1. Federal Investigation and Prosecution of Computer and Intellectual Property Crimes Matthew Devlin Assistant United States Attorney Computer Hacking and Intellectual Property Coordinator United States Attorney’s Office Western District of Texas Austin, Texas 1Nov 2012

2. Overview Computer Hacking & Intellectual Property (CHIP) Program and Network Computer Hacking & Intellectual Property (CHIP) Program and Network DOJ Computer Crimes & Intellectual Property Section (CCIPS) DOJ Computer Crimes & Intellectual Property Section (CCIPS) Types of Cases Types of Cases Computer CrimesComputer Crimes Intellectual Property Rights CrimesIntellectual Property Rights Crimes Working With Victim Companies Working With Victim Companies 2 Nov 2012

3. What is the CHIP Program? Nationwide CHIP Network Nationwide CHIP Network At least one CHIP prosecutor in each of 93 U.S. Attorney’s Offices At least one CHIP prosecutor in each of 93 U.S. Attorney’s Offices More than 250 CHIP attorneys nationwideMore than 250 CHIP attorneys nationwide CHIP Units in 25 U.S. Attorney’s Offices CHIP Units in 25 U.S. Attorney’s Offices Austin/San AntonioAustin/San Antonio Dallas, San Francisco, Los Angeles, Sacramento, San Diego, Seattle Denver, New Haven, Tampa, Miami, Atlanta, Chicago, Baltimore, Boston, Detroit, Kansas City, Newark. Brooklyn, New York, Philadelphia, Pittsburgh, Nashville, Alexandria, and Washington, D.C.Dallas, San Francisco, Los Angeles, Sacramento, San Diego, Seattle Denver, New Haven, Tampa, Miami, Atlanta, Chicago, Baltimore, Boston, Detroit, Kansas City, Newark. Brooklyn, New York, Philadelphia, Pittsburgh, Nashville, Alexandria, and Washington, D.C. 3 Nov 2012

4. CHIP Responsibilities Prosecute Core Offenses Prosecute Core Offenses Computer CrimeComputer Crime Intellectual Property Rights OffensesIntellectual Property Rights Offenses In-house Subject Matter Expertise In-house Subject Matter Expertise Advice and training to prosecutors and agentsAdvice and training to prosecutors and agents Outreach: Law Enforcement Outreach: Law Enforcement Incident ResponseIncident Response Search Warrants / 2703 ProcessSearch Warrants / 2703 Process Advice and SupportAdvice and Support Outreach: Community Outreach: Community Familiarize IP community with law enforcement optionsFamiliarize IP community with law enforcement options 4 Nov 2012

5. Cybercrime.gov Public Page Public Page Latest News Releases Latest News Releases Documents & Reports Documents & Reports Contact Info Contact Info Cases Cases 5 Nov 2012

6. IP Enforcement National IP Rights Coordination Center (DHS) National IP Rights Coordination Center (DHS) Multi-agency clearinghouseMulti-agency clearinghouse FBI, DHS, USPIS, FDA, other agenciesFBI, DHS, USPIS, FDA, other agencies DOJ CCIPS DOJ CCIPS U.S. Attorney’s Offices – CHIP Program U.S. Attorney’s Offices – CHIP Program Nov 2012 6

7. DOJ International Presence Intellectual Property Law Enforcement Coordinator (IPLEC) Intellectual Property Law Enforcement Coordinator (IPLEC) Bangkok, Thailand China/Southeast Asia Sofia, Bulgaria Eastern Europe 7 Nov 2012

8. International Cooperation G8 24/7 Network G8 24/7 Network 49 countries (map, right)49 countries (map, right) DOJ (CCIPS) is the U.S. point of contactDOJ (CCIPS) is the U.S. point of contact Around-the-clock assistance availableAround-the-clock assistance available Council of Europe Convention on Cybercrime Council of Europe Convention on Cybercrime Facilitates international investigation/ prosecutionFacilitates international investigation/ prosecution Minimizes substantive and procedural obstaclesMinimizes substantive and procedural obstacles 8 Nov 2012

9. Federal Judicial Districts in Texas SouthernDistrict Houston CorpusChristi Brownsville Laredo McAllen EasternDistrictSherman Tyler Beaumont Lufkin WesternDistrict El Paso Pecos Midland Del Rio San Antonio Austin Waco Alpine NorthernDistrict Amarillo Lubbock Fort Worth Abilene Dallas San Angelo 9 Nov 2012

10. Computer Crime Cases Hacking / Unauthorized Access Hacking / Unauthorized Access Virus/Worm attacksVirus/Worm attacks Denial of service attacksDenial of service attacks Theft of data and electronically stored infoTheft of data and electronically stored info Computer Fraud Computer Fraud PhishingPhishing Internet Fraud/Theft Internet Fraud/Theft 10 Nov 2012

11. Cybercrime Statutes Identity Theft (18 U.S.C. § 1028) Identity Theft (18 U.S.C. § 1028) Aggravated Identity Theft (18 U.S.C. § 1028A) Aggravated Identity Theft (18 U.S.C. § 1028A) Access Device Fraud (18 U.S.C. § 1029) Access Device Fraud (18 U.S.C. § 1029) Computer Fraud and Abuse (18 U.S.C. § 1030) Computer Fraud and Abuse (18 U.S.C. § 1030) CAN-SPAM Act (18 U.S.C. § 1037) CAN-SPAM Act (18 U.S.C. § 1037) Wire Fraud (18 U.S.C. § 1343) Wire Fraud (18 U.S.C. § 1343) Communications Interference (18 U.S.C. § 1362) Communications Interference (18 U.S.C. § 1362) Wiretap Act (18 U.S.C. § 2511) Wiretap Act (18 U.S.C. § 2511) Unlawful Access to Stored Communications (18 U.S.C. § 2701) Unlawful Access to Stored Communications (18 U.S.C. § 2701) 11 Nov 2012

12. Intellectual Property Cases Criminal Copyright Infringement Criminal Copyright Infringement Digital Millennium Copyright ActDigital Millennium Copyright Act Trademark / Counterfeit Product offenses Trademark / Counterfeit Product offenses Online PiracyOnline Piracy Counterfeit PharmaceuticalsCounterfeit Pharmaceuticals Economic Espionage Economic Espionage Theft of Trade Secrets Theft of Trade Secrets 12 Nov 2012

13. IPR Criminal Statutes Copyrighted Works Copyrighted Works Criminal Infringement of a Copyright (18 U.S.C. § 2319 & 17 U.S.C. § 506) - Up to 5 yearsCriminal Infringement of a Copyright (18 U.S.C. § 2319 & 17 U.S.C. § 506) - Up to 5 years Trafficking in Counterfeit Labels for Software & Music (18 U.S.C. § 2318) - Up to 5 yearsTrafficking in Counterfeit Labels for Software & Music (18 U.S.C. § 2318) - Up to 5 years Trafficking in Recordings/Videos of Live Musical Performances (18 U.S.C. § 2319A) - Up to 5 yearsTrafficking in Recordings/Videos of Live Musical Performances (18 U.S.C. § 2319A) - Up to 5 years Unauthorized Recording of Movies in a Theater (18 U.S.C. § 2319B) – Up to 3 yearsUnauthorized Recording of Movies in a Theater (18 U.S.C. § 2319B) – Up to 3 years Circumvention of Copyright Protection Systems (17 U.S.C. §§ 1201-1205) - Up to 5 yearsCircumvention of Copyright Protection Systems (17 U.S.C. §§ 1201-1205) - Up to 5 years Unauthorized Reception of Cable Services (47 U.S.C. § 553) - 6 mos (individual use) / 2 years (commercial gain)Unauthorized Reception of Cable Services (47 U.S.C. § 553) - 6 mos (individual use) / 2 years (commercial gain) 13 Nov 2012

14. IPR Criminal Statutes Trademarks Trademarks Trafficking in Counterfeit Goods & Services (18 U.S.C. § 2320) - Up to 10 yearsTrafficking in Counterfeit Goods & Services (18 U.S.C. § 2320) - Up to 10 years Trade Secrets Trade Secrets Economic Espionage (18 U.S.C. § 1831) - Up to 15 yearsEconomic Espionage (18 U.S.C. § 1831) - Up to 15 years Theft of Trade Secrets (18 U.S.C. § 1832) - Up to 10 years (corporation - up to $5M fine)Theft of Trade Secrets (18 U.S.C. § 1832) - Up to 10 years (corporation - up to $5M fine) Confidentiality- Protective orders and other actions authorized (18 U.S.C. § 1835)Confidentiality- Protective orders and other actions authorized (18 U.S.C. § 1835) 14 Nov 2012

15. 18 U.S.C. § 1831 Economic Espionage Act (a) In general.--Whoever, intending or knowing that the offense will benefit any foreign government, foreign instrumentality, or foreign agent, knowingly-- (a) In general.--Whoever, intending or knowing that the offense will benefit any foreign government, foreign instrumentality, or foreign agent, knowingly-- (1) steals, or without authorization appropriates, takes, carries away, or conceals, or by fraud, artifice, or deception obtains a trade secret;(1) steals, or without authorization appropriates, takes, carries away, or conceals, or by fraud, artifice, or deception obtains a trade secret; (2) without authorization copies, duplicates, sketches, draws, photographs, downloads, uploads, alters, destroys, photocopies, replicates, transmits, delivers, sends, mails, communicates, or conveys a trade secret;(2) without authorization copies, duplicates, sketches, draws, photographs, downloads, uploads, alters, destroys, photocopies, replicates, transmits, delivers, sends, mails, communicates, or conveys a trade secret; (3) receives, buys, or possesses a trade secret, knowing the same to have been stolen or appropriated, obtained, or converted without authorization;(3) receives, buys, or possesses a trade secret, knowing the same to have been stolen or appropriated, obtained, or converted without authorization; (4) attempts to commit any offense described in any of paragraphs (1) through (3); or(4) attempts to commit any offense described in any of paragraphs (1) through (3); or (5) conspires with one or more other persons to commit any offense described in any of paragraphs (1) through (3), and one or more of such persons do any act to effect the object of the conspiracy,(5) conspires with one or more other persons to commit any offense described in any of paragraphs (1) through (3), and one or more of such persons do any act to effect the object of the conspiracy, shall, except as provided in subsection (b), be fined not more than $500,000 or imprisoned not more than 15 years, or both. (b) Organizations.--Any organization that commits any offense described in subsection (a) shall be fined not more than $10,000,000. (b) Organizations.--Any organization that commits any offense described in subsection (a) shall be fined not more than $10,000,000. Nov 2012 15

16. 18 U.S.C. § 1832 Theft of Trade Secrets (a) Whoever, with intent to convert a trade secret, that is related to or included in a product that is produced for or placed in interstate or foreign commerce, to the economic benefit of anyone other than the owner thereof, and intending or knowing that the offense will, injure any owner of that trade secret, knowingly-- (a) Whoever, with intent to convert a trade secret, that is related to or included in a product that is produced for or placed in interstate or foreign commerce, to the economic benefit of anyone other than the owner thereof, and intending or knowing that the offense will, injure any owner of that trade secret, knowingly-- (1) steals, or without authorization appropriates, takes, carries away, or conceals, or by fraud, artifice, or deception obtains such information;(1) steals, or without authorization appropriates, takes, carries away, or conceals, or by fraud, artifice, or deception obtains such information; (2) without authorization copies, duplicates, sketches, draws, photographs, downloads, uploads, alters, destroys, photocopies, replicates, transmits, delivers, sends, mails, communicates, or conveys such information;(2) without authorization copies, duplicates, sketches, draws, photographs, downloads, uploads, alters, destroys, photocopies, replicates, transmits, delivers, sends, mails, communicates, or conveys such information; (3) receives, buys, or possesses such information, knowing the same to have been stolen or appropriated, obtained, or converted without authorization;(3) receives, buys, or possesses such information, knowing the same to have been stolen or appropriated, obtained, or converted without authorization; (4) attempts to commit any offense described in paragraphs (1) through (3); or(4) attempts to commit any offense described in paragraphs (1) through (3); or (5) conspires with one or more other persons to commit any offense described in paragraphs (1) through (3), and one or more of such persons do any act to effect the object of the conspiracy,(5) conspires with one or more other persons to commit any offense described in paragraphs (1) through (3), and one or more of such persons do any act to effect the object of the conspiracy, shall, except as provided in subsection (b), be fined under this title or imprisoned not more than 10 years, or both. (b) Any organization that commits any offense described in subsection (a) shall be fined not more than $5,000,000. (b) Any organization that commits any offense described in subsection (a) shall be fined not more than $5,000,000. Nov 2012 16

17. Trade Secret (18 U.S.C. § 1839) all forms and types of financial, business, scientific, technical, economic, or engineering information, including patterns, plans, compilations, program devices, formulas, designs, prototypes, methods, techniques, processes, procedures, programs, or codes, whether tangible or intangible, and whether or how stored, compiled, or memorialized physically, electronically, graphically, photographically, or in writing if …” all forms and types of financial, business, scientific, technical, economic, or engineering information, including patterns, plans, compilations, program devices, formulas, designs, prototypes, methods, techniques, processes, procedures, programs, or codes, whether tangible or intangible, and whether or how stored, compiled, or memorialized physically, electronically, graphically, photographically, or in writing if …” The owner has taken reasonable measures to keep such information secret - AND –The owner has taken reasonable measures to keep such information secret - AND – The information derives independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable through proper means by, the publicThe information derives independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable through proper means by, the public “owner” means the person or entity in whom or in which rightful legal or equitable title to, or license in, the trade secret is reposed. “owner” means the person or entity in whom or in which rightful legal or equitable title to, or license in, the trade secret is reposed. 17 Nov 2012

18. Foreign Instrumentality/Agent (18 U.S.C. § 1839) “foreign instrumentality” means any agency, bureau, ministry, component, institution, association, or any legal, commercial, or business organization, corporation, firm, or entity that is substantially owned, controlled, sponsored, commanded, managed, or dominated by a foreign government; “foreign instrumentality” means any agency, bureau, ministry, component, institution, association, or any legal, commercial, or business organization, corporation, firm, or entity that is substantially owned, controlled, sponsored, commanded, managed, or dominated by a foreign government; “foreign agent” means any officer, employee, proxy, servant, delegate, or representative of a foreign government; “foreign agent” means any officer, employee, proxy, servant, delegate, or representative of a foreign government; Nov 2012 18

19. Confidentiality & Non-Disclosure (18 U.S.C. § 1835) In any prosecution or other proceeding under this chapter, the court shall enter such orders and take such other action as may be necessary and appropriate to preserve the confidentiality of trade secrets, consistent with the requirements of the Federal Rules of Criminal and Civil Procedure, the Federal Rules of Evidence, and all other applicable laws. An interlocutory appeal by the United States shall lie from a decision or order of a district court authorizing or directing the disclosure of any trade secret. In any prosecution or other proceeding under this chapter, the court shall enter such orders and take such other action as may be necessary and appropriate to preserve the confidentiality of trade secrets, consistent with the requirements of the Federal Rules of Criminal and Civil Procedure, the Federal Rules of Evidence, and all other applicable laws. An interlocutory appeal by the United States shall lie from a decision or order of a district court authorizing or directing the disclosure of any trade secret. Nov 2012 19

20. Criminal Enforcement of IPR Criminal charges can be brought when there is willful or knowing infringement. Criminal charges can be brought when there is willful or knowing infringement. Criminal cases require a higher burden of proof: “Beyond a reasonable doubt” Criminal cases require a higher burden of proof: “Beyond a reasonable doubt” Remedies: incarceration, fines, and restitution Remedies: incarceration, fines, and restitution Common factors affecting whether to charge a criminal violation include: Common factors affecting whether to charge a criminal violation include: Organized Criminal InvolvementOrganized Criminal Involvement Public Health and Safety ConcernsPublic Health and Safety Concerns Commercial Nature of ViolationCommercial Nature of Violation Amount of Loss & HarmAmount of Loss & Harm Violation of Previous JudgmentViolation of Previous Judgment 20 Nov 2012

21. Criminal Investigation and Prosecution Team Coordinate investigative and legal strategy Coordinate investigative and legal strategy Focus On Electronic Evidence Focus On Electronic Evidence Determine source IP address(es)Determine source IP address(es) Seize ComputersSeize Computers Email Search WarrantsEmail Search Warrants Traditional Investigative Steps Traditional Investigative Steps Search Warrant / SurveillanceSearch Warrant / Surveillance Undercover / Confidential informantsUndercover / Confidential informants Banking / Transaction RecordsBanking / Transaction Records ConfessionConfession 21 Nov 2012

22. Why Report Cyber/IPR Crime? Perpetrators are organized and large-scale violators Perpetrators are organized and large-scale violators Anyone can be - and many have been - a victim... and may be again. Anyone can be - and many have been - a victim... and may be again. Help prevent future violations & losses Help prevent future violations & losses Ensure the costs of engaging in criminal activities outweigh the benefits Ensure the costs of engaging in criminal activities outweigh the benefits Public companies likely must disclose anyway Public companies likely must disclose anyway The sooner, the better The sooner, the better 22 Nov 2012

23. Why Report? Enforcing IP Rights Can: Enforcing IP Rights Can: Improve product-related health and safetyImprove product-related health and safety Foster growth of economic industries (software, high tech, etc.)Foster growth of economic industries (software, high tech, etc.) Foster creativityFoster creativity Create incentive for investmentCreate incentive for investment Fulfill international treaty obligationsFulfill international treaty obligations 23 Nov 2012

24. The Criminal Process: What to Expect Initial report to law enforcement Initial report to law enforcement Results of internal investigation?Results of internal investigation? Loss/Damage valuationLoss/Damage valuation Civil remedies should always be consideredCivil remedies should always be considered Sting operation?Sting operation? LE will use best efforts to minimize disruption to normal business operations LE will use best efforts to minimize disruption to normal business operations Victim cooperation Victim cooperation Establish Ownership / Unauthorized AccessEstablish Ownership / Unauthorized Access Identify Counterfeit ProductsIdentify Counterfeit Products Address Technical IssuesAddress Technical Issues Intrusion issues Intrusion issues Proving trade secret Proving trade secret Evidence gathering Evidence gathering GJ subpoenasGJ subpoenas Search Warrants / 2703 processSearch Warrants / 2703 process Evidence preservationEvidence preservation 24 Nov 2012

25. The Criminal Process: Prosecution Prosecution Prosecution Plea negotiationsPlea negotiations IndictmentIndictment Notification to victim of significant prosecution eventsNotification to victim of significant prosecution events Discovery Discovery Rule 16, FRCrPRule 16, FRCrP Brady obligationsBrady obligations Protective OrderProtective Order Sentencing Sentencing Loss/Damage amount Loss/Damage amount Restitution Restitution Forfeiture Forfeiture 25 Nov 2012

26. The Criminal Process: Things to Keep in Mind Pending/anticipated civil litigation Pending/anticipated civil litigation Expect public disclosure of the incident(s) at some point Expect public disclosure of the incident(s) at some point Criminal investigation should not be viewed as a way to develop a civil case Criminal investigation should not be viewed as a way to develop a civil case May have limited disclosure to victim about progress of criminal investigation May have limited disclosure to victim about progress of criminal investigation Privacy Act / FOIAPrivacy Act / FOIA Grand jury secrecyGrand jury secrecy Sealed court documentsSealed court documents Once charges are filed, prosecution will move forward quickly Once charges are filed, prosecution will move forward quickly 26 Nov 2012

27. Federal Law Enforcement Contacts Federal Law Enforcement Contacts U.S. Attorney’s Office www.justice.gov/usao U.S. Attorney’s Office www.justice.gov/usao U.S. Secret Service www.secretservice.gov U.S. Secret Service www.secretservice.gov Stolen financial dataStolen financial data U.S. Postal Inspection Service www.postalinspectors.uspis.gov U.S. Postal Inspection Service www.postalinspectors.uspis.gov IPR crimes involving the mailsIPR crimes involving the mails Drug Enforcement Administration Drug Enforcement Administrationwww.justice.gov/dea Counterfeit pharmaceuticalsCounterfeit pharmaceuticals Federal Bureau of Investigation Federal Bureau of Investigationwww.fbi.gov Computer intrusions & IP crimes Stolen data Theft of trade secrets U.S. Immigration and Customs Enforcement www.ice.gov U.S. Immigration and Customs Enforcement www.ice.gov Counterfeit imported goods U.S. Food & Drug Administration U.S. Food & Drug Administrationwww.fda.gov Counterfeit pharmaceuticals Nov 2012 27