Our Excellence - Economic Crime & Detection

Project

Estimations of the economics model of crime and the ongoing critical threats created by Identity frauds

Core Development Areas

Study the trends, causes, early detection, and prevention of Identity fraud & theft, e.g.:

• Exploratory & descriptive studies to record & understand the size & scope of Identity fraud & theft
• Examination of characteristics of individuals, organizations, and business victimized by Identity fraud

Introduction

Beyond the garden variety methods of identity theft identified in the above studies, the modus operandi of criminals who are engaged in identity fraud has proven to be dynamic, technologically innovative, and focused on vulnerabilities of information systems. They have exploited the outermost perimeter of secure corporate and government systems where customers, vendors, and citizens seek services.

According to State Bureau of Diplomatic Security documents, passport fraud is often committed in connection with other crimes, including narcotics trafficking, organized crime, money laundering, and alien smuggling.

Since 2003, there has been a dramatic increase in the collection methods used by criminals to steal personal identifier information. These include key logging programs, phishing and pharming schemes, and a variety of methods to gain access to databases containing vast amounts of information. One study on key logging reports that this hacking activity has increased over 65% since 2004. VeriSign reports that in 2005 there were 6,191 key loggers, as compared to 3,753 in 2004 and 300 in 2000. "Key loggers, silently installed programs that record a victim's keystrokes and sends them to hackers, put tens of millions of Internet users' finances, personal data and account information at risk. Largely distributed by organized cyber theft groups, they are typically packaged with phishing emails or spy ware -- malicious code that then tracks victims' online activity -- often eluding traditional security defenses like anti-virus software and firewalls".

Hackers use key logger programs to collect keystrokes from unsuspecting victims whose use of online chat rooms and instant messaging type programs makes them vulnerable. The hacker activates the program so that he can collect any information that the user has inputted online, including personal data used in online transactions.

While malware, viruses, and worms still pose problems, cyber criminals have become more sophisticated, organized, and clandestine in their Activities. While activists seek maximum public exposure to advance a political cause, fraud is all the more insidious because perpetrators and victims conspire to keep it hidden. This year promises to be the worst yet…Cyber criminals are making so much money - more than the illegal drug trade last year, according to the U.S.Treasury - that they've been doing their own R&D. That research is already bearing fruit. Experts worry that direct theft of data (as opposed to phishing…) is on the rise. Identity thieves are now able to target specific attacks against specific people or companies and they can select their targets based on factors like net worth (Sparks, 2006).

Cyber criminals, like any other criminals, are eager to stay at least one step ahead of law enforcement and the technological community. Any technological innovation presents an opportunity for them. The newest cellular technologies, including iPods and MP3 files, are vulnerable to key logger and other forms of spy ware. Organized crime groups are also using botnets to increase their efficiency in implementing denial of service attacks, spamming, and stealing personal information.

Because China's PCs don't generally run licensed versions of Microsoft's Windows, they're not eligible for the security patches Microsoft makes available to its legitimate users. Hackers have already taken control of the PCs of thousands of unsuspecting Chinese and used them as a platform from which to launch Spam attacks. These so-called botnets are routinely bought, sold and swapped in Internet chat rooms (Sparks, 2006). Cyber crime commerce is booming and negatively impacting legitimate commerce and national security.

IIME will focus its research activities into the following areas:

• Current and emerging criminal groups that perpetrate identity fraud and theft with a focus on their modus operandi o Value of information: societal and criminal calculus
• Review and analysis of emerging data on identity fraud and its relationship to criminal behavior
• Develop best practices for detecting, preventing, investigating, and prosecuting attacks from organized criminal groups, cyber criminals, and insiders
• Evaluate technology as a problem and a solution

Managing Identity Fraud: Information Policy and Technology

It is evident that focusing solely on identity fraud and theft is insufficient, because the phenomenon is part of a much broader and complex discussion. The identity fraud problem quickly morphs into several areas that impact on how organizations and individuals conduct business or accomplish their mission. Although collecting and matching personal identifying data presents a risk, it is key to providing customer service, maintaining a good reputation, ensuring trusted transactions, protecting against fraudulent applications, preventing terrorism, and locating sexual predators. Because personal identifier information is required to validate or authenticate identity, it is valuable and absolutely necessary. Its market value makes it increasingly vulnerable to crime. It can be stolen and used for immediate financial gain (creating an account and charging purchases) or as part of a batch of identities available for sale through carding websites. The challenge is to develop trusted and secure information-sharing environments that maximize the societal benefits of using this type of information and minimize the risks associated with it.

Corporations and governments that hold personal identifier information must:

• Evaluate and improve their information security practices to protect sensitive information
• Prevent the potential loss of this data
• Develop policies for use of information
• Consider the privacy implications for the use and abuse of this information
• Review and assess their identity authentication systems and background screening methods
• Determine how information is being used to harm individuals and businesses and implement solutions to mitigate the harm
• Find solutions to the impediments and risks of information sharing
• Determine how enabling technologies can facilitate information sharing and enhance privacy. Consumers are faced with questions regarding
• How they can prevent themselves from becoming an identity fraud victim
• How to respond to breach notices
• What to do if someone assumes their identity
• How they can best manage and control their identity

IIME will conduct research in areas

Study the use of data, its protection, and the role of enabling technologies to facilitate privacy and information sharing.

• Impact of data breaches on the rate of identity theft
• Public perception studies to determine attitudes toward trust, information use, and policies
• Evaluation of privacy technologies that purport to enable enhanced privacy and facilitate information sharing
• Securing sensitive information: practices, methods, and policies

Identity Management System

Identity management systems need strong identity authentication processes. Determining that a person who is claiming an identity is really the person whose identity is presented is a critical stage for commerce and security, both domestically and globally. The personal information an agency, institution, or corporation holds is an asset that must be protected in order to establish and maintain trust between the organization and its clients or customers. The risks and consequences of a security breach include impairment of reputation, financial losses, loss of customer confidence, failure to meet regulatory standards, and added costs. Strong identity management systems are necessary to assist in regulatory compliance, prevent fraud, improve security, promote customer confidence, and to enter into a trusted relationship transaction.

While efforts have been made to use risk-based methods to improve the identity authentication process, they have not been completely successful. Government programs such as CAPPS II have been cancelled because policy concerns over mission creep, audit, and redress have not been addressed to the satisfaction of congressional committees. The rash of disclosures about security breaches in 2005 made a big splash in the media. In reality, only a small percentage of the breached data caused any harm. This may be because in many cases the data was lost, not stolen. Attempts to use stolen data are often thwarted by fraud prevention and mitigation strategies that many institutions have in place.

However, the risk of stolen data being misused is still there. "Society's growing reliance on information technologies exacerbates both the threat posed by personal information in the wrong hands and the dangers of poorly focused or excessive regulation intended to guard against that threat" must be developed and implemented. Best practice standards and technological systems must be put in place to secure identifying information and protect against security breaches for every organization - private or public - that processes, stores, and uses personal data.

IIME will focus its research in Required Research areas such as

Study how to improve identity authentication systems and protect identity information to reduce fraud and improper payments, and protect national security.

• The evaluation of risk-based technology solutions
• The effectiveness of identity authentication systems
• Improving authentication methods of customers and citizens using business and government web-based systems

*******************************