Online fraud: We got law, but no enforcement

Plenty of laws exist to prosecute online identity thieves and fraudsters, and also to co-opt ISPs (Internet Service Providers) and online auction sites into the fight against fraud, but enforcement is lacking across the board, according to security experts.

"Most countries have laws that adequately address Internet fraud," said Paul Luehr, vice president of consulting and technical services firm Stroz Friedberg LLC, in an e-mail interview. "We lack the technical skills to track down these people, and we lack the means of effectively collaborating on investigations across national boundaries."

The Internet community worldwide has recently seen an upsurge in phishing scams, or the online exploits by people attempting to steal sensitive information such as a password, bank account or credit card number, often under the guise of updating account information.

For example, the Nigerian 419 or advance fee fraud continues to take victims. A U.K. man was jailed this week for six years for defrauding his own employers in order to raise money to use in a fake bank transfer scheme.

Meanwhile, Australian online betting sites have been targeted by Russian extortion gangs, who have flooded the sites with traffic, effectively closing them down, after the sites refused to pay protection money of US$20,000.

And online auction sites are now routinely targeted for check fraud, where a buyer pays for goods with a fake check which is not discovered until the goods have been shipped.

"One of the major issues is that a lot of these crimes are perpetrated by individuals outside of the U.S. and in countries where law enforcement does not have a cooperation with ISPs," said Jahan Moreh, chief security architect of Secure Data in Motion Inc.'s Sigaba business unit, in an e-mail interview. "That is why we are a major proponent of educating people by making them aware of the issues and what they should watch for."

Yet, inside the U.S., there are a number of laws which could be applied to online fraudsters, according to Luehr. Phishing could be prosecuted under laws relating to identity theft, credit, hacking, mail fraud, wire fraud, releasing viruses and spamming.

The wire fraud statute alone can carry a penalty of 30 years in prison and a fine of $1 million if a bank is affected, Luehr said.

The setting up of fake bank Web sites, which have become an integral part of the 419 fraud, violates U.S. criminal and civil laws that prohibit fraud, deceptive advertising, unregulated banking and the sale of unregistered securities. The Securities and Exchange Commission (SEC) has prosecuted dozens of cases of these types, according to Luehr.

According to Internet anti-fraud watchdog groups, ways of attacking bank frauds at their source include ISPs boosting their security, or at least closing down fake bank Web sites and shutting e-mail accounts of known fraudsters. But this relies on the good will of the ISP, which is not always forthcoming.

"Organizations have both the means and the methods to take strong security measures to protect customers and consumers by using technology," said Sigaba's Moreh. "(But) the requirements for privacy protection are in direct conflict with the requirements of security."

According to Luehr, major ISPs like Microsoft Corp.'s MSN, Yahoo Inc., America Online Inc. and Earthlink Inc. have a public reputation to uphold and so work closely with law enforcement to shut down fraudsters using their systems. Conversely, smaller ISPs have an active interest in ignoring suspect practices on their services, from a legal as well as a financial perspective.

"ISPs and hosters can be held liable for 'aiding and abetting' a law violation or for providing the 'means and instrumentalities' of fraud," Luehr said. "However, prosecutors and civil litigants must prove they acted with some level of guilty knowledge before holding them liable. That means that smaller ISPs and Web hosters have a tendency to avoid any guilty knowledge by burying their heads in the sand."

Also, an ISP which closes a site down could be sued for breach of contract and tortious interference with a business relationship, Luehr said.

Technology may offer a way beyond the mayhem of the open Internet, but it is uncertain whether this will be available to all users.

"We will continue to use the open Internet for communication, but we will use stronger forms of security to ensure the privacy and integrity of that communication," Moreh said. "Extensions of protocols, such as IPsec or HTTP/SSL, are great examples of using the existing protocols while providing security."

Luehr thinks the general public will probably always use an open network. "Trust will be built through 'gated communities' like VPNs (Virtual Private Networks), private chatrooms or through encrypted transactions that use digital certificates or biometrics."

Apart from the negligible international cooperation and the lack of technical skills, a failure to clearly understand the nature of online fraud is hampering progress.

"Cybercrime is the third-highest priority of the FBI behind fighting terrorism and foreign espionage," Luehr said. "In practice, however, Internet fraud cases sometimes fall between the cracks because they are not as sophisticated or as urgent as cyberterrorism or hacking cases."

"I believe the (political) will is there but there is a lack of understanding of the issues," said Moreh. "(Politicians) try to approach these types of fraud as they would traditional, non-cyber-related fraud."

In the U.S. cases, the effort to fight fraud appears split between the FBI, the U.S Secret Service, the Federal Trade Commission, the Department of Justice and even the U.S. Postal Inspection Service.

Other barriers cited by security specialists and watchdog groups to pursuing online fraud include:

-- government agencies such as the FBI and Department of Justice often draw an artificial line between Internet fraud and other types of computer crime cases, so that the most tech-savvy agents pursue hacking and software piracy, leaving Internet fraud to less skilled investigators;

-- investigators may pass over a multimillion-dollar Internet fraud because it initially looks like a much smaller case;

-- complaint services such as the Internet Fraud Complaint Center and Consumer Sentinel are not well known and are hence under-utilized;

-- law enforcement authorities cannot easily act on information received from external sources unless it is submitted in their preferred format;

-- despite laws designed to speed up international cooperation, getting most evidence from overseas can take up to six months;

-- privacy regulations in many countries give people the right to conduct business anonymously, preventing any real security measure from being implemented worldwide.

There seems to be no immediate prospects that technology or law enforcement can stem the flood of online frauds as the open nature of the Internet, which was chiefly responsible for its explosive growth, provides such an ideal ground for people who want to exploit it.

Consumer education has also proved ineffective, as the increasing number of victims going public shows. The 419 fraud alone is believed to have garnered $5 billion from victims over the last six years. Fraud complaints by U.S. consumers against foreign companies have risen from 4,968 in 1999 to 34,882 in 2003, according to Consumer Sentinel.

Although the initiative lies with the online criminals, attempts to wrest back the Internet for the purposes it was originally designed for have not been abandoned, according to Luehr. "Online fraud and ID theft are definitely crimes that can and should be pursued," Luehr said.