Corruption, intimidation, robbery, violent assault, forgery, large-scale fraud. No, not the subject of the latest John Grisham novel, but sensational allegations, made public Apr. 4 by Hermitage Capital Management -- until recently the largest foreign portfolio investor in Russia. In a detailed and damning report, titled Criminal Justice -- Russian-Style, Hermitage alleges the fund's Russian subsidiaries have fallen victim to an elaborate con designed to defraud the fund of hundreds of millions of dollars. 
  
The most sensational part of Hermitage's allegations is that the attempted larceny was carried out with the direct connivance of officials in the Russian police. Hermitage alleges the police seized documents and equipment that were instrumental to the attempted fraud, which involved bogus court cases based on forged documents, the aim of which was to sue Hermitage subsidiaries for hundreds of millions of dollars. "The most shocking thing is not that there are corporate raiders in Russia who attempt to steal your shares," says Jamison Firestone, managing partner of Firestone Duncan, Hermitage's law firm. "The shocking thing is that the police worked hand-in-hand with them, and actually performed the theft of the documents so that the corporate raiders could then do their work."

So the two-pronged scam worked in one area and failed in another. The perpetrators weren’t able to steal the assets from us based on the fake court claims, but they were able to steal $230 million from the Russian government by filing amended tax returns on behalf of our stolen companies. What makes this story even more shocking is that we filed six 255-page criminal complaints with the Russian authorities in December last year, one month before the tax fraud took place, and they did nothing to stop it. Two complaints were sent to the Russian General Prosecutor, two to the Russian State Investigative Committee and two to the Internal Affairs Department of the Interior Ministry. There was enough information to prevent the fraud and indict a number of people behind it if the government had acted. 

Instead of doing anything to save the Russian state from this highly sophisticated and organized looting, two of our complaints were thrown out immediately; two were returned to the same Interior Ministry official we were complaining about (essentially, he was being asked to “investigate himself”); and one was thrown out for “lack of any crime committed.” Only one complaint was taken seriously. It was taken up by the Russian State Investigative Committee in early February, but before it could get any traction, the case was lowered to the South region of the Moscow district of the State Investigative Committee (the lowest level of the Committee) and by June, another senior Interior Ministry official whom we had named in our complaint had joined the “investigation” team (again, to “investigate himself”). To this day there has been no serious response by the Russian authorities to this massive fraud against the Russian state. 

As we described in our April letter, the problem of corporate “raiding” is now so endemic in Russia that President Medvedev speaks about it as one of the biggest problems faced by Russian businesses. In this case, raiders have taken this problem to a new and absurd extreme by “raiding” the Russian state itself and so far getting away with it. Together with HSBC, we will shortly be filing new criminal complaints with the Russian General Prosecutor and Russian State Investigative Committee as well as with many law enforcement authorities outside of Russia. It is hard to predict what will happen next in this unfolding and unbelievable saga, but as always we will keep you updated on any further developments as they arise.

Of course we see individual identity theft on a regular basis (actually as Ross Anderson points out its not really identity theft but poor controls on the bank's parts using SSNs as secrets and so on), but you dont see a major corporation stolen every day.

• Implementing a risk-based approach for distribution of DMF information. One suggestion: Have NTIS delay release of updates to public customers for one year to give SSA ample time to correct erroneous entires.
• Limiting information included in the data sold to public customers.
• Starting required breach notification evaluation procedures.
• Providing appropriate notification to living individuals whose information was released in error.
  

Nowhere is that shift clearer than at the FBI's Regional Forensic Computer Lab here, which once lifted traces of incriminating Google searches from a suspect's hard drive to help convict him of murder. This week the lab became the sixth computer forensic lab in the nation to be accredited by the American Society of Crime Laboratory Directors, in another sign that computer forensics is no longer just about investigating hacker attacks.

"We've found video of gangsters rapping a song about a murder they committed," RCFL examiner John Leamons says.

The growth of law enforcement computer labs is an indication of how technology is increasingly involved in, or on the periphery of, criminal activity. San Diego-area law enforcement agencies founded the first regional forensic lab in 1998; there are now 14 such labs in the United States, with two more coming online this year. Last year the labs collectively performed more than 13,000 forensics examinations. The San Diego lab alone handled more than 1,000 requests from 40 law enforcement agencies in 2007, including 171 child pornography cases and 160 murder investigations.

In its early days, the RFCL examiners not only recovered the data, they analyzed it for evidentiary value based on the particulars of the case. But with exponentially growing data and caseloads, the 22 examiners here now focus on collecting and preserving data in a manner that will hold up in court, then hand that data back to the police agency for analysis.

Not surprisingly, the most valuable information comes from the files that suspects thought they had deleted, but which remained hidden in the nooks and crannies of their hard drives. "The key to computer forensics is unallocated space," says Leamons, who is on loan to the lab from the San Diego Police Department.

No one can remember a case being kicked because the lab made an error, but they can remember cases where they found evidence that exonerated people charged with crimes, Leamons says.

Cellphones pose a particular challenge, says Rebecca Adimari, one of the five examiners who work on them.

"Each has its own operating system and frequency -- there's probably over 500 makes and models and not many of them are the same," she explains. "There can be so much evidence on there."

From the unique ringtone caught on camera during a holdup -- to the accidentally recorded conversations on voice notes, to the Israeli thug keeping notes of extortion visits on his PDA -- the way people use their phones can be pretty incriminating.

"When they arrested the Arellano Felix people (a gang of Mexican drug lords later convicted of murder and drug crimes in 2007), they recovered 14 phones including one with a photo of a machine gun," Adimari says.

She has hundreds of power and data cables, since they're all peculiar to individual phones. And she has a special box that blocks signals on the phones in the lab, so no information is lost or compromised.

Examiner Patrick Lim, from the Naval Criminal Investigative Services, says he recently recovered data from a hard drive that had been burnt to a crisp. Asked if it was from an arson or a murder, Lim says he can't reveal the details.

"It was burned. That's all I can say."

More news here. Commentary here.

How long before this device is in the hands of the hacker community? Days? Months? They had it before it was released?

EDITED TO ADD (4/30): Seems that these are not Microsoft-developed tools:

COFEE, according to forensic folk who have used it, is simply a suite of 150 bundled off-the-shelf forensic tools that run from a script. None of the tools are new or were created by Microsoft. Microsoft simply combined existing programs into a portable tool that can be used in the field before agents bring a computer back to their forensic lab.

Microsoft wouldn't disclose which tools are in the suite other than that they're all publicly available, but a forensic expert told me that when he tested the product last year it included standard forensic products like Windows Forensic Toolchest (WFT) and RootkitRevealer.

With COFEE, a forensic agent can select, through the interface, which of the 150 investigative tools he wants to run on a targeted machine. COFEE creates a script and copies it to the USB device which is then plugged into the targeted machine. The advantage is that instead of having to run each tool separately, a forensic investigator can run them all through the script much more quickly and can also grab information (such as data temporarily stored in RAM or network connection information) that might otherwise be lost if he had to disconnect a machine and drag it to a forensics lab before he could examine it.

And it's certainly not a back door, as TechDirt claims.

But given that a Federal court has ruled that border guards can search laptop computers without cause, this tool might see wider use than Microsoft anticipated.

When the deluge began in 2006, officials scurried to come up with software "patches," "wraps," and other bits of triage. The effort got serious last summer when top military brass discreetly summoned the chief executives or their representatives from the 20 largest U.S. defense contractors to the Pentagon for a "threat briefing." BusinessWeek has learned the U.S. government has launched a classified operation called Byzantine Foothold to detect, track, and disarm intrusions on the government's most critical networks. And President George W. Bush on Jan. 8 quietly signed an order known as the Cyber Initiative to overhaul U.S. cyber defenses, at an eventual cost in the tens of billions of dollars, and establishing 12 distinct goals, according to people briefed on its contents. One goal in particular illustrates the urgency and scope of the problem: By June all government agencies must cut the number of communication channels, or ports, through which their networks connect to the Internet from more than 4,000 to fewer than 100. On Apr. 8, Homeland Security Dept. Secretary Michael Chertoff called the President's order a cyber security "Manhattan Project."

It can only help for the U.S. government to get its own cybersecurity house in order.