Will mobile phones mean more crime?

Greyscale backing image
[Dave Birch] There was a discussion at this year’s Digital Money Forum with David Nordell from the Terror Finance blog. He called mobile payments a terrorist’s dream, but I disagreed. People always see the worst in new technologies, projecting existing crimes on to it. But the ability of new technology to fight crime is surely just as great. Mobile phones are no different from any other technology in that respect. One the one hand mobile phones can be used to commit new crimes, but on the other hand they can be used to prevent, detect and solve crimes.

Recently, two death row inmates were arrested in Nakuru GK Prison after being tracked through the assistance of mobile services firm Safaricom. More than 10 mobile phones and a number of SIM cards that were used to transact more than Sh300,000 were confiscated. The inmates colluded with people outside the prison to provided them with phone numbers of wealthy people who they called and threatened with death if they did not follow orders. Police launched investigations into how the convicts had separately received Sh350,000 and Sh40,000 in their welfare accounts when the racket that was unearthed in February.

[From Daily Nation: – News |Police probing mobile money transfer racket]

Nice mobile payment application — call people up, get them to send money back via the mobile payment system — but only if you’re a really stupid criminal, since the phone company knows where you are and will tell the police. And the police will be able to track you, and they will know the details of anyone else you call. And it doesn’t matter if it’s a prepaid phone not registered to you, because knowing where you are and who you are calling is pretty useful information.

The tracking is especially useful and in the future we will come to accept that we know where stuff is, all the time. As an aside, this doesn’t mean the end of privacy, but I think it does mean new notions of privacy.

Within seconds, a Tampa map appeared with a blinking orange dot moving away from the park. “We’re thinking to ourselves, there are our cell phones going down the road,” Jennifer Jensen said. The dot left the park, headed down McKinley Drive, headed south of Fowler Avenue and stopped less than 4 miles away from where it started… Caroline switched to satellite mode, and they were suddenly looking at the outside of the Bentley Court Apartments, 11603 N 22nd St.

[From There’s an app for that, too — Tampa cops find stolen iPhones with GPS – St. Petersburg Times]

At one level, this is just a fun “there’s an app for that story”. But think about it more as a window into the “internet of things” future. When everything is connected to everything else across an infrastructure then the idea of stealing something will become outdated (although, to be fair, some idiots still rob banks with shotguns). What’s the point of getting into my car if you can’t drive it without my RFID keyfob, what’s the point of stealing my TV if it will only decode encrypted signals if it is in range of my router and what’s the point of running off with my mobile phone if it won’t allow you to make calls unless you can mimic my voice? And what’s the point of stealing any of them at all if I can log in to any computer anywhere in the world and see where they all are?

Dog’s life

Greyscale backing image
[Dave Birch] There was a news story in the UK recently about the very sad death of a young woman who was lured to a remote spot by a man who met her on Facebook. The man was pretending to be a teenage boy. Facebook became the focus of the story, with the usual calls for something to be done. So is the sky falling in because of social networking?

You could just as easily argue that criminals are easier to catch because of Facebook, or any other new technology. The police can use them too, can’t they? Doesn’t social networking make it easier for the police and others to work together? Couldn’t Twitter help detectives? Can’t detectives subscribe to RSS feeds on cases of interest? (Frankly, I doubt it, but you get my point.)

[From 15Mb: yet another blog from Dave Birch » Blog Archive » The “Ford Mondeo Killer”]

People might think they’re anonymous, but they’re not. A rational policy on law and order would surely try to get more criminals to carry out their crimes online, because it’s easier to catch them in the virtual world than in the real one.

When a YouTube video came to its attention on Friday in San Francisco, the FBI had a Philadelphia man in custody the next day

[From How the FBI busted one YouTube nutjob in under a day]

It’s the same logic as with money laundering. If you raise high barriers by making people prove who they are before going online then they will either go to great lengths to avoid the rules (thereby enriching middlemen) or just avoid going online, in which case they cannot be tracked or traced at all. I wrote an article for SPEED (“Moving money and securities worldwide”) magazine’s Spring issue, noting that if criminals were to abandon suitcases full of 500 euro notes for platinum pieces in Everquest (frankly unlikely, but there you go) then surely it would be easier for law enforcement officers to masquerade as half-orc barbarians in Norrath than as criminals in the real world and therefore follow the money.

Fit and counterfeit

Greyscale backing image
[Dave Birch] When the first Bank of England banknotes were issued in June 1694, they must have seemed pretty secure, with their fancy engraving and the handwritten signatures. It must have been a bit of a shock in August 1694 when the first counterfeits were detected. Or should I say that the first counterfeits bad enough to be detected were detected. One of the problems that plagued the Royal Mint at that time was that the machinery to make notes and coins was being stolen by corrupt employees and sold to the criminal underworld. The machines were not really producing counterfeits, because they were the same plates and dies as being used in the mint, they were producing unauthorised versions. Banknotes have evolved a bit since then, but given the regularity of the stories about North Korea “supernotes”, the counterfeiters have kept pace.

North Korea has been producing “super notes,” counterfeit 100-dollar bills practically indistinguishable from legal tender, even since 2007 when the U.S. released North Korea from financial sanctions. North Korea has also tried to bring some of the notes into South Korea.

[From Daily NK – Super Notes Still in Production]

There’s no need to get Korean ultraforgers on board so far as the new UK national identity card goes. In fact, our indigenous forgers have been doing an excellent job, selling first-class forgeries of the UK ID card even before the UK ID card existed. Why they are bothering is not entirely clear.

Darren McTeggart tried to use the £30 card to pick up a replacement credit card from a branch of Santander – formerly Abbey – in Manchester, where the scheme was rolled out on a voluntary basis last year. Mr McTeggart, one of the first people to get the card, said: “They said it was not on their list of approved ID.

[From Man can’t prove ID with ID card – Telegraph]

I’m sure this is just a hiccough. But how are indigenous ultraforgers creating their dastardly fake ID cards? Are they breaking into the government’s factories and stealing the chips? Have they got corrupt insiders working for them? Sadly, nothing that interesting. It’s apparently so easy to forge documents like this that the police are now asking the companies who sell printers to report suspicious customers, much as banks have to do when opening new accounts.

U.K. police are trying to get wider participation from printer manufacturers and makers of specialist equipment in a voluntary program designed to cut off criminals from the tools they need to make fraudulent passports and ID cards.

[From UK Police Engage Print Industry to Stop Fake IDs – PCWorld Business Center]

Oh come on. You can’t seriously tell me that criminals can just walk into PC World and buy printers that can produce a fake ID card? I don’t believe that for a moment. Oh, wait…

The Met has shut at least 20 [fake ID] “factories” in the last 18 months and believes more than 30,000 fake identities are in circulation. Police examined 12,000 of them and established they were behind a racket worth £14 million. One £750 printer was withdrawn from sale at PC World after detectives revealed it could produce replicas of the proposed new ID card and EU driving licences.

[From Police war on fake ID factories as fraudsters net millions | News]

Whoops. I’m sure this isn’t what former Home Secretary David Blunkett had in mind when he was outlined his plans for the national ID card way back whenever.

Imperfect crime

Greyscale backing image
[Dave Birch] Some years ago at the Digital Money Forum, Richard Bartle from the University of Essex characterised the economy of virtual worlds as “people buying things that don’t exist from people who don’t own them” which was, frankly, a brilliant summary. There are also, sadly, a class of people stealing things that don’t exist from people who don’t own them and this is a crime, so it was with great interest I read that

A British man has been arrested and cautioned for stealing accounts for online game Runescape… A statement from the Police National e-crime unit said: “A 23-year-old man was arrested in Avon and Somerset… on suspicion of a number of computer misuse offences.”… Once hi-tech thieves have these credentials they plunder the accounts, strip characters of their items and sell off the rare virtual goods for Runescape gold.

[From BBC News – Runescape creator pursues ‘phishing thieves’]

This is real identity theft. If criminals somehow get into my bank account and spirit the money away, I don’t really care because it’s the bank’s problem and they will give me the money back. But if the criminals take over my Runescape character, that’s a real personal violation. As I said before

a bank can easily restore my money, but it’s much harder for Facebook to restore my reputation (apart from anything else, a reputation takes time to build). Which is the worse crime?

[From Digital Identity Forum: What identity is important?]

It’s the latter, clearly. So perhaps the “standard” use case for strong authentication should be switched from logging on for home banking to logging on to Facebook, which takes us into the world of OAuth and OpenID instead of EMV and OTP. In this world, there’s already plenty of work going on around authentication, credentials and federation that could provide key portions of the infrastructure that we know that we are going to need in the mass market.

Over seas fraud

Greyscale backing image
[Dave Birch] Strange. I had an odd phone call from my (UK high street bank) card issuer. My wife had tried to buy a kitchen appliance online and the transaction had been declined. I got an automated call from the issuer: essentially it read me details of some transactions and then said something along the lines of “press 1 if these are really you, press 2 if you suspect fraud”. I pressed “1” but called the bank anyway because I was curious.

I could understand why an online transaction for a grand to a merchant that we’d never purchased from before would set off an alarm bell. The very polite lady at the call centre apologise for the inconvenience. I told her that I didn’t mind in the least and was happy that they were looking out for me. I suggested that they update their neural network fraud detection software, since if my wife’s card were stolen by an Eastern European criminal gang, the system would note an immediate drop in spending (boom! boom! — the old ones are the best aren’t they) but not a titter. Their call centre staff are clearly not well-versed in the more traditional aspects of English humour.

But there were two rather odd things about this call. First of all, the bank told me that in future if I expect to make a purchase in excess of £500, I should call them in advance to help them to manage the account. What a hassle. Maybe I could help them further by going to a bank branch and drawing out the cash then driving to the shops and buying everything in person, but whatever.

So I call the bank to alert them that I’m off to Moscow and the bank says: “calling us makes no odds I’m afraid. The fraud alert may still occur. It’s built into the system.”

[From The Financial Services Club’s Blog: From Russia with Love]

Secondly, two of the transactions that I was asked to verify were card-present, chip and PIN transactions at UK chain retailers (Tesco and Waitrose). Why on earth would the neural network supercomputer suspect that chip and PIN transactions — with the correct card in the terminal and the correct PIN entered — might be fraudulent?

Digital division

Greyscale backing image
[Dave Birch] There was yet another debate about the “digital divide” in London, featuring the British government’s technology tzarina, Martha Lane Fox (note for foreign readers: Martha Lane Fox was a co-founder of the famous internet enterprise Lastminute.com), who is charged with forcing a recalcitrant populace — one-sixth of Britons say they don’t want the web — to log on to things. There are 10 million people in Britain who have never been on the Internet and the Digital Inclusion Task Force has to get 4 million of them “online” by 2012, otherwise… Actually, I don’t know what the “otherwise” clause is, so had better move on.

At the debate, they were (essentially) talking about the divide between people who order books online from Amazon and people who don’t, and I’m sure this is an important topic, but I’m not that interested in it. I once got into trouble in a meeting with a public sector customer because I said that people who weren’t on the web generally didn’t want to be, and since they could clearly afford Sky television and mobile phones, I didn’t think that it really mattered that they chose not to buy broadband. But I digress.

Is there an interesting, and more important, digital divide? Yes, there is. And it’s the digital divide between the developed world and the developing world. But it’s not what you think and, as Tomi Ahonen frequently points out, it’s got nothing to do with “one laptop per child” or submarine cables for internet access.

In the Industrialized World we have TVs, PCs, FM radios, fixed landlines and mobile phones to consider and compare and use and more than half of the population has one of each of those. In the Developing World, the only technology that reaches half the population is mobile telecoms, and all others are tiny in comparison. For the Emerging World, mobile is not only the first screen it is literally the only screen.

[From Communities Dominate Brands: The Digital Divide in Numbers: TVs, PCs, Internet users, Mobile around the world]

If we are going to deliver services to the mass of people in the developing world, services that are going to improve the lives of the mass of the population, then we need to focus those services on the mobile channel.

# The mobile device will be the primary connection tool to the internet for most people in the world in 2020.
# The transparency of people and organizations will increase, but that will not necessarily yield more personal integrity, social tolerance, or forgiveness.
# Voice recognition and touch user-interfaces with the internet will be more prevalent and accepted by 2020.

[From Pontydysgu – Bridge to Learning » Blog Archive » Digital Identities and Social Relations]

This seems like a reasonable projection given current trends and a bit of imagination and, personally, I think that the issue of transparency may well have the most impact, changing both businesses and government in ways that we haven’t taken on board yet but that’s an issue for another day. But take these points on board, particularly the reinforcing synergies between the mobile phone as the device, the mobile phone as the tool for opening up organisations and the mobile phone as locus for the voice interface (which, together with voice authentication, will transform identity and authentication).

Be alert

Greyscale backing image
[Dave Birch] Simple text message alerts are an easy way to integrate the mobile phone into the payments environment. A long way away from NFC handsets and such like, but simple and practical and of high utility. If you are walking down the street and you suddenly get a text message telling you that your card has been used to buy a TV in Khazakstan, then you will know much more accurately than any neural network as to whether this is a valid use of your card or not.

Incidentally, in the modern business environment, these services also provide an excellent feedback mechanism. If you know what alerts customers are setting, then you can use that information to tailor better products for them. It’s a simple example, I think, of how a new channel can help customers to design new services on behalf of the business just by providing more interaction (and therefore more information). So if you discover that customers are setting alerts for overseas transactions but not for domestic transactions, then why not sell them a “domestic only” card or whatever.

But back to text. It’s got a lot going for it. It’s ubiquitous, it’s inexpensive, it’s flexible.

Because that’s where the money is

Greyscale backing image
[Dave Birch] The electronification, virtualising and dematerialising of money means the electronification, virtualising and dematerialising of crime, because (naturally) criminals go where the money is.

FBI officials say a mix of banking Trojans and phishing attacks has plagued victims – mainly public institutions and small and midsize businesses – to the tune of $100 million in attempted losses as of October.

[From FBI: Online Banking Attacks Reach $100 Million Mark]

Note, by way of comparison, that about $60m was stolen in physical bank robberies throughout the USA in the whole of 2008. How stupid do you have to be to walk into a bank with a gun when you could just stay at home and send out some e-mails? We must find a way to accelerate the transition to e-payments and at the same time make e-money more crime-resistant than cash.

The Swedish experiment

Greyscale backing image
[Dave Birch]Within the narrow confines of this blog, Sweden is one of the favourite geographies, partly because it is struggling with cash and partly because it is more transparent than some other banking systems.

The Swedish central bank published some detailed figures on the cost of payments and they provide useful input to the debate on the future of payments. They show that on average the variable cost of an ATM cash withdrawal to the issuing bank is around 1.3 SKr

[From Digital Money Forum: Cost dynamics, again]

Well, that doesn’t sound like very much. But in Sweden, it multiplies up to a big fraction of the economy because the Swedes are heavy ATM users.

Stefan Ingves (the Governor of said Central Bank) said that Sweden has “many more” cash transport robberies than its neighbours because, essentially, cash withdrawals from all ATMs are free (despite the large costs entailed in cash handling). This means, in turn, that Swedes use cash far more than Finns, Danes, Norwegians and (especially) Icelanders.

[From Digital Money Forum: The Cash Menace up North]

Mr. Ingves also notes (in the speech referred to above) that Sweden has far more cash-in-transit robberies than its neighbours and suggests an alignment of the private and social costs: the cost of armed robberies, he said, should be accounted in the cost of cash. This means that far from being free at ATMs, cash in Sweden should be expensive. He is, of course, completely correct.

What identity is important?

Greyscale backing image
[Dave Birch] A couple of days ago I was in a discussion concerning the discrepancy between what enlightened experts (eg, me) think about identity management and what governments, civil servants and IT vendors think about identity management. One of the points I made, which I think I can defend, is that the “common sense” notion of identity, rooted in our pre-industrial social structures and pre-human cortex, is not only not very good at dealing with the properties and implications of identity in an online world but positively misleading when applied to system and service design. The fact is that virtual identity and “physical” identity are not the same thing, and they differ in ways that we are only beginning to take on board. Here’s an interesting reflection on the difference between physical and virtual identity.

I used to work on campus 5 days a week, but working at home more has coincided with the advent of blogs and twitter. My professional and personal profile on campus is now much higher than it was when I attended every day, but largely sat in my office, and occasionally ventured out for coffee.

[From Establishing Our Online Identity « Ramblings of a Remote Worker]

Interesting. An online identity in a context that makes it worth more than an offline identity, because it is more connected. The Facebook economy, so to speak. Which leads me on to…

Subscribe to our newsletter

You have successfully subscribed to the newsletter

There was an error while trying to send your request. Please try again.

By accepting the Terms, you consent to Consult Hyperion communicating with you regarding our events, reports and services through our regular newsletter. You can unsubscribe anytime through our newsletters or by emailing us.