Progress In Prosecuting Cybercrime?

Twenty years ago this weekend, the first person was indicted for a cybercrime: Robert Morris, the author of the Morris Worm, which infected thousands of computers in 1988-1989. Matthew Parrella, chief of the Computer Hacking and Intellectual Property (CHIP) Unit for the U.S. Attorney's Office in San Jose, talks with Guy Raz about the past and future of cybercrime prosecution.

Copyright © 2009 NPR. For personal, noncommercial use only. See Terms of Use. For other uses, prior permission required.

GUY RAZ, host:

(Soundbite of music)

Cyber crime is not a new problem.

(Soundbite of past reporting)

Ms. CARMEN FIELDS (Newscaster): Life in the modern world has a new anxiety these days. Just as we've become totally dependent on our computers, they are being stalked by saboteurs, saboteurs who create computer viruses...

RAZ: That's newscaster Carmen Fields from a 1988 broadcast on WGBH in Boston. She was reporting on the Morris worm, a virus that crawled into 10 percent of all computers that were connected to the Internet at that time.

Twenty years ago this weekend, its creator, Robert T. Morris, became the first person to be indicted for a cybercrime. And since then, hundreds of other hackers have been prosecuted for similar crimes, prosecuted by U.S. attorneys who are part of specials teams called CHIP Units. It stands for Computer Hacking and Intellectual Property.

Matthew Parrella is chief of the CHIP Unit in Silicon Valley, California, the first one created. I asked him about the legacy of the Robert Morris indictment.

Mr. MATTHEW PARRELLA (Chief, CHIP Unit, Silicon Valley, California): Well certainly it was the first implementation of the Computer Fraud and Abuse Act, so it was important in it of itself as a prosecution. But it was also important to communicate a message that this type of crime would be prosecuted and would be investigated.

RAZ: Twenty years ago, presumably it was relatively difficult for somebody like Robert Morris to get away with what he did. How easy is it today for a computer hacker to send out a virus and never be found?

Mr. PARRELLA: Well, there's a much greater security presence, but still there's a tremendous amount of different varieties of viruses out there. And there are actually areas in the Internet where if you know where to go and you know how to get in there, you'll be able to just download already written malicious code and utilize it. So to answer your question, it becomes a little bit easier because today a hacker doesn't need to absolutely sit down and write the code. They can obtain the code ready-made, so to speak, from a Web site of like-minded individuals.

RAZ: How much of what you do now deals with trying to find out - track down who is infecting the Internet?

Mr. PARRELLA: Quite a bit. Part of the difficulty in this area of investigation is that we could have a victim company in Silicon Valley have their network intruded upon and we will trace the hack; the final step, we'll be able to trace it to will be an ISP in Eastern Europe or Southeast Asia or something like that, and this is a relatively common occurrence, the origination from areas where we have difficulty obtaining evidence.

RAZ: So at that point, so to speak, the trail runs cold.

Mr. PARRELLA: Well, it can. It's critical for us in this area and for the United States as a whole to develop relationships with these countries whether it's by treaty or otherwise to help obtain evidence in these cybercrime matters.

For instance, I had a prosecution a few years back of the major counterfeiter of Microsoft products who was a Singaporean citizen, and Singapore would not extradite one of their own citizens, and we ran an undercover operation where this individual was lured to Hong Kong, arrested on our arrest warrant, and it took us two and a half years to extradite her from Hong Kong to San Jose where she was prosecuted. Ultimately she pleads guilty.

And so you can see there's tremendous amount of obstacles there. I mean that's not leaving the store with the stolen CDs in the backpack. That's a huge effort.

RAZ: There's something that we're hearing a lot about now. It's called cloud computing.

Mr. PARRELLA: Yes.

RAZ: First of all, can you briefly explain what that is?

Mr. PARRELLA: Well, it's moving many of the applications and computing power from the private individual's PC onto a series of systems that's operated by a provider. So, your PC or your workstation or your company's network will operate more efficiently because it doesn't need to store and run the actual applications. That's being done in the cloud, as it say.

There is a, obviously, a disadvantage which is the old saw about Sutton's law which is that we rob banks because that's where the money is. In this case, these cloud computing centers will become targets and that is what I see as being on the horizon for cybercrime.

RAZ: So, I mean, how are you going to tackle this?

Mr. PARRELLA: Well, in any cybercrime there's always a trail. There's always something left behind whether it'd be a log or something left in a - in deleted file space or something like that. If we have access to the evidence we can usually put it together. However, it does require companies to obey, you know, good security procedures. By and large these companies realize that in order to do business they need to be secure.

RAZ: Matthew Parrella is chief of the Computer Hacking and Intellectual Property Unit for the U.S. Attorneys Office. He spoke to me from just outside of San Jose, California.

Mr. Parrella, thanks so much.

Mr. PARRELLA: Thanks a lot.

(Soundbite of music)

Copyright © 2009 NPR. All rights reserved. No quotes from the materials contained herein may be used in any media without attribution to NPR. This transcript is provided for personal, noncommercial use only, pursuant to our Terms of Use. Any other use requires NPR's prior permission. Visit our permissions page for further information.

NPR transcripts are created on a rush deadline by a contractor for NPR, and accuracy and availability may vary. This text may not be in its final form and may be updated or revised in the future. Please be aware that the authoritative record of NPR's programming is the audio.

Comments

 

Please keep your community civil. All comments must follow the NPR.org Community rules and terms of use, and will be moderated prior to posting. NPR reserves the right to use the comments we receive, in whole or in part, and to use the commenter's name and location, in any medium. See also the Terms of Use, Privacy Policy and Community FAQ.