Crime and punishment?

Yesterday a full stop was placed to one of the most notorious cases of cybercrime in Russia over the past few years.

Kaspersky Lab didn’t take part in this case, although of course we followed it with interest.

The case was investigated over two years; the amount of time taken did give rise to the thought that maybe the investigators were having some problems. We’ve got used to the fact that in Russia, the vast majority of cyber crime cases never make it to court, and those that do end up with conditional sentences and fines.

Yesterday’s sentence shocked us. 8 years in jail. Article 273 (creating and distributing malicious programs for the IBM) of the Criminal Code of the Russian Federation prescribes from 3 to 7 years imprisonment for crimes committed as part of a group. Clearly, the defendants were sentenced in accordance with Article 163, (extortion, sentence from 7 – 15 years imprisonment).

DoS attacks were the scourge of the Internet between 2002 and 2004. However, we’ve noticed a real drop in the number of attacks, and it could be said that this type of cyber crime is already pretty much extinct.

The zombie networks used to conduct this type of attack haven’t gone away. It’s just that cyber criminals have found more profitable and less risky ways to use these networks: sending spam, spreading adware, and stealing users’ personal data. Zombie networks are causing far more damage to far more people than they ever did when they were being used to conduct DoS attacks.

The script kiddies who conduct DoS attacks are on the lowest rung of the cyber crime ladder. The ‘real’ cyber criminals work in a much more subtle manner, putting them currently beyond the notice of law enforcement bodies.

The sentence given yesterday in Saratov is clearly designed to demonstrate to the West that Russia is battling against cybercrime, and is capable of working closely and successfully with agencies in other countries. This strict sentence is the first time a cyber crime trial in Russia has resulted in a real prison sentence.

We can only hope that in future the Russian law enforcement bodies won’t just be involved in widely publicized cases, but will also be able to react quickly and professionally to any type of cyber crime.