Caught in the Net:Is Cyberspace a New Haven for Crime?

The Internet has been described as a forest, containing boundless treasures. On the other hand, it also has its traps, capable of luring the unsuspecting onto wayward paths.

In late August, a commercial bank reported to the Criminal Investigation Bureau (CIB) that someone had copied its web pages to a similar URL address, leading users to the bogus bank in the hope that they would reveal important personal information, including account and PIN numbers. Police were able to trace email and Internet account registration information to their suspect within a month, solving the case before the culprit, not yet 20 years of age, could withdraw any of the clients' savings using the illicit information. The suspect was subsequently brought up on charges of attempted fraud.

Shortly after the September 21 Chichi earthquake, the CIB discovered that someone located in Taiwan had posted a letter in English across dozens of Usenet discussion groups worldwide, appealing for people to contribute to earthquake relief in Taiwan. The poster instructed contributors to wire funds to a personal bank account, but was thwarted by police crime units before any donations had been deposited.

The Criminal Investigation Bureau's Computer Crime Unit was set up in 1996 to handle cases such as pornographic websites, Internet scams, online arms sales, and the malicious spread of computer viruses. Pictured here is the "cybercop" headquarters. （photo by Vincent Chang）

Electronic world on the blink?

The Wild and Wooly World of the Internet has seemingly become a new tool in the arsenal of those aiming to scam wealth and goods. Recently, a case was discovered involving a girl at a vocational high school who engineered a series of cyberspace romances. The case helped society put in focus just how easy it is to create illusions and lead people astray in the virtual world.

In this particular case, the female student, weighing in at a hefty 100 kilos in real life, claimed to be a graduate student at National Taiwan University. Posting pictures of stunning models, she attracted the attention of cyber suitors. Having captivated their interest, she then borrowed money from them under the pretext of needing cash to purchase a new computer and for recreation and entertainment.

Once the media latched onto this story, a kind of "You've Got Mail" gone bad, heated discussion ensued throughout society. Some criticized the media for showing enlarged photographs of the tubby girl in a "Popeye the Sailor Man" pose, saying it revealed prejudice against fat girls and the Internet in general. They contended that most cases involving a swindle of only NT$50,000 or NT$100,000 would never get written up on page three of the newspaper. Others made fun of the highly educated male victims of the scheme, calling them wishy-washy bookworms fooled by appearances.

Still others showed a better understanding of the issues at hand, calling those critical of people making cyber-friendships "the uninformed passing judgement on the experts." In cyberspace, where everyone hides behind the anonymity of a computer screen, it should come as no surprise that many people make false claims about their age, profession or measurements, or even pose as members of the opposite sex. Sisy Chen, CEO of dreamer.com.tw, praised the corpulent girl's creativity, saying she'd love to have her put her talents to use at the website.

Varying degrees of awareness concerning Internet capabilities and characteristics exist among netizens, but in the eyes of the police, the rapidly changing world of the Internet is a major headache.

"The public can be optimistic about the development of the Internet, but we have to be a bit more concerned," says Lee Hsiang-chen. Lee, a specialist in the CIB's Information Department, has led the investigation of numerous Internet-related cases. He adds, "It's so hard to describe the monster that is the Internet. It's too changeable. That, combined with the constant introduction of new hardware and software, can generate all sorts of new types of crime." The 14-person staff under Lee's direction is the first police unit in Taiwan expressly in charge of handling computer-related crime, earning them the nickname "cybercops."

"Conventional crime has a crime scene, where you can collect such physical evidence as the weapon, blood residue, or blood-stained clothing, so that attempts to destroy evidence take quite a bit of time. However, computers are different, as data can be made to disappear with one keystroke." Chang Wei-ping, a section chief in the Information Department, transferred from a teaching position at Central Police University two years ago. In Chang's view, the difference between Internet crime and conventional offenses is that someone looking to rob a bank puts himself in danger when he shows up at the scene with a knife or a gun; in contrast, computer crime can be perpetrated with no physical exposure whatsoever.

Should pornographic websites be combated? And can law enforcement keep up with their growth? This is the main controversy concerning the CIB's Internet patrol efforts. （CIB file photo）

Cybercops strike back

The CIB's Internet police force was established in September 1996, but computer-related crimes had already been occurring in Taiwan prior to that time.

In 1993, a systems engineer at a Taichung bank was arrested for using a computer program to record customer account and PIN numbers during ATM withdrawals, then using the information to make counterfeit cash cards.

In 1994, a former employee of printer maker Epson dialed in to Epson's computer database from his new company and rewrote the basic programs used to program IC layouts, thereby causing Epson to inadvertently manufacture faulty chips.

While these cases resulted in losses, they were nowhere as big as the "Godfather of Arms" case of September 1997.

This particular case was first broken by local newspapers, which claimed that a website was selling Italian-made "Palm Thunder" handguns to domestic customers, but neglected to say which site or sites were perpetrating such behavior. Nevertheless, the CIB, incredulous but eager to determine the veracity of the reports, got on the Web to investigate, discovering a site called "Godfather of Arms." With this, then-Minister of Justice Liao Cheng-hao, having verified the existence of a website trafficking illicit guns, announced that the Ministry of Justice had ordered police and investigation units to focus full effort on investigating the case. The next day, the case was headline news on the crime pages of all the newspapers, making the "Godfather of Arms" website famous overnight.

More than 100 million people now use the Internet worldwide, offering endless business opportunities but also presenting numerous traps. Computers themselves do not commit crimes; it is the human mind that must be defended against.

Evidence recedes from sight

Despite the authorities' determination, the investigation of the people behind the website was fraught with difficulties.

First, the site itself was set up in the United States, and although the site's content was written in Chinese, the perpetrators behind the site could be in Taiwan or might very well be ethnic Chinese living in another country. Moreover, the sale of handguns is legal in various US states, and Taiwan would have no jurisdiction over "Godfather of Arms" if the site itself were registered in the United States.

Furthermore, the site stated that the "Palm Thunder" guns, sold for US$250, must be paid for anonymously, and that deals would be processed only after payment was received, leading police to suspect fraudulent behavior. Another knotty issue was that the top headline treatment of the "Godfather of Arms" in the press might have alarmed the site's operators, spurring them to ditch the evidence and cover their tracks. Nevertheless, police and prosecutors contacted domestic Internet service providers (ISPs), such as Hinet and Seednet, to ask for their assistance in providing the log-on records of suspicious Internet users.

Just as police and prosecutors became desperate for something to build a case upon, Lee Hsiang-chen of the CIB's Information Department, received a call that perked up his ears. The call came from Kimo, a domestic search engine, where it was discovered that someone had inserted a link to the "Godfather of Arms" website into the Kimo site.

A week after learning of the existence of the "Godfather of Arms" site, the Taipei district attorney, search warrant in hand, led an investigation team south to Miaoli County, where they found Yang Chien-min, suspected of posting "Godfather of Arms" ads. Without delay, they took Yang and his computer equipment back to the Bureau. At first, the 20 year-old Yang Chien-min denied posting gun sale ads on the Internet. However, Lee Hsieng-chen hooked up Yang's computer in the Bureau's office and began searching the suspect's hard drive for his Internet browsing history. Only when he questioned Yang as to why he had been to the "Godfather of Arms" site numerous times did the suspect admit having been to the site out of curiosity after seeing the newspaper reports. Yang then claimed that he downloaded some information on gun sales at the site, and then hit the wrong button while connected to the Kimo site, inadvertently posting the gun sale ads.

With the clear Internet connection record on Yang Chien-min's hard drive, plus Kimo's testimony that they had more than once deleted ads which Yang Chien-min had attempted to add to their site, the district attorney was able to charge Yang Chien-min with "publicly inciting the criminal behavior of others" in violation of Section 153 of the Penal Code. Yang subsequently received a five-month prison sentence, suspended for three years.

From personal computers to national defense data, security issues loom everywhere. Computer network operators must take steps to safeguard their systems at all times to prevent unwanted intervention. Pictured is the Chihhang Air Force Base in Taitung.

Lowest detection rate

One of the attributes of the Internet is its penetration around the corner and across the world. Quick-thinking opportunists were soon ready to seize on this new tool of dissemination.

If we listed the various ways in which the Internet has "flown off the handle" over the past few years, it would become clearly apparent that the fraud, destruction, gambling, incitement to crime, and infringement of copyrights of the "brick-and-mortar" world have long since spread to cyberspace. Such cases include: a threat to US president Bill Clinton's life; the spread of rumors claiming that a certain brand of sanitary napkins was infested with bug eggs; the claim by a university student on a BBS bulletin board that his professor was plagiarizing student reports, resulting in a lawsuit for slander; a scam in which online shoppers paid for CD drives but received Oolong tea instead; the dissemination of pornographic images; the sale of pirated software; and the sale of illegal drugs over the Internet.

Last August, a big scandal marred Central Police University's recruitment of two-year technical program students. Kuo Chen-yuan, director of CPU's Department of Computer Science, was suspected of taking bribes from students, then going into the computer system and revising the students' test scores. The Taoyuan public prosecutors' office, in charge of the investigation, focused on Kuo Chen-yuan as the suspect, but Kuo quickly deleted all the information from the office's PCs and disappeared. The police were able to track down Kuo's personal notebook computer, but Kuo, being a computer expert, had taken precautions, adding password protection to his files when he saved the list of student names and bribes taken. Temporarily stymied, the Taoyuan prosecutors sought the assistance of the CIB to crack the code. In view of the gravity of the Central Police University scandal and the large number of people involved, prosecutors, citing anti-corruption criminal codes, sought a life sentence for Kuo Chen-yuan.

After nearly a year in the courts, the Taoyuan District Court sentenced Kuo to life imprisonment and permanent deprivation of civic rights. The other defendants, 63 in all, received sentences ranging from 18 months to 16 years.

While expediting criminal conduct, the Internet makes collection of evidence difficult. These characteristics, combined with the medium's technical nature, conspire to make Internet-related crimes the hardest to break. According to Lee Hsiang-chen, 80% of all successful prosecutions of Internet-related crimes come about only after civilians lodge complaints and provide the information necessary to solve cases.

The diversity of cyber-crimes seems to mirror the rapid development which is a defining feature of the Internet. Classified by type of case, the CIB's Computer Crime Unit estimates that the majority of cases it handles involve software piracy or pornographic websites. Especially given the Ministry of Education's advocacy of Internet literacy among elementary and middle school students, many people worry that the Internet is too full of embarrassing, lewd images which can corrupt young hearts and minds.

Evil always a step ahead

In one case, for example, the CIB arrested a Taipei County man operating the "Forbidden Paradise" website, where paying members used access codes to view and download lewd pictures taken from overseas sites. The CIB has also stamped out pornographic CD-ROM trading rings operated via e-mail, and prosecuted people for openly providing or soliciting sex partners via the Internet.

Although the CIB's "trophies" include the shutdown of a large pornographic website that had attracted over one million visits, most elected officials and women's groups still feel that not enough effort has gone into thwarting such conduct. After all, they say, if sufficient resources have gone into crackdowns, why has the number of porn sites on the Internet actually grown?

When you plug the Chinese word for "pornography" into a search engine, you can always turn up a host of pornographic websites. It seems as if such sites just come back with a vengeance. Efforts to crack down on the sale of pirated software over the Internet have been similarly thwarted.

The Computer Crime Unit faces a major dilemma in trying to decide how much of its resources should be devoted to crackdowns on Internet sites offering pornography and pirated software.

"In order to get around the police, many pornographic websites have moved overseas. We have approached scholars and experts for tips on how to look for pornographic sites set up abroad, but the answers only pointed to the difficulty of doing so," relates Chang Wei-ping.

The simplicity of setting up a website these days makes detection all the more difficult. Chang Wei-ping notes that in the past the person signing up for Internet access had to make the application for himself, and the ISP certification process is fairly strict. These days, however, given the intensity of competition among ISPs (Taiwan now has over 100 such companies of all sizes), many operators offer free access and e-mail accounts, and when Chang's people check users' registration details when following leads, "We find that some people are registered as the 'Office of the President' under the name 'Lee Teng-hui.' In practically eight out of 10 cases we can't trace the individual concerned, and 90% of the personal information on file might be false."

Not a "lawless" realm

Even in cases where "lawbreakers" or "troublemakers" are caught, how does one decide whom to fine? How much should they be fined? And according to what laws should they be prosecuted? Opinion is also divided widely over whether laws should be amended or new legislation introduced with Internet crime expressly in mind. Still, given the lawlessness of the Web, with people skirting on the borders of unlawful activity, authorities have begun to place more emphasis on enforcement.

Previously, ROC law did not allow for punishment of those that used others' accounts, or stole or destroyed others' files, via the Internet. However, after investigation by relevant agencies, nine new articles were added to the Penal Code in October 1997 concerning computer-related crime, including the offenses of "disclosing secrets of others obtained or held by the use of computer equipment," and "interfering with the stored computer data of others."

Nevertheless, there are many questions about how to apply the new laws. Such an issue arose in the case of Chen Ying-hao, who had written a computer virus.

On April 26 of this year, a computer virus known as "Chernobyl" ("CIH" for short) broke out across the Internet, crashing hundreds of thousands of computers across the globe and damaging computer records. Investigations by police in Taiwan and abroad subsequently verified that the virus originated in Taiwan.

Several days later, the Computer Crime Unit followed leads to Chen Ying-hao, a young man currently serving in the military, who admitted that he had written the virus last year while still attending university. However, Chen claimed that he was motivated by pure research, and that the virus had spread to infect a wide area only after repeated dissemination by others.

According to Article 352 of the Criminal Code, violators who "interfere with the stored computer data of others, to the harm of the public or others," may be incarcerated for up to three years with or without forced labor, or fined up to NT$10,000. If it were determined that Chen Ying-hao had maliciously disseminated the virus, he could be sentenced to time in jail. However, many creators of computer viruses are computer jocks, most of whom write viruses to show off their computer acumen. As Chen Ying-hao likely belongs to this ilk, and since under the article in question a prosecution can only be brought if a complaint is made, it has thus far not been possible to charge Chen, for lack of sufficient evidence. Prosecutors are currently reviewing the case.

Every crime leaves a trail

The case of Yang Chien-min, convicted of posting ads for the "Godfather of Arms" website, stirred considerable controversy over what grounds the conviction should stand upon.

The focus of contention was that Yang Chien-min was not the operator behind the "Godfather of Arms" site, but had simply registered the site with a certain Chinese-language search engine; meanwhile the real "Godfather" remained beyond the law's reach. The second issue of contention concerned the possible guilt by association of his ISP.

"The controversy shouldn't have anything to do with us (the police). We are only responsible for investigating and securing an arrest. Whether the prosecutors seek a prosecution is up to them to decide," says Lee Hsiang-chen.

Hsieh Ming-kuan, a district attorney at the Taipei public prosecutors' office, points out that in the case of a pornographic website showing exposed genitals, the Web host can remove the offending material of its own volition. Hsieh believes that putting ISPs in charge of controls would save the most trouble and effort. Further, if Chinese-language search engines could reduce the likelihood of related "hits," the circulation rate of such sites could be reduced. "Still, law enforcement agencies can't just do what they want, but must be able to stand their legal ground. The problem is that attitudes toward the Internet are constantly changing, so that if law enforcement agencies come down too hard they run the risk of criticism for 'interfering with freedom of information.'"

Another district attorney relates that Internet crime work includes assisting judges in establishing lines of questioning, as many judges are unfamiliar with the world of cyberspace. In some cases involving highly computer-literate suspects, even what questions to ask can be unclear.

"With conventional crime, the motivation is either profit or sex; with computer-related crime, the sticky part is that often there is no clear motive," says Liu Ta-chwan, technical advisor to the CIB and head of the Internet section of National Chiao Tung University's Computer Center. Liu notes that computers enjoy a high-tech image, appearing to remove people one level from misdeeds perpetrated via computer. For example, writing a computer virus that leads to computer crashes requires the passing of the virus among several hundred computers. Given the indirect nature of the harm, the people at the root of it sometimes fail to see how they have done anything wrong.

Still, lack of criminal intent merely reduces criminal responsibility, and there is no way around incontrovertible evidence.

Internet technology has created a fast-moving, chaotic world for humanity in the fin de siecle. In considering lawless conduct, we must keep in mind that it is not computers but rather people who get out of line, and that it is the human mind, not technology, that is so difficult to handle.