Archives for October 2020

On October 15, 2020, General Salvador Cienfuegos Zepeta, 72, former Defense Minister of Mexico from 2012 to 2018 under President Enrique Pena Nieto, was arrested by U.S. federal authorities in Los Angeles on charges of Drug Trafficking. The four-count indictment against Cienfuegos charges him with conspiracy to manufacture and distribute cocaine, heroin, methamphetamines, and marijuana, as well as conspiracy to launder proceeds from the sale of narcotics. After his transfer to the U.S. District Court for the Eastern District of New York, he was denied bail.

According to documents filed with the court by the United States Attorney’s Office, while serving as the Secretary of National Defense for Mexico, Cienfuegos used his position to assist the H-2 Cartel, a notorious drug trafficking organization alleged to be headed by Juan Francisco Patron Sanchez and based in Nayarit and Sinaloa, Mexico. The U.S. Department of Justice (DOJ) alleges that the H-2 Cartel has engaged in “countless acts of horrific violence, including torture and murder.” The Cartel distributes drugs through the United States. The DOJ states that the cartel has operated in Mexico “with impunity, engaging in wholesale drug trafficking, firearms trafficking and violence, including dozens of murders, without interference from Mexican law enforcement officials.”

As the head of the Mexican Army and Air Force, Cienfuegos, according to DOJ, would ensure that no military operations were undertaken against the Cartel. He would also direct military operations against H-2 Cartel’s competitors, locate maritime shipping assets for the Cartel, assist the Cartel in expanding its territory in Sinaloa and introduce cartel members to other corrupt Mexican officials. Cienfuegos also provided the Cartel with information concerning ongoing US. law enforcement investigations of the Cartel. One Cartel member was murdered as a result of information received from Cienfuegos concerning U.S. law enforcement efforts. Cienfuegos allegedly received millions of dollars in bribes in exchange for the information he provided to the H-2 Cartel.

Cienfuegos was the head of Mexico’s anti-drug operations and held himself out as a key partner in the U.S. war against drugs. He is the second high-ranking official of the Peña Nieto administration to be arrested. In 2019, former Security Minister Genaro Garcia Luna was arrested on similar charges. These arrests have prompted a review of Mexican law enforcement by the current President, Andres Manuel Lopez Obrado, who has vowed to suspend any officer associated with the corruption of the former regime. If convicted, Cienfuegos faces a maximum sentence of life in prison.

On October 1, 2020, attorneys at Hilliard Shadowen LLP and Hilliard Martinez Gonzales LLP filed a petition with the Inter-American Commission on Human Rights to hold the United States accountable for the cross-border killings of multiple Mexican citizens. The Petitioners are family members of six victims killed by U.S. Border Patrol agents. The victims include a 16-year-old who was shot in the back 10 times, Guillermo Arevalo who was picnicking with his wife and daughters along the Rio Grande, and four others. The death of 15-year-old Sergio Hernandez sparked a Supreme Court case.

Counsel for the Petitioners, Nicholas Shadowen, said: “These tragic cases are yet another series of police killings in America that have gone largely unnoticed and wholly unredressed. The United States must be held accountable; there must be police reform in this country; and it must happen now.”

The consequential lawsuit comes at a complicated time in U.S.-Mexico relations. U.S. President Donald Trump has been increasing border security and militarizing the border since his election in 2016.

The Petition

The petition alleges that U.S. border patrol agents engaged in systematic extrajudicial killings of Mexican citizens along the U.S.-Mexico border. It also alleges that the U.S. violated international law by refusing to allow the families of the victims to obtain judicial review in U.S. courts, citing sovereign immunity. The Supreme Court’s ruling in the case of Sergio Hernandez, which refused permission for his family to get judicial review by suing the border patrol agent who killed Hernandez, is the latest example of this refusal.

Another counsel for the Petitioners, Robert Hilliard, said “When the law of the land is that a U.S. law enforcement officer, while on U.S. soil, may shoot and kill an unarmed, unthreatening child, unchecked by the U.S. civil justice system, the arch of the moral universe snaps, no longer able to bend towards justice. The courage of the late Justice Ruth Bader Ginsburg’s dissenting words resonate: ‘I resist the conclusion that ‘nothing’ is the answer required in this case.’ We call on this Commission to declare and find a violation of international law. What matters is the life wrongly taken, and the immensity of death.”

Inter-American Commission on Human Rights

The Inter-American Commission on Human Rights (IACHR) is the human rights arm of the Organization of American States (OAS). IACHR was created in 1959 “to promote and protect human rights in the American hemisphere.” As a member of OAS, the U.S. has committed to uphold its obligations to the organization, which include abiding by the American Declaration of the Rights and Duties of Man, a declaration that prohibits the arbitrary taking of life. However, non-compliance by a state deprives the system of its effectiveness. The United States is a repeat non-compliance state, meaning that the Inter-American human rights system has not been able to enforce its decisions.

“Rocking Policy”

The Border Patrol maintains a “Rocking Policy,” which permits agents to shoot to kill even in the absence of imminent threat. The policy was established to allow Border Patrol agents to shoot and kill Mexicans “who allegedly threw rocks at them, regardless of whether [it] posed an imminent risk of death or serious injury to the agents or anyone else, and regardless of whether other, nonlethal means were available to avert any such risk” according to a lawsuit filed by Arevalo’s wife.

The “Rocking Policy” that the CBP has raises questions about the degree to which deadly force is warranted by a BP agent when the greatest threat to the agent is rocks being thrown at them or at the border fence.

The recent petition and Supreme Court case will likely complicate the debate about human rights on the U.S.-Mexico border. Advocates for immigration rights, as well as children’s welfare, may come to cite this petition as proof of dangerous and abusive U.S. policy.

On September 24, 2020, the Task Force convened by the think tank of the Antiquities Coalition published its first joint report, Reframing U.S. Policy on the Art Market: Recommendations for Combating Financial Crimes. The report proposes 44 recommendations related to money laundering, sanctions violations, tax evasion, and terrorist financing. The recommendations also address other financial crimes specific to the art market such as forgery and fraud.

Current Vulnerabilities

The $28.3 billion U.S. art market is not only the largest unregulated legal market in the U.S. but the largest unregulated legal market in the entire world. The Bank Secrecy Act (BSA), which establishes certain AML and anti-terrorism financing controls for U.S. entities, does not apply to the art industry, though the Treasury Department of Foreign Asset Control (OFAC) forbids U.S. people and entities from transacting with sanctioned persons. Therefore, the art industry is extremely vulnerable to the financial crimes described in the Task Force’s recent report.

The U.S. art market could become a hotspot for money laundering and other financial crimes, in part because similar markets across the globe have already shored up their vulnerabilities. The UK, Switzerland, and the European Union have already heightened AML protections using measures similar to those that the U.S. is currently considering.

Congress has also highlighted these vulnerabilities in a recent report on the Rotenbergs, a family of Russian oligarchs that has laundered money through the U.S. art market. The bipartisan report proposed a number of changes compatible with the following recommendations of the task force.

Recommendations

The report made tailored recommendations to Congress, the White House, the Department of the Treasury, the Department of Justice (DOJ), federal law enforcement, and the Department of State, among others.

Perhaps the most important recommendation among the 44 total was the recommendation that Congress extend the Bank Secrecy Act to the U.S. Art Market. The bipartisan congressional report released earlier on the Rotenbergs made the same recommendation. On October 22, 2019, the House voted in favor of a bill modifying the Bank Secrecy Act. A provision in the bill, HR 2514, Section 213, would extend the Act to apply to “persons trading or acting as an intermediary in the trade of antiquities, including an advisor, consultant or any other person who engages as a business in the solicitation of the sale of antiquities.” The bill is now awaiting approval in Senate.

The report also recommended that Congress define cultural property crime as a predicate offense to money laundering, similarly to counterfeit, embezzling, forgery, and theft.

The report also recommended that the White House assign the appropriate Senior Director to manage U.S. policy regarding transnational crimes via cultural property.

The report’s recommendations to the Department of the Treasury focused on outreach and education. However, it also stated, “The Internal Revenue Service (IRS) should require proof of legal title and known ownership history in support of tax deductions for high value charitable donations or purchases of art or antiquities museum, other tax-exempt organization, business, or private collector.” This measure would likely serve to prevent tax fraud.

The report recommended to the DOJ that the Deputy Attorney General include cultural property crimes within the purview of the Task Force on Market Integrity and Consumer Fraud. It also recommended that the DOJ establish several types of infrastructure that do not currently exist. It proposed creating an office of cultural heritage crimes prosecutors, new training for U.S. Attorneys’ Offices and the Federal judiciary on cultural property crimes, a new toolkit for investigators and prosecutors pursuing cultural heritage crimes, and a methodology for the DOJ to track its own effectiveness in pursuing these crimes.

The report also recommended that the Federal Bureau of Investigation and Homeland Security Investigations “increase the focus on financial crimes in their existing law enforcement training on art theft and antiquities trafficking.” While this recommendation calls upon the FBI’s existing infrastructure, it could profoundly change the FBI’s approach to monitoring the U.S. art market.

The report also recommended art market associations form a collaborative consortium, which will share data and technology relevant to AML enforcement. This same collaborative consortium should consider adopting blockchain technologies, managed by a third party, to track ownership information on artwork. The third party could provide to an association data upon request.

Online art markets should protect their platforms from criminal transactions by building algorithms to detect misuse. They should require proof of identity from all sellers and buyers, particularly for high value transactions. This recommendation is similar to the Responsible Art Maret initiative implemented recently by Switzerland, which provides guidelines to associations and art sellers on how to collect information on customers and provenance. The Fifth Anti-Money Laundering Directive passed by the EU also pushes for art associations and markets take responsibility for their own sales by collecting information on customers before conducting high-value transactions.

While the report focused on actions inside the U.S., it also recommended that Interpol create a new purple notice for alerts and information sharing specific to cultural property crimes. It also recommended that red notices be assigned for fugitives wanted for these crimes.

The report recommended executive branch law enforcement actions, which is significant because these can be implemented without the need for new legislation. Meanwhile, some of the other recommendations have a likely chance of success in Congress, where the U.S. art market’s vulnerabilities are a bipartisan concern. Their implementation would be a major success for the U.S. in combatting financial crimes. However, the consequences would be global, preventing sanctioned persons responsible for crimes and wrongdoing around the world from hiding their money in the U.S.

Information security professionals today are awash in overwhelming, and constantly replenished surges of information about cyberthreats.  Because so much of this cyberthreat intelligence concerns external threats of increasing sophistication and complexity, from organized criminal networks to state actors, it can be easy for information security teams to overlook the possibility that disgruntled insiders may pose a risk to their organization’s networks and data.

Insider attacks, however, are a genuine and persistent dimension of the cyberthreat environment.  The Ponemon Institute’s 2020 Cost of Insider Threats Report found that in only two years the number of insider threats has increased 47 percent — from 3,200 in 2018 to 4,716 in 2020 – while the cost of such incidents has increased 31 percent, from $8.76 million in 2018 to $11.45 million in 2020. In addition, careless or negligent employees account for 62 percent of incidents, leading to an average cost of $307,111 per incident, while incidents involving malicious insiders or credential thieves lead to an average cost of $871,686 per incident.

One recent case provides concrete examples of the damage that a single disaffected employee can cause within an organization. On September 24, the U.S. District Court in Maryland sentenced Shannon  Stafford, a former information technology (IT) manager for a global company identified only as “Business A,” to a year and a day in federal prison and restitution of $193,258.10 for illegally accessing and damaging Business A’s computer network.

According to the U.S. Department of Justice, Stafford was employed in Business A’s information technology department from 2005 to 2015. As part of his duties, he had access to other employees’ system login credentials “and was authorized to use them in the course of performing his technical support duties.” He also was responsible for disabling network access credentials company users at the end of their employment.

Although Stafford was promoted in 2014 to a managerial role, as technical site lead for the company’s Washington office, he was demoted in March 2015 to an IT support role because of performance issues in his management position. After his performance issues continued, Stafford was fired on August 6, 2015.

Beginning on the evening of August 6, Stafford engaged in a series of actions directed at damaging Company A’s network:

• August 6: That evening, Stafford “repeatedly attempted to remotely access Business A’s computer networks from his residence,” using the laptop that the company had provided to him. He unsuccessfully tried to access Company A’s network approximately 10 times, using his own credentials and those of a former co-worker whom he had previously assisted.
• August 8: In the early morning, Stafford successfully used the former co-worker’s credentials and the company laptop to access, without authorization, the computer that had been located under his desk in the Washington office. He “used the Washington IT computer to execute demands to delete all of the file storage drives used by the Washington office, then changed the password to access the storage management system.” The deletion of those files
  • caused a severe disruption to the company’s operations and the loss of some customer and user data. Changing the password hindered the company’s efforts to determine what happened and restore access to its remaining files. As a result of the deletion of the network file storage drives, Washington users were unable to access their stored files for approximately three days, until the data could be restored from backups.  Customer and user data that was not included in the most recent backup prior to Stafford’s deletion of the files was permanently lost.
• August 11: Stafford “unsuccessfully attempted to remotely access the company’s computer network from his home approximately 13 times, using credentials that were not his.”
• August 13: A Company A representative “spoke to Stafford and demanded that he cease and desist his attempts to unlawfully access Business A’s computer systems.
• August 21 – September 9: Despite Company A’s demand, between August 21 and September 9, Stafford “attempted to access the company’s network from his home approximately 17 times, using credentials that were not his.”
• September 14: Stafford “used the credentials of another former co-worker to access a network file storage system computer that he had been responsible for maintaining in the IT department of the company’s Baltimore office, intending to cause the same type of damage he did when he deleted the Washington office’s stored files.” That attempt failed “because Business A had changed the password after Stafford’s attack on the Washington files.”

The actual loss to Business A that resulted from Stafford’s damage and attempted damage to its computer systems, including the costs of restoration of the deleted systems, investigation of the events, and response to the intrusion was at least $38,270. In addition, Business A incurred legal fees of $133,950.60 and a fee of $21,037.50 for a forensic investigation.

Ultimately, a federal grand jury indicted Stafford in 2017 on two computer damage-related charges: one for the August 8 damage to the files in Company A’s Washington office, and the other for Stafford’s damage attempts between August 21 and September 9. Stafford was convicted after a four-day trial.

***

In one sense, Stafford’s case is unremarkable because it did not involve the use of any sophisticated hacking techniques.  Yet it is precisely the simplicity of his conduct and the ease with which he caused harm to his company that should be of concern to chief information security officers (CISOs) and chief compliance officers (CCOs) in all types of companies around the world.  What Stafford did can easily be mimicked by other disgruntled IT staffers in other countries – as United Kingdom law enforcement has seen on several occasions (here, here, and here).

For that reasons, CISOs and CCOs should make use of the Stafford case in two ways.  First, they should cite it in briefing senior executives in their organizations and remind them of the risks of internal computer sabotage.  Those risks certainly include the immediate costs of lost business and repairing the damage.  But CCOs and CISOs can also join forces with their businesses’ legal officers to point out the potential for regulatory enforcement action based on the organization’s failure to maintain adequate information security.

Second, they should make sure that their organizations’ internal procedures include certain minimum procedures in place when it appears that it may be necessary to terminate or demote an IT manager or employee whose workplace conduct includes serious indications of hostility or anger.

Based on Stafford’s and other insider sabotage cases, those procedures should include the following.

First, if an organization decides to terminate an IT employee, or receives a resignation letter with immediate effect from that employee, it should not accept the employee’s representations that he will return a company-issued computer. Rather, the company should take immediate lawful action to obtain custody of that computer. Under no circumstances should the company rely on the employee’s promises to return company property in due course. As Stafford’s and other insider-sabotage cases have shown, even one or two days after separation of that employee can be enough to allow the employee to use the company computer to cause damage.

Second, if an IT employee is about to be separated from the organization, even before, and during, the formal actions to inform the employee of his termination and escort him from the premises, the organization should review the employee’s outgoing emails for indications of intent to retaliate against the company and determine what levels of administrator access that employee may have.

In one insider-sabotage case, an IT help desk employee, even after his termination, was able to access an administrator account and shut down his company’s email server and application server and delete systems files essential to restoring computer operations. Even though the employee’s access rights reportedly had been revoked as he left the building, the company’s IT director found that the employee had emailed himself a list of network access codes and passwords for various company IT subsystems.

Third, with respect to IT administrators, the organization should have a second person, whether inside that organization or in an external information security firm, who has system privileges and access equivalent to or greater than those of the IT administrator. No organization should be totally reliant on a single individual who, if threatened with demotion or termination, could be tempted to retaliate against the organization’s networks or files.

Accordingly, if the organization has made the decision to terminate that administrator, it should direct the backup administrator to take all necessary steps to block the primary administrator’s access to the enterprise’s systems immediately before, or during, the organization’s notifying the disgruntled administrator of his termination, before that administrator can take action against the organization.

None of these measures are guaranteed to prevent a disaffected IT employee from lashing out at his organization by using what IT skills he has. All of them, however, can reduce the chances that such an employee will succeed in his destructive mission, and can be accomplished at minimal cost to the organization. The potential risks of operational shutdowns and loss of key files and processes, and of regulatory sanction for failure to maintain adequate cybersecurity measures, are too substantial to ignore.

On August 14, 2020, Jose Filomeno Dos Santos, son of former Angolan president Jose Eduardo Dos Santos, was sentenced to five to eight years on charges of fraud and peddling influence. Dos Santos was discovered when his $500 million-dollar transfer from the Angolan national bank in 2017 was flagged by British authorities. Dos Santos concealed the transaction, masquerading it as a project to lure foreign investment to the African country. The British alerted the Angolan authorities, resulting inan investigation around money laundering, embezzlement, and other forms of criminal conduct. Dos Santos was removed from his position as governor of the sovereign wealth fund in 2018. This transaction would have been the first of three, totaling to $1.5 billion, had it gone undetected. The transaction would have most likely gone unnoticed, and Dos Santos would have gotten away with his misconduct, were it not for cooperation and communication between financial authorities of both Britain and Angola.

This incident came at the front-end of scandal around the former first family. This particular transaction occurred in 2017, only weeks before the former president, Jose Eduardo Dos Santos, stepped down.  Eduardo Dos Santos held power in the country for nearly 38 years. Throughout that period, family accrued billions of dollars; meanwhile, 50 percent of Angolans live on under $2 a day. For decades, Dos Santos, and his family have been accused of corruption. The “Luanda Leaks,” a slew of documents reported on by the International Consortium of Journalists (ICIJ), seem to validate these beliefs, specifically implicating the former president’s children: his daughter, Isabel Dos Santos, and his son. The Luanda Leaks are 700,000+ emails, charts, contracts, and other documents that detail how Isabel Dos Santos amassed a two-billion-dollar fortune. Dos Santos was able to use favorable contracts and government loans to fund her industries. More than 400 banks and institutions were part of laundering schemes to accrue Dos Santos’ wealth.

Eduardo Dos Santos’ successor, Joao Lourenco, though selected by Dos Santos, launched a campaign on anti-corruption. As discontent with the party grows due to the poverty, this anti-corruption focus is useful in gaining popular support. In response to the accusations of corruption, Isabel Dos Santos claims that the investigation is motivated by a personal issue between families. This conviction in the case of her brother may discredit that defense.

A key challenge for Angola, amongst many oil-rich countries, is the “resource curse.” This moniker is given to countries that profit from resources such as oil, gold, or other assets but suffer economic inequality and a failure to circulate capital. The major reason for that is because any revenue from extracting resources is easily siphoned off to a few individuals rather than being redistributed. Much of this money is often taken out of the country and reinvested into foreign banks or initiatives. A crucial means of combatting these issues is to target corruption and crackdown on offenders. The recent actions taken against Dos Santos by Britain and Angola are an example of how to prevent this corruption.