Mobile Broadband, e-Fraud & Anonymity Against My Website [closed]

Question

I was wanting to know if the blend in the title of this post provides e-criminals an open field to explore.

What I mean is this: say a fraudster goes and buys a pay-as-go SIM card from a certain Mobile Broadband Network, and tops it up with $10; pays for it with cash - or even, pays someone to go the shop and buy the aforementioned SIM card (in case the fraudster is very paranoid).

He then transfers this $10 voice credit to an add-on of, say, 1GB internet and uses this SIM on his dongle, attached to a laptop with a fully encrypted HDD. Now he is ready to start doing bad things against my website: this hacker is aware of Geolocation, so he will only perform his attacks from crowded areas where lots of people are likely to be using their laptops (in case the Law Enforcement will track the geolocation and timestamp and look for security cameras' footage to find someone using a laptop at the time of the attacks).

Because this is not like in films, he will not be chased while he is on the act of hacking the bits out of my website, so being caught on the act isn't really an issue for him.

Conclusion:

He finishes his dirty business for the day and keeps doing this for months being always careful and paranoid.

Questions:

1-In the eventuality he becomes somehow a suspect, what is the likelihood of being convicted should the Law Enforcement get hold of his encrypted laptop? 2-Finally, what are his mistakes that we can pick upon in order to convict him. The other side of the coin is: how can he not be caught by us?

Answer 1

Conviction depends a lot on the legal system; things are really different depending on whether he is caught by legal forces in Sweden, Belarus, Canada or Ouzbekistan, who have somewhat distinct notions of rights of the accused. Hard disk encryption is here a gimmick to try to evade incrimination, but it won't work by itself, because many countries have laws which will force you to reveal decryption keys (or they will just break your thumbs, depending on the country). What your hacker would need is plausible deniability. TrueCrypt attempts at supporting that, but, to my knowledge, this has never been tested in court.

Tracking is another matter. For the serious cases (e.g. wide terrorist actions), police forces throughout the World will collaborate to tap wires, invest caches, follow people in the street, bribe, interrogate and shovel; and they will usually find out perpetrators because human beings are full of chemical activity and leave traces everywhere. Historically, people who could evade coordinate police action for long periods are people who benefited from at least tacit collaboration of lots of people.

Your attacker may want to stick to "crowded places" but analysis of security cameras will show who was in that area; over time, correlation will pinpoint the specific individual.

Of course, no such wide-scale operation will occur for something as trivial as hacking a Web site. Let's face it: you are not worthy of the full power of police forces. They may still be interested in your story because attackers often have other activities; someone who hacks Web sites repeatedly may also be involved in a quantity of other illegal activities, and will probably be in touch with other people so inclined.

(The implicit message I want to make here is that while hacking occurs in computers, humans are involved, and that happens in the physical world, subject to possible investigation methods which have been honed by policemen for the last two centuries, since the term "policeman" was invented, actually.)