September 09, 2004, 10:33 AM — Plenty of laws exist to prosecute online identity thieves and fraudsters, and also to co-opt ISPs (Internet Service Providers) and online auction sites into the fight against fraud, but enforcement is lacking across the board, according to security experts.
"Most countries have laws that adequately address Internet fraud," said Paul Luehr, vice president of consulting and technical services firm Stroz Friedberg LLC, in an e-mail interview. "We lack the technical skills to track down these people, and we lack the means of effectively collaborating on investigations across national boundaries."
The Internet community worldwide has recently seen an upsurge in phishing scams, or the online exploits by people attempting to steal sensitive information such as a password, bank account or credit card number, often under the guise of updating account information.
For example, the Nigerian 419 or advance fee fraud continues to take victims. A U.K. man was jailed this week for six years for defrauding his own employers in order to raise money to use in a fake bank transfer scheme.
Meanwhile, Australian online betting sites have been targeted by Russian extortion gangs, who have flooded the sites with traffic, effectively closing them down, after the sites refused to pay protection money of US$20,000.
And online auction sites are now routinely targeted for check fraud, where a buyer pays for goods with a fake check which is not discovered until the goods have been shipped.
"One of the major issues is that a lot of these crimes are perpetrated by individuals outside of the U.S. and in countries where law enforcement does not have a cooperation with ISPs," said Jahan Moreh, chief security architect of Secure Data in Motion Inc.'s Sigaba business unit, in an e-mail interview. "That is why we are a major proponent of educating people by making them aware of the issues and what they should watch for."
Yet, inside the U.S., there are a number of laws which could be applied to online fraudsters, according to Luehr. Phishing could be prosecuted under laws relating to identity theft, credit, hacking, mail fraud, wire fraud, releasing viruses and spamming.
The wire fraud statute alone can carry a penalty of 30 years in prison and a fine of $1 million if a bank is affected, Luehr said.
The setting up of fake bank Web sites, which have become an integral part of the 419 fraud, violates U.S. criminal and civil laws that prohibit fraud, deceptive advertising, unregulated banking and the sale of unregistered securities. The Securities and Exchange Commission (SEC) has prosecuted dozens of cases of these types, according to Luehr.
According to Internet anti-fraud watchdog groups, ways of attacking bank frauds at their source include ISPs boosting their security, or at least closing down fake bank Web sites and shutting e-mail accounts of known fraudsters. But this relies on the good will of the ISP, which is not always forthcoming.
"Organizations have both the means and the methods to take strong security measures to protect customers and consumers by using technology," said Sigaba's Moreh. "(But) the requirements for privacy protection are in direct conflict with the requirements of security."
According to Luehr, major ISPs like Microsoft Corp.'s MSN, Yahoo Inc., America Online Inc. and Earthlink Inc. have a public reputation to uphold and so work closely with law enforcement to shut down fraudsters using their systems. Conversely, smaller ISPs have an active interest in ignoring suspect practices on their services, from a legal as well as a financial perspective.
"ISPs and hosters can be held liable for 'aiding and abetting' a law violation or for providing the 'means and instrumentalities' of fraud," Luehr said. "However, prosecutors and civil litigants must prove they acted with some level of guilty knowledge before holding them liable. That means that smaller ISPs and Web hosters have a tendency to avoid any guilty knowledge by burying their heads in the sand."
Also, an ISP which closes a site down could be sued for breach of contract and tortious interference with a business relationship, Luehr said.
Technology may offer a way beyond the mayhem of the open Internet, but it is uncertain whether this will be available to all users.
"We will continue to use the open Internet for communication, but we will use stronger forms of security to ensure the privacy and integrity of that communication," Moreh said. "Extensions of protocols, such as IPsec or HTTP/SSL, are great examples of using the existing protocols while providing security."
