Collaboration between Law Enforcement Agencies in Combating Cybercrime: Implications of a Taiwanese Case Study about ATM Hacking

Analytic Plan

This study employs qualitative methods to obtain meaningful information about the FCB cybercrime investigation that took place across multiple law enforcement agencies. Researchers examine FCB case-related legal documents, investigative and analytic reports, in conjunction with insightful interviews of NPA police officers and MJIB special agents. In total, eight different law enforcement officers’ interview data—two from MJIB and six from NPA—are analyzed in the present study. To understand different aspects of the complicated FCB case, researchers used a purposive sampling strategy to approach potential eligible law enforcement officers who involved in investigation. Two researchers independently conducted semi-structural interviews by using the official local language—Mandarin—from 2017 to 2018. Each researcher interviewed sampled officers individually or jointly with another, depending upon their work setting and schedule. Contents of the interviews were later manually analyzed to retrieve the themes relevant to law enforcement collaborations and cross-agency competitions. Although case study methodology does not offer statistical generalizations, it contributes to our collective understanding of a little known phenomenon—ATM hacking—because none of the prior studies examine ATM hacking as an emerging form of cybercrime using qualitative data.

Given confidentiality concerns, this study used code names to refer to the interviewees’ statements throughout the manuscript. Participants also referred researchers to other prospective interviewees who might contribute to the construction of a case profile from the various roles involved such as digital forensics, computer forensics, criminal apprehension, and pubic information.

First Commercial Bank ATM Hacking: Case Profile and Modus Operandi in Brief

With a sophisticated plan, a group of European cybercriminals—Carbanak/Cobalt—used a publicly available security program named Cobalt Strike to penetrate the FCB’s networks and then hacked into 41 ATMs at 22 branches across three cities (Taipei, New Taipei, Taichung) in Taiwan on July 11, 2016 (Sancho et al., 2017). Cobalt group targeted one particular model of ATMs (PC 1500XE), which is manufactured by the German company Wincor Nixdorf International and used by financial institutions globally (Taipei District Prosecutors Office [TDPO], 2016). This model of ATMs also has well-known vulnerabilities within the industry. The organized criminal group sent 22 conspirators representing eight different nationalities to pick up cash that was poured out from malware-infected ATMs much like “jackpotted” slot machines. The criminals then attempted to launder the collected cash which amounted to NT $83.3 million dollars (approximately $2.6 million US dollars). The high profile case captured the public’s attention, and authorities felt pressured to quickly solve the incident and prevent financial panic. Because the vulnerabilities of this specific ATM were well known and remote control proves to result in financial gains increased the opportunity to be targeted in this Taiwanese case. As special agent “S” relates,

“This is a totally rational and well calculated operation. . .if they have done it before and have not been caught [by the police], it is easy for them to replicate the modus operandi here [in Taiwan]. . .once you know you can easily remote control ATMs to spit out cash in a few seconds, this is definitely easy money, a very lucrative gain.” (special agent “S”)

According to the MJIB’s cybercrime section chief and documents, the modus operandi utilized by the Cobalt group to penetrate the FCB network can be briefly broken down into three steps (see Figure 1). First, the hackers prepared an attack operation and developed the malware to infect targeted ATMs. Digital forensics show that hackers began a system invasion from an IP address in Switzerland on May 31, 2016 and penetrated the FCB London branch’s voice recording system that connects to the company’s internal network. As an investigator in the FCB case, agent “S” adds:

“Investigation showed that one alleged explanation [for the FCB case] is the hackers infiltrated a voice recording system in London through ‘spear phishing’ against an administrator who holds specific credential in the first place. . . this is a very common ‘social engineering’ that hackers would use to trick individuals into clicking on something they should not click like a hyperlink, an image, an ad.” (special agent “S”)

Second, hackers infiltrate FCB internal servers by deploying the malware through the FCB’s Intranet. With credentials obtained from the London branch, hackers dispatched five executable files related to cash-dispensing and trace-wiping on the NCR server. Hackers then breached an administrator’s account at the FCB’s headquarters in Taiwan and delivered fake package files (with the filename extension “.DMS”) on the access point (AP) servers that are only recognized by ATMs for updating programs. Once the targeted ATMs finished updating with the disguised malware, the thieves were halfway through setting up the jackpotting scheme.

OPEN IN VIEWER

Figure 1.

FCB ATMs hacking.

Once the targeted ATMs finished updating with the malware, both telnet service and file transfer protocol (FTP) were enabled to allow remote connection among ATMs to execute pre-installed malware on the NCR server. The entire process of Intranet infiltration and infection took about 6 weeks. The third step was to access the ATM’s cash for which money mules were assigned to designated ATMs from July 9 to July 11, 2016, when an intense typhoon just passed Taiwan. On the day of the cyberattacks, mules contacted hackers who remotely controlled the ATMs to dispense cash and to execute a trace-wiping file removing their digital footprints. The final step involved money mules transporting, transferring and hiding the stolen cash, and facilitating the process of money laundry upon receiving further instructions from the Cobalt group.

Conventionally, financial institutions and companies might tend to cover up cyber incidents out of concern for damaging the reputation of their business, losing customer confidence, and possibly compromising the status of working relations with regulating authorities (Taylor et al., 2011). In this case, however, the FCB decided to work with law enforcement agencies from the inception, and one strategy was to distribute the news of the ATM hacking and the suspects’ photos through all types of media coverage right after the cash was withdrew. Before the Cobalt group could relax and enjoy their illegal gains, three mules were apprehended by the police in Taiwan on July 17, 2016, and the district prosecutor’s office (TDPO) issued an arrest warrant for the remaining 19 suspects who had fled. Later in September, the TDPO charged the mules with multiple criminal offenses against computer security and recommended that the judge impose a 12-year-sentence for each offender. Taiwan is one of many countries that have suffered from ATM hacking arranged by Cobalt, yet, is the first state to solve their hacking-related crime. Subsequently in 2018, one of the alleged ringleaders of the current case was arrested in Spain (Devereux, 2018). It has been argued that the positive outcome was elevated by the cooperation between the MJIB and the NPA along with other members of Taiwanese law enforcement and international collaborators.

Pragmatic Implications: Collaboration between Law Enforcement Agencies

National-local law enforcement collaboration has been a controversial part of operations for decades in many democratic societies, as competition for budget resources and “turf jealousies” between agencies are well-known disincentives of cooperation (Geller & Morris, 1992). For example in the U.S., compared with the FBI, some federal law enforcement agencies like the Bureau of Alcohol, Tobacco, Firearms, and Explosives (ATF) appears to have a better working relationship with local police. This probably because the ATF has more specific areas of expertise that are less likely to overlap with but supplement to local police agencies. On the other hand, the organized FBI predated many formal police departments where local law enforcement agencies were developing, and local police often had to share jurisdiction with the federal bureau that had few specific federal crimes to focus on (FBI, 2018). Traditional bureaucratic boundaries and competition in policing assignments, resources (Stewart, 2011), and organizational culture (Cohen, 2017) are barriers of collaborative relationship among national-local law enforcement agencies. In addition, the FBI’s prioritization of fighting local corruption often included investigating illegal activities within police agencies (Geller & Morris, 1992).

In Taiwan, the NPA tends to have better collaborative relationships with other law enforcement agencies (e.g., Immigration Agency) than with the MJIB. Three interviewed NPA officers (Commander “L1”, Chief “C2”, Supervisor “C1”) mentioned their collaborations with the Immigration Agency and/or the Airport Police during the investigation, while no MJIB agent addressed this point. Although both NPA and MJIB are organized at the same hierarchical level within the central government’s bureaucracy, the MJIB—like its equivalent the FBI—is missioned to prioritize a number of national major crime investigations such as counter-terrorism, public corruption, white collar crime (e.g., economic crime, money laundering) and cybercrime. Given the complexity of foreign affairs and diplomatic relations, the Taiwanese official liaison and member of the Egmont Group Financial Intelligence Units (FIU) is MJIB. As officers in the Taipei City Police Department [TCPD] pointed out:

“for dealing with financial related affairs [crime], MJIB enjoys priority. . .therefore, FCB would approach MJIB to file the financial loss and complaints in the first place.” (Supervisor “C1”, Criminal Investigation Division [CID])

“Let me put it in this way, MJIB investigates two [significant] cases per year, while we police have to handle a case every other day, but people believe MJIB agents are of higher quality than us. If I could just work on two cases per year, I could do better investigations. So, this is an apple-and-orange comparison which cannot be practical. I worked with MJIB before, and I think NPA’s investigation capacity is no less than MJIB. . . Financial industry is reluctant and unwilling to file incident reports with us [the police], and they tend to report to MJIB. . .because they believe that MIJB would handle cases well, while the police would leak information for media coverage.” (Commander “L1”, CID)

These statements underscored that the goals of crime fighting missions are blurred across levels of policing commonly, in which would produce incremental competition and even interagency tension between local and national agencies. It has been noted that there are pressures in interagency collaboration in crisis and significant crime on roles of network and leadership (Waugh & Streib, 2006). Such situation is especially true when both local and national policing are involved with a high-profile case like the FCB incident. As TCPD officers commented:

“MJIB takes the lead in computer forensics [in FCB case]. . .but MJIB does not have a good working relationship with NPA. . . They [MJIB] would like to grow their capacity for digital forensics, but I think NPA has compatible abilities in this area. . .in the current case, we [NPA] worked on investigating malware intrusion that MJIB would like to take over. . .”(Commander “L1”, CID)

“. . .our roles [in FCB case] are liaison of international law enforcement agencies and data analysis, including digital forensics, and this is our strength. . . but we are competing with MJIB in the area of digital forensic” (Supervisor “C4”, CID)

Before the collaborative relationship between the NPA and the MJIB was developed in the FCB case, there were issues raised within the police regarding jurisdiction. The analysis of interviews also revealed that interagency collaboration operates at local policing level “seem to experience the high level of estrangement from their counterparts” (Cohen, 2017, p. 893). This may result from turf jealousies derived from “performance-first” organizational culture in Taiwanese policing. Intelligence and resource sharing between local police agencies were somewhat blocked. As NPA officers recalled:

“At the beginning of investigation, it was a bottom-up, not top-down approach that it is supposed to be, which is time consuming. . .we surveyed each banks for potential victimization of ATM hacking and then narrowed down to First Commercial Bank only. . .because ATM hacking happened all over the different jurisdictions. . .many police precincts set a special task force for this [FCB case] initially. . .we [the police] lost direction on the investigation and were unsure what happened. . .should we use the NPA to lead the case and ask all precincts to share resources and cooperate with the investigation?” (Chief “C2”, Third Precinct, Keelung City Police Bureau)

“At the beginning, the FCB case was thought [by the NPA police] to be a regular fraud ring where a member was sent to pick up the cash [from an ATM]. . .It feels like that there was a lack of one central command during the initial stage of investigation. Different police branches provided inconsistent lists of suspects for investigating the same case. While everyone worked on the same case, they were holding different levels of information and resources. I believe we [the police] wasted a lot of time on not sharing and integrating intelligence internally.” (Detective “T1”, CID)

In terms of cybercrime fighting, the present study confirmed that there are strong incentives for national-local collaborations when an individual or a group of criminals operates across jurisdictions or state/national borders and caused substantial damages (e.g., Kevin Mitnick, Cobalt group). The complexity of the FCB case involving both traditional crime investigation strategies and advanced technologies to combat ATM hacking further highlights the need for local police (NPA) to team up with the national agency (MJIB). This emerged collaborative relationship between NPA and MJIB is accord with Mitchell et al. (2015) observation whereby law enforcement collaboration between agencies would develop because of the need for innovative and creative approaches to break the deadlock, improve operations, and achieve the desired outcomes. The TCPD officers explained:

“I don’t think we compete with them [MJIB] in digital forensics, despite concerns in the current [FCB] case they are in charge of the computer forensic investigation. . .and we agree with their [crime investigation] perspectives presented in the indictment. . . I still believe the most important thing is to arrest money mules and seize the stolen cash. . .” (Commander “C3”, CID)

“I believe this [FCB] case should be considered as two parts. First, someone needs to get the money back because this is a heist case, and later on, we need to establish where the bagmen go and how the money would be laundered. These all rely on our [local police] investigation in the physical environment . . .” (Supervisor “C4”, CID)

“Even though we might have miscommunication and disagreement with MJIB on dealing with this [FCB] case, we still built a good collaborative channel with them. . .we all are very busy. . .they [MJIB] present digital forensic evidence and sort out the modus operandi, but we figure out how to get the money back and search and apprehend the bagmen. . .one thing is undeniable, the MJIB has professional expertise in computer forensics and we receive training from them, the NPA needs to learn more in this area.” (Supervisor “C1”, CID)

“MJIB primarily communicate through Taipei District Prosecutors Office because of their leading role in investigation. . .we could have more meetings [to facilitate resource sharing]” (Special Agent “L”)

These statements underlined that collaboration allows authorities to take full advantage of the additional investigative skills and prosecutorial tools necessary to deal with criminals that exist both in physical and virtual environments. Indeed, partnership is an essential toolkit to establish efficient channels for information exchange across agencies (Mitchell et al., 2015).

With that said, the reason that Taiwanese authorities could solve the FCB case within a few days is because of cohesive collaboration of national-local law enforcement, which are indicated by clearly separated and focused tasks for each side. In this case, the MJIB effectively processed computer forensics, and the NPA broadcasted suspects’ information to the general public, tracked and seized the stolen cash, and arrested suspects. Officers acknowledged that effective leadership is important within the police, especially to frontline responders. Moreover, with positive community-oriented policing and a good relationship between citizens and the police in local communities, citizens were eager to contact the police and to provide information that led to the arrest of three bagmen.

“Initially, citizens reported to the police that some foreigners suspiciously withdrew money without touching ATMs. Another citizen reported that a pile of NT $60,000 dollars was left on the floor next to an ATM. I personally think these citizens’ reports are important because we [law enforcement] might not even notice the incident even after all suspects left Taiwan.” (Detective “T1”, CID)

“I was impressed by enthusiasm of three citizens who made [initial] reports to the police. . .when the news of suspects was broadcasted on mass media, an Airbnb owner who happened to host a suspect contacted us right away” (Chief “C2”, Third Precinct, Keelung City Police Bureau)

“Taiwanese citizens are indeed enthusiastic and alerted [about crime]. . .I think that coordinated collaboration [of law enforcement] in many aspects leads to a good outcome of the case.” (Special Agent “L”)

“Specifically, leadership, clear and separated responsibility, information and resource sharing, and cross-agency collaboration. . .are attributable factors to this successfully solved case” (Chief “C2”, Third Precinct, Keelung City Police Bureau)

This case later attracted international attention, especially law enforcement field, not only because the Taiwanese authorities recovered more than 90 percent of the stolen cash (approximately $2.4 out of $2.6 million US dollars) but also because Taiwan is the first state to arrest, prosecute, convict, sentence, and imprison three members of the Cobalt group who has allegedly committed more than a hundred of ATM heists globally (Devereux et al., 2018; Finkle & Wu, 2017). As a TCPD officer highlighted:

“Two months after the Taiwanese FCB incident, the same criminal group [Cobalt] used the same technique and committed another ATM attack in Romania. Several bagmen recognized from the FCB case were also involved in that case. There were quite a few similar criminal incidents that have occurred across Europe. . . they [Europol] are familiar with this type of crime, even have identified a few suspects, but Europol has not arrested anyone [at the time of interview] because of insufficient evidence. . .we shared the investigation process, computer forensic results and other case related reports with Europol, our experience intrigued them on case follow up. . .” (Supervisor “C4”, CID)

Ultimately, the FCB case led to the arrest of a hacker in Spain in March 2018. Even though Taiwan is a state that has not been officially recognized by many countries, political institutions, and international forums, the positive outcome of FCB case highlights the competency and professionalism of Taiwanese law enforcement in dealing with transnational crime and cyber investigations. The FCB case demonstrates Taiwanese authorities’ capacity to working with international allies in fighting economic-driven cybercrime. As a TCPD officer explained:

“. . .We report the [FCB] case to the Interpol because such type of crimes usually occurred in Europe, however, we have insightful details. Interpol are very eager to cooperate, although Taiwan is not a member. . .I do not perceive the constraints of non-Interpol membership regarding information sharing that we used to have. . .because of FCB case, Europol invited us to meet with them three times to exchange anti-cybercrime experience in Taiwan, and they also share the European experience. . .” (Commander “C3”, CID)

Cybercrime is borderless; this form of crime can occur beyond the physical constraints and human-made barriers that relate to traditionally defined jurisdictions. Such feature also implies that the challenges of patrolling cyberspace would demand more non-traditional thinking and investigation strategies, resources, collaboration across agencies and states. Law enforcement agencies in Taiwan agreed on this phenomenon but expressed it in different ways:

“The positive outcome for this [FCB case] was a result of collaboration across law enforcement agencies and legal authorities. . .it [solving cybercrime] might be impossible, if not to mobilize large scale resources” (Special Agent “L”)

“. . .we [police] presented the current case [FCB case] and investigation information along with digital forensics evidence to law enforcement agencies in the United States, Thailand, South Korea, Europe etc. . . afterwards, we received requests for international investigative cooperation from China. . .and the Netherlands….” (Supervisor “C1”, CID)

“International corporations, indeed, may face political pressure on the ‘one China policy’ from many states. . .but for cybercrime this might be a different issue. . .[for example] Mainland China, a communist society, and America have not yet found a good way to discuss criminal cases. . . when they [U.S.] conducted cybercrime investigations, they found many [Chinese] hackers use the proxy servers in Taiwan as a path of attack and want us [Taiwan] to help figure out what happened. We are on a very unique position.” (Commander “C3”, CID)

“Despite the fact that Taiwanese authorities successfully solved the FCB case, technically, we have no clue as to who the real hacker behind this incident was. . . still, we are closer to identifying and apprehending more members of the Cobalt group than any other country. . . more importantly, we should jump out of the box of traditional crime investigation because cybercrime happened in a virtual space with anonymity and no boundaries.” (Special Agent “S”)

The experience of the Taiwanese FCB case offers practical lessons for similar foreseeable cybercrimes (see Volz, 2018), as well as demonstrates the nature of relations between law enforcement agencies. Details of the modus operandi and investigation provided by the investigating agents highlight the risks of cyber victimization, particularly how contemporary criminals take advantage of the Internet to “rob” financial institutions in the international community (Sancho et al., 2017). Moreover, given its geopolitical position in the world, Taiwan is at the forefront between democratic and communist regimes and may be targeted by more cyberattacks. With the largest number of Internet users, Chinese government maintain tight control over telecommunication infrastructure and enforce Internet censorship system through policing citizens’ speech in the cyberspace, both behind the “Great Firewall of China” and overseas (Liang & Lu, 2010). As one of officers suggests:

“Taiwan cannot join Interpol because of China, especially the chair [at the time of interview] is from China. . .we never stop exchanging information with the police in China though. . .International community is very interested in Taiwan’s ability of investigating cybercrime. . .Western countries recognize our cyber forensics and Taiwan’s international status. Because we are democracy and China is a communist country, it is difficult for U.S. to communicate with and understand China. Quite some investigations of cybercrime routing through Taiwan. . .China’s cyber investigation is mysterious [to Western countries] because they have a lot of Internet military, and the scale is huge. . .North Korea also has a lot of Internet military. There are many usages of Internet military. . .” (Commander “C3, CID)