President's Identity Theft Task Force issues recommendations

The Identity Theft Task Force has issued the formal recommendations they've been putting together since May, 2006. The recommendations include feedback solicited from the general public.

The final report is comprehensive -- identifying all the issues that have made identity theft and the financial crimes that result from it -- a major concern in the public eye.

The report does (slightly) downplay the problem of data-breaches, noting no significant increase in financial crimes and identity theft from them. I'm not sure, I completely agree with this, but other's could probably argue this point with me. Despite this, it does make a lot of great recommendations on how to limit our exposure to the problem.

In all fairness, it's very difficult, if not impossible, to identify the original point of compromise in an identity theft case. In most cases, the best guess rule applies. With information being sold over the Internet, the criminal using the information probably isn't sure where it came from originally, either. And even if they were to tell us, most of them can't be considered 100 percent credible.

Underground carder forums seem to be selling personal and financial information, too inexpensively. This phenomenon ties the less sophisticated identity thieves with those of a more sophisticated (organized) nature. Given this, the problem has the ability to expand, rapidly.

As there is more demand, we might see more information being used in all sorts of crimes and Internet access is growing, rapidly.

Congress considered several bills on data breaches in their last session, but failed to pass any of them. Protecting against data breaches is going to be an expensive proposition and my guess is that there is a lot of lobbying going on by the organizations that will ultimately pay for protecting the information better.

The report calls for stricter laws and more aggressive enforcement, which is something that should be taken seriously. In my opinion, a large part of the problem is that identity theft is too easy to commit, extremely profitable, and consequences are minimal, if caught.

Also called for is more cooperation of an International nature, which is going to be a key part of any resolution to what is rapidly becoming a global problem.

The full report can be seen, here.

The Task Force's homepage, which has more good information, can be seen, here.

Blog exposes risk in reporting ID Theft

(Screenshot courtesy of the In Security Blog)

I'm surprised no one has called this one out before. John Sharp, author of the In Security Blog writes:

Those of you who follow my blog know that I'm worried about the increasing sophistication of keyloggers. Which is why, when I went on the FTC site this morning, I was a little shocked to discover that the format of the FTC ID Theft Complaint Form presents a veritable gift to keyloggers.

Full post from the In Security Blog (great read), here. There are also some great tips on how to avoid becoming a crimeware victim on the PR release on this from Authenium (John's company), here.

John's concerns are well founded. The Anti Phishing Working Group, which tracks phishing, malware and crimeware (normally keylogger variants) shows their use increasing, monthly.

Keyloggers (once on a system) record keystrokes, sending them back to the person, who covertly placed the software on the system. Criminals often install (drop) these cybernasties using spam e-mails, which lure people to click on their links.

The information, the criminals intend to log (steal) is personal and financial, which is then used to steal money.

(Chart courtesy of Websense and the APWG)

Sadly enough, keylogging software has so-called legitimate uses and can be legally purchased by anyone. One of the legitimate (so-called) uses is to spy on other people (invade their privacy).

Just about anyone can buy this wonderful technology right on the Internet, which can bee seen, here. Perhaps if it wasn't so easily available, the problem wouldn't keep getting worse?

The FTC does a lot of good in their battle to fight identity theft. You can get a lot of good information about how not to become a victim by visiting their page on it, here.

Once a computer has been compromised with crimeware (keylogging software), anything entered on it can be logged (exposed). Even if the site you are sending the information to is "secure," your computer IS NOT!

The Internet is full of sites requesting your personal details, the bottom line is to make sure your system is secure, or if it IS NOT - avoid sending personal or financial details, anywhere.

Medical Identity Theft Could Kill

Recently, I've seen a lot written about Medical Identity Theft. There seems to be a lot of people getting bills for medical procedures they never received and subsequently going through a lot of "pain and suffering" to clear their good names.

And (it seems) organized criminal are getting involved in the activity, probably because it's a "profitable" enterprise with little danger of getting caught.

BusinessWeek online did an interesting article about this, where they said:

Yet the thief isn't always an individual desperately needing medical care. In some instances, the perpetrator can be a doctor hoping to pad his or her income by filing fraudulent claims. Even worse, law enforcement authorities say that more and more frauds are being perpetrated by organized crime rings who steal dozens, and sometimes thousands, of medical records, as well as the billing codes for doctors. The rings then set up fake medical clinics—offering free health screenings as a ruse to draw in patients—that submit bogus bills to insurers, collect payments for a few months, and then disappear before the insurers realize they've been had. (Dixon notes that health records now fetch $50 to $60 each on the black market, vs. a mere 7 cents for stolen résumés.)

BusinessWeek online article, here.

The BusinessWeek article quotes Pam Dixon, executive director of the World Privacy Forum, and rightfully so. The World Privacy Forum (to the best of my knowledge) was the first to call out this growing problem and has done quite a bit of work to determine the extent of it.

They have an entire page devoted to it on their site, here. I highly recommend it for anyone, who is, or might become a victim of this growing trend.

Based on their research, they have presented some key recommendations:

• Individuals’ rights to correct errors in their medical histories and files need to be expanded to allow them to remove false information from their files.
  
• Victims of medical identity theft should have the right to receive one free copy of their medical file.
  
• Individuals should have expanded rights to obtain an accounting of disclosures of health information.
  
• Notification of medical data breaches to consumers has the potential to save lives, protect health, and prevent losses.
  
• All working prototypes for the National Health Information Network need comprehensive risk assessments focused on preventing medical identity theft while protecting patient privacy.

The World Privacy Forum has also presented their finding to several government agencies, including the FTC.

This problem goes beyond the financial implications of identity fraud because it could cause great harm to victims, who have had erroneous medical information put in their medical histories. People could be improperly diagnosed, which might (in an extreme case) lead to their demise.

I did a previous post:

Tell it to the Identity Theft Task Force

Since the Federal Identity Theft Task Force is soliciting information from the public - this would be an appropriate place for someone to voice their thoughts (recommendations) about medical identity theft.

Ask Eric if there is "Zero Liability" in Identity Theft

Sometimes to understand what an identity theft victim is faced with you need to hear about it from a person, who has actually experienced it.

We live in a world where our information is gathered, sold and not protected very well. Meanwhile, there seems to be an army of fraudsters compromising credit issuers, who issue credit without checking very carefully.

Then there is the advertising, which claims that their financial products have a "zero fraud liability."

The Boston Globe did an interesting story that shows the liability innocent people face when they become identity theft victims.

Beth Healey writes:

Eric W. Carroll's credit report says he has a home in Florida, a wife named Katrina, and a pile of unpaid bills.

He first learned this when a debt collector called him in 2002, dialing his apartment in Bridgewater, yet asking for an Eric W. Carroll from Avon Park, Fla. Carroll insisted there was some mistake: He was not married, and he had never lived in Florida.

Nearly five years later, collectors are still hounding the wrong Eric Carroll.

Boston Globe story, here.

And even though Eric seems to have done all the right things, he seems to still be suffering.

There is no zero liability for identity fraud and we need to stop "sugar coating" the true impact it has on individual people.

Here are two places, I've recently "blogged" about where people can voice their opinion to people that can make a difference:

Tell it to the Identity Theft Task Force

Consumers Union Calls for Congress to Protect People's Personal Information

Tell it to the Identity Theft Task Force

On May 10, 2006, the Federal Identity Theft Task Force was formed and has been working on what some believe is a national crisis. And it very well could be, identities are a very personal matter and should be considered, "sacred."

Now they soliciting advice from the public on how they can improve upon the recommendations they've already come up with.

I got this from the press release on the Federal Trade Commission's website:

The Federal Identity Theft Task Force, chaired by Attorney General Alberto R. Gonzales and co-chaired by Federal Trade Commission Chairman Deborah Platt Majoras, is seeking public comment on ways to improve the effectiveness and efficiency of federal government efforts to reduce identity theft. The public comments on these issues will supplement the research and analysis being conducted, provide further information about the proposals being considered, and identify areas where additional recommendations may be warranted.

You can visit the Federal Identity Theft Task Force's site, here.

For all of us who have been "ranting" about this problem, here is our chance to voice our opinions and make a "difference" in what has become a significant problem.

The site has a lot of resources for victims and those who might become one.

They also have two "interesting" ten-minute videos about identity theft:

English, here.

Espanol, here.

Boeing Holds Employee Accountable in Laptop Theft

Laptops are stolen all the time - and far too often - they contain personal and financial information that can be used for identity theft purposes.

The Boeing Company announced Thursday that they fired the employee, who had their laptop stolen and compromised 400,000 people's personal information. This wasn't the first Boeing employee that lost a laptop containing sensitive information.

Boeing is saying that the computer was "password protected," and they believe the intent of the thief was to steal the laptop rather than breach the information on it. They are also saying that there is no evidence of identity theft, but are "assuming the worst case scenario."

I sometimes wonder if the same public relations firm prepares all these statements. They all say about the same thing - that there is no evidence the information has been used to commit "identity theft."

Of course, with all the attention brought upon this, even if the original motive was to steal a laptop, the thief probably is now aware the laptop contains a lot of information that can be sold for a price.

It's become pretty easy to find a place to sell stolen information with carder forums designed to do so operating on the Internet. Previous post, here.

The employee was terminated (fired) for not having the information "encrypted" per Boeing policy, which was implemented because of the earlier "laptop thefts."

Even if the information were encrypted - in theory at least - encrypted data can still be hacked by someone with the knowledge to do so. Another problem is that if information can be downloaded, it can be compromised by a dishonest insider, or with a "compromised password."

Just last week, the media was awash with stories of IT students being "courted" to work for organized criminal groups - which more and more - seem to be getting involved in technology based crimes, including "identity theft."

I did a post with my thoughts on this matter, here.

In all fairness, Boeing isn't the only organization losing laptops with personal information on them. The Privacy Rights Clearinghouse, which maintains a chronology of "known data-breaches," hit the 100 million mark this week (number of people compromised in the U.S., alone). Just this week, they documented eight "known" breaches.

Note, they can only document the "known breaches" and breaches that previously were "unknown" seem to be appearing, all too often.

Encryption and computer security measures are only one part of the solution. It's the information that the bad guys are after and we need to stop keeping it in places where it's too easily stolen.

Firing one employee is unlikely to have any impact on the overall problem.

James Wallace, Seattle PI has an extensive article about the Boeing story, here.

Discarded Computers might still have a lot of Sensitive Information on them

One of the ways identities are compromised is when computers are discarded without properly "washing" the hard-drive with specialized software, or destroying the hard-drive, itself.

I did a post in about this, here.

Bill Lambrecht of the St. Louis Post - Dispatch wrote an interesting article, where they purchased several old computers in Nigeria and were able to get a lot of information from them.

Interestingly enough, he quotes a prominent Nigerian, Oladele Osibanjo, who is a regional coordinator for the Basel Convention - a global treaty intended to protect people from the mishandling of hazardous materials as saying:

"The e-waste you are exporting is coming back to you in the form of cyber-crime. Maybe when Americans realize what is happening, they will be a little more careful."

While Mr. Osibanjo is trying to warn us about identity theft, I'm certain his true concerns lie more with hazardous materials that are damaging people's health in other countries. When I went to their site, the fact that this occurs, alarmed me.

St. Louis Post - Dispatch article, here.

Although the article is extremely informative - and there is ample proof of fraud coming from Nigeria - I continue to be amazed at the amount of press they receive about it.

With the recent ABC 20 20 story brought about by a certain former politician, who is behind bars and might be Chelsea Clinton's father-in-law someday, Nigerian fraud is again making headlines.

Stealing and using information is a worldwide problem and there are criminals involved in the "trade" in a lot of places.

So far as Chelsea, it must be hard to be Bill and Hillary's daughter, and she certainly doesn't seem to get in as much trouble as some twins, who were in South America recently.

Saying that, the story calls attention to what I consider the potential of a huge problem. Companies and organizations are constantly upgrading their computers and a lot of them get discarded.

Besides identity theft, there is a huge potential that "sensitive information" could be sifted from these hard-drives that would compromise trade secrets, or even government information.

The State of Crimeware on the Internet

"Crimeware," according to Wikipedia was a term coined by Peter Cassidy of the Anti-Phishing Working Group as a "type of computer program or suite of computer programs that are designed specifically to automate financial crime."

Last week, the US Department of Homeland Security, SRI International Identity Theft Technology Council and the Anti-Phishing Working Group issued a pretty telling report about how crimeware is being used to commit financial crimes and identity theft.

From the executive summary, here is how crimeware is used by Internet criminals:

Crimeware is software that performs illegal actions unanticipated by a user running the software, which are intended to yield financial benefits to the distributor of the software.

Crimeware is a ubiquitous fact of life in modern online interactions. It is distributed via many mechanisms, including:

• Social engineering attacks convincing users to open a malicious email attachment containing crimeware;
• Injection of crimeware into legitimate web sites via content injection attacks such as cross-site scripting;
• Exploiting security vulnerabilities through worms and other attacks on security flaws in operating systems, browsers, and other commonly installed software; and
• Insertion of crimeware into downloadable software that otherwise performs
  a desirable function.

Full report, here.

Recently, we've read about organized crime groups employing "highly technical personnel" and carder rooms - where financial information is bought and sold.

A recent USA Today story about "carder forums" quoted the following statistics:

$67.2 billion: FBI estimate of what U.S. businesses lose annually because of computer-related crimes.

$8 billion: Consumer Reports estimate of what U.S. consumers lost the past two years because of viruses, spyware and Internet scams.

93.8 million: Privacy Rights Clearinghouse's count of personal records reported lost or stolen since February 2005.

26,150: The Anti-Phishing Working Group's count of unique variations of phishing scams reported in August 2006.

Crimeware and the Internet are fueling the identity theft problem - which in turn could threaten the stability of our financial systems. Some even say, might be a National Security issue, also.

In the rapidly changing world of technology, laws have failed to keep pace. Perhaps with the upcoming elections, it's time for all of us to examine what our political representatives are doing about this problem.

We might find that we all have a common interest on this issue!

Richard Clarke's Views on Identity Theft

Richard Clarke - former National Security Advisor and Special Advisor to the President on Cyber Security - has opinions on the current identity theft crisis. And although (to some) his opinions are considered controversial - he is no doubt a person with a great deal of experience.

Four leaders of the "free world" have listened to his opinions.

After leaving government service -- he nows heads a private firm (Good Harbor Consulting LLC) -- which consults on security matters, to include identity theft issues.

Jack Kelly of the Pittsburgh Post-Gazette covered Mr. Clarke's speech at Carnegie Mellon University in 2005 and quoted him as saying:

"Identity theft -- which is being conducted more and more by international criminal gangs based in countries where law enforcement is lax -- is primarily a crime problem, but is also a national security problem."

In this speech - - he also covered the fact that obtaining (high-quality) fake identification is easy and that despite all the security at airports -- there is no attempt to verify, whether or not an ID is legitimate.

Link to full article (speech), here.

Clarke also supports "immediate disclosure" when data-breaches occur and spoke of this in an article, where he was interviewed by Dan Briody (published in CIO Insight). In this article, he also aptly points out the problem of data-mining companies.

Link, here.

Not everyone is going to agree with Richard Clarke, but he does seem to have a lot of valid insights into what has become an international problem.

It would be interesting to see what his opinion is on President Bush's Identity Theft Task Force and the direction they are going.

Sometimes people are "controversial" to raise the "awareness" level on an issue. Come to think of it -- from a historical perspective -- there are a lot of famous people, who were considered "controversial," that were later proven correct.

Do It Yourself Crime Kits Victimize the Masses

It appears that phishing attempts have hit an all time record thanks to the availability of "do it yourself kits" available on the Internet.

Phishing is a leading cause of identity theft, which impacts millions of people a year.

Dinah Greek, Computeract!ve reports:

This was the warning from the Anti Phishing Working Group (APWG) , which said the kits allow non-technical criminals to start up their own online criminal empires.

All the information they need to set up phishing emails or websites infected with malware, such as Trojans, viruses and worms, is contained in the kits bought and sold online.

Full story, here.

Do it yourself (crimeware) kits aren't entirely new and have been reported before, here.

We keep hearing about the record number of phishing attempts being recorded. Unless some of these people start getting caught - we are likely to see the number continue to grow!

And the criminal "do it yourself industry" doesn't limit itself to phishing. Kits on how to scam on auction sites are also being sold (previous post), here.

California Predicts the Top Ten Scams for 2006

Much of the legislation to curb Fraud, Phishing and Financial Misdeeds enacted worldwide can be traced to laws in California. This is probably because of the amount of fraud that the Golden State has suffered in recent times.

Based on this, it would make sense to pay attention to what California predicts when it comes to fraud.

Here is what California predicts for 2006, courtesy of the Department of Corporations:

Senior Investment Fraud. The elderly are targeted for fraud for several reasons, such as older Californians are most likely to have a nest egg, own their own home or have excellent credit-all of which the con artist will try to tap into. As seniors plan for retirement, they may fall victim to such investment schemes as oil and gas, real estate, and annuities. They should be careful when solicited by mailers, telephone, and through free lunch or dinner seminars. In the past year, DOC assisted with a Southern California district attorney's office to bring criminal charges against three perpetrators for selling promissory notes offering a 12 percent annual return and then absconding with seniors' money. The defendants were charged with 850 felony counts of senior fraud.

Mortgage Fraud. Predatory mortgage lending involves a wide array of abusive practices and usually takes place in the subprime market, targeting borrowers with weak or blemished credit records. The most common lending abuses include excessive fees, abusive prepayment penalties, loan flipping, and other shady practices. In addition, foreclosure schemes are on the rise in which the prepetrators mislead the homeowners into believing that they can save their homes in exchange for a transfer of deed and up-front fees. The perpetrator profits from these schemes by remortgaging the property or pocketing fees paid by the homeowner. DOC, as part of a California task force comprised of local district attorneys and the California Attorney General filed a judgment in 2006 against a major subprime lender to resolve predatory lending allegations against the company, which will provide consumers $295 million in restitution and require sweeping reforms of the firm's business practices.

Affinity Fraud. These scams exploit the trust and friendship that exist in groups of people who have something in common, such as religious or ethnic communities, the elderly, military servicemembers, or professional groups. The fraudsters who promote affinity scams frequently are-or pretend to be-members of the group and enlist respected community or religious leaders from within the group to unwittingly spread the word about the scheme. In 2005, DOC brought enforcement actions against perpetrators of investment scams affecting members of the African American and the Korean American communities in Southern California, and a foreign currency scheme targeted at the Chinese American community in the Bay Area.

Identity Theft/Phishing. Identity theft is a trend that is often aided by technology and is the criminal activity of stealing someone's personal information for financial gain. More often than not, it involves "phishing," where Internet users believe that they are receiving e-mail from a specific, trusted source, or that they are securely connected to a trusted Web site, when that is not the case. As more investment and banking accounts, as well as 401(k) plans, are accessible online, thieves may attempt to obtain your access codes and passwords so they can transfer all of the assets out of accounts.

Online Escrow Fraud. In 2005, DOC enforcement actions to crack down on online escrow fraud increased by 16 percent from 2004. Escrow services fraud involves a perpetrator proposing the use of a third-party escrow service to facilitate the exchange of money and merchandise. The buyer sends payment to a phony escrow site that closely resembles a legitimate escrow service. Or, the seller sends merchandise to the bogus buyer, and waits for the payment through the escrow site, which is never received because it is a sham.

Commodities/Foreign Currency. Consumers should take special care to protect themselves from the many types of commodities fraud. They might be selling precious metals, such as silver or gold, or foreign currency, such as Euros, Yen or Deutschmarks. Be wary of any firm that offers to sell commodities or commodity futures or options, particularly if a firm promises high profits and low risks, or claims that they have made profits for all of their customers. The commodities and futures markets are very risky, and investors can lose their entire investment very quickly. In 2005, DOC took enforcement action against a firm and sales representatives in San Diego County who were not registered with the Commodity Futures Trading Commission to sell foreign currency contracts. Investors were not aware that the promoter had been barred from the National Futures Association, the self-regulatory organization for the futures industry, and a principal had been ordered by the NASD to pay damages in two separate incidents. Oil and Gas Scams. With oil prices at record levels and continued Middle East instability, DOC is concerned about the increase in oil and gas scams that it is experiencing. Perpetrators lure investors into unsuitable or fraudulent oil and gas ventures promising quick profits on a low risk investment. A San Diego scam using five different company names touted a 90 to 95 percent probability of striking oil in oil wells and returning investors' principal investment within a few years, which some customers never received. At least seven California residents invested more than $770,000 in the scam. The perpetrators failed to disclose prior convictions of mail fraud and wire fraud and that at least seven other states had taken administrative action against the sales agents for securities fraud.

Ponzi/Pyramid Schemes. Named for swindler Charles Ponzi, the premise is simple: use money from later investors to pay early investors. Instead of investing customers' funds, the operator pays dividends to initial investors using the principal amounts invested by subsequent investors. The scheme generally falls apart when the operator flees with all of the proceeds, or when a sufficient number of new investors cannot be found to allow the continued payment of dividends. Another very old form of fraud, a pyramid scheme, promises consumers or investors large profits based primarily on recruiting others to join their program, not based on profits from any real investment or real sale of goods to the public. A product may be used to hide the pyramid structure if the company's incentive program force recruits to buy more products than they could ever sell, or the sales occur only between the people inside the pyramid structure or to new recruits joining the structure, not to consumers out in the general public.

Military Fraud. There has been heightened concern at the federal and state government levels about the financial vulnerabilities of servicemembers and their families, particularly in light of recent deployments to Iraq and Afghanistan. Money woes can be especially difficult for National Guard and Reserve soldiers, who often have to make a rapid switch from civilian to military life when they get called up. DOC created the California Troops Against Predatory Scams (TAPS) program to provide financial education and consumer protection tips, supported by an effective and timely consumer enforcement program.

Disaster and Charity Scams. Scammers will attempt to capitalize on the aftermath of Hurricane Katrina and other disasters. Be careful of investment fraud scams which claim to be trading programs that guarantee high returns, with a portion going to aid relief efforts. Others promote businesses that stand to profit from relief and rebuilding efforts. Be cautious of the influx of Web sites soliciting for charitable donations to avoid phishing and identity theft.

It never ceases to amaze me at the lack of moral fiber fraudsters have. If California is correct, they will target the elderly, charities, people's homes, their identities, their retirement savings and even the military in time of war.

Besides supporting legislation to put these people away (for a long time), the most effective tool against fraud is awareness. It is a kind thing to share awareness to protect those, who might fall into harm's way by an activity that is becoming epidemic in nature.

I would like to thank the State of California for sharing this with us all.

Press Release link, here.