Three Minutes: The FTC Chief Takes on Cybercrime
8939
Over the past few years, computer crimes and annoyances have become an increasingly important part of the U.S. Federal Trade Commission's work. In the past year, the FTC has announced settlements with spammers, adware distributors, and even Sony BMG Music Entertainment, over its distribution of rootkit software.
397382
A former security researcher who served time for hacking has been charged with new cybercrimes.
295255
Also: Tightening the Net on cybercrime. Read these stories and more from around the Web on News.com Extra.
647139
Raising the fine line US consumer watchdog the Federal Trade Commission (FTC) is calling for a bigger stick with which to punish spyware purveyors.â¦
150675
Not bad take for three days work A former computer consultant has admitted to breaking in to more than 60 business kiosks at hotels and stealing credit card information during a three-day crime spree earlier this year.â¦
261857
R. James Nicholsonâs term was marked by the theft of a laptop computer that compromised the personal information of tens of millions of people.
23544
Cybercrime reporting confusion The HMRC child benefit data loss debacle has reinvigorated calls to establish a central police unit to tackle cybercrime. Business leaders are expressing concern that not enough is being done to help victims of computer crime, who are unsure of who to turn to in the event of being subjected to computer-related fraud or attack.â¦
630811
The US has a new head of cyber security, amid concerns about the Bush administration&#39;s commitment to protecting computer networks from attack.
30036
The U.S. Federal Trade Commission (FTC) has begun mailing claim forms to more than 1,400 identity theft victims who spent money to clear up identity-theft problems due to a security breach at data broker ChoicePoint announced in early 2005.
506507
The U.S. Federal Trade Commission (FTC) has asked a federal court to require an alleged Web page hijacking operation to obey previous orders barring unfair and deceptive practices.
636792
Scammers are sending out virus-laden e-mails claiming to have information on complaints filed with the U.S. Federal Trade Commission, the FTC warned Monday.The e-mail appears to come from frauddep@ftc.gov -- a spoofed address -- and it includes a malicious attachment that downloads keylogging software, which is used to steal sensitive information such as passwords and account numbers.&quot;While the e-mail includes the FTC seal, it has grammatical errors, misspellings, and incorrect syntax,&quot; the FTC said in an alert , released Monday. &quot;Recipients should forward the e-mail to spam@uce.gov and then delete it.&quot; E-mail sent to this uce.gov address goes into the FTC&#39;s spam database, which is used by investigators.Online scammers often masquerade as government agencies such as the Internal Revenue Service in the hopes of tricking unsuspecting victims into clicking on attachments or visiting malicious Web sites.
724562
Until just a few months ago, Gary Warner did not have the kind of day job you&#39;d expect from an antiphishing crusader. He didn&#39;t work for a security vendor or a bank, or any kind of company you&#39;d expect to care about phishing.Warner&#39;s career as a cyber-sleuth began on Halloween 2000. That&#39;s when his company&#39;s Web site was defaced by a hacker named Pimpshiz as part of a pro-Napster Internet graffiti campaign.&quot;My boss came to me and said, &#39;Find out who did this and put them in jail,&#39;&quot; said Warner, who was at the time an IT staffer with Energen, a Birmingham, Alabama oil and gas company.It was an eye-opening experience. &quot;I called the police and they were like, &#39;What do you want us to do?&#39;&quot; he said.Months later, when Pimpshiz struck servers at NASA, Warner reached out, calling staff there and saying &quot;Hey, we know who this guy is. Here&#39;s his name and address.&quot;Since then, Warner has quietly become one of the most-respected authorities on phishing in the U.S. -- the kind of guy that federal agents and banking IT staff call when they want to know how to catch the bad guys and shut down their credit-card-stealing Web sites.With Warner&#39;s help, authorities eventually arrested Pimpshiz, whose real name is Robert Lyttle,&#160;in connection with the hacks.Fishing for PhishersWarner said that the Pimpshiz case was formative, underlining how hard it is for law enforcement to catch the bad guys on the Internet.&quot;The experience showed me that it&#39;s not that they don&#39;t care,&quot; Warner said.&#160;&quot;Their hands are tied by the legal process.&quot;Soon, Warner found himself spending dozens of hours each week compiling data on spammers and phishing attacks. &quot;I would sit for a couple of hours every morning and find all the new phishing sites that I could,&quot; he said.He&#39;d take screenshots of the sites, e-mail the Webmasters who were hosting them and ask them for Web logs, and eventually he started making connections -- he&#39;d connect one phishing group with several different attacks -- and learn who he needed to call to get Web sites removed, no matter where in the world they were hosted.He&#39;d get calls from IT staff at small credit unions asking for help taking down fraudulent sites, every day, all day long. It was cutting in on his work. Late last year, he decided to make a change. &quot;I went to my boss and told him that I&#39;m going to look for a way to do this full time.&quot;Helping the Feds Crack Down on Online FraudIn July, with recommendations from FBI and Secret Service agents,&#160;Warner took a job as Director of Research in Computer Forensics with the University of Alabama at Birmingham (UAB).He also began working with law enforcement, not only educating FBI and Secret Service agents on how crimes were committed, but also helping to track down the criminals and helping with take-downs.&quot;He&#39;s an outstanding resource for the FBI,&quot; said Dale Miskell,&#160;supervisory special agent with the FBI&#39;s Birmingham Cyber Crime unit, who has worked with Warner since 2005.Miskell said Warner has helped the FBI with investigations and taught staff about his antiphishing techniques.&quot;He could be a multimillionare by his skillsets... he&#39;s a very gifted speaker, he can talk to the techies, and then he can turn around and talk to the non-techies and everyone will understand.&quot;Warner is now focusing on fighting cyber-crime full-time and on training a new generation of network forensics investigators. &quot;You wouldn&#39;t believe the looks on their eyes the first time they got an e-mail back from a Webmaster saying, &#39;Thanks for letting me know. I just shut that down.&#39;&quot;When he spoke with IDG News, it was five days after final exams at the University of Alabama at Birmingham and though it would have no effect on their marks, four students were still coming into the labs to help shut down phishers.&quot;That idea that as a private citizen, you can help, that&#39;s the kind of thing we&#39;re trying to inspire,&quot; he said.The Future of Phish-bustingAt the University, Warner is building up a 256-node supercomputer which could eventually become the largest collection of spam email on the planet, processing as many as 100 million email messages per day and providing researchers and law enforcement with valuable analysis data.For Warner, the work isn&#39;t so much a job, as it is his moral responsibility as a computer scientist. &quot;One of the things that really bothered me from the very beginning was people who were using my field to attack other people,&quot; he said. &quot;The way I see it, this is our Internet. I&#39;m going to stand at the end of my driveway and protect what&#39;s mine.&quot;He says that his anti-phishing work hardly feels like work at all. &quot;This is what I like to do,&quot; he said. &quot;It&#39;s cheaper than golf, and you can do it when the weather&#39;s bad.&quot;What You Can Do to Protect Yourself&quot;The best people that help law enforcement have no motive other than to catch the bad guy,&quot; said one law enforcement official who declined to be identified because he hadn&#39;t been authorized to speak with the press.But even if you&#39;re not a cyber sleuth, if you get hit by a computer criminal there are some things you can do to help police catch the criminal. What you should do depends a little bit on the crime. If you&#39;re the victim of identity theft, it&#39;s worth filing a report with state and local police so that you have a record of the crime.That comes in handy later, in case you need to prove that it was the thief, and not you, that incurred any subsequent charges. Another good place to stop is the Federal Trade Commission (FTC) site, which has a variety of tools to help identity theft victims get organized and set their credit back on track. And if things get really bad, the Social Security Administration can help you, too. This site has instructions on how to report social security fraud and get a new social security number.You can file a report with the FTC, but if you want your data to be used to catch the bad guys, the Internet Crime Complaint Center (IC3) is a better bet. Run in part by the FBI, the IC3 data is used regularly by law enforcement to link together large schemes. The more factual data you can report about your crime, the more useful it will be to police. Sometimes a single fax number or eBay ID can help crack open an entire case.The FBI is most interested in crimes that involve malicious software, phishing, and child pornography. Spam and auction fraud get a lower priority and, worse, if you&#39;re the victim of an auction fraud, the odds of you ever getting your money back are very low.Still, if you&#39;re rigorous about documenting the crime, and you fill out that IC3 complaint, you just may be helping to bring down your criminal -- some day.
259841
(InfoWorld) - The U.S. Federal Trade Commission will wade into an emerging debate on the nature of identity crime when it releases its latest ID theft statistics at the RSA Conference in San Francisco next week. The data, set to be released on Wednesday, will be based on information compiled by the FTC's Consumer Sentinel complaint database, said Claudia Bourne Farrell, an FTC spokeswoman. The Consumer Sentinel data is based on "anecdotal ... data that has been self-reported to the FTC by consumers," Farrell said. The FTC is preparing a more comprehensive ID fraud survey, similar to one it published in 2003, which is expected to be released in the coming months. Still, the FTC's Consumer Sentinel report is based on a large amount of data. In 2005, for example, consumers logged more than 650,000 complaints, accounting for about $680 million in losses. The FTC's numbers will come at a time when there is some debate about whether ID theft is actually on the rise. Using a methodology developed for the 2003 FTC survey, Javelin Strategy & Research reported Thursday that this type of fraud actually dropped in 2006. The total cost of identity fraud was down 12 percent last year, totalling $49.3 billion in losses, according to Javelin. Nationwide, there were about 500,000 fewer victims, year-over-year, the research company said. Javelin's results run "contrary to all the trends we are seeing in the market," said Gartner analyst Avivah Litan. "In fact, the U.K. banks just released a study showing their identity theft-related fraud is up nearly 20 percent," she said.
273554
THE United States Federal Trade Commission (FTC) formally announced on Tuesday its first assault against spyware - bits of computer code that surreptitiously install themselves on the computers of Internet users to track their activities, push them to
372874
Nearly lost in the news about the&#160;U.S. Federal Trade Commission&#39;s (FTC) approval on Thursday of Google&#39;s acquisition of DoubleClick&#160;was another action by the agency: The publication of a proposed set of privacy principles governing online behavioral advertising.The release of the privacy principles is an important and welcome step, said Peter Swire, a senior fellow at the Center for American Progress, a liberal think tank, and a law professor at Ohio State University. Although some privacy groups blasted the FTC for approving Google&#39;s DoubleClick deal, the acquisition has helped place focus on the entire online advertising industry&#39;s privacy practices, Swire said.&quot;It&#39;s good that the FTC is shining a spotlight on this industry,&quot; Swire said Friday. &quot;Online advertising is in its second boom. They&#39;re trying lots of new techniques; some of those techniques have privacy problems.&quot;The FTC hosted a workshop on behavioral advertising and privacy in November. The agency&#39;s proposed privacy principles, a series of &quot;self-regulatory&quot; steps the FTC is recommending for online advertisers, come in part from that workshop.Among the FTC&#39;s proposals:-- Web sites that collect information for behavioral advertising should provide a &quot;clear, consumer-friendly, and prominent statement&quot; about the reason for collecting that data. Consumers should be able to choose whether they will allow that information to be collected.-- Any company that collects or stores consumer data for behavioral advertising should provide &quot;reasonable security&quot; and should keep data only as long as necessary to fulfill legitimate business or law enforcement needs.-- Companies should only collect sensitive data for behavioral advertising if they obtain express consent from the consumer.The Center for Democracy and Technology (CDT), a group focused on online privacy and civil liberties, also praised the FTC for releasing its privacy principles. The principles are a &quot;clear sign that the commission does not believe that the industry&#39;s current self-regulation framework is sufficient to protect consumers today,&#8221; CDT Deputy Director Ari Schwartz said in a statement.CDT also called on Google to &quot;step up and make a clear, public statement about its plans for proactively protecting consumer privacy.&quot; Consumer privacy in the behavioral advertising market remains an industrywide concern that requires the focus of consumers, policymakers and companies, CDT said.The release of the privacy principles should send a signal to online advertisers, said Leslie Harris, CDT&#39;s president. &quot;In releasing these principles, the FTC hasn&#39;t closed the door to other options,&quot; she said in a statement. &quot;Self-regulation is part of the solution for protecting consumer privacy, but clearly self-regulation hasn&#39;t lived up to its promises.... We&#39;ll need a rigorous mix of self-regulation backed by regulatory enforcement.&quot;Other privacy groups criticized the FTC for its ruling allowing Google&#39;s acquisition of DoubleClick to move forward. The agency had reason to act on privacy concerns raised by the merger and failed, said Marc Rotenberg, executive director of the Electronic Privacy Information Center (EPIC), one of three privacy groups that asked the FTC to block the merger or impose privacy conditions.The FTC could have established &quot;the necessary safeguards for personal data and competition that could have allowed a global [privacy] framework to emerge,&quot; Rotenberg said. &quot;[The FTC&#39;s] sole purpose is to protect the public interest. It failed to do so ... in a case that will have far-reaching implications for the Internet economy and the privacy rights of American consumers.&quot;Joseph Turow, a communication professor at the University of Pennsylvania, agreed. The European Union is still investigating the Google-DoubleClick deal, with a decision not due until April, and it is likely that regulators there will take a harder look at privacy issues, he said.Consumer tracking and privacy should be part of the FTC&#39;s antitrust review when it looks at online advertising deals, he said. &quot;You can&#39;t talk about the digital advertising market today without talking about competition in targeting Americans,&quot; he said.Google supports the FTC&#39;s efforts to create privacy guidelines, David Drummond, the company&#39;s senior vice president for corporate development and chief legal officer, said in a blog post. &quot;The FTC&#39;s decision publicly affirms what we and numerous independent analysts have been saying for months: Our acquisition does not threaten competition in what is a robust, innovative, and quickly evolving online advertising space,&quot; Drummond wrote. &quot;In fact, we firmly believe the transaction will increase competition and bring substantial benefits to consumers, web publishers, and online advertisers.&quot;Critics failed to show specific privacy harms, added Thomas Lenard, president of iGrowthGlobal, a conservative think tank. &quot;I don&#39;t see a problem because nobody has demonstrated the acquisition will result in any privacy harm to consumers,&quot; he said. &quot;All the allegations are very hypothetical. Privacy advocates assert that Google&#39;s and DoubleClick&#39;s activities injure consumers, but they don&#39;t provide any evidence.&quot;If the FTC had blocked the deal, it would be &quot;penalizing success, and that would send a bad signal to the marketplace,&quot; Lenard added. &quot;That would also be bad for consumers.&quot;
309381
Computer security experts and law enforcement officials need standards for the network forensics that are becoming common in trial cases.
441496
The man at the center of the nation's first spyware case &#151; a businessman notorious for his junk Internet mailings &#151; says federal regulators were politically motivated in targeting him for enforcement of new bills outlawing intrusive software.