Computer Crime, Evidence Search and Seizure

1. Computer Crime, Evidence Search and Seizure D/S/Sgt. Arni K. Stinnissen Anti-Rackets Section Investigation Bureau Ontario Provincial Police 705 329-6400

2. What is Computer Crime? • Crimes Through Use of a Computer • Crimes Against Computer • Most Crimes Can Have a Computer Element

3. Definition - Computer Crime • What is computer crime? (unofficial definition) “...any criminal activity involving the copy of, use of, removal of, interference with, access to, manipulation of computer systems, and/or their related functions, data or programs.”

4. Technology Specific Offences • Unauthorized use - s.342.1 • Mischief to data - s.430(1.1) • Theft of telecommunications - s.326 • Fraud Sections

5. Criminal Code Offences • Unauthorized Use of Computer Sec. 342.1 Section defines number of computer-related terms such as “computer password”, “computer program”, “computer service”, “computer system”, “data”, “electro-magnetic, acoustic, mechanical device”, “function”, “intercept”, “traffic” (in password)

6. Section 342.1 Highlights • (A) fraudulently obtaining a computer service • (B) intercepting any function of a computer system • (C) using computer system with intent

7. Fraudulently Obtaining • Fraudulently and w/o colour of right • Obtains directly or indirectly • Any computer service • computer service defined as”data processing and storage & retrieval of data”

8. Intercepting Function • Fraudulently and w/o colour of right • ‘Interception’ defined in similar to wiretap

9. Use System with intent • Intent to commit an offence as per subsections a) (obtaining any computer service) & b) (using device to obtain service) • used for ‘caught in the act’ but not quite there

10. Trafficking In Passwords • Trafficking in computer password • Criminalizes using, possessing, trafficking in or permitting another person to have access to a password that would enable a person to commit an offence under (a),(b) or (c)

11. Possession of Device Sec. 342.2 • relates to the possession of interception devices such as wire tapping equipment • could be interpreted to mean Trojan horse programs

12. Mischief to Data Sec. 430 (1.1) • applies to destroying, altering data, rendering data useless, obstructing with lawful use of data, interfering with lawful use, interrupts lawful use, or denies lawful access

13. Mischief - related Provisions • Section 429 (1) • Causes event • Act or omission • knowing will likely cause event • being reckless (i.e.. doesn’t care) • Deemed to act willfully

14. Mischief - Related Provisions • Section 429(3) Where it is an offence to destroy or to damage anything • Partial interest no defence • Whole interest no defence if acting fraudulently

15. Theft of Telecommunications • Offence modified in 1986 to add telecom theft • Provides: • 326. (1) every one commits theft who fraudulently, maliciously, or without colour of right, • (A) abstracts, consumes or uses electricity or gas or causes it to be wasted or diverted; or • (B) uses any telecommunication facility or obtains any telecommunication service. • (2) In this section and in section 327, "telecommunication" means any transmission, emission or reception of signs, signals, writing, images or sounds or intelligence of any nature by wire, radio, visual, or other electromagnetic system.

16. Other Code Offences - Theft • Theft & information • R. v. Stewart (1988), 41 C.C.C.(3d) 481 (S.C.C.) • Theft requires • Property that can be either • TAKEN (physical property) or • CONVERTED (intangibles included) • BUT must be converted in a way that DEPRIVES the true owner of their interest

17. Other Offences • Obscene material • Hate crimes • Threatening offences • e-mail • e-fraud

18. Search Authorities • Search Warrant 487 • General Warrant 487.01 Prov. Crt Judge used for special search techniques • assistance order 487.02 may be used to require assistance to effect the warrant • search provisions of POA

19. Powers to Search Searcher’s operation of computer system and copying equipment -- s. 487(2.1) (2.1) A person authorized under this section to search a computer system in a building or place for data may (a) use or cause to be used any computer system at the building or place to search any data contained in or available to the computer system;

20. Power to Search (cont’d) (b) reproduce or cause to be reproduced any data in the form of a print-out or other intelligible output; (c) seize the print-out or other output for examination or copying; and (d) use or cause to be used any copying equipment at the place to make copies of the data.

21. Power to Search (cont’d) (2.2) Every person who is in possession or control of any building or place in respect of which a search is carried out under this section shall, on presentation of the warrant, permit the person carrying out the search

22. Power to Search (cont’d) (a) to use or cause to be used any computer system at the building or place in order to search any data contained in or available to the computer system for data that the person is authorized by this section to search for; (b) to obtain a hard copy of the data and to seize it; and

23. Power to Search (cont’d) (c) to use or cause to be used any copying equipment at the place to make copies of the data.

24. Problems Investigating Computer Crime • Few agencies willing to devote resources and time • High cost to investigate • Easy destruction of evidence • Easy for culprits to cover their tracks • Legal problems • Inexperienced police officers

25. Is There Any Hope? • The Law is Constantly Evolving • Training in Computer Crime is Increasing • Public is Becoming More Aware of the Problem • Computer Security is Being Accepted as a Necessity of Doing Business • Public Education !!!