Mikko Hypponen calls upon the foundation of the Internetpol
It’s a picture full of shadows and few lights the one outlined in the quarterly security report by F-Secure, a well-known Finnish company that produces antivirus software and integrated protection solutions. By analyzing the striking cyber-crime cases reported during the third quarter of 2008, the wrap-up highlights the difficulty to effectively fight an international phenomenon with the only aid from the local laws and the current cooperation treaties between the police authorities.
By exploiting the Internet pervasiveness and the easiness with which it’s possible to deceive unskilled computer users, cybercrime has no borders and often not even well-known executors. The efforts of the local police authorities are noteworthy, but rarely they succeed in dealing with the on-line frauds and the obsessive spam forwarding through botnets with hundreds of thousands of zombie-PC. To avoid the further degeneration of the situation, the F-Secure Chief Research Officer Mikko Hypponen calls upon the creation of a supranational force, with the full powers to investigate and hit malware writers and botnet masters in any corner of the world they are located.
“The Internet has no borders and online crime is almost always international – says Hypponen – yet local police authorities often have limited resources for investigations. Even if the locations of online criminals are discovered, the investigations rarely uncover the full scope of the crime. The victims, police, prosecutors and judges cannot see the full picture and therefore don’t know the true costs of the crime“.
The antivirus companies task is to protect the users’ computers, continues Hypponen, “but little can be done directly by non-governmental organizations to fight the criminals at the heart of the matter“. The threat from spammers and software engineers writing malware requires a jointly and adequately massive effort, suggests the F-Secure CFO, according to which it should be taken into consideration “the creation of an online version of Interpol, an ‘Internetpol‘, that is specifically tasked with targeting and investigating the top of the crimeware food chain“.
Actualizing such an organization isn’t a simple task, Hypponen admits, considering for example the fact that malware writing isn’t illegal or prosecutable in certain countries. “But if we do not act now to fight the source of crimeware – the expert concludes – it will continue to grow stronger and threatens to destroy the current model of Internet business, banking and commerce“.
As a proof of the risk for the current situation of on-line crime, the F-Secure report quotes clamorous cases like the one of Jeremy Jaynes, an American spammer first condemned thanks to the USA federal anti-spam law effective since 2003 and then saved by the Virginia Supreme Court, according to which the above said anti-spam law infringes the First Amendment of the USA Constitution on the freedom of expression. During a perquisition in the Jaynes’ house the police had found CDs with 176 millions of e-mail addresses and 1.3 billions of usernames, but such an overwhelming proof hasn’t been considered enough to persuade the Court to jail the criminal.
F-Secure talks about “AKILL” too, the eighteen years old New Zealander and “botnet master” Owen Thor Walker who wrote banking trojans that would have earned 15.4 millions of dollars to a criminal gang, but that has got away with a 10,000 dollars fine. The judge has stated that Walker has acted mostly because of curiosity and he has a “potentially outstanding future”, the boy is now wooed by several overseas companies and the fact that his malicious codes have infected 1.3 millions of computers, for a total estimated cost of 20 millions of dollars isn’t so important.
The Internetpol Hypponen talks about is needed also to fight that kind of cyber-crime designed to target events or situations with an exceptional resonance in the media and people’s life, like for example it happens with the late phishing attempts build around the financial crisis that is shaking up the entire world. Or with the spam campaign centered on the alleged sexual scandal of the USA presidency candidate Barack Obama, in which case the junk-mails contain a link to a pornographic video that has the only purpose of downloading and installing a banking trojan on the client.