Sophos Cloud Optix
Do you know how to report a computer crime? Or even who you would report it to?
So far, we have looked at phishing and SQL injection attacks, unauthorised email account access and malware in our series of articles on how to report a computer crime. In this article, we’ll look at trolls.
We’ll look at what offences are committed in different countries when a crime like this happens, how you should report the crime, and what evidence you can preserve.
Take this scenario:
Annie has split up with her boyfriend, Greg, of three years.
Greg is upset by this and seeks retribution by posting slurs about Annie’s reputation using toe-curling vocabulary on a social networking site.
What was the offence?
Greg commits an offence by using a communication network to send a message that is either threatening, abusive, or harassing and is done with the intent to cause alarm, distress and or anxiety.
The legal bit
We’ve focused on the UK, USA, Canada and Australia, but each country has its own legislation, though the relevant statute often exists to accommodate the same offences in each country.
UK
In the UK, most computer crime falls under offences covered by one of three pieces of law:
Other associated crimes could include Conspiracy or Money Laundering offences, but victims of computer crime are more often than not affected by at least one of the three acts listed above.
In this case, the most offense will be covered by Section 127 of the Communications Act 2003; Improper use of public electronic communications network.
This legislation is wide-sweeping and applies to messages that are sent via a public electronic communications network.
USA
In the USA, states have individual laws regarding the communication of threats. So the crime will be covered by differing state law, depending on where the offence took place.
Canada
The Criminal Code of Canada contains sections that specifically cater for cybercrime, including:
- Unauthorised Use of Computer
- Possession of Device to Obtain Computer
- Mischief in Relation to Data
- Identity Theft and Identity Fraud
In this case, Section 264(1) of the Criminal Code: Criminal Harassment was contravened. Canadian law makes criminal harassment an offence punishable by summary conviction or by indictment. This offence currently carries a maximum penalty of ten years in prison.
Australia
Both state laws and commonwealth laws exist in Australia. In South Australia, the investigation of cybercrime by police is classified under three tiers and is spread across the organisation depending, mainly, on severity.
The primary legislation for computer offences is the Summary Offences Act, 1953 (SOA) and the Criminal Law Consolidation Act, 1935 (CLCA).
Reporting the crime
UK
In the UK, when a crime has taken place it should be reported to the police, so Annie should immediately report it at the local police station.
A crime allegation may be investigated by a police force or may be referred to the Police Central e-Crime Unit (PCeU) which provides the UK’s investigative response to the most serious incidents of cybercrime. The PCeU requests that the routine reporting of computer crime offences are not made directly to them.
USA
In this case the trolling should be reported at Annie’s local FBI office.
Canada
The Royal Canadian Mounted Police (RCMP) are the main agency with regard to the investigation of federal statutes, but they also have policing responsibility for a number of the Canadian provinces and all 3 territories, as well as some local police services in towns and cities.
Annie should report the trolling to her local police service. If appropriate, it will be escalated for the attention of the agency with federal responsibility, the RCMP.
Australia
Annie should report the crime to the Australian State or Territory Police.
Investigation policy differs from state to state but the Australian Federal Police website offers a guide on whether the crime should be reported to either Australian State or Territory Police.
Preserving the evidence
Annie should keep all messages and offensive content, however tempting it is to delete. She should take some examples of the content when reporting the crime to the authorities.
The content can be used in evidence that may assist any prosecution case. It may also contain useful metadata that may help in attributing the activity to the perpetrator.
Remediation
Sadly, trolls will always exist – we can’t wave a wand and make them disappear entirely from the internet but there are some handy tips that Annie could follow about how to deal with internet trolls.
Conclusion
In general, it’s important that all computer crime is reported. Even if no investigation follows, crime report intelligence can be built up and an accurate picture of the levels of computer crime can be produced.
If victims of a particular crime do not come forward to report incidents, then the number stated in crime reporting statistics will be not be a true reflection of the number of crimes taking place.
The scenario above is given as an example to help you in understanding when and what offences have taken place. Please be reminded that no two situations are the same and we have not catered for the “what if” situation.
We have also not included any corporation’s AUP (Acceptable Use Policy) that may be in place and may have been breached.
All of the scenarios are made up and the characters depicted bear no resemblance to any person.
Acknowledgements
Naked Security gratefully acknowledges the assistance of the following organisations in preparation of this series of articles:
UK Police Central e-Crime Unit
Action Fraud
United States Federal Bureau of Investigation
United States Secret Service
Royal Canadian Mounted Police
South Australia Police
Troll, man with laptop, roadsign and investigator images courtesy of Shutterstock.
I think it's important to note that slurring someone using toe-curling language is not a crime in itself. As you say it is illegal when it is threatening, abusive, or harassing and is done with the intent to cause alarm, distress and or anxiety which is absolutely right.
I find it alarming that in the UK you can be convicted if you offend someone – so you need to be very careful what you post online.
Agree. Free speech protections are strong in the US.
If the posts are part of a pattern of harassment that would lead the victim to feel she is in danger of physical harm, then it would come under stalking/terroristic threats. If the posts are factually incorrect and defamatory, then it would come under libel. If he pretends to be her and does so convincingly, it would be illegal as well.
But he can legally post embarrassing true things far and wide. He can post things that are mere matters of opinion, and he can post things that are clearly satire/parody. He can say she's a terrible cook. He can't say her cooking put him in the emergency room if it didn't happen. He can say he'd rather make love to a dead water buffalo because it would look and smell better in bed, but he can't say she made love to a guy behind the dumpster of the bar where she just met him unless it happened. She is free to say the same things about him, or to use her superior wit to make his posts look ridiculous. The response to offensive speech is more speech.
No it doesn’t have to be a threat only to be abusive, malicious and harassing and done with the intent to cause alarm, distress and or anxiety. This can be criminal harassment without including a threat under many states in the USA such as South Carolina.
Not even one word about EU.
Very sad and biased post.
Obviously, we couldn't cover every country in the world in the context of this series of articles.
If you have any information about how victims can report computer crimes in other countries, we would be happy to share it. Just leave a comment!
Put up or shut up! I like that!
US Federal law: 18 USCS § 2261A, "Stalking"
In part: "Whoever– . . . (2) with the intent- (A) to . . . cause substantial emotional distress to a person in another State . . . uses . . . any interactive computer service . . . to engage in a course of conduct that causes substantial emotional distress to that person . . . shall be punished as provided in section 2261(b) of this title."
(View in full)
If the harassment doesn't cross state lines, it would be better to contact state agencies.
You can also file a complaint with the Internet Crime Complaint Center (ic3.gov). They have a step-by-step process to get the information needed so they can forward the complaint to the right agency.
The largest crimes being committed are by social and dating sites who allow anyone to post photos that do not belong to them and false names in order to romance scam potential victims.
Many many men and women have not only had their hearts broken but have lost thousands of dollars to these unscrupulous people.
Even when the sites are contacted and told that the accounts are fake they do nothing.
Facebook and its associated sites are the biggest offenders.
what are you supposed to do when you report it and get told there is no crime and this is not the kind of thing they care about
Why even mention Canada and our laws?? The police here will do nothing, other then place the blame on the victim, unless it involves child porn.
The author, a former detective (with the Metropolitan Police Computer Crime Unit) has an obvious problem with using the correct terminology.
Trolling is a term created by whiners to condemn anyone with whom they disagree, usually philosophically. Harassment and libel should always be reported to the appropriate authorities. The author makes no distinction between the two.
^*THIS*^
Nothing quite as irritating as someone spouting misguided and inaccurate garp to the gullible GP and taking terms completely out of context.
Were "Trolling", as used in the *CORRECT* vernacular, made illegal, suffice it to say the investigators, prosecutors and incarceration facilities would be overwhelmed in a matter of hours.
Utterly ridiculous concept.
I wonder if there is any way to prosecute the Nigerian scammers and internet fraud cases from Nigeria ?
The amount coming from there is huge !!
I was a victim early on…but what about the newest victims? What recourse do they have ?
Is there any chance of prosecuting Nigerian fraud cases?
There are MANY agencies that accept Nigerian "419" scam/spam reports, including the US Secret Service. https://duckduckgo.com/?q=419+spam
Yes, just do a search for "reporting 419 scams" or "spams" and you'll come up with some results. You can report them to the US Secret Service. I tried to post some links, but apparently Sophos censors URLs in comments.
Gene wrote:
"I was a victim early on…but what about the newest victims? What recourse do they have ?"
A: When (and only then) we stop looking for that "fast-buck" will we be safe from scammers. The con's level of success depends on the level of greediness of the mark.
Jobe
This article is just not done right and miss leading. Trolling and Harassment or what ever else are dif things. I almost feel as if the article itself is used as a troll.
My report went so well… My yahoo ID was stolen. I did the FBI report then called my police department to file a report. They couldn't take it because it was from another state. I did some sleuthing and discovered the name and state for the perpetrator. (Let's just say that he was trying to blackmail me for my yahoo ID's return and was being obvious enough that I googled a few things and found him easily.) I called the place where he lived. It was a tiny small town department in Tennesee and the gentleman that answered the phone had no clue how that internet computery thing could cause crime. He'd never been on that type of technology. It was like a bad police countrified television sitcom. I later turned my perpetrators website in to microsoft as he was distributing hacked office products for "free". He never was stopped. I watched for a few years as an IP tools site told me everytime his website expired or moved to a new provider. It moved around a lot as the provider found out he was committing crimes but a new one always took him. Yahoo was able to give me my ID back and he didn't get into my Yahoo wallet account. He didn't use my personal data that was on the account. That was all happy, but it showed me that our law enforcement needs significant changes in internet crime management.
When a website is committing crimes, many domain name registrars will put the domain name on clienthold, which not only shuts down the website, it prevents the site from moving to a new host and keeping all the same traffic. You can find that information from the "whois," available from sites like domaintools.com or who.is.
There is in fact a US Federal law that applies to the illustration: 18 USC 2261A, "Stalking"
In part: "Whoever– . . . (2) with the intent- (A) to . . . cause substantial emotional distress to a person in another State . . . uses . . . any interactive computer service . . . to engage in a course of conduct that causes substantial emotional distress to that person . . . shall be punished as provided in section 2261(b) of this title."
If the harassment doesn't cross state lines, it would be better to contact state agencies.
You can also file a complaint with the Internet Crime Complaint Center (ic3(dot)gov). They have a step-by-step process to get the information needed so they can forward the complaint to the right agency.
"USA: In this case the trolling should be reported at Annie's local FBI office."
It obviously works, just ask the director of the CIA and the General who went down in flames.
Who would have thought?
I'd like to see Sophos do a "How to report a computer crime" for individuals who have their pictures and home addresses/telephone numbers posted without their consent. For example, in cases where young women have their nude pictures stolen from Facebook, etc. and end up on site's like Hunter Moore's:
http://www.dailydot.com/society/dot-dot-dot-inter… http://www.villagevoice.com/2012-04-04/news/reven…
I'd like to see Sophos do a "How to report a computer crime" for individuals who have their pictures and home addresses/telephone numbers posted without their consent. For example, in cases where young women have their nude pictures stolen from Facebook, etc. and end up on site's like Hunter Moore's (Google him)
I fear you have trolling confused with cyber-bullying.
Trolling does not involve any of what was listed. The art of trolling is an art of humor at possibly another's expense by their own stupidity. More specifically, trolling involves posting inflammatory, extraneous, or off-topic messages with the primary intent of gaining an emotional response or otherwise disrupting normal discussion. This is legal nearly everywhere, and causes no harm that the victims do not solely inflict on themselves.
Put simply, the art of trolling is one of manipulating your audience. The occupation is similar to a professional magician (illusionist if you don't want to say "magic"), or a comic relief role in a film, book, or play.