Cyber Security Assignment

Part 1 

Question 1 

Advancement in technology has improved the way people live by changing human behavior in various ways. Over the last twenty years, technology has changed human behavior through: 

It has created a digital wall. Technology has changed how people interface; instead of consulting each other for knowledge, they primarily rely on technology for knowledge. The internet and search engines have made it possible for people to access the information they need instead of consulting others. This has stagnated social skills, creativity, and innovation. For instance, a student would rather "google" something they do not understand rather than ask the lecturer, who would have provided a better explanation. 

People have become less safety-conscious. Technology gadgets like mobile phones have reduced the attention human beings have to safety. For example, individuals are often inclined to use their phones even while driving, which has increased the chances of accidents. 

Question 2 

A subculture is a small cultural group under a larger group, normally having beliefs that vary from the larger culture, although some beliefs may be similar. Subcultural groups have their values about culture, sex, and politics; they serve as an excellent way for people with similar interests. 

The growth of the internet has improved how communication between members of a subculture communicate. The internet has brought people in subcultures together by providing them with a platform to exchange ideas. It has made the sharing of ideas quick and accessible via social media. People with common interests can share ideas online through blogs and social media groups, which has promoted communication. For example, Facebook groups have allowed individuals to share interests and enjoy sports like football. 

Part 2 

Capital One 

In 2019, Capital One was hit by a data breach where personal information of more than 100 million individuals was stolen. The hacker accessed the server, storing clients' information through a firewall “misconfiguration” on a web application (Weise & Flitter, 2019) . This can be classified as computer fraud, as the hacker obtained the server illegally, but there is no evidence of her selling the data online. 

The FBI tracked the hacker's activity through digital footprints of online activities on Meetup, slack messaging, and twitter, which linked her to the data breach. The hacker used the name “erratic," which was linked to her online posts (Weise & Flitter, 2019) . The FBI also obtained several digital devices, which were referenced to Capital One data theft. 

This crime can be classified under the routine activity theory. It emphasizes that the offender should have the motivation and obtain a satisfactory target, which is vulnerable (Reyns, 2013) . Ms. Thompson was not interested in selling the personal information obtained nor hiding her online activities. Instead, she was motivated to the crime, Capital One was a suitable target, and had a firewall misconfiguration, which Ms. Thompson used. She used her expertise as a software engineer and former AWS worker for the data breach. 

U.S. A Military 

In 2019, U.S. military seniors and veterans' personal information was obtained illegally in the South Korea base. This information was photographed from a computer screen and then used to withdraw and reroute millions of benefits. The money was wired to the hackers' bank accounts and laundered before the money was traced, and five individuals indicted (Vigdor, 2019) . This was a case of identity theft as the criminals assumed the identity of the veterans to withdraw and reroute the cash to their accounts. 

The department of justice followed the money through the digital footprints left behind by the money trail. The offenders had found ways to launder the money to other people’s accounts using international wire remittance services. After tracing the money destination, the investigative team was able to narrow down to the offenders. 

This case fits the low self-control cybercrime theory. It stresses that individuals with less control are self-centered, lack empathy, short-sighted, risk-takers, and impulsive (Burruss, Bossler, & Holt, 2012) . In this case, the suspects in the crime never calculated the consequences of the crime and took a huge risk of stealing the information from a USA military base–this was daring! Also, the individuals showed a lack of empathy by ripping off the benefits of disabled veterans without considering how they would survive. 

First American 

In 2019, the real estate company, The First American, experienced a serious data breach that compromised around 900 million records dating back to 2003. The company's website was compromised, and any individual could publicly access any document if they had the viewing link and were able to modify the link. The main problem was the website design error referred to as the Insecure Direct Object Reference (Newman, 2019) . Accessing the information from the website made this crime an identity theft as personal identifying information was obtained and could have been sold online. 

The major problem may not have been an attack but a website design problem. The Insecure Direct Objective Reference allowed an intruder who managed to identify the viewing link to obtain clients’ personal information. The investigation team temporarily brought down the site until the issue was rectified, after which the website was put back online. 

This crime can be classified as a routine activity theory. According to this theory, an opportunity and motivation must exist for a crime to occur (Myers, 2016) . In this case, any individual who needed any information could access it through the legitimate website. Individuals obtaining the data were opportunists as the website was unprotected, and the rewards of selling the data online acted as motivation. 

Part 3 

Question 1 

For this investigation, various laws can be applied. Some of the laws include: 

Computer Fraud and Abuse Act. This act prevents individuals from unauthorized access to another computer system (Hagen, 2010) . 

Stored Communications Act. This act prevents individuals from unauthorized access to stored electronic communication or data. Accessing data from the motor vehicle record is a violation of this act (Justice, 2020). 

Identity Theft and Assumption Deterrence Act. This involves using information from another person for unlawful activities (FBI, 2016). 

Question 2 

The information that could be obtained by the FBI during the search includes his home and office computers, cellphones, USB drives, and information stored electronically. According to Cornell Law (2016), to obtain a search warrant, the FBI should appear to a neutral judge and present hard facts either as testimony or an affidavit; establishes a basis for issuance. In case there are grounds for issuance, the judge gives a signed warrant, which identifies the property to be seized from the search, the person, time, and place of search. 

Question 3 

After searching the property, the evidence obtained will be extracted and processed through (Norwich University, 2017): 

Identification. This involves collecting preliminary information about cybercrime. Information identified include, who, how, and when the crime occurred. 

Collection. This process involves acquiring the evidence. Information from hard drives, USB drives, cell phones, and computers is acquired and secured by controlled boot discs to obtain sensitive data, transferring and copying digital data. This process must follow legal procedures. 

Evidence examination. Involves examining the data in archives using various analysis techniques for digital data analysis, such as software. 

Documentation and reporting. Involved recording information relating to evidence obtained and recording all activities related to the investigation, such as storing data. This ensures the integrity of the data. 

Question 3 

In 2011, Aaron Swartz was prosecuted for the CFAA violation. He was prosecuted for bulk downloads of about 2.7 million study resources from JSTOR service through the MIT network. JSTOR never pursued the case. The department of justice prosecuted the case as Swartz violated stored media accessing policies with the intent of unauthorized distribution of the materials on campus. He was charged with four counts of felony, which later increased to 13 as the download dates were delineated. He was to face a 50-year sentence and a possible fine of $1 million. Swartz was presented with a pre-deal to complete a six-month sentence, but he rejected it (Zetter, 2015) . He later committed suicide. 

References 

Burruss, G. W., Bossler, A. M., & Holt, T. J. (2012). Assessing the mediation of a fuller social learning model on low self-control’s influence on software piracy. Crime and Delinquency, 59 (5), 1157-1184. 

Myers, N. (2016). Review of the Roots of Youth Violence: Literature Reviews (Vol. 5). Ontario: Ministry of Children, Community, and Social Services. Retrieved from http://www.children.gov.on.ca/htdocs/English/professionals/oyap/roots/volume5/chapter03_rational_choice.aspx#:~:text=Routine%20activities%20theory%20relates%20the,offender%20will%20commit%20a%20crime. 

Newman, L. H. (2019, May 24). Hack Brief: 885 Million Sensitive Financial Records Exposed Online. Wired . Retrieved from https://www.wired.com/story/first-american-data-exposed/#:~:text=On%20Friday%2C%20independent%20security%20journalist,website%20for%20anyone%20to%20access. 

Reyns, B. W. (2013). Online routines and identity theft victimization: Further explaining routine activity theory beyond direct-control offenses. Journal of Research in Crime and Delinquency, 50 (2), 216-238. 

Search Warrant. (2016, May 25). Cornell Law School: Legal Information Institute . Retrieved from https://www.law.cornell.edu/wex/search_warrant 

Steps for Conducting Computer Forensics Investigations. (2017, September 11). Norwich University Online . Retrieved from https://online.norwich.edu/academic-programs/resources/5-steps-for-conducting-computer-forensics-investigations 

Vigdor, N. (2019, August 23). 5 Indicted in Identity Theft Scheme That Bilked Millions From Veterans. The New York Times . Retrieved from https://www.nytimes.com/2019/08/21/us/military-identity-theft-scheme.html 

Weise, K., & Flitter, E. (2019, July 29). Capital One Data Breach Compromises Data of Over 100 Million. The New York Times . Retrieved from https://www.nytimes.com/2019/07/29/business/capital-one-data-breach-hacked.html 

Zetter, K. (2015, October 26). The Most Controversial Hacking Cases of the Past Decade. Wired . Retrieved from https://www.wired.com/2015/10/cfaa-computer-fraud-abuse-act-most-controversial-computer-hacking-cases/