WORKING DOCUMENT

 

 

e + Finance + Crime

  A  Report  on  Cyber-Crime  and  Money Laundering

 

 

  

prepared for the 

Nathanson Centre for the Study of Organized Crime and Corruption,

Osgoode Hall Law School, York University

Toronto, Ontario, Canada

 

by Gyula Zombori

15 January 2001

 

 

  

Best viewed in electronic format to utilize hyperlinks.

Document Map option may be chosen in View command (in MS Word software)

to navigate inside the document.

  

1                   Table of Contents

  1         Table of Contents

 2        Preamble 

            2.1      Introduction.

            2.2       Executive Summary

 3        Questions 

             3.1      What Is New?

                        3.1.1    Ethics

                        3.1.2    Vulnerability

                        3.1.3    Global Action 

                        3.1.4    Global Reaction 

                        3.1.5    Global Jurisdiction? 

            3.2      Crime and Criminal Law 

                        3.2.1    Definition 

                        3.2.2    Intention 

                        3.2.3    Harm or Danger

                        3.2.4    Designation 

                        3.2.5    Criminal Responsibility 

             3.3      Law Enforcement

                        3.3.1    Burden of Proof

                        3.3.2    Anonymity 

                        3.3.3    Speed 

                        3.3.4    Evidence 

                        3.3.5    Cryptology 

                        3.3.6    Privacy and Secrecy 

                        3.3.7    Risks of Cyber-Payment

 4        Answers 

             4.1      Canadian Law

                        4.1.1    Proceeds of Crime (Money Laundering) Act

                        4.1.2    Personal Information Protection and Electronic Documents Act

                        4.1.3    Access To Information Act

                        4.1.4    Privacy Act

             4.2      U.N.   -   United Nations

                        4.2.1    U.N.   Vienna Convention 

                        4.2.2    U.N.   Palermo Convention 

             4.3      EU   Directive

             4.4      FATF   -   Financial Action Task Force on Money Laundering 

                        4.4.1    FATF-style Regional Bodies 

                        4.4.2    FATF   Recommendations 

                        4.4.3    FATF   Annual Report

             4.5      FIU   -   Financial Intelligence Unit

                        4.5.1    FinCEN 

                        4.5.2    Financial Transactions and Reports Analysis Centre of Canada 

             4.6      CISC   Annual Report

             4.7      U.S.   Strategy

             4.8      CoE   Convention   (Draft)

                        4.8.1    Other CoE Efforts 

                        4.8.2    Structure of the Convention 

                        4.8.3    Definition of Cyber-Crime 

 5        Conclusion 

 

2                   Preamble  

        2.1           Introduction

The Internet age is a (but not the) brave new world, it is no longer news.  Advising what to do in it, would be presumptuous.  This paper tries to be balanced, collecting available information on the questions and answers, in connection with potential and real risks of e-business, caused by cyber-crime and money laundering.

One of the fundamentals of doing business is trust.  It is true generally, but the importance of it in e-business cannot be overemphasized.  If trust and confidence would be lost in cyber-space, then real and potential benefits of new technology could not be exploited.  It would not only represent a loss in the general ledgers of e-business companies, but in all parts of human life.

  

***

 

It makes sense, to summarize the facts of changes caused by computing and the Internet.

 The Cyber-World and Business

new electronic (market)place offers new opportunities and possibilities,
opportunities to do business, evade the law, commit crime, and so on,
the importance of and dependency on the networked information technology sector has been growing continuously,
the Internet has made international co-operation possible and unavoidable,
this includes international cooperation in business, legislation, criminal activities, criminal investigation, law enforcement, and so on.

  The Cyber-World and Society 

new technology has been modifying social values, behaviours, life styles,
cyber-space is a type of existing community,
it has created a new community,
many elements of a traditional society can be found in the cyber-space,
representation of social groups are different,
there are both over-represented and under-represented social groups in cyber-space, similarly to other exclusive places, such as education or politics.

 The Cyber-World and Law 

moral and legal structures, paradigms break down in cyber-space,
legislation and regulation inevitably fail to keep pace with the imagination of criminals.

The Cyber-World and Crime 

computer crime poses a serious threat to society,
it may target basic utilities, energy, transportation, communications services, military and political institutions,
cyber-crime is becoming increasingly sophisticated, perpetrators more knowledgeable, and increasingly difficult to detect.

The Cyber-World and Money Laundering 

the new electronic marketplace offers new opportunities and possibilities for money laundering as well,
international cooperation in anti-money laundering was/is inevitable before/after the Internet age,
cyber-payment systems might offer the same flexibility as cash,
these systems might offer new tools for money laundering, eliminating the problem of “time and space".

More generally, the meaning of time and space must be revisited.  Living in the Internet time and cyber-space, practical implications of time and space require reconsideration.

 

***

This paper has been prepared primarily for Canadian initiative and usage on the topic of cyber-crime and money laundering.  Consequently, the selection of information is guided by these facts.  While both geographic and thematic scope could be extremely broad, the paper does not contain all possible information, which might be selected and/or be of interest to others.  Unfortunately, this type of limitation of “time and space" has not been eliminated by the new technology.

The collection of data terminated as of 15 January 2001.  Based on the above-mentioned selection criteria, many important publications could not be analyzed.  One of the latest is the Prosecuting Intellectual Property Crimes Manual published by the U.S. Department of Justice, released on 5 January 2001.  (http://www.cybercrime.gov/ipmanual.htm)

This paper contains an inseparable enclosure, a bibliographic database file on cyber-crime and money laundering.  It includes publications similar to the above-mentioned among other 500+ hyperlinks.  The database contains a complete resource kit for both; research on general information in e-business or on-line library catalogues; and search for specific bibliography titles on cyber-crime and money laundering.  Web sites were last visited on 1 January 2001 or shortly thereafter.

2.2           Executive Summary

This report collects available information on the questions and answers on the potential and real risks of e-business, caused by cyber-crime and money laundering.  Trust is one of the fundamentals in doing business.  If trust and confidence would be lost in cyber-space, then the real and potential benefits of new computing and Internet technology could not be exploited.  It would be a huge loss for the e-business sector as well as society at large.

The report accepts common concepts of anti-money laundering literature.  Money laundering is not just one type of crime.  It is the lifeblood of crime, it helps the conversion of illicit funds into the legitimate sphere:  investing into the mainstream of business, creating new power to commit new crimes; or living off the laundered fruit of illicit funds.

More than ever before, money laundering is a worldwide phenomenon.  Moreover, money laundering has or may be accompanied by an other international challenge, cyber-crime.

In the Questions section, an overview is provided of,

what truly and originally new in cyber-space,
how morals have been changed by new technology,
how new technology brought new interpretations to the principles of criminal law,
what new risks and difficulties have arisen for e-business and law enforcement,
what potential new tools have been created for cyber-crime and money laundering.

In the Answers section, the latest Canadian, American and international legal materials and instruments are reviewed.  How United Nations,
the European Union,  G-7 (G-8) countries (FATF),  and  the Council of Europe try to find appropriate answers for the questions of cyber-crime and money laundering.

 

3                   Questions 

3.1           What Is New?

 The very first question that arises in connection with cyber-crime and money laundering is,

whether there is any truly and originally new problem,
or it is the new appearance of old problems that must be faced.

 In other words, are we doling with

traditional crimes committed or facilitated by the Internet   
(old problems, new techniques), or
new techniques give rise to entirely new problems.

Is the so-called cyber-crime just a new quantity of problems because of speed and international context, or it is the beginning of a qualitatively new age in crime. 

At first sight, it seems that networked computers provide not only a quantitative change in the way people manage their public and private lives and conduct legitimate and illegal business;  but computing and the Internet also represent a qualitative change.  If it is true, then legal paradigms and systems also must keep pace with new technology.

Most computer crimes have parallels in traditional crimes, such as trespass, and destruction of property.  On the other hand, there are characteristics, which make computer crimes unique among criminal offences.  These

may be committed remotely and across geographic boundaries,
may be committed in many jurisdictions at the same time,
may have effects years or decades after they are launched or planned,
may or may not violate "traditional" criminal laws,
may be difficult or impossible to investigate, and even more difficult to prosecute (note:  the burden of proof is on the prosecution).

(Find additional details in:  Mark D. Rasch:  The Internet and Business: A Lawyer's Guide to the Emerging Legal Issues, Computer Law Association, 1996)

Here those new issues are taken into consideration, which influence criminal law and the electronic business, as a whole.  Of course, additional items could be mentioned, like speed, anonymity, or risks of cyber-payments.  These questions will be analyzed in detail, as the problems of law enforcement.

 

3.1.1    Ethics

However laws themselves may be immoral, criminal laws (usually) are based on the established ethical structures of societies. 

Our transitional age is a typical period for anomie (anomy, normlessness).  It is a condition of instability resulting from a breakdown of standards and values or from a lack of purpose or ideals (in societies or individuals).  The French sociologist Émile Durkheim in his study of suicide introduced the term.  Robert K. Merton, in the United States, studied the causes of anomie, or normlessness, finding it severest in persons who do not have acceptable means of achieving their cultural goals.  In psychological usage, anomie means the state of mind of a person, who has no standards or sense of continuity or obligation, and who has rejected all social bonds.

An age of transition is a period of instability too.  It is a result of the breakdown (or change) of old standards and values.  For example, the anonymity provided for users of computer networks may cause them to attempt offences, which they would never commit except in cyber-space.  In the world outside cyber-space, an ethical structure of acceptable and unacceptable behaviour has been established.  There has also been years of experience and law.  Cyber-space has no common ethical and legal experience.

Being a member of mass society, living in a vacuum, lacking a coherent ethical structure in cyber-space, social or individual behaviour may not be predictable.  It is obvious, that a rented car must be paid for.  It is no so obvious, that listening and/or downloading music from Napster must also be paid for.

 

3.1.2   Vulnerability

In February 1995, when Kevin Mitnick was arrested, it was an incident, far from the madding crowd.  Mitnick broke into the home computer of Tsutomu Shimomura (a well-respected computer security expert), stole computer security tools, and distributed these over the Internet.  However, Mitnick's case and plea-bargain agreement is an interesting story of cyber-crime history, now it is just an example of feeling of vulnerability.  At the time, basically, the public handled it as an heroic act or a funny story.

In February 2000, when denial-of-service attacks on prominent commercial Internet sites and dissemination of the "I Love You" virus happened, it was a real threat for the masses.  By that time, the Internet had become a very important part of everyday life.  By then, the public had understood that cyber-crime is a serious international problem.

Objective and subjective vulnerability should be distinguished.  Vulnerability can be objectively dangerous, however it is not felt.  On the other hand, feeling of vulnerability can be higher than it really is or should be.  Everybody has experienced the feeling of lack of control, in case of a car repair or in a medical situation.  When the process is not transparent or not controllable, feelings of uncertainty are quite normal.

In case of cyber-crime, both the terms of objective and subjective vulnerability are appropriate.  However, knowledge of vulnerability is not enough.  Knowledge of objective vulnerability should be in accordance with the feeling of subjective vulnerability.  It would be helpful for making appropriate (not panic- led) civil actions and political steps.  Or, at least, to prevent dispersion of computer viruses, caused by lack of knowledge and/or negligent behaviour.  However there are no licence and liability insurance requirements for computer users, yet networked computers are dangerous vehicles.

 

3.1.3   Global Action

  Any messages posted on the Internet are accessible globally.  Consequently, both publisher and reader, by using the Internet, may unintentionally find themselves subject to all nations' jurisdiction.  They may commit their action (publishing and reading) intentionally.  But they do not take into consideration, that their act may be deemed socially harmful or dangerous as well as specifically defined, prohibited, and punishable, under any (perhaps many) state or federal criminal laws.

 

3.1.4   Global Reaction

As any action taken over the Internet is global, it might require global reaction.  The requirement of global reaction is obvious in case of both cyber-crime and money laundering.  Although, how to do, it is less obvious.

  Having a look at the legal systems of only the English-speaking world, a wide diversity can be found.  English criminal law still consists of a collection of statutes of varying age (the oldest still in force being the Treason Act, 1351), and a set of general principles that are chiefly expressed in the decisions of the courts (case law).  In Canada, the national parliament enacted the criminal code for the country as a whole.  In the United States, criminal law is primarily a matter for the individual states.  Even if the American Law Institute published the Model Penal Code in 1962, attempting to establish a consistent framework for defining offences and general principles, the code itself was never enacted completely.

  Against these difficulties, there are well-crafted and well-working multilateral agreements.  A very common solution is described in the following paragraph.  The example is taken from the Financial Action Task Force on Money Laundering (FATF, an international body, established by the G7 countries.)

 “It was recognised from the outset of the FATF that countries have diverse legal and financial systems and so all cannot take identical measures.  The Recommendations are therefore the principles for action in this field, for countries to implement according to their particular circumstances and constitutional frameworks allowing countries a measure of flexibility rather than prescribing every detail.  The measures are not particularly complex or difficult, provided there is the political will to act.