Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was wanting to know if the blend in the title of this post provides e-criminals an open field to explore.

What I mean is this: say a fraudster goes and buys a pay-as-go SIM card from a certain Mobile Broadband Network, and tops it up with $10; pays for it with cash - or even, pays someone to go the shop and buy the aforementioned SIM card (in case the fraudster is very paranoid).

He then transfers this $10 voice credit to an add-on of, say, 1GB internet and uses this SIM on his dongle, attached to a laptop with a fully encrypted HDD. Now he is ready to start doing bad things against my website: this hacker is aware of Geolocation, so he will only perform his attacks from crowded areas where lots of people are likely to be using their laptops (in case the Law Enforcement will track the geolocation and timestamp and look for security cameras' footage to find someone using a laptop at the time of the attacks).

Because this is not like in films, he will not be chased while he is on the act of hacking the bits out of my website, so being caught on the act isn't really an issue for him.


He finishes his dirty business for the day and keeps doing this for months being always careful and paranoid.


1-In the eventuality he becomes somehow a suspect, what is the likelihood of being convicted should the Law Enforcement get hold of his encrypted laptop? 2-Finally, what are his mistakes that we can pick upon in order to convict him. The other side of the coin is: how can he not be caught by us?

share|improve this question

closed as not constructive by Lucas Kauffman, Iszi, Scott Pack, Rory Alsop Feb 20 '13 at 16:24

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

This question is overly broad, source for debate and not really constructive. – Lucas Kauffman Feb 13 '13 at 20:15
On top of that, he totally skipped the step where he should be using TOR and bouncing his connection through 100+ nodes. – Iszi Feb 13 '13 at 20:18
Have to agree with you all. I am trying to think how far this could go; but I agree it is not constructive and open for debate. The fact I didn't mention TOR is because I was trying to pose the mobility issue. And @Cory, I am sorry, English is not my first language and sometimes I make things up when some false cognats creep in: I guess that's the side effect of speaking more than one language – Lex Feb 13 '13 at 20:49
@Lex Sorry, I'll delete the comment where I poked fun at your phrasing/misspelling. – Cory J Feb 13 '13 at 20:53
No need for apologies, @Cory, it doesn't offend me at all. "To herr is uman." – Lex Feb 13 '13 at 20:58
up vote 3 down vote accepted

Conviction depends a lot on the legal system; things are really different depending on whether he is caught by legal forces in Sweden, Belarus, Canada or Ouzbekistan, who have somewhat distinct notions of rights of the accused. Hard disk encryption is here a gimmick to try to evade incrimination, but it won't work by itself, because many countries have laws which will force you to reveal decryption keys (or they will just break your thumbs, depending on the country). What your hacker would need is plausible deniability. TrueCrypt attempts at supporting that, but, to my knowledge, this has never been tested in court.

Tracking is another matter. For the serious cases (e.g. wide terrorist actions), police forces throughout the World will collaborate to tap wires, invest caches, follow people in the street, bribe, interrogate and shovel; and they will usually find out perpetrators because human beings are full of chemical activity and leave traces everywhere. Historically, people who could evade coordinate police action for long periods are people who benefited from at least tacit collaboration of lots of people.

Your attacker may want to stick to "crowded places" but analysis of security cameras will show who was in that area; over time, correlation will pinpoint the specific individual.

Of course, no such wide-scale operation will occur for something as trivial as hacking a Web site. Let's face it: you are not worthy of the full power of police forces. They may still be interested in your story because attackers often have other activities; someone who hacks Web sites repeatedly may also be involved in a quantity of other illegal activities, and will probably be in touch with other people so inclined.

(The implicit message I want to make here is that while hacking occurs in computers, humans are involved, and that happens in the physical world, subject to possible investigation methods which have been honed by policemen for the last two centuries, since the term "policeman" was invented, actually.)

share|improve this answer
Makes sense, Tom. Thanks very much: I appreciate it. – Lex Feb 13 '13 at 20:40
On the subject of US law, see here where EFF discusses the 5th amendment and how it relates to forcing disclosure of encryption keys: – Cory J Feb 13 '13 at 20:51

Not the answer you're looking for? Browse other questions tagged or ask your own question.