Send the Cypercops.

Brazil takes aim at online crime.

AFTER INAUGURATING BRAZIL'S first computer-crimes unit earlier this year, Belo Horizonte officer Marisa de Oliveira Costa quickly found reason to celebrate. Within weeks, Brazil's first cyberspace police chief had jailed a software pirate and nabbed a hacker who had published confidential information about a local company on the Internet. "We are right behind these criminals and they know it," says De Oliveira, head of the Special Computer Crimes and Electronic Fraud Precinct.

Collaring cybercrooks is one thing. Punishing them may prove more difficult. Brazilian cops have a tool to help fight piracy in a new federal law that grants software programs the same copyright protection as books. But there is no specific law against hacking, the electronic equivalent of breaking and entering, even as pursuit of the activity for fun and profit grows in popularity. De Oliveira used a 1996 wiretapping law to arrest her hacker. The legislation sets prison terms for "intercepting" information over the telephone by eavesdropping. Whether the charge sticks remains to be seen.

"We have caught about a dozen hackers, but no one ever goes to jail," says Alberto Bastos, security director of M6dulo Security Solutions, a software developer that wrote programs to protect vote-tallying computers used in the last national election.

The need for effective law enforcement is growing. Brazilian hackers are boldly penetrating the country's largest state agencies and private corporations at more than twice the rate of just a year ago. Someone nearly erased the Federal Income Tax Service's website recently. In more serious attempts, others boasted on the Internet that they had broken into the network Banco Bradesco--the latter an incident that officials from Brazil's largest private bank deny occurred. The country's Central Bank reports an average of three online assaults a month, but officials say that security measures have so far thwarted trespassers. "I imagine the hackers are kids who don't want to cause us financial problems, but want to make their mark by breaking the barriers we put up," says Roberto Ozu, head of the bank's computer department.

The damage they cause is no child's play. A study by Modulo shows that one in three large companies has suffered a security breach and the company estimates that hackers cost large Brazilian firms an average US$568,000 a year through work shutdowns, data theft, fraud, lost contracts and investigative costs. Few companies report their experience to the police.

Internet sites devoted to the exploits of cyber bandits support the theory of adolescent pranksters. Hackers call themselves "alpinists" seeking the thrill of "reaching the top." They proclaim their conquests at web sites with names such as Freecker, Hack n' Roll, Top Hacker Brazil and Kingdom of Hackers. "They are typically boys between 14 to 17 years of age who exchange information with U.S. hackers and then copy their methods," says Julio Botelho, director of technology at Rio de Janeiro's City University. However, some have developed lethal homegrown efforts such as last year's so-called Leandro Kelly, a virus that began destroying data stored on computers in the state of Minas Gerais before spreading throughout the globe.

The rise in hacking is directly correlated to growing Internet usage. Since the Internet started gaining widespread use in Brazil around 1995, the number of subscribers has grown at a heady clip. By 2001, Brazil should have 7 million people online. Together with the increase in users, the suffers who have gone over to the dark side of computing are growing in number and sophistication. "It's certain they are learning more each day and evolving," says Botelho.

Adolescent hackers are tiring of simple thrills and graduating to activities with payoffs. The most common online financial crime involves stealing credit card numbers and withdrawing funds from the estimated 3 million Brazilian users of home banking. Spying for companies that pay to discover a competitor's business strategy is another growth sector. "Many companies are so unprepared to confront hackers that they never know what hit them," says M6dulo's Bastos.

Police are no better off. "Industrial espionage by computer is a new area for us," says Mauro Silva, the head of the Sao Paulo Internet Police Division. Silva, who took a course in computer crime at FBI headquarters in the United States, hopes to create the nation's second cyber police station later this year and encourage more corporations to report online crime. "I understand why most today remain silent after a break-in," he says. "Let's say hundreds of American Express credit card numbers are stolen. [The company] wouldn't want that made public."

Despite their growing ranks, Brazilian hackers have yet to gain much fame in the public eye. Not so in neighboring Argentina, where Julio Cesar Ardita, a 23-year-old computer science student also known as "El Griton (The Screamer)," pleaded guilty last year to hacking after breaking into computer networks at the Pentagon and NASA. Under a plea agreement, Ardita will serve three years' probation in Argentina and pay a $5,000 fine.

Brazilian officials have decided it's time to dissuade their young hackers before they hit the big time. At least eight bills that would set punishments for online crime are under debate in Congress. Security specialists and the country's budding cyber police force applaud the measures. But Carlos Alberto Teixeira, an ex-hacker who covers the computer industry for the Rio daily O Globo, says jailing hackers may not be the answer: "It will give Brazilian hackers their first martyr and inspire them to increase break-ins and destruction," he says. Yet Teixeira agrees that stronger laws and more cyber cops will convince at least the teen amateurs to pursue other hobbies, clearing the battlefield for officer De Oliveira and other cybercops to pursue the hard-core hackers.

BRAZIL'S RISING TIDE OF CYBERCRIME 

35% of firms suffered some type of break-in against their computer system in 1998.

54% were perpetrated by outside hackers while ...

46% were inside jobs by employees or ex-employees.

SOURCE: Modulo Security Solutions