DarkMarket_ Cyberthieves, Cybercops and You - Misha Glenny [28]
Once detailed to the Autodesk case, Crabb traced the fraud by checking where customers of the counterfeit programs were sending their money. It turned out they would make payments into bank accounts belonging to fifteen ‘mules’, US citizens dotted around the country. Money-laundering and scams depend upon these (largely) unwitting characters, who respond to advertisements offering good returns on work carried out from your home computer. Successful candidates are then required to place their bank accounts at the disposal of their new employer. In the Autodesk case, the mules would receive
$200 and then forward $180, holding back $20 as their commission. They sent the money to a bank in Latvia, one of the three Baltic states whose role in both cybercrime and the broader issue of cyber security is out of all proportion to their combined population of seven million.
With the help of the Latvian police, Crabb discovered that the final destination of the monies was a set of bank accounts in Ternopil, western Ukraine. The accounts all belonged to a certain Maksym Kovalchuk or his wife.
Crabb realised that Kovalchuk by himself was not going to bring down the US economy. By the standards of major organised-crime groups, he was earning peanuts from this particular scam, galling though it was for Autodesk. Instead, Crabb worked on cracking open Kovalchuk’s email account to discover if there were any other secrets there, and at some point he hit upon a ‘unique capability’ to monitor Kovalchuk’s communications – which one can only interpret to mean that Crabb either hacked into his target’s computer or persuaded Kovalchuk’s email host to give him access. Whatever the truth, the ‘unique capability’ was to have a far-reaching impact on the real world, because almost as soon as he had started reading the emails, Crabb realised that Kovalchuk was involved in a project that was much bigger than the Autodesk scam: the development of a website called CarderPlanet.
Although the primary focus of his investigation remained Kovalchuk and his connection with the scam, Crabb began to map CarderPlanet’s Family tree, almost as a sideline. Unaware that he was being monitored by a US agency, Kovalchuk was fairly free with his conversation and so a combination of luck and diligent investigative work had put Crabb in an enviable position. Not only was he ahead of the game with Kovalchuk himself, but the inspector had even stolen a march on Western intelligence agencies as well. By partially penetrating the most dynamic cyber-criminal community in the world, he had succeeded where the Western spooks had so far failed.
Yet while Crabb was able to learn a great deal about what was going on in Ukraine’s hacking community, there was not much he could do about it. He couldn’t even bust Kovalchuk. Not only did the United States have no extradition treaty with Ukraine, but the political circumstances prevailing in this enormous East European country were most infelicitous. Leonid Kuchma was President of this country, which embodied a vast network of corrupt relationships between oligarchs and organised crime. Furthermore, the United States was competing with Europe and Russia for influence over the country, and at this time the prevailing wind was blowing from Moscow with some force. As long as he stayed in Ukraine, Kovalchuk was safe.
In the midst of this, in late 2002 while Inspector Crabb was still in San Francisco, he was called in by the security department of Visa, whose headquarters happen to be located there, too. Their people were frustrated by the inordinate success of a hacker named Boa, who had successfully stolen or assisted others in stealing