminal Process: The Criminal Process: What to ExpectWhat to Expect
Initial report to law enforcementInitial report to law enforcement• Results of internal investigation?Results of internal investigation?• Loss/Damage valuationLoss/Damage valuation• Civil remedies should always be consideredCivil remedies should always be considered• Sting operation?Sting operation?
LE will use best efforts to minimize disruption to normal business LE will use best efforts to minimize disruption to normal business operationsoperations
Victim cooperationVictim cooperation• Establish Ownership / Unauthorized AccessEstablish Ownership / Unauthorized Access• Identify Counterfeit ProductsIdentify Counterfeit Products• Address Technical Issues Address Technical Issues
Intrusion issuesIntrusion issues Proving trade secretProving trade secret
Evidence gatheringEvidence gathering• GJ subpoenasGJ subpoenas• Search Warrants / 2703 processSearch Warrants / 2703 process• Evidence preservationEvidence preservation
2424Nov 2012Nov 2012
The Criminal Process:The Criminal Process:ProsecutionProsecution
ProsecutionProsecution• Plea negotiationsPlea negotiations• IndictmentIndictment• Notification to victim of significant prosecution eventsNotification to victim of significant prosecution events
DiscoveryDiscovery• Rule 16, FRCrPRule 16, FRCrP• Brady obligationsBrady obligations• Protective OrderProtective Order SentencingSentencing
Loss/Damage amountLoss/Damage amount RestitutionRestitution ForfeitureForfeiture
2525Nov 2012Nov 2012
The Criminal Process:The Criminal Process:Things to Keep in MindThings to Keep in Mind
Pending/anticipated civil litigationPending/anticipated civil litigation Expect public disclosure of the incident(s) at some pointExpect public disclosure of the incident(s) at some point Criminal investigation should not be viewed as a way to Criminal investigation should not be viewed as a way to
develop a civil casedevelop a civil case May have limited disclosure to victim about progress of May have limited disclosure to victim about progress of
criminal investigationcriminal investigation• Privacy Act / FOIAPrivacy Act / FOIA
• Grand jury secrecyGrand jury secrecy
• Sealed court documentsSealed court documents
Once charges are filed, prosecution will move forward Once charges are filed, prosecution will move forward quicklyquickly
2626Nov 2012Nov 2012
Federal Law Enforcement Contacts Federal Law Enforcement Contacts
U.S. Attorney’s OfficeU.S. Attorney’s Officewww.justice.gov/usaowww.justice.gov/usao
U.S. Secret ServiceU.S. Secret Servicewww.secretservice.govwww.secretservice.gov
• Stolen financial dataStolen financial data
U.S. Postal Inspection ServiceU.S. Postal Inspection Servicewww.postalinspectors.uspis.govwww.postalinspectors.uspis.gov
• IPR crimes involving the mailsIPR crimes involving the mails
Drug Enforcement AdministrationDrug Enforcement Administration
www.justice.gov/deawww.justice.gov/dea
• Counterfeit pharmaceuticalsCounterfeit pharmaceuticals
Federal Bureau of InvestigationFederal Bureau of Investigation
www.fbi.govwww.fbi.gov
• Computer intrusions & IP crimesComputer intrusions & IP crimes
• Stolen dataStolen data
• Theft of trade secretsTheft of trade secrets
U.S. Immigration and Customs U.S. Immigration and Customs EnforcementEnforcementwww.ice.govwww.ice.gov
• Counterfeit imported goodsCounterfeit imported goods
U.S. Food & Drug AdministrationU.S. Food & Drug Administration
www.fda.govwww.fda.gov
• Counterfeit pharmaceuticalsCounterfeit pharmaceuticals
Nov 2012Nov 2012 2727