# data[].attributes.attachment_link.title
¿Qué es el ciberterrorismo y debe preocuparte? | Telcel Empresas

# data[].attributes.attachment_link.description
Cuando te preguntas qué es el ciberterrorismo, las dudas pueden inundarte, pero aquí te damos una idea de que es y cómo protegerte.

# data[].attributes.headline
Computer Attack and Cyber Terrorism:Vulnerabilities and Policy Issues for Congress

# data[].attributes.subject
Computer Attack and Cyber Terrorism:Vulnerabilities and Policy Issues for Congress

# data[].attributes.attachment_link.readable_text
Mark M. Pollitt

FBI Laboratory

935 Pennsylvania Ave. NW

Washington, D. C. 20535

Abstract:
This paper discusses the definition of cyberterrorism, its potential, and suggests an approach to the minimization of its' dangers. The definition of cyberterrorism used in this paper is combines the United States Department of State's definition of terrorism as politically motivated acts of violence against non-combatants with a definition of cyberspace as the computers, networks, programs and data which make up the information infrastructure. The conclusion is that by limiting the physical capabilities of the information infrastructure, we can limit it potential for physical destruction.
Keywords:
Terrorism, cyberspace, cyberterrorism, information infrastructure, computer security.
Disclaimer:
This paper was submitted by the author in connection with academic studies at George Washington University. It does not represent the policy, opinions, or conclusions of the United States Government or of the Federal Bureau of Investigation. The opinions expressed herein are wholly that of the author.

by Mark M. Pollitt

Introduction

"We are at risk. Increasingly, America depends on computers. They control power delivery, communications, aviation, and financial services. They are used to store vital information, from medical records to business plans to criminal records. Although we trust them, they are vulnerable - to the effects of poor design and insufficient quality control, to accident, and perhaps most alarmingly, to deliberate attack. The modern thief can steal more with a computer than with a gun. Tomorrow's terrorist may be able to do more damage with a keyboard than with a bomb."(1)

Thus began the opening chapter of one of the foundation books in the computer security field. This book, commissioned by the National Academy of sciences, was the product of twenty-one experts in their field and was a proposed blueprint for future computer security in the United States. In the six years since this was written, computers and information technology has exploded. But most people, including those in the computer field, believe the above statement to still be true.

The combination of two of the great fears of the late twentieth century are combined in the term "cyberterrorism". The fear of random, violent victimization segues well with the distrust and outright fear of computer technology. Both capitalize on the fear of the unknown. It is easy to distrust that which one is not able to control.

Terrorism, with it's roots in the periphery of mainstream society, is feared. It is perceived as being random, incomprehensible and uncontrollable. Groups with obscure names and origins impact catastrophically on the innocent. It is, in fact, designed to be feared. That is its real power.

Technology is feared from two perspectives. First, it is by definition arcane. It is complex, abstract and indirect in its impact on individuals. Because computers do things that used to be done by humans, there is a natural fear related to a loss of control. People believe, that technology has the ability to become the master, and humanity the servant.

The popular press has further fueled the fires by "hyping" the concept of convergence. According to the press, one is lead to believe that all of the functions controlled by individual computers will all converge into a singular system. Further support for this scenario is the increase in "connectivity". Many people conclude that the entire world will soon be controlled by a single computer system.

Ironically, these same people subjectively understand that since computers are products of, and operated by, human beings, they are not reliable in either a mechanical or logical sense. Certainly, there can be no doubt as to immense benefits from computer technology. With any technology, be it telephones or automobiles, there are risks. Most risks can be managed. It is the "unmanageable" risks that we fear. This paper will address what the risks and possibilities are of combining terrorism and computers.

Definitions

Before we can discuss the possibilities of "cyberterrorism, we must have some working definitions. The word "cyberterrorism" refers to two elements: cyberspace and terrorism.

Another word for cyberspace is the "virtual world". Barry Collin defines the virtual world as "symbolic - true, false, binary, metaphoric representations of information - that place in which computer programs function and data moves."(2)

Terrorism is a much used term, with many definitions. For the purposes of this presentation, we will use the United States Department of State definition:

"The term 'terrorism' means premeditated, politically motivated violence perpetrated against noncombatant targets by sub national groups or clandestine agents."(3)

If we combine these definitions, we construct a working definition such as the following:

"Cyberterrorism is the premeditated, politically motivated attack against information, computer systems, computer programs, and data which result in violence against noncombatant targets by sub national groups or clandestine agents."

This definition is necessarily narrow. For the term "cyberterrorism" to have any meaning, we must be able to differentiate it from other kinds of computer abuse such as computer crime, economic espionage, or information warfare. I would suggest that the latter is a offensive and defensive function of governments.

What is it that computers do?

In their essential elements computers do three things: they store information, they process information and they communicate. All of the myriad things that we associate with computers are really combinations of these three actions. An even simpler analogy is that a computer is like a box. You can put something into the box. You can take something out of the box (but not something that wasn't already there) and you can manipulate the things in the box. What is surprising to most people is that the computer does not "control". Computers, in and of themselves, do not act. They act either through humans or through devices attached to the computer.

This point is important. In order to discuss the role of computers with respect to terrorism, we must understand their limits. Short of electrocuting one's self with the power supply or being so unfortunate as to walk under a falling machine, computers cannot, directly, kill or injure. That is not to say that there are not indirect risks of physical harm, nor direct risks of economic injury. Computers may communicate to other devices that do have physical actions which can cause death or injury. The direct risks of economic injury are perhaps the most significant of all the risks. While computers may be referred to as "weapons", they act indirectly.

Risks to computer systems

There are several typologies concerning the risks to computer systems. These can be categorized as outcome based or method focused. The latter focuses on the methodologies used to attack systems. The method focused is very useful for evaluating specific targets. It cannot successfully anticipate all technologies and is therefore not very useful for strategic planning. We will apply the outcome based methodology.

Several writers have suggested typologies for outcome-based risk assessment(4)(5)(6). While they differ in structure, they identify three key risk factors. These can be summarized as: access, integrity, and confidentiality. We shall take a moment to discuss the significance of each of these issues(7).

Access is the ability of authorized parties to obtain information or cause actions to be taken as specified. That ability to operate the computer or obtain information can be limited or eliminated in several fashions. The information (data), programs (instructions) or the physical device can be destroyed. The computer system can also be interfered with to the extent that the system becomes so unreliable that it is useless. This interference can occur within the computer system's storage and/or processing or with respect to its' communications pathways.

Clifford Stoll, author of the "Cuckoo's Egg", once told this author that the worst thing that could happen to him, as a astro-physicist, was for someone to alter the fifth decimal place of the constant Pi. He reasoned that all of his calculations would be flawed and all of his work would then be useless. This reasoning highlights the reliance that we place on computerized data. If it is not correct, it may be worse than its' destruction.

The mantra of the late 20th century is that information is power. This has become a reality. The possession of accurate, timely information is the key to competitive advantage. This is true regardless if you are a superpower government or a small business person. Computers have created new risks (and rewards) concerning the discovery of information which it originator wished to remain confidential. There is an inevitable trade-off between availability and privacy.

I have outlined the risks in the context of information. But, these same risks apply to computers designed for the control of processes. In effect, anything that can happen to information, can happen to processes controlled by computers.

Are these risks being currently being exploited? The answer is an unequivocal yes. Do these exploitation's directly impact the public? Indirectly yes. However, the impact is rarely serious or fatal. Why? The human being has not been taken out of the loop.

Terrorist applications for computer security risks

Could these vulnerabilities be utilized by terrorist elements? Certainly. These risks are independent of motive or perpetrator. These risks are structural to the use of computers. Let's examine some commonly presented scenarios.

Collin(8) suggests a number of scenarios. I will discuss several of them. One that he proposes is for a "hacker" to take over the process control computers on a cereal manufacturing line. The subject then alters the amount of iron supplement added to a fatal dose. Boxed cereal then sickens and kills a nation of children.

There are a number of fallacies concerning this script. The quantity of an additive providing nutritional benefit is minimal. The quantity necessary to change s nutritious additive to become toxic is greater by a substantial amount, if it is even possible! Presumably, when the usual quantities of additive run out on the production line, someone will notice the increased consumption. Most food manufacturers conduct routine product testing for just such eventualities. It is a business necessity in this litigious world. It is also likely that the taste of the altered product will be changed, and not for the better. I submit that this may be possible, but the likelihood of success is minimal.

Another commonly offered scenario involves the air traffic system. The world's air traffic control system is highly computerized. The "terrorist" either obtains control of the system or alters the system in such a fashion that airplanes are flown into each other, resulting in mass death.

This scenario requires that the entire human element and the structure of the rules involving the control of aircraft are ignored(9). The computers used in the air traffic control system do not control anything. They merely provide an aid to the human controller. Even if he/she were deceived by the computer, there is other human beings in the loop. A basic tenant in pilot training is "situational awareness". From the first day of training, pilots are taught to be aware of not only their location, direction and altitude, but those of all other aircraft. Pilots routinely catch errors committed by air traffic controllers. It is the spectacular human failures that result in aircraft collisions. Further, the "rules of the road" for aircraft operations anticipate the complete failure of the air traffic control system. In fact, the rules are designed to work where there is no air traffic control at all! Thousands of flights are conducted each day in bad weather, around the world without the benefit of an ATC system at all!

A similar scenario is proposed concerning the operation of a subway or train system. Brief reflection will show that failures of the electronic and mechanical controls are anticipated. That is why few of these systems are not "manned". It should also be noted that mechanical failures are much more common and catastrophic in nature and affect.

Conclusion

The current state of cyberspace is such that information is seriously at risk. The impact of this risk to the physical health of mankind is, at present, indirect. Computers do not, at present, control sufficient physical processes, without human intervention, to pose a significant risk of terrorism in the classic sense. Therein rest two lessons.

The definition of terrorism needs to address the fundamental infrastructure upon which civilization is increasingly dependent. A proactive approach to protecting information infrastructure is necessary to prevent its becoming a more serious vulnerability.

As we build more and more technology into our civilization, we must ensure that there is sufficient human oversight and intervention to safeguard those whom the technology serves.

(1) National Research Council, "Computers at Risk" National Academy Press, 1991.

(2) Collin, Barry C., "The Future of CyberTerrorism", Proceedings of 11th Annual International Symposium on Criminal Justice Issues, The University of Illinois at Chicago, 1996 http://www.acsp.uic.edu/OICJ/CONFS/terror02.htm

(3) United States Dept. of State, "Patterns of Global Terrorism", Washington, DC, 1996

(4) Parker, Donn. "Crime by Computer", Charles Scribner's Sons, New York 1976

(5) Icove, David, et al. "Computer Crime - a crimefighter's handbook", O'Reilly & Assoc., Sebastopole, California, 1995.

(6) Barrett, Neil, "Digital Crime",Kogan Page Limited, London, 1997

(7) Power, Richard, "Current and Future Danger", Computer Security Institute, San Francisco, 1995

(8) Collin, Barry C., "The Future of CyberTerrorism", Proceedings of 11th Annual International Symposium on Criminal Justice Issues, The University of Illinois at Chicago, 1996 http://www.acsp.uic.edu/OICJ/CONFS/terror02.htm

(9) Federal Aviation Administration, "Instrument Flying Handbook", Government Printing Office, 1980

# data[].attributes.attachment_link.description
Mark M. Pollitt FBI Laboratory 935 Pennsylvania Ave. NW Washington, D. C. 20535 Abstract: This paper discusses the definition of cyberterrorism, its potential, and suggests an approach to the minimization of its' dangers.

# data[].attributes.body
Artículo sobre la relación entre desarrollo tecnológico y riesgos de delitos en línea de Australia

# data[].attributes.attachment_link.readable_text
Foreword | As our use of information and communication technologies increases and evolves, incidents of technology-enabled crime are likely to continue. Based on what we know today, this paper summarises a range of potential challenges that regulators and law enforcement agencies need to bear in mind. Key areas identified include infrastructure risks, the use of wireless and mobile technologies, more sophisticated malware, new identification and payment systems, computer-facilitated fraud, exploitation of younger persons, intellectual property infringement, and industrial espionage. Successful prosecution and appropriate sentencing for these crimes will require coordinated policing and on-going legislative reform.
Toni Makkai
Director
As ICT continues to advance, there will be increasing opportunities for criminals to act unlawfully. Serious and justifiable concerns exist about the ways in which new technologies are likely to be misused in the years to come. Technology-enabled crime already ranges across a wide spectrum of activities. These include crimes that involve breaches of personal or corporate privacy, crimes committed by individuals that deliberately alter data within corporations or government agencies for profit, personal or political objectives, and crimes that involve attempts to disrupt the operation of the internet. These, and other areas, are likely to pose considerable challenges for regulators and law enforcement over the coming period, particularly the next two years. In which areas, then, are risks of technology-enabled crime most likely to occur?

Infrastructure risks

Developments in ICT now greatly facilitate commerce between developed countries and newly emerging economies such as India and China. Although these economies are developing quickly, their information security, and legal and ICT policy environments are often less well developed. In this environment technology-enabled crime attacks on Australian organisations could emanate from, or make use of, security weaknesses in those countries. Threats to ICT infrastructure could also arise from natural disasters and other accidental causes. A recent example was the earthquake in Taiwan on 26 December 2006 that disrupted telephone and internet services throughout Asia. The expansion of broadband services also creates risks arising from the fact that connections are open continually - making it easier for malware attacks such as botnets to occur against insecure computers, often used from home.

Threats to critical infrastructure

Tight couplings between different areas of critical infrastructure (CI) - information technology and communications, banking and finance, water, energy and utilities, transportation, mass gatherings, food, and emergency services - may result in rapid escalation of seemingly modest disruptions from within one sector to others. If insecure sectors are compromised, they can then be used as launching pads to attack other CI sectors. Private companies responsible for the majority of CI are a major vector for cyberterrorism and crime, although growing concern exists over networked computers in other contexts such as households and educational institutions, which may be the targets of network-oriented malware.

A successful attack on ICT infrastructure that supports many areas of CI may disrupt supply chain systems, financial sector networks or power grids. Consequences of these attacks could reverberate after the immediate damage is done, as cross-sector interdependencies are of primary importance. Specific examples of cyberterrorism are rare at present in Australia and internationally, although any instance of technology-enabled crime that exposes vulnerabilities in CI security indicates a potential for a cyberterrorist attack.

A further area of risk concerns planning of terrorist attacks that involve the use of ICT. Terrorists, for example, could simply use open-source geospatial information to plan attacks on military forces stationed overseas. For example, it was recently reported that terrorists might have used information obtained from Google Earth™ to facilitate their planning of physical attacks against British troops in Iraq. (Harding 2007). Terrorists could also use social networking sites, such as those used by extremist and supremacist groups, as vehicles to reach an international audience, solicit funding, recruit new members, and distribute propaganda.

Outsourcing risks

The growing acceptance of the internet as a communication tool and the trend for corporations to locate their operations in developing countries to benefit from lower labour costs have resulted in an increasing number of outsourced operations being conducted offshore. Offshore outsourcing, particularly to lower-cost countries, is likely to increase in the next two years. In fact, it has been predicted that more than 3.4 million US jobs are likely to be located offshore by the end of 2015 (McDougall 2004).

Outsourcing involves the transfer of a significant amount of management control to offshore vendors and this usually results in diminished control over security arrangements. There is also a possibility for vulnerabilities to be clandestinely introduced into software developed offshore and for loss or misappropriation of intellectual property to occur, particularly in countries with inadequate legal systems for protecting such rights.

Data storage and dissemination

Future technological innovations and the declining price of electronic data storage devices will continue to lower entry barriers for digitisation of information. The size and capability of data storage devices will continue to be enhanced by advances in technology.

With increased digitisation of information, the future will see the increased likelihood of digital content being a source of disputes or forming part of underlying evidence in judicial proceedings.

Better educated criminals are likely to explore alternatives to hiding data over the internet such as storing data on compromised machines, password-protected file-sharing websites, email accounts and less reputable content providers hosted in countries with lax cybercrime legislation. They are also likely to leverage the use of anti-forensic tools and information hiding tools including steganography to further impede the collection of evidence.

Developments in data storage and dissemination technologies such as proprietary storage media and cryptographic algorithms can also impede forensic investigators and prevent police from acquiring digital evidence and analysing digital content forensically. For example, the integrity of data can possibly be compromised during extraction or conversion from incompatible proprietary formats. An in-depth understanding of how different technologies and applications operate is crucial in collecting digital evidence.

It can reasonably be anticipated that technology-enabled crime prosecutions involving multiple jurisdictions will continue to occur as legislation dealing with such matters is subject to amendment over the next two years to deal with new technological developments and threats.

Wireless and mobile technologies

Mobility is an enduring characteristic of today's knowledge-based society. As businesses continue to engage in e-commerce and m-commerce, they will become increasingly global and interconnected. This will increase the risks of identity-related financial crime committed through the use of modern technologies. The following wireless and mobile technologies are examples of possible threats in the next two years.

Mobile devices: The increasing use of mobile devices, with ever-increasing storage capacities, constitutes a key threat for the future. Moreover, the ease with which erased data on such devices (which might contain passwords and account details) can be recovered increases their attractiveness to criminals. Advances in 3G and 4G wireless telephony and the widespread dissemination of Bluetooth-enabled mobile phones will increase the popularity of multimedia services such as multimedia messaging services (MMS). MMS could be exploited by criminals and malware writers in various ways, as demonstrated by Mulliner and Vigna (2006).

Instant messaging (IM): The proliferation of IM programs constitutes another threat for the future. Malware authors will continue to target IM programs with malicious code (e.g. W32.heartworm which installs files on victims' computers recording personal and financial information). Botnets, one of the internet's biggest threats, will also target IM and other peer-to-peer networks for command and control (C&C) of infected systems. This will allow C&C servers to be arranged in a distributed structure to limit traceability by law enforcement.

Wireless networks: Key among the vulnerabilities created by wireless networks is that networks and their data can be accessed without physical access being required. This facility assists both the user and the criminal. Enhanced methods of exploiting wireless vulnerabilities include drive-by subversion of wireless home routers through unauthorised access by mobile WiFi clients and other forms of attacks. These include eavesdropping and sniffing of voice over internet protocol (VoIP) calls, man-in-the-middle attacks, denial of service attacks, and making 'free' calls on VoIP networks built over wireless local area networks.

Evolution of malware

The trend to exploit social vulnerabilities and prey upon the public interest by using breaking news events to disseminate malware is likely to continue in the next two years. So too will the trend of designing malware for facilitating blended attacks (e.g. spy-phishing - phishing attacks that involve the use of malicious applications to perpetrate online information theft). The availability of a market in which to sell malware provides criminals with financial incentives to offend. In January 2007, Li Jun from Central China's Hubei Province was arrested for reportedly authoring the password stealer W32/Fujacks and selling W32/Fujacks to other internet hackers for more than 100,000 yuan (Dao 2007).

Malware authors will continue to explore ways to deny victims access to information regarding the source or nature of malware infection. The future will also see the continued development of malware employing self-modifying code and code obfuscations to elude detection by anti-virus and anti-malware products. Other stealth techniques to hide files, processes or registry values belonging to the malware, including the installation of an application program interface (API) that hooks into running processes or changes system APIs, will continue to be enhanced.

Bot malware (and zombies): The level of sophistication of bot malware has increased considerably in recent times and will continue to do so in the next two years. New classes of bot malware that aim to elude detection by anti-virus software will appear (e.g. Queenbots). Malware that exploits portable executable packers - originally designed to reduce the size of an executable file on disk through compression - will also emerge.

Kernel-mode malware: Kernel-mode malware, which is executable as part of a computer's operating system and has full access to the computer's resources, is hard to detect. Several working prototypes of kernel-mode malware and hypervisor (e.g. Blue Pill) have been identified as a risk. Although kernel-mode malware has yet to become popular, threats from such malware are likely to increase.

Ransomware: The application of cryptographic tools and techniques to enhance new malware attacks will also increase. This includes ransomware programs designed to search for data on compromised systems and encrypt these data (e.g. Win32.Gpcode.ag ransomware). This activity, also known as cryptovirology or denial of resources attacks, has yet to become widespread, although it is very likely that ransomware attacks will become more targeted, for example, against certain organisations and industries. They will also use more complex encryption functionality.

Internet browsers and web services: These will be of interest to criminals and malware authors. For example, users' computers can be infected by malware when they visit compromised websites (by exploiting vulnerabilities in web servers or operating systems) that host malicious programs.

Existing security measures such as network-based firewalls may not be able to defend against threats of unauthorised access to a web service. Di Paola and Fedon (2006) demonstrated how Asynchronous JavaScript and extensible markup language can be exploited to facilitate attacks against web services. Future probable exploitation of internet browsers and web services to disseminate malware includes designing malware to hide browser attack codes and circumvent existing anti-malware products, and mix known exploit codes so that they become unrecognisable to anti-virus programs.

Unauthorised access

Threats from outsiders: Semantic attacks committed through social engineering will continue to be employed by criminals to gain access to computers and networks. Social engineering is the use of psychological tricks to manipulate human behaviour often through deception on unsuspecting users to gain access information. Once access to the system has been gained, they are able to manipulate the information to suit the needs of their attack. For example, information from unauthorised intrusions into systems that process or store information related to customer transactions can facilitate illicit financial transactions.

Threats from insiders: Insider threats can be further divided into two categories: threats of insider attack on behalf of, or controlled by, an outsider (e.g. zombie computers controlled by bot malware), and self-motivated insider attacks.

As critical systems become increasingly dependent on software and are connected to the internet, insider threats belonging to the first category will be of ongoing concern. Corrupt insiders could deliberately introduce vulnerabilities during the coding of inhouse software used to manage sensitive military or intelligence networks. This could allow terrorists or foreign intelligence agents to exploit vulnerabilities and surreptitiously enter systems, gain control, and launch attacks via and against compromised systems.

There will also be more avenues for insiders to leak sensitive documents or information. An example is the website http://wikileaks.org/ designed for whistleblowers in authoritarian countries to post sensitive documents on the internet without being traced. The anonymity feature is provided with the use of an anonymising protocol that allows data to be routed through a network of servers. Cryptography is used to further obscure the data path and make it untraceable.

Identification system

Although the Australian national health and social services access card is not designed to be a generalised government identity card, the biometrically-enabled card will have widespread use and applications, making it a likely target for criminals. Areas of risk will relate to the dishonest initial enrolment of users as well as data security, with respect to the card's computer chip and supporting databases. Threats might also arise from criminal groups which seek to compromise the system's computer infrastructure, or others who seek to obtain personal information for use in identity-related crimes.

Radio frequency identification (RFID) enabled biometric passports are designed to provide strong authentication that unequivocally identifies their bearers. New hardware devices and software programs that seek to compromise the quality of data protection mechanisms and supporting architecture, will include passport cloning, brute-force attacks on keys used for access control, and devising new ways of tracking and scanning covertly (to circumvent the use of Faraday cages). A recent study by Rieback et al. (2006) on the design principles for RFID malware together with proof-of-concept examples underscores the feasibility of RFID devices being abused to be exploited in attacks against biometric passports.

New payment systems

Likely criminal threats in an environment in which internet international funds transfer instructions (IFTIs) and e-currencies continue to grow, arise from the fact that many electronic currency transactions are not captured by regulators, and that internet IFTIs may assist in the money laundering process.

The following electronic payment technologies are examples of possible threats in the next two years (AIC 2007).

Prepaid cards: The anonymity offered by pre-paid cards continues to act as a vehicle for facilitating illicit financial transactions and money laundering, particularly as value limits increase. A recent report (NDIC 2006) emphasises similar concerns.

Smart cards: The future will see the development of new hardware devices and software programs that seek to compromise the quality of data-protection mechanisms used in smartcards. In a recent study of 20 different RFID-enabled credit cards issued in the United States by Visa, Master Card and American Express, Heydt-Benjamin et al. (forthcoming) presented proof-of-concept prototypes and attacks. The study suggested that RFID-enabled credit cards are susceptible in various degrees to a range of other traditional RFID attacks such as skimming.

Online gaming and gambling

In the virtual multiplayer online games (MMOG) worlds (e.g. Second Life), players are able to purchase virtual properties, accommodation and merchandise, and inflate their virtual status using physical cash. For example, it was reported on LindeX, the official Second Life currency exchange, that an exchange rate was estimated to be L$250 (Linden Dollars in Second Life) to US$1 as at January 2007.

The availability of a market in virtual goods trading provides criminals with financial incentives to offend. Organised criminal rings and hackers target MMOG sites to steal gamers' usernames, passwords, credit-card numbers, and virtual game pieces and accessories. Stolen virtual characters are then 'sold' to the original owners or to other players.

Risks of money laundering will also increase as MMOG sites emerge as a potential vehicle for online money laundering. For example, money launderers could purchase virtual currency using illicit cash and exchange the virtual currency back into cash.

Existing avenues of money laundering such as online gambling, a multibillion dollar industry, will continue to be used. To avoid detection, small numbers of transactions will be carried out and then requests made for repayment from offshore casinos. Although offshore casinos may not be required to maintain transaction records, payments can be deposited into money mules' accounts to obfuscate the money trail.

Computer-facilitated frauds

Globalisation and the new economy, enabled by the latest internet based technologies and e-commerce, have created new and greater opportunities for criminals to commit fraud against both businesses and consumers. Computer-facilitated frauds include advanced fee scams (e.g. Nigerian scams) and online auction frauds. Major drivers with an impact on computer-facilitated frauds include the rapid expansion of new and emerging technologies and the apparent ease of committing consumer fraud.

Click frauds: Several search engines such as Google™ and Yahoo™ and online sites are supported either in part or in full by pay-per-click advertising revenue models. In such models, advertisers are charged based on the click-through rate of an advertisement. However, such a revenue mechanism could be abused by malicious hosting sites. Click frauds have been identified as an emerging threat to e-commerce (Delaney 2005).

Despite efforts to improve click fraud identification techniques and raise the entry barrier for fraudsters, financially motivated criminals and malware authors will continue to design malware that seeks to circumvent existing measures (e.g. viruses such as the w32.KMeth worm that can direct infected users to fraudulently increase traffic to specific online advertisements).

Online auction frauds: Online auction sites provide buyers and sellers with a global virtual market and storefront to buy and sell a wide range of merchandise through competitive bidding. Crimes associated with online auctions, particularly online auction frauds, are likely to increase. Criminals and malware authors will continue to design malware to circumvent existing anti-fraud measures for illicit financial gains.

Phishing and spam: Phishing attacks will become more sophisticated and the number of such attacks will increase. Dissemination of spam will be facilitated not only through the use of botnets, but also VoIP -Vishing - and mobile phones (via SMS) - SMiShing - which will be used to overcome existing spam prevention and detection filtering software. The future will see an increase in persistent attacks using redirection or the use of malware techniques that trap even astute internet users. The development of technical attacks poses a growing challenge as these are often more persistent and difficult to detect.

Another important threat to emerge will be the use of spoofed embedded links that look like links to the institution being impersonated but which lead to malicious sites. Some sites may contain code that allows the phishers to retrieve contextual information such as details of sites visited from the browser's cache. The contextual information obtained can then be used to facilitate 'context aware phishing'.

It is also likely that automated tools (e.g. Universal Man-in-the-Middle Phishing Kit) will be further enhanced to include more sophisticated capabilities targeting two-factor authentication mechanisms such as subversion of token-based logons, and acquisition of and reuse of one-time token data in real time.

Although phishing attacks can be either syntactic - exploiting technical vulnerabilities - or semantic - exploiting social vulnerabilities - the future will see a continuing movement from syntactic attacks to semantic attacks.

Exploitation of younger persons

As young people increasingly make use of personal computers and mobile devices, risks will arise where inadequate security measures are in place. Online scams are likely to target young users, who may be less vigilant in detecting scams than adult users. In recent years, a new form of bullying, including harassment targeting young users, has emerged which makes use of communication technologies.

Child exploitation and offensive content

Although the level of knowledge of and measures to combat the dissemination of child pornography and involvement of children in sexual offending have increased, individuals and groups of criminals will continue to use ICT to carry out such crimes.

The use of cryptographic technologies will continue to be used by offenders to enable images to be shared securely. In addition, it can be expected that involvement in child exploitation will include the highly disturbing practice of live child sexual abuse videos being streamed to internet chatrooms, with the actual perpetrator responding in real time to commands from other participants who are able to see the images.

Intellectual property infringement and industrial espionage

The enhanced capacity of ICT systems will enable electronic products to be copied and reverse engineered (stripping down and analysing competitors' products) more quickly and easily than at present. The transfer of technology to countries with different notions of property rights, or weaker protection of rights as part of investment and outsourcing projects, will increase the risk of counterfeiting, piracy, illegal transfer of technology and facilitation of industrial espionage. For example, companies outsourcing business process operations to other countries could face difficulties in protecting their intellectual property rights and enforcing foreign court judgments. A recent report (IIPA 2007) suggested that China and Russia are rated as the countries of greatest concern to the copyright industries, contributing to losses in revenue of US$2.207 billion and US$2.18 billion respectively (see also Kennedy & Clark 2006; Gross 2007; Yang 2007).

As digitisation continues to infiltrate all aspects of corporate life, a growing number of opportunities will arise for the commission of industrial espionage.

Such attacks may use electronic surveillance and data capture technologies to steal commercial-in-confidence information, or may be directed at intellectual property held electronically. Enhanced reverse engineering techniques will also facilitate unauthorised access and exploitation of intellectual property. Criminals, competitors and foreign intelligence agents could also exploit commercial joint venture and offshore outsourcing relationships for commercial gain. Risks of industrial espionage may also arise where confidential contractual negotiations are carried out using email and wireless communications that have not been encrypted or are otherwise carried out over insecure networks.

Targets of attacks

The next wave of security threats will be targeted attacks aimed at specific organisations or individuals within enterprises. A particular household (or consumer) may be targeted as a vector to support intrusions of more valuable targets. As a result, prevention at both the consumer and business levels will remain of high importance. In addition to existing threats, new attacks will come from people, not just with programming experience, but with business, systems and legal experience. There will be a significant shift in offender focus with more attacks targeting specific businesses and specific systems within those businesses. Cybercriminals will probe for weak or unguarded computer networks within commercial organisations whose ability to detect and to respond to fraud or other thefts may be slow, imprecise or limited.

The next generation of threats will move from client to server vulnerabilities with offenders moving away from mass distributed attacks that assault any computer connected to the internet to attacks against single corporate networks, which are more profitable for cybercriminals. Traditional transnational organised crime groups are unlikely to shy away from using the technology-enabled crime environment to facilitate the operation and/or to disguise the illicit proceeds of real world based crimes. Organised operations which make use of conventional technology-enabled crime methodologies will also increase as the use of networked computers for criminal purposes develops. Organisations in the financial services industries are likely to be targeted more frequently than others, with financial gain the ultimate goal. Terrorist financing through the use of technology-enabled crime will also develop as an important risk area.

The prosecution and judicial disposition of cases involving technology-enabled crime will continue to raise key issues faced by police and prosecutors. These include the need for legislative reforms as a result of the emergence of new offences, criminal complicity, jurisdictional issues (whether jurisdiction exists and the problem of concurrent jurisdiction), complex and novel arguments relating to admissibility of evidence or the exercise of discretion, novel defences and defence arguments and appropriate sentences for convicted offenders.

There is no single all-encompassing answer to responding to technology-enabled crime. Countering these risks is a multi-dimensional challenge and requires effective coordination and collaborative efforts on the part of a wide range of government and private sector entities. Possible directions for action include:

engaging the ICT security industry in the design of secure software and hardware

establishing public-private sector partnerships and information sharing initiatives

establishing task forces dedicated to the investigation and prosecution of technology-enabled crime cases

enhancing the training and educational capabilities of police, prosecutors and IT professionals.

Conclusions

Technical assistance to less ICT-advanced jurisdictions will also be essential. This will help not only to minimise the development of technology-enabled crime within these locations, but also to enable assistance to be provided for the investigation of increasingly cross-jurisdictional technology-enabled crimes. Developing a culture of security for information systems and networks is of primary importance, and this can be achieved through coordinated efforts by both government and private sector organisations. If these efforts are successful, the development of new forms of technology-enabled crime in the future will be minimised.

References

All URLs correct at July 2007

Australian Institute of Criminology (AIC) 2007. New methods of transferring value electronically. High tech crime brief no. 14

Dao C 2007. 8 arrests in computer virus case. China daily 13 February

Di Paola S & Fedon G 2006. Subverting AJAX - next generation vulnerabilities in 2.0 web applications. Presented at 23rd Chaos Communications Congress, Berlin

Delaney KJ 2005. In 'click fraud', web outfits have a costly problem. Wall street journal 6 April: A1

Gross G 2007. U.S. to file trade complaint against China. PCworld.com 9 April

Harding T 2007. Terrorists use Google maps to hit UK troops. Telegraph.co.uk 13 January

Heydt-Benjamin TS et al. forthcoming. Vulnerabilities in first-generation RFID-enabled credit cards. Proceedings of Financial Cryptography and Data Security 2007 Lecture notes in computer science

International Intellectual Property Alliance (IIPA) 2007. Copyright industries in the U.S. economy: the 2006 report. Washington, DC

Kennedy G & Clark D 2006. Outsourcing to China: risks and benefits. Computer law & security report 22(3): 250-253

McDougall P 2004. There's no stopping the offshore-outsourcing train. Information week 24 May

Mulliner C & Vigna G 2006. Vulnerability analysis of MMS user agents. In Proceedings of IEEEACSAC 2006: 77-88

Rieback M et al. 2006. RFID malware: design principles and examples. Pervasive and mobile computing 2(4): 405-426

United States. National Drug Intelligence Center (NDIC) 2006. National drug threat assessment 2007: drug money laundering. Washington, DC: NDIC

Yang D 2007. The impact of business environments on software piracy. Technology in society 29(1): 121-141

About the authors

Dr Kim-Kwang Raymond Choo and Rob McCusker are research analysts at the Australian Institute of Criminology.
Dr Russell G Smith is Principal Criminologist at the Australian Institute of Criminology.

# data[].attributes.attachment_link.title
The future of technology-enabled crime in Australia

# data[].attributes.attachment_link.description
As our use of information and communication technologies increases and evolves, incidents of technology-enabled crime are likely to continue. Based on what we know today, this paper summarises a range of potential challenges that regulators and law enforcement agencies need to bear in mind.

# data[].attributes.body
Objetivos de desarrollo (CEPAL)

# data[].attributes.attachment_link.readable_text
El Portal de datos abiertos de la Unión Europea da acceso a los datos abiertos publicados por las instituciones y organismos de la UE. Los usuarios son libres de utilizar y reutilizar todos los datos que encuentren en este catálogo, ya sea con fines comerciales o no comerciales.

# data[].attributes.attachment_link.description
El Portal de datos abiertos de la Unión Europea da acceso a los datos abiertos publicados por las instituciones y organismos de la UE. Los usuarios son libres de utilizar y reutilizar todos los datos que encuentren en este catálogo, ya sea con fines comerciales o no comerciales.

# data[].attributes.body
https://data.europa.eu/euodp/es/home?
https://es.statista.com/
https://index.okfn.org/

# data[].attributes.body
https://data.europa.eu/euodp/es/home?
https://es.statista.com/
https://index.okfn.org/