Student prosecuted for cyber crime

Student prosecuted for cyber crime

Asip Agus Hasani, The Jakarta Post, Yogyakarta

Petrus Pangkur, a 22-year-old student at Sanata Dharma University
in Yogyakarta, probably never expected to face court proceedings
when last year at an Internet cafe here, he ordered a helmet and
glove from an American company's homepage using someone else's
credit card number that he picked up from a website.

It just seemed so simple, ordering things over the Internet
with two credit card numbers that were not his own. All he had to
do was type in the numbers and follow the verification process
after selecting an item.

It only began to dawn on him that maybe he had made a mistake
five days later, when he was notified by the Yogyakarta office of
U.S.-based courier service UPS that he had a package from the
United States. After signing the administrative forms at the UPS
branch office, he was arrested by police officers who were
waiting for him.

"I wasn't really serious," Petrus repeatedly told the judges
at the Sleman District Court last Friday, during the second
hearing of his trial. It is the first time in the country that a
person has been tried for this type of cyber crime.

Prosecutors have charged Petrus with violating Article 363 of
the Criminal Code on theft and Article 378 of the Criminal Code
on deception. The articles carry maximum prison sentences of
seven years and four years, respectively.

Petrus came to Yogyakarta three years ago from Flores, East
Nusa Tenggara, to continue his studies. The Internet was new to
him, and after about a year in Yogyakarta he began to visit
Internet cafes.

At first he just visited chatrooms and surfed different
websites. But he soon realized the Internet could be used for
other activities, as conversations about ordering goods using
credit card numbers belonging to people overseas were common
among university students, including his friends at his
boardinghouse.

It was from talking to his friends that he learned about
websites where you could obtain such credit card numbers.

So on March 3 last year, Petrus ordered a helmet and a glove,
costing a total of US$365.93, from www.agv.com, the homepage of
Alabama-based AGV Inc., using two fraudulent credit card numbers.

"He is only an amateur `carder' who worked alone. He did not
use a false name or a false address. And he didn't send a friend
to pick up the package," Information Technology (IT) expert Roy
Suryo, who was testifying as an expert witness, said during
Friday's hearing.

In an interview with The Jakarta Post following the hearing,
Roy said professional "Internet carders" worked in teams using
systems meant to make it difficult for the police to trace
them.

"They usually ask that the things they order be sent to at
least two different addresses before the goods reach the final
address... They also never used their real names.

"Thus the goods they order can be on their way to their final
destination for several months, by which time the documents in
the Internet Protocol that recorded the transaction of the
'carders' have been automatically erased.

"So if they were caught by the police, there would not be
enough evidence to send them to court," Roy said.

Roy said he was sorry to see an amateur like Petrus facing
trial when so many professional cyber criminals were still free.

He estimated that professional carders caused at least Rp 500
million (US$55,555) in losses to companies with commercial
websites.

A computer expert who asked not to be named told the Post that
professional Internet carders were helped by people in courier
service companies, and even by police officers.

A professional carder here can build a Harley Davidson
motorcycle by ordering spare parts piece by piece, the source
said. But he added that it would be impossible to do this without
some help.

Yogyakarta is among the five Indonesian cities where the
majority of cyber crimes in the country occur, including
"hacking" and "cracking". However, the police have a difficult
time fighting this type of crime because of a lack of knowledge
and equipment.

"Our KUHP (Criminal Code) can't deal with cyber crimes, so
judges will only accept conventional legal evidence such as in
Petrus' case. This is silly," Roy said.

The Indonesian police, who have been widely criticized by
developed countries, particularly the United States, for failing
to deal with cyber crime, may be making Petrus an example who can
be held up to these critics.

"In Petrus' case, we caught him red-handed and we have almost
everything required by the court, including a legal complaint
from AGV Inc. stating that the company suffered a financial loss
from the cyber crime committed by Petrus," Comr. Didi Yasmin of
the Yogyakarta Police said.