Security Watch

Is 'Cybercrime' Really Killing the Internet?

Media coverage belies the actual damage being done.

• By Russ Cooper
• 05/24/2006

As a result of stories like these, we get other reporters suggesting that theft of information via cybercrime -- which today seems to mean any form of crime that involves a computer, including the theft of a laptop from a home or cafe -- is "mushrooming."

Who here thinks we only started to store personally identifiable information on computers in the last year or two? Who thinks laptops and desktops, and servers for that matter, have only recently started being stolen?

If we add up the numbers from all of the reported identity theft stories, every U.S. citizen is likely to have already had their identities stolen, likely more than once. Yet we don't see the expected deluge of stories about people, in the millions, who find out they have a second home they've never seen but have to pay for, or millions going bankrupt in order to avoid the abuse of their credit.

I'm certainly not suggesting that such crime doesn't happen, or that there aren't any victims out there who have had such problems. I'm only saying the problem is far greater in the media than it is in the average consumer's lives. And the mandated disclosure of such data losses are going to fuel stories for years.

Consumers certainly are questioning whether their information is safe, at least those few who are actually paying any attention to such stories. Reality tells us, however, that consumers are very willing to give over their personal information, be it for an Easter egg, a CD or simply because they were asked nicely. Read the bottom of any credit card or life insurance application and you'll see just what you're giving away. So while theft of identification information needs to be dealt with, I doubt you'll find a massive consumer outcry.

Meanwhile, one expert recently speculated that e-business, including the use of online banking sites, will come to a complete halt by the end of this year as a result of cybercrime and the threat of identity abuse.

Phishing, he alleges, is going to cause the vast majority of consumers to simply stop using the Internet, deeming it just too unsafe...presumably akin to the consumer walking late at night in the worst part of town.

Like the media representation of identity theft, phishing has become another media darling. There's no doubt that the volume of phishing e-mails has soared. Equally, there's no reason to believe it will be reduced any time soon. Few of the available anti-spam solutions can identify a phishing attempt from other legitimate advertising. Worse, many legitimate companies fail to understand how their brands can be abused by phishers as a result of that legitimate company's own actions.

I always love to tell the story of my own bank, the Canadian Imperial Bank of Commerce, who sent me a wonderful HTML e-mail that, amongst other things, included a graphic of the signature of the bank officer whose name was in the e-mail. Hmm, let's see, I have the bank's official logo, and the signature of someone who many of the bank's customers will have heard of. All I have to do is replace what's in between and I've got a very effective phishing scam...largely supplied by the bank itself. On top of these faux pas, the bank used a third-party marketing company to mail their e-mails out to everyone, so the headers were forged on purpose to minimize that fact. CIBC customers were, therefore, primed for a phishing e-mail scam by the bank itself.

But even if some phishing attempts are effective, and a recent paper on penny stock scams suggest they are somewhat effective, there's a really simple way to restore trust and eliminate phishing -- just disable HTML e-mail. All of a sudden the links aren't pointing to the legitimate Web site, the phisher's bogus site name is there...and guess what? It's not even similar to the legitimate site's name. The text that remains after converting HTML to plain text is usually total garbage -- even the simplest novice would be hard pressed to follow a link in such an e-mail.

So, in my view, the bottom line is that while personal information is being lost and stolen, the number of victims falls far short of the volume lost or stolen. This is equally true of phishing scams, despite the suggestions of impending collapse.