Really Bad Idea: Make ISPs Liable For Cybercrime Efforts

from the oh-come-on dept

Let me start off this post by noting that, while I don't know Noah Schachtman personally (other than a few emails back and forth many years ago), I've always liked his work writing for Wired and other publications. However, I'm surprised to see him advocating the strong use of third party liability as a tool to deal with cybercrime, as a part of a paper for the Brookings Institute. The idea is that, when talking about spammers & scammers online, there are, perhaps, a small number of ISPs who tend to do business with these guys, and Schachtman believes that by making those ISPs liable, it would pressure them into cutting off the bad clients.

Schachtman has numerous caveats and is pretty specific in his plan that it only apply to a specific list put out by a trusted independent third party, that the methodology for being on the list is clear and that an appeals process also be explicit. On top of that, he says that it should be limited to "universally recognized crimes, like theft, fraud, and criminal trespass" and is clear in saying that it "wouldn’t work for politically inflammatory speech or copyright infringement; they’re too open to abuse and overly broad interpretation."

Also, in reading the report, it's clear that this isn't just something he came up with overnight, or some random blogger or reporter dashing off a column on some fragment of a thought they had an hour before deadline. He's put a lot of thought and research into this. But I still think the idea is dreadful and shortsighted. It wouldn't solve the problem it seeks to deal with, at all, and (even worse) it would open up all sorts of collateral damage or unintended consequences.

First off, it wouldn't solve the problem it's trying to solve. We've seen this time and time again with attempts to shut down any kind of "rogue" behavior online by going after intermediaries. The bad players just figure out some other place to go, and they often go further underground in ways that makes it tougher to find or track them and their activities. Even Schachtman admits that many would likely jump to ISPs elsewhere. So, if it's not actually stopping the behavior, then what's the value?

Second, while Schachtman is clear that this shouldn't be used for those other things, chipping away at third party liability protections in any arena is quite dangerous, because it's not hard to see lobbyists using that to push for such rules to be expanded to cover their pet area. Anyone who thinks that the RIAA and MPAA wouldn't pounce on this and work hard to add copyright infringement to the list simply hasn't been paying attention. What Schachtman describes in terms of the ability to sue an ISP for third party actions has been the legacy entertainment industry's wet dream for over a decade. Anyone who thinks that politicians would distinguish the types of crimes that Schachtman focuses on from garden variety claims of copyright infringement is living in a dream world.

And, honestly, I'm still at a loss as to why this is actually needed. It seems like there remain much more effective ways to deal with issues like this that don't involve giving up basic concepts of properly applying liability to the actual party responsible. The first is actually targeting those responsible for the crimes. If they're using known ISPs, then it seems like there is a record trail that can be traced back to go after those actually breaking the law to try to put them out of business. Second, if the concern (as it appears) is that some US ISPs are doing this and that's a shame, then deal with that publicly, by more publicly shaming ISPs who are popular among criminals. Use public pressure to get them to (a) either help law enforcement or (b) to enforce reasonable terms of service. Trying to make them liable as a third party will make life difficult for them, but not the actual scammers.

Filed Under: copyrights, cybercrime, isps, liability, third party liability

Time To Stop Being So Fascinated With The Cyber- Part Of Cybercrime

from the it's-just-crime dept

In the past, we've noted that when technology is somehow involved in a crime, suddenly people (and especially the press) seem to forget about the actual crime that's happening and focus just on the technology. It appears others are noticing this as well. Slashdot points us to a nice rant by Neil Schwartzman pointing out that it's silly to single out "cybercrimes" as being "cyber" at all: they're just crimes. The fact that you're using a computer or the internet as part of it doesn't change facts when a crime is being committed, and at times people seem to get so focused on the cyber- part that they miss the seriousness of the crime itself:

When someone is mugged, harassed, kidnapped or raped on a sidewalk, we don't call it "sidewalk crime" and call for new laws to regulate sidewalks. It is crime, and those who commit crimes are subject to the full force of the law...

Some of these crimes involve technology. So what? Criminals have used technology before.

Some of these crimes cross borders. So what? Crimes have crossed borders before.

He similarly attacks the concept of "cyberwar" and the fact that various governments are hyping that up these days:

While we are at it, we should mention 'cyber-warfare', something often conflated with cyber-crime. Cyber-crime is not "cyber-warfare." There may be state or terrorist agencies copying the tactics and methods of these criminals, but that does not mean that the criminals must be left alone until new cyber-warfare agencies have been created and funded.

But, of course, by naming it "cyberwar," it creates something that seems "new," and with something "new," money can flow. The reason for these new "cyber-war agencies," is money. The suppliers want to sell to the government, so they hype it up. The folks who want more power get to set up an entirely new group -- and in an area that's considered "hot." The use of "cyber" is generally there to mislead people, and often for the sake of money.

Filed Under: crime, cybercrime

US Officials Finally Going After Online Organized Criminals In Other Countries

from the it's-a-start dept

It's no secret that Eastern Europe has become the center of an awful lot of organized crime online. Various phishing and scam rings tend to work from a variety of different Eastern European countries without much fear of law enforcement or prosecution. Most of the enforcement in the US to date has been on the few unfortunate Americans who got involved in such scams -- but such targets were almost always small-time scammers compared to the big players across the ocean. However, there are some signs that's starting to change. Forbes details the first case of a foreign cybercriminal being extradited to the US, noting that greater cooperation between foreign governments and the US means that we should be seeing more of this. However, the article also notes that this is only one small attempt, and officials haven't really been able to do any damage to some of the bigger organized crime groups online. Still, given how little the US gov't had been able to do to actually go after the real criminals, it is a good sign that at least they're looking for ways to reach across boundaries to find them.

Filed Under: cybercrime, eastern europe, extradition, organized crime, us

Apparently, Cybercrime Isn't Actually A Trillion-Dollar Business

from the maybe-it-needs-a-bailout-too dept

While online scams and cybercrime are growing, the claim made recently that cybercrime is a trillion-dollar business simply isn't true, says The Register. As Gary Stiennon points out, if it were, it would be bigger than global IT business itself, as well as the GDP of several industrialized nations. AT&T's chief security officer threw out the figure in front of a Senate committee; he also said that cybercrime was a bigger business than the global drug trade, another claim Stiennon disputes. He dug into where the myth was started, and how it's evolved, and traced it back to a single comment made by a consultant to the US Treasury Department in 2005. It's then been so commonly cited -- often by security companies looking to advance their own agendas -- and repeated that it's become widely accepted. Certainly cybercrime is a problem, and a growing one, but overstating its true impact won't make fighting it any easier.

Filed Under: cybercrime, hype

Forget The Economy, Security Vendor Says Cybercrime Is The Real Threat

from the that's-not-my-job-man dept

You might have noticed that the economy is in the tank. Something about this "credit crunch" and "recession" and whatnot. But the amount of attention governments around the world are paying to these issues is giving cybercrime a foothold, according to a new study from a -- yep, you guessed it -- security vendor. This is the same vendor that's been saying the government needs to create new laws to combat cybercrime for at least a year. While their consistency is notable, their implication that the government is in the best position to fight cybercrime seems misguided. The best solutions remain technical and market-based in nature, while the usual mess governments make out of this sort of thing are hardly a ringing endorsement of their abilities to solve technological problems. All this makes you wonder if maybe the vendors see some way for themselves to gain from cybercrime legislation. Surely that's not right...

Filed Under: cybercrime, threats

Online Criminals Move On To Corporate Espionage

from the plain-old-phishing-doesn't-pay dept

One of these days, someone will do a fascinating study or book on the evolving nature of online crime. It's a constantly changing phenomenon that would be quite interesting to study. A few years ago, we noted that the ease with which script kiddies could jump into the phishing and online extortion market meant that margins were getting squeezed for older online organized crime groups who had focused on such practices in the past. Apparently, the big money now has moved away from standard phishing and into corporate espionage. Organized crime groups are figuring out ways to hack into company networks, suck up as much data as possible, and then sell it off to the highest bidder -- whether it's competing firms or foreign governments.

Filed Under: corporate espionage, cybercrime, espionage, organized crime, phishing