Forensic Detectives

Computerworld - Something looked fishy in PayPal Inc.'s merchant account system. Late in 2000, hundreds of new accounts were being opened under the same names, including Hudsen and Stivonson. PayPal's antifraud team was dispatched. Investigators tied the accounts to a single IP address that used Perl scripts to automatically fill in applications that opened the accounts using stolen credit card numbers.

Those accounts were then used to purchase approximately $100,000 of computer equipment on eBay. And, from the looks of things, preparations were being made to turn credit into cash by depositing charges as payments into the PayPal accounts and then to an outside bank account.

That's when the FBI called asking for help examining the computers of two suspects from Russia with PayPal account information on their computers. PayPal's evidence and support helped the FBI charge Alexey Ivanov and Vassili Gorchkov with multiple counts of wire fraud in May.

But PayPal's cybersleuthing also improved PayPal's bottom line by leading to the development of a pattern-matching fraud prevention system that has reduced PayPal fraud rates to 0.5%—well below than the average e-business fraud rate of 1.3% to 2.6%, according to Stamford, Conn.-based Gartner Inc.

"We found tremendous value in having these skills in-house," says Ken Miller, director of the 75-person fraud control group at PayPal, a Palo Alto, Calif.-based online payment processor. "A lot of our competitors have gone out of business because of fraud. We were able to drop our fraud rate significantly."

Because more and more evidence is digital these days, people with expertise in computer forensics and network/Internet investigations are being called upon to answer such questions as how someone got in, what systems were affected and how, how to repair them and how to prevent such incidents from happening again, says John Tan, research scientist of forensics at @Stake Inc. in Cambridge, Mass.

While forensics and investigative work are each highly specialized, they both require similar skills: strong network and systems engineering expertise (to know where evidence, including erased files, hangs out on the network), the ability to think analytically, an inclination toward thoroughness beyond tedium, knowledge of hacking tools and techniques, and the ability to follow your nose, say forensics professionals and employers. An investigative background in government, the military, law enforcement, or banking and legal support is also important.

Using freeware and commercially available tools, a computer forensics investigation starts with a mirror-image backup of a computer system and then proceeds with keyword searches through commonly used applications, file systems and the slack space where erased data resides until overwritten, says Charles Neal, vice president of cyberterrorism detection and incident response at Exodus Communications Inc., a Santa Clara, Calif.-based provider of Internet hosting services for businesses.