Exploring Cyber Security, Crime, and the Evolution of Trust Online

Cyber Security, Crime and the Web Dr Craig Webber Associate Professor of Criminology c.webber@soton.ac.uk Before the Web Crime and (in)Security on the Web now Into the Future

Before the Web Trust: We often forget that trust is a key requirement in criminal enterprise. When engaging in a criminal transaction we are effectively confiding in someone else something we know is wrong, it is illegal. The costs of getting this trust-relationship wrong are high where crime and deviance are concerned Before the web, engaging in criminal transactions, be it buying and selling stolen goods or gaining someone s trust in order to get them to give up personal details, relied on face to face negotiations. Affability or threat, a reputation for closing the deal. Ironically, many criminal transactions relied on people telling the truth. Be it a threat backed up by force, a getaway driver who could really drive fast, stolen credit cards that were linked to a bulging bank account and still worked. Somewhere in the transaction, someone has looked into someone else s eyes and made a judgement about their trustworthiness

Crime and (in)Security on the Web now So how has the web changed this? A lot of our everyday understanding of crime on the web is based on the notion of the virtual. The virtual is often contrasted with the real But, this is a false dichotomy. Putting more and more resource into making the web more knowable through widespread and secret surveillance can have the opposite effect of making it simultaneously less knowable, whilst undermining the civil liberties of those not engaging in crime and deviance. Why? Because crime and deviance do not just reside on the web. It drifts on and off the web. A criminal event can begin outside a bank where a fake ATM has copied the identifying information from a card s magnetic strip and recorded the PIN being entered. This can then move online where special discussion forums facilitate the trade in such stolen credit card data. The web should not be the prime focus of security, but instead is one space amongst many that has been added to the repertoire of crime and deviance. The web can just as easily be taken out of the equation for many criminal enterprises. It augments many tasks, not replaces them Governments seeking more intrusive techniques of surveillance are doing a very good job of sending those engaging in criminal activity back to the pub car park and the security of cheap, and therefore disposable and untraceable, mobile phones and face to face transactions.

Into the Future The web does provide many advantages that did not exist before The speed and efficiency to move large amounts of data with relative ease, and seeming anonymity The web has become a social and business space that transcends political and legal borders So what does the future hold? We are increasingly seeing debates about the end of the memorised password. As we spend more time on the web engaging in security-critical activity, such as banking, so we are building up a mountain of passwords that our memories are not suited to remember without techniques and tricks, or writing them down. Biometric gatekeepers allow us to carry our passwords on our person, in full view, but seemingly secure. A fingerprint or an iris scan. Certainly there are problems with biometrics, and the IPhone fingerprint scanner was hacked soon after its release. Despite the problems it would seem this is one possible future for securing our use of the web. So it is also likely to be a prime area for criminal exploitation. One interesting question for criminology is the idea that we can create totally secure systems, cars that cannot be stolen, phones that cannot be accessed, websites that are not hackable. What will the criminal do in the future? CCTV and Displacement?

Some key terms explained Phishing: Literally fishing for information; a form of social engineering intended to encourage people to give up information that they would not normally do, or they are unaware of how the information could be used to defraud them. Carding: Buying and selling stolen credit cards, specifically the data that the card stores in its magnetic strip Drift: A concept discussed by the sociologist David Matza (1964) to explain how delinquents justify their deviant behaviour, and how such behaviour often echoes behaviour in the non-deviant world and is justified as OK in similar ways. He deserved it ; She brought it on herself . It also refers to the way we drift in and out of deviancy and that such deviant behaviour is not the only defining characteristic of someone s life. Someone is not always a criminal in the same way that someone is not always virtuous. We can also use the concept to explain how crime and deviance can drift between spaces, for example between on-line and off-line. moral panic: Stanley Cohen s (1972) classic sociological term to explain how the media and politician whip up a storm of anger about some perceived deviant act. Such moral panics hide more serious problems often caused and facilitated by the very same social group the whipped up the storm in the first place.