by Bob Burls @ Naked Security from Sophos
Do you know how to report a computer crime? Or even who you would report it to?
So far, we have looked at phishing and SQL injection attacks, unauthorised email account access and malware in our series of articles on how to report a computer crime. In this article, we'll look at trolls.
We'll look at what offences are committed in different countries when a crime like this happens, how you should report the crime, and what evidence you can preserve.
Take this scenario:
- Annie has split up with her boyfriend, Greg, of three years.
- Greg is upset by this and seeks retribution by posting slurs about Annie’s reputation using toe-curling vocabulary on a social networking site.
What was the offence?
Greg commits an offence by using a communication network to send a message that is either threatening, abusive, or harassing and is done with the intent to cause alarm, distress and or anxiety.
The legal bit
We've focused on the UK, USA, Canada and Australia, but each country has its own legislation, though the relevant statute often exists to accommodate the same offences in each country.
UK
In the UK, most computer crime falls under offences covered by one of three pieces of law:
- Computer Misuse Act 1990
- Communications Act 2003
- Fraud Act 2006
Other associated crimes could include Conspiracy or Money Laundering offences, but victims of computer crime are more often than not affected by at least one of the three acts listed above.
In this case, the most offense will be covered by Section 127 of the Communications Act 2003; Improper use of public electronic communications network.
This legislation is wide-sweeping and applies to messages that are sent via a public electronic communications network.
USA
In the USA, states have individual laws regarding the communication of threats. So the crime will be covered by differing state law, depending on where the offence took place.
Canada
The Criminal Code of Canada contains sections that specifically cater for cybercrime, including:
- Unauthorised Use of Computer
- Possession of Device to Obtain Computer
- Mischief in Relation to Data
- Identity Theft and Identity Fraud
In this case, Section 264(1) of the Criminal Code: Criminal Harassment was contravened. Canadian law makes criminal harassment an offence punishable by summary conviction or by indictment. This offence currently carries a maximum penalty of ten years in prison.
Australia
Both state laws and commonwealth laws exist in Australia. In South Australia, the investigation of cybercrime by police is classified under three tiers and is spread across the organisation depending, mainly, on severity.
The primary legislation for computer offences is the Summary Offences Act, 1953 (SOA) and the Criminal Law Consolidation Act, 1935 (CLCA).
Reporting the crime
UK
In the UK, when a crime has taken place it should be reported to the police, so Annie should immediately report it at the local police station.
A crime allegation may be investigated by a police force or may be referred to the Police Central e-Crime Unit (PCeU) which provides the UK's investigative response to the most serious incidents of cybercrime. The PCeU requests that the routine reporting of computer crime offences are not made directly to them.
USA
In this case the trolling should be reported at Annie's local FBI office.
Canada
The Royal Canadian Mounted Police (RCMP) are the main agency with regard to the investigation of federal statutes, but they also have policing responsibility for a number of the Canadian provinces and all 3 territories, as well as some local police services in towns and cities.
Annie should report the trolling to her local police service. If appropriate, it will be escalated for the attention of the agency with federal responsibility, the RCMP.
Australia
Annie should report the crime to the Australian State or Territory Police.
Investigation policy differs from state to state but the Australian Federal Police website offers a guide on whether the crime should be reported to either Australian State or Territory Police.
Preserving the evidence
Annie should keep all messages and offensive content, however tempting it is to delete. She should take some examples of the content when reporting the crime to the authorities.
The content can be used in evidence that may assist any prosecution case. It may also contain useful metadata that may help in attributing the activity to the perpetrator.
Remediation
Sadly, trolls will always exist - we can't wave a wand and make them disappear entirely from the internet but there are some handy tips that Annie could follow about how to deal with internet trolls.
Conclusion
In general, it's important that all computer crime is reported. Even if no investigation follows, crime report intelligence can be built up and an accurate picture of the levels of computer crime can be produced.
If victims of a particular crime do not come forward to report incidents, then the number stated in crime reporting statistics will be not be a true reflection of the number of crimes taking place.
The scenario above is given as an example to help you in understanding when and what offences have taken place. Please be reminded that no two situations are the same and we have not catered for the “what if” situation.
We have also not included any corporation’s AUP (Acceptable Use Policy) that may be in place and may have been breached.
All of the scenarios are made up and the characters depicted bear no resemblance to any person.
Acknowledgements
Daedalus Teks does not take credit for this article, Daedalus Teks shares articles like these in order to make clients more aware of the I.T. Field. Daedalus Teks gratefully acknowledges the assistance of Naked Security and the following organisations in preparation of this series of articles:
- UK Police Central e-Crime Unit
- Action Fraud
- United States Federal Bureau of Investigation
- United States Secret Service
- Royal Canadian Mounted Police
- South Australia Police