Digital warfare
Expert Edward McAndrew says nation is facing 'perfect cyber-crime storm'
1:29 p.m., Feb. 15, 2016--On Friday, Feb. 12, Lenore Matusiewicz was sentenced to life in prison by a federal judge standing at her bedside in a Philadelphia hospital. The critically ill 70-year-old woman made history that afternoon when she became the first person in the United States to be convicted and sentenced for cyberstalking resulting in death.
Cybersecurity expert Edward McAndrew, a member of the team of Delaware-based prosecutors who secured Matusiewicz’s conviction and those of her son and daughter, shared lessons learned from that case and others he handled at the U.S. Department of Justice in a lecture at the University of Delaware last week.
People Stories
'Resilience Engineering'
Reviresco June run
Surveying the landscape
“We’re facing the perfect cyber-crime storm — great connectivity, enormous amounts of data, and open networks,” McAndrew said.
The cyber-threat landscape is dotted with a broad assortment of crimes, including identity and intellectual property theft, tax fraud, child exploitation, obstruction of justice, economic espionage, extortion, bullying, stalking, money laundering, terrorism, and even domestic violence. Cyber-criminals work at all levels from stealing the personal information of individuals to bringing down entire systems.
McAndrew pointed out that the physical and virtual worlds are becoming increasingly entwined on this landscape.
“Violent crimes on the street can now be solved with digital evidence,” he said. “Your phone is no longer a phone — it’s a witness with a near-perfect long-term memory and no bias. We’ve reached the point where we’re relying on devices to tell stories and humans to fill in the blanks.”
The cyber-landscape is populated by an alphabet soup of good guys — the DOJ, the SEC, the FCC, the FTC — battling bad-guy spies, thieves, and terrorists. Journalists, security researchers, and cyber-investigative firms are also in the fight to identify, pursue, disrupt, and deter cyber-criminals.
Because cyber-crime is so far-reaching and insidious, the job of assessing, mitigating, and responding to threats requires multidisciplinary teams of lawyers, crisis managers, IT and human resources specialists, and others.
“Every organization needs an up-to-date [cybersecurity] playbook,” McAndrew said.
A new battlefield
McAndrew talked about a recent major power failure in western Ukraine that may have been the world’s first cyber-attack on an infrastructure system. In the days and weeks after the outage, headlines across the Internet asked the question “Did Russia Kill Ukraine’s Electricity?”
“This is a new front in warfare,” McAndrew said. “We’re fighting an asymmetrical threat where someone who can’t fight us on the battlefield may be able to beat us on the digital front.”
Cyber-crime can also inflict reputational harm, as in the case of the November 2014 cyber-attack on Sony Pictures Entertainment. The company paid millions of dollars to employees whose personal information was stolen and millions more to repair its damaged public image.
But perhaps the most chilling crime in this frightening new landscape is murder.
Murder, they wrote
The Matusiewicz case first made the news in August 2007, when Lenore Matusiewicz and her son, David, kidnapped David’s three young daughters and fled to South America. In March 2009, after the group was found living in a motor home in Nicaragua, David and Lenore Matusiewicz were arrested, and the children were returned to their mother, Christine Belford.
But the pair of kidnappers, along with Lenore’s daughter, Amy Gonzalez, then launched a three-year campaign of digital torment on Belford, harassing, stalking, and spying on her in cyberspace.
“After the kids were found, the mother was demonized by the family — their goal was to get her to give up,” McAndrew said. “When she didn’t give up, they took a new tack.”
On Feb. 11, 2013, David’s father, Thomas, shot Belford and a friend with a semi-automatic pistol in the New Castle County Courthouse on King Street in Wilmington, Delaware. After a confrontation with police, he turned the gun on himself.
“The shooter was dead, but the case was by no means over,” McAndrew said. “We were able to connect the cyber-stalking to the ultimate murder, and the case was moved from the virtual world to the physical world. These people operated very much like a terrorist cell.”
Following a month-long trial in 2015, Lenore and her two children were found guilty of conspiracy and cyber-stalking that resulted in the death of Christine Belford.
A life lived online
McAndrew also talked about the growing tension between surveillance and security, between privacy and civil rights — and the need to achieve a balance.
And he cautioned that people’s credit card numbers are not their greatest vulnerability.
“It’s your user names and passwords that are the keys to the kingdom,” he said.
To illustrate, he shared a hacker’s two-line-long password made up of a confusing mix of letters, numbers, and characters.
“The hackers put forth a much greater effort to protect the information they steal than the people they steal it from,” McAndrew said.
That’s a message well worth remembering in an era when people live their lives online.
About the Series
The next lecture in the series, which is hosted by the Cybersecurity Initiative, will take place on March 16.
Rajesh De, a partner at Mayer Brown LLP, will discuss “Cybersecurity: Recent Developments and Trends in the Law,” from 2:30-3:30 p.m. in Mitchell Hall with a reception to follow in DuPont Hall lobby.
The lecture is free and open to the public. Those planning to attend the reception should RSVP to Wendy Jordan at cybersecurity@win.udel.edu.
Visit the website for more information.
Article by Diane Kukich
Photos by Kathy F. Atkinson and Wenbo Fan