United States Secret Service: Protecting the Nation’s Leaders and Financial InfrastructureHugh Dunleavy Special Agent in Charge, Criminal Investigative Division

In the spring of 2010, undercover agents of the United States Secret Service New York Field Office discovered some postings on an Internet forum from a member using the online nickname “f1ex.” In these messages, “f1ex” proudly boasted of his ability to compromise the networks of financial institutions and discussed his global network for the distribution of stolen financial data. In the early stages of the investigation, these agents, assigned to the New York Electronic Crimes Task Force, learned that “f1ex” had been a fixture in the criminal underground since 2003, with associations to cyber criminal organizations such as Shadowcrew, dismantled by the U.S. Secret Service in 2004. Agents classified “f1ex” as an overseas hacker involved in selling illegally obtained credit card account numbers through online forums and various other means.

Why is the Secret Service, an agency renowned for protecting the President of the United States, investigating an Internet hacker? The answer goes back to April 14, 1865, and the creation of the U.S. Secret Service. As the nation’s Civil War neared its end, President Abraham Lincoln and his Treasury Secretary, Hugh

McCulloch, discussed the creation of the Secret Service to combat the counterfeiting of U.S. currency. At the time, nearly one-third to one-half of all U.S. currency in circulation was counterfeit, which threatened to destroy an already fragile wartime economy. Ironically, that evening after meeting with McCulloch, Abraham Lincoln was shot at Ford’s Theatre and died the next morning. Today, the Secret Service has a dual mission: to safeguard the nation’s financial infrastructure and to protect national leaders.

Over the years, the Secret Service has maintained a long history of protecting American consumers, industries and financial institutions from fraud. With the evolution of payment systems and modernization of commerce, the Secret Service has also evolved to ensure the protection of the economy. The passage of new legislation in the 1980s gave the Secret Service authority for investigating credit card and debit card fraud and parallel authority with other federal law enforcement agencies in identity theft cases. In 1984, Congress gave the Secret Service concurrent jurisdiction to investigate financial crimes as they relate to computers.

Trustwave 2012 Global Security Report

The Secret Service has long recognized that partnerships and cooperation act as force multipliers in conducting investigative and protection operations. In 2001, Congress recognized the value of the Secret Service Electronic Crimes Task Force (ECTF) model established in the New York Field Office, where law-enforcement, the private sector and academia collaborated in detecting and suppressing computer-based crime. Through 2001’s USA PATRIOT Act, Congress directed the Secret Service to establish a network of ECTFs to combat the rise of cybercrime. Currently there are 31 ECTFs: 29 domestic task forces and two located overseas in London and Rome. These ECTFs and their associated partnerships allow the Secret Service to employ both proactive and responsive investigative tactics centered on exploiting vulnerabilities identified in the cybercrime underworld. Agents and ECTF partners have achieved success investigating financial and cybercrimes that range from bank and wire fraud to network intrusions, from botnets to credit card offenses and many cybercrimes in between. This explains why Secret Service undercover agents were looking into cybercrimes when they identified “f1ex” as an investigative target of interest.

Through the spring and into the summer of 2010, undercover Secret Service ECTF agents monitored and engaged “f1ex” attempting to identify the hacker who now had been traced back to Malaysia. As this investigation progressed, Secret Service agents learned that “f1ex” was planning on traveling to the United States. Agents arranged to meet “f1ex” in New York City to purchase stolen credit card account numbers. During the course of the investigation, agents identified “f1ex” was Lin Mun Poo, a Malaysian citizen. On October 21, 2010, an undercover agent met with Poo at a Queens, New York, diner and purchased $1,000 worth of compromised credit card numbers. The New York ECTF later identified the account numbers were issued from a bank in Nepal.

In a second meeting with undercover agents, arrangements were discussed for a continued long term relationship for the distribution of compromised data, further illustrating Poo’s access to stolen data. Agents set up in a hotel room in Brooklyn, New York waited for the deal to be finalized. Poo arrived with other associates and negotiations began to purchase thousands

of stolen credit cards. During the meeting, Poo was taken into custody. A subsequent analysis of Poo’s laptop computer revealed more than 100 GB of data, including approximately 413,000 credit card account numbers with an estimated value of $206 million. This analysis also revealed evidence of multiple network intrusions into government and banking sector systems.

On April 13, 2011, in the Eastern District of New York, Lin Mun Poo plead guilty to violating Title 18, United States Code, Section 1029 (Access Device Fraud). On November 4, 2011, Poo was sentenced to serve 10 years in a federal prison.

The investigative mission of the Secret Service has evolved to keep pace with the information revolution and rapid globalization of commerce. The combination of advanced technology with the worldwide Internet has created the venue for transnational cyber criminals to operate with nearly complete anonymity. The Secret Service and their law enforcement partners are committed to disrupting and dismantling these criminal networks. The arrest and successful prosecution of Lin Mun Poo is just one instance that demonstrates the proactive approach and cooperation that exemplifies the collaborative efforts of the Secret Service’s ECTFs. The Secret Service will aggressively continue its mission to safeguard U.S. financial infrastructure and payment systems and preserve the integrity of the U.S. economy. The Secret Service is proud to partner with law enforcement, the private sector and academia to accomplish this mission.

Please visit the Secret Service website athttp://www.secretservice.gov for more details and a complete list of resources.

Trustwave 2012 Global Security Report

This excerpt is from the Trustwave 2012 Global Security Report.

Download the complete report at www.trustwave.com/gsr.