Follow the Money: Identity Theft

In today’s world, you are your data. So what happens when that data is stolen? It’s a question that’s becoming more and more important: according to the Bureau of Justice Statistics, over 10 percent of Americans aged 16 or older experience identity theft every year, with the associated financial losses totalling over $17 billion.

Identity theft is, in and of itself, nothing new. The FBI has been busting people for counterfeit IDs and forged checks for a long time. But with the integration of the internet into mainstream society and commerce, identity theft has taken a new and insidious turn.

While it can take many forms, identity theft is primarily about stealing people’s data: Social Security numbers, login names and passwords, driver’s license numbers, and bank account information. Ways to use this information maliciously range from tax return fraud, to medical fraud, to digital impersonation. But by far the most common consequence of identity theft is compromised debit and credit card information.

Famous Case: Alberto “Soup Nazi” Gonzalez

The case against one of the most infamous identity thieves began by pure chance. In July 2003, a plainclothes NYPD detective observed a young man pulling out cash from an ATM. The detective noticed that the young man pulled out a few hundred dollars, then inserted a new card and pulled out a few hundred dollars more. And then he did it again. And again. The cycle repeated and repeated, until the NYPD detective intervened. The young man, whose name was Alberto Gonzalez, had been cashing out funds from blank cards that he’d imprinted with stolen card numbers.

Alberto Gonzalez, also known by his online handle soupnazi, was arrested and turned over to the Secret Service’s Electronic Crimes Task Force, who had been investigating cases of cash-related identity theft in the area. Investigators learned that not only did Gonzalez have millions of stolen credit card numbers on a database in his personal computer, but he also worked as a moderator of a large online black market site called Shadowcrew that peddled both stolen data and the tools needed to take advantage of it.

Agents convinced Gonzalez to work as an informant. In this role, Gonzalez persuaded his coworkers to begin communicating through a secure VPN (a VPN which had, in fact, been wire-tapped by the Secret Service), and his efforts in the investigation led to the indictment of over a dozen members of Shadowcrew. He then aided in another investigation, and then another, earning the trust of the Secret Service, and even a paid salary. He spoke at conferences and seminars. And, along the way, unbeknownst to his handlers, he worked with fellow hackers to steal an additional 180 million identities from corporations like OfficeMax, Target, Barnes & Noble, and 7-Eleven.

One way Gonzalez’s crew worked was through a technique called ‘war-driving,’ where hackers would park themselves physically close to a big-box store, and next, with high-powered antennae and laptops, listen in on the traffic of the store’s WiFi networks. Gonzalez would compromise log-in accounts, debit and credit card numbers, and transaction information; then he’d store his haul on rented servers in the Netherlands, Latvia, and Ukraine. From there, Gonzalez sent this data out to an international syndicate, where collaborators in Europe, Asia, and South America would buy the stolen info and then send cash or wires back to Gonzalez, through proxies.

In a parallel two-year investigation, an undercover agent was finally able to meet with one of Gonzalez’s collaborators in Dubai. While there, the agent copied the collaborator’s hard drive, gaining info that linked them to major cases of identity theft in the US. This led investigators to a case in North Carolina where a man had been caught with $200,000 in cash and 80 blank debit cards. That led them to a man named Jonathan James, who investigators surveilled and found sitting in a car with a laptop and a high-powered antenna. And, finally, that led to a thumb drive that showed who was providing this network with stolen card data: someone who went by the name of soupnazi.

In the subsequent raid on Gonzalez, investigators found two laptops teeming with evidence and over $1.6 million in cash. According to the Office of the Attorney General, Gonzalez cost victimized companies over $400 million in reimbursements and legal fees. Gonzalez pled guilty to all charges against him, and received the longest-ever sentence given to an American for computer crimes: two concurrent 20-year terms.

How Forensic Investigators Fight Identity Theft

Identity theft doesn’t have a typical crime scene. There is no blood, and there are no fingerprints. But there are still forensic traces if an investigator knows where to look.

Today’s investigations require following the trail of money and data across international borders and through complicated tunnels of tech. Forensic professionals from both the public sector and the private sector need to be versed in a wide range of fields: from cybersecurity, to forensic accounting, to digital evidence collection. Their investigations can take years, requiring collaboration between numerous agencies and countries. To catch today’s criminal requires one to be as intelligent and sometimes as ruthless as the suspect.

Catching identity thieves is one of the most difficult tasks for forensic investigators. Large swathes of data are often stolen in a single heist, then parceled off to a wide network of accomplices who parcel the stolen data out further. The very nature of the crime includes the masking of one’s identity, which makes pinpointing the perpetrator all that much harder. Much of the attention focuses on preventing attacks in the first place, or recouping losses to the unwitting victims. But small groups of dedicated investigators are going after the perpetrators themselves. If you’re ready to study up and join the fight, read on to get a look at some standout programs and experts working against identity theft.