NCJ Number
48046
Journal
CONGRESSIONAL RECORD - SENATE Volume: 123 Issue: 122 Dated: (JULY 19, 1977) Pages: S12389-S12394
Date Published
1977
Length
6 pages
Annotation
A REVIEW OF 150 MAJOR PUBLICIZED COMPUTER FRAUD CASES ARE REVIEWED, AND PREVENTIVE SECURITY MEASURES ARE DISCUSSED.
Abstract
COMPUTER FRAUD IS DEFINED AS ANY DEFALCATION OR EMBEZZLEMENT ACCOMPLISHED BY TAMPERING WITH COMPUTER PROGRAMS, FILES, OPERATIONS, EQUIPMENT, OR MEDIA RESULTING IN LOSSES TO THE ORGANIZATION WHOSE COMPUTER SYSTEM WAS MANIPULATED. LOSSES IN THESE CASES AVERAGED WELL OVER $100,000 EACH. DISBURSEMENT FRAUDS ARE THE MOST COSTLY BECAUSE THEY ARE MOST DIFFICULT TO DETECT AND THEREFORE CONTINUE LONGER. IN MOST TYPES OF ORGANIZATIONS, AUTOMATED SYSTEMS THAT PAY MONEY FROM THE ORGANIZATION TO SUPPLIERS, EMPLOYEES, OR OTHERS ARE THE MOST TROUBLESOME. METHODS OF COMPUTER MANIPULATION MAY INCLUDE THE ADDITION, ALTERATION, OR DELETION OF TRANSACTIONS; FILE OR PROGRAM CHANGES; OR IMPROPER OPERATION. ON THE BASIS OF KNOWN SCHEMES, IT IS LIKELY THAT THE VAST MAJORITY OF COMPUTER FRAUDS GO UNDETECTED, PARTICULARLY WHEN ONE CONSIDERS THAT THOSE FRAUDS WHICH WERE DETECTED WERE INCOMPETENTLY CARRIED OUT. IT IS LIKELY THAT A LARGE AMOUNT OF COMPUTER FRUAD GOES UNDETECTED IN THE FOLLOWING CATEGORIES: PENSIONS, STATE AND LOCAL GOVERNMENT INVENTORY AND DISBURSEMENT, INSURANCE CLAIMS, CORPORATE BILLING, FEDERAL GOVERNMENT PROGRAMS, AND LOANS. IN GENERAL PERPETRATORS OF SUCH FRAUDS CAN HOLD VIRTUALLY ANY JOB POSITION RELATED TO COMPUTERIZED PROCESSES. PROGRAMMERS APPEAR LEAST LIKELY TO BE INVOLVED IN FRAUD, ALTHOUGH THIS MAY ONLY BE A GENERALIZATION FROM DETECTED CASES. USUALLY THE HIGHER THE JOB POSITION AND THE GREATER THE RESPONSIBILITY, THE GREATER THE PROSPECTS FOR FRAUD. A NUMBER OF MEASURES MAY BE TAKEN TO DECREASE THE LIKELIHOOD OF COMPUTER FRAUD. TRANSACTION CONTROLS, PARTICULARLY OVER THE GENERATION AND FLOW OF INPUT TRANSACTIONS, SHOULD BE IMPLEMENTED. RIGOROUS AUDIT AND IMPROVED RESPONSIBILITY MEASURES SHOULD BE INSTITUTED; PROGRAM CONTROLS AND FILE CONTROLS ARE NECESSARY. RESPONSIBILITY FOR THE FOLLOWING FUNCTIONS SHOULD BE KEPT SEPARATE: INPUT DATA GENERATION, INPUT CONTROL, COMPUTER OPERATION, PROGRAMMING AND MAINTENANCE, OUTPUT CONTROL, AND DATA PROGRAM FILE CONTROL. TABULAR DATA ON PERPETRATORS, COSTS TO BUSINESS, TYPE OF SCHEME/MANIPULATION, AND BRIEF CASE SUMMARIES OF 15 COMPUTER FRAUDS ARE PRESENTED. (JAP)