http://www.afp.gov.au/publica/platypus/jun98/computer.htm


AFP Computer Crime Team investigation leads to first jail sentence for
computer hacking

By Janice Jarrett
   
     An AFP investigation led recently to what is believed to be the
     first jail sentence delivered in Australia for computer hacking and
     one of the most sensational cases of its kind yet seen in this
     country.
     
   The success in the conviction of Skeeve Stevens, who broke into the
   computer system of Internet Service Provider AUSNet causing actual and
   potential commercial harm, was clinched by Eastern Region's Computer
   Crime Team.
   
   Stevens had applied for employment with the company in January 1995,
   saying he knew of security holes within AUSNet and other Internet
   Service Providers and that his information could be given to the media
   to discredit AUSNet's competitors. His application was turned down.
   AUSNet contacted the AFP on April 18 after finding material making
   damaging claims against it displayed on the Internet.
   
   The case, which attracted strong media interest nationally and
   internationally, also highlighted some of the evolving legal aspects
   for law enforcement practitioners in adapting to meet the challenges
   of investigating crimes and presenting evidence to court in the
   `computer age'.
   
   And while the traditional methods of investigation and the usual
   protocol for court may seem to be outmoded in a `hacking'
   investigation, it was significant that tangible and traditional
   evidence - fingerprints - was a major factor in linking the suspect
   with the crime, and that `victim impact statements' formed a strong
   part of the Crown's case.
   
   In contrast, travel, a usual component of investigations involving
   national inquiries,became obsolete as the Internet was used to obtain
   statements from people at computer sites around Australia which were
   affected by the crime.
   
   The Eastern Region Computer Crime Team members on the case were former
   Federal Agent Graham Henley, Federal Agent Allen Williams, and team
   leader Federal Agent Chris Buttner.
   
   Federal Agent Buttner said that the case was a particularly important
   one for the AFP.
   
   Stevens was sentenced to three years' jail (18 months non-parole) in
   the Sydney District Court on March 27, 1998, in a hearing which lasted
   three hours.
   
   "It is the harshest sentence given for an offence under Part VIA of
   the Crimes Act 1914, and when coupled with the recent decision (March
   1998) of the Victorian County Court (DPP v. Idolo) - another
   Commonwealth prosecution under Part VIA Crimes Act 1914 - there is
   emerging a precedent for the jailing of offenders under Section 76E of
   the Act," Federal Agent Buttner said.
   
   The complications of de-coding encrypted data, which may lead to
   delays in an investigation, also posed considerable challenges for the
   case investigators. "The present NSW criminal justice system (with the
   administrative requirement of four weeks for the handing over of the
   prosecution brief) places great strains on any law enforcement agency
   involved in computer crime investigations (including pornography) if
   commercial or military grade encryption of data or images is involved.
   Ultimately, this might result in dropped charges."
   
   Mr Buttner said a by-product of the investigation was the uncovering
   of instances of some sections of the media being manipulated by
   Stevens.
   
   "It highlighted the thin line between some aspects of `investigative
   journalism' and counselling the commission of offences," he said.
   
   The investigation demonstrated the importance of liaison with business
   and corporate organisations. The University of Sydney and Australian
   Internet Service Provider Ozemail were asked to help in reconstructing
   an intricate web of Internet hacking activity from Monash University
   (where Stevens used a friend's computer account) to AUSNet's Sydney,
   Melbourne, Perth, Brisbane and Darwin computers and Ozemail via the
   Menzies School of Health Research in Darwin, and other Ozemail
   accounts.
   
   Mr Buttner said that a major prosecution issue was to show the full
   extent of the `damage' done by Stevens.
   
   "Although some of the published credit cards were used locally and
   overseas to make fraudulent purchases, the total value was not high.
   
   "Federal Agent Williams was tasked to provide what amounted to `victim
   impact statements' for AUSNet and the banks and I have no doubt that
   the quality of that work was a significant factor in sentencing," he
   said.
   
   He also praised the work of Federal Agents Neil Campbell and Brad
   Deacon (Southern Region) and Lisa Richards (Eastern Region) who
   assisted in the investigation.
   
   ABC communications journalist, Tom O'Byrne, provided a summary of
   remarks made by Judge Cecily Backhouse at the sentencing. They
   included:
   
   "I generally accept [the Crown] submission on the seriousness of the
   offence in the indictment. In particular the substantial matter that
   [Stevens] obtained access to the home page of AUSNet and altered
   information. . . . This in time led to the withdrawal of a large
   number of customers . . ."
   
   "Real criminality arises from the copying of the confidential files
   [AUSNet's operating system data files]."
   
   "He [Stevens] intended to do harm to the company, and [his] activities
   seriously damaged the company."
   
   "In my view the prisoner's motives were malicious, and apparently
   motivated by the offer of his employment being rejected."
   
   The strong interest in the case was demonstrated the day after
   Stevens' sentencing when there were many Internet links to the various
   news articles it generated, often with considerable prominence, such
   as the home page of Beverley Hills Software (a USA-based Windows NT
   Developer) which displayed the story as the leading news item for the
   day with a hyperlink to a report in the Australian Financial Review.
   
BACK TO JUNE 1998 PLATYPUS