--- begin forwarded text X-Sender: oldbear@tiac.net Date: Tue, 12 Nov 1996 17:46:02 -0500 To: Digital Commerce Society of Boston <dcsb@ai.mit.edu> From: The Old Bear <oldbear@arctos.com> Subject: Litt: 10/28 speech to ABA/ABA Mime-Version: 1.0 Sender: bounce-dcsb@ai.mit.edu Precedence: bulk Reply-To: The Old Bear <oldbear@arctos.com> < gopher://198.80.36.82:70/00s/current/news/topic/econ/96102905.lec > *96102905.LAR 10/29/96 FIGHTING ELECTRONIC MONEY LAUNDERING DEMANDS MULTI-PRONGED STRATEGY (Byliner by DAAG Robert S. Litt) (1930) By Robert S. Litt Most observers believe that widespread electronic commerce is probably inevitable. It offers us the exciting prospect of doing away with many of the costs, burdens, and problems associated with paper money. But the advent of electronic commerce presents certain challenges to law enforcement as well. One of the biggest challenges is the new opportunities for criminals to launder their dirty money. Traditionally, money launderers have deposited troublesome and bulky cash proceeds into banks or other financial institutions to obscure its criminal origins. Or they have created phony companies, or engaged in sham transactions, to hide illicit profits. These methods usually create paper trails that can be traced by law enforcement. Through education, training and the enactment of stringent laws and regulations in this regard, and through close cooperation between the Departments of Treasury and Justice, law enforcement has made great progress preventing and detecting money laundering. As a result, it is increasingly difficult for criminals to launder their money successfully. But certain types of electronic commerce systems permit virtually anonymous transactions and leave no paper trail. These systems could undo years of hard law enforcement work. Electronic commerce could allow a money launderer who wants to transfer tainted funds to do so without the risk of engaging in personal contact with a potentially suspicious bank employee. And the funds could be transferred anywhere in the world by an automated on-line banking system that could be accessed from the safety of the money launderer's home. Similarly, a bank that operates completely on-line could court the business of money launderers with little danger of prosecution. Such a virtual bank could easily be located overseas, beyond the reach of U.S. law enforcement. A recent article in the Washington Post suggests that we are already encountering offshore, on-line banks. According to the Post article, one offshore bank describes itself as the first bank on the Internet, offering the opportunity to open accounts, wire money, order credit cards or write checks by computer from anywhere in the world, around the clock. The bank's Worldwide Web page describes the benefits it offers to customers: "Since there are no government withholding or reporting requirements on accounts, the burdensome and expensive accounting requirements are reduced for you and (the bank). The bank maintains the strictest standards of banking privacy in offshore business and financial transactions. Indeed, (the bank's country) has stiff penalties for officers or staff that violate banking secrecy laws." It is not hard to imagine who will be attracted to this kind of banking. Some smart card systems go further, and would permit money launderers to obscure the origins of funds while avoiding financial institutions entirely. These systems have no central registry of transactions which would allow the transactions to be reconstructed. A sophisticated launderer, using multiple cards, could create an intricate series of transfers that could not be unraveled, and that would circumvent almost all existing money laundering laws. Internet payment systems can similarly permit multiple transactions that could be next to impossible to trace, particularly if unscrupulous merchants cooperate with the criminals. How do we respond? One big step toward eliminating money laundering and other law-breaking through electronic commerce would be to implement electronic cash technologies that track all transfers. We have received information that at least one provider of a smart card system that is already in use in Europe has modified its cards for use in the United States so that financial institutions will be able to track card usage. The system will allow them to audit for fraud, if not recreate every transaction. But a solution such as this raises a fundamental philosophical issue for our society -- striking the proper balance between anonymity and accountability. This question is being debated in many contexts as the Internet grows. Important reasons abound to allow anonymity in communications networks. Whistleblowers may want to remain anonymous to avoid retribution. Consumers may wish to obtain information on a product without ending up on hundreds of mailing lists. Rape victims may want to discuss their experiences without revealing their identities. Unfortunately, criminals also benefit from anonymity. They want to avoid getting caught. Anonymous remote communications can help them avoid detection and apprehension. And so effective law enforcement requires accountability. We must be able to hold individuals who harm others accountable for their conduct. We can find a middle ground between anonymity and accountability in the principle of confidentiality. In a confidential system, a person's identity is not generally known, but in appropriate circumstances -- for example when a court order is obtained -- the identity can be determined. Confidentiality permits us to allow anonymity in appropriate circumstances but does not permit criminals to obtain new advantages from the anonymous capabilities of the Net. This concept of confidentiality embodies the message chosen by the framers of the U.S. Constitution to limit law enforcement through the Fourth Amendment. They rejected a system under which law enforcement could have unfettered access to citizens' papers; but equally they rejected a system where those papers could be immune from scrutiny under any circumstances. Rather, they provided for access to a person's documents under appropriate judicial supervision, forbidding unreasonable searches and seizures and requiring warrants and subpoenas. The same kind of balancing, an approach that protects both anonymity and accountability, should govern our approach to electronic cash. Those are some of the challenges we will face. The Department of Justice has been taking some steps to help us prepare for these challenges, drawing on the expertise we have had in dealing with other computer crimes such as hacking. The first lesson that we have learned is the need for extensive training. To fight computer crime, agents and prosecutors must understand computer and telecommunications technology, and be dedicated full time to this complex area of law. The FBI has now created three computer crime squads, in Washington, San Francisco and New York City. The Secret Service also has agents trained to deal with electronic crimes against financial institutions. The expertise of these agents will be a crucial asset in fighting abuses of electronic commerce. Successful investigation of high-technology crime also requires the participation of technically literate prosecutors. In 1991, the Criminal Division of the Department of Justice created what is now the Computer Crime and Intellectual Property Section, which we have recently doubled in size. And we have set up, with the cooperation and support of our U.S. attorneys nationwide, a network of prosecutors who have been specially trained to serve as Computer and Telecommunications Coordinators. These "CTCs," as they are known, presently serve as resident experts on computer crime issues. But to be successful in combating money laundering or any other form of electronic crime, an international response is absolutely necessary. Many of the crimes of the future will not be hampered by international boundaries, because electronic funds need not be physically transferred; they can be instantaneously and covertly shipped via telephone and data networks. Because computer criminals often are not in the same country as the electronic funds that they are stealing, passports and other existing international controls are of limited use in identifying and apprehending them. Thus, a concerted international effort will be necessary to ensure that electronic commerce criminals cannot take advantage of weak laws in one country to commit crimes with impunity in the United States. We are making great progress in this effort. We have already had several instances of international cooperation leading to the arrest of overseas hackers who have broken into U.S. computers, and we are working in a number of international forums to institutionalize that cooperation and to seek coherent rules and policies that will enable us to prevent abuses of electronic commerce. In addition to working with other governments, we will have to work with industry. The issue of encryption is particularly prominent now. Without strong encryption, successful electronic commerce is probably a fantasy. But encryption that is too strong -- that cannot be broken when appropriate -- risks terrible and irrevocable damage to law enforcement capabilities that are critical to our ability to protect us all. Our goal is to encourage the use of strong encryption to protect privacy and commerce, but in a way that preserves law enforcement's ability to protect public safety. We're not looking to expand what we can do now, just to preserve this ability against the threat of unbreakable encryption. Our goal is confidentiality -- protecting the privacy of individual communications while preserving our present ability under the law to obtain this information when we need it. Similarly, in electronic commerce, we want to work with industry to ensure that the needs of law enforcement are met without either stifling the development of a vibrant new technology or compromising individual rights. We believe that the electronic commerce industry should incorporate certain features into the designs of their smart cards systems, features that we consider necessary to avoid abuses in this area. We don't want to dictate how these features are designed, but there are certain reasonable elements that industry should build into its systems. First, a transaction using a digital purchasing system should generate and safely store records similar to those of credit cards whenever a cardholder makes a purchase or transfer that exceeds a designated size. In this regard, we must again emphasize that we are not seeking to give government any new authority, merely to ensure that we can get information when we are authorized to do so. Second, electronic commerce systems should be designed to maintain sensible limits on the amount of value that may be stored or transferred on a single smart card or personal computer. Few people carry tens of thousands of dollars in cash on their persons; permitting "smart cards" of such value would greatly increase the opportunities for fraud. Finally, and for obvious reasons, we must encourage the major smart card system providers to use responsible financial entities as the primary outlets for their cards. Our last challenge is to update laws that might otherwise become outdated. At present it is not clear whether our existing laws are adequate to deter and punish electronic commerce abuses. Since Congress did not and could not have foreseen the current electronic commerce revolution, law enforcement authorities must be prepared, at least at first, to combat these abuses through existing criminal statutes that are not perfectly adapted to the problem. We do not want to create new laws for their own sake, and certainly not without understanding the effects that they would have on a vibrant new industry. On the other hand, if we find that the law enforcement problems presented by electronic commerce are outstripping our ability to deal with them, changes in our legal structure may be required. The challenges faced by law enforcement in electronic commerce will be enormous. We have already begun to prepare for some of these challenges, but we realize that we have much more to do. With training, technological understanding, international cooperation, diligent law enforcement, and the cooperation of industry, we will meet these challenges. (Mr. Litt, a deputy assistant attorney general, is President Clinton's nominee to head the Justice Department's Criminal Division. The article was adapted from his Oct. 28 speech to the American Bar Association and the American Bankers Association in Washington. It is in the public domain and may be reprinted without permission.) NNNN ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To unsubscribe from this list, send a letter to: Majordomo@ai.mit.edu In the body of the message, write: unsubscribe dcsb Or, to subscribe, write: subscribe dcsb If you have questions, write to me at Owner-DCSB@ai.mit.edu --- end forwarded text ----------------- Robert Hettinga (rah@shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/