Tag Archive for: cyber crime

Transnational serious and organised crime: we need a white paper

/in

Transnational serious and organised crime (TSOC) has profound economic, social, political and humanitarian costs for Australia and Australians, with impacts that are felt every day. It constitutes a formidable global challenge with multifaceted implications that transcend borders, communities and social-economic divides.

While Australia has had a National Strategy to Fight Transnational, Serious and Organised crime since 2018, it’s clear that our current policies, strategies, laws and law-enforcement capacity aren’t stopping the growth in TSOC costs. Australian federal, state and territory governments need to promote public policy discourse on how we ought to respond to this challenge. A good way to start would be to commission Australia’s first white paper on TSOC.

Economically, TSOC directly affects both developing and developed economies globally. Drug trafficking, human trafficking, cybercrime and money laundering inflict substantial financial costs on Australian citizens. Those losses manifest in direct economic damage, including reduced productivity, weakened market integrity and distorted competition. The World Economic Forum estimates that transnational crime and corruption siphon off up to 5 percent of global GDP.

In 2015 the Australian Criminal Intelligence Commission (ACIC) estimated that serious and organised crime had cost Australia $36 billion in the 2013–14 financial year, including both crime and prevention and response costs. In 2022 the ACIC reported that in the 2020–21 financial year the direct and indirects costs could total up to $60.1 billion. Despite all the policies, legislation and enforcement, serious and organised crime costs have dramatically increased.

However, there’s been no effort to update our national strategy. And there’s little reason to doubt that the cost will be significantly higher the next time it’s measured. The numbers suggest that our current strategy is not preventing, mitigating or disrupting this threat.

The challenge is that serious and organised crime has become increasingly transnational in its linkages and costs over the past two decades.

TSOC fosters environments conducive to corruption, weakening governance structures and eroding public trust in institutions. Collusion between criminal networks and corrupt officials perpetuates a cycle of criminality, hindering the efficient functioning of markets and impeding socio-economic development. The costs associated with combating corruption, implementing robust regulatory frameworks and restoring institutional integrity further exacerbate the economic burden imposed by TSOC. Unfortunately, Australians are not just victims of crime; our demand for illicit commodities, the laundering of proceeds of crime from Australian criminal activity, and Australian criminals are also responsible for exacting these costs on developing nations. Australians might not see these kinds of costs daily, but our nation’s demand for illicit drugs plays a big part.

While the amount of money involved is vast, it’s important to remember that TSOC also has indelible impacts on communities, families and individuals that can’t be measured in dollar terms.

Drug trafficking engenders addiction, health crises and societal upheaval. The opioid epidemic in various regions exemplifies the devastating consequences of drug-related crime, including overdose deaths, strained healthcare systems and social disintegration. The violence associated with drug trafficking exacerbates community tensions, undermines public safety and fosters a climate of fear and insecurity.

Cybercrime has emerged as a pervasive threat with far-reaching social implications in the digital age. Cybercriminal activities such as hacking, identity theft, ransomware attacks and data breaches compromise individual privacy, erode trust in digital platforms and disrupt societal norms. The proliferation of cybercrime undermines economic stability through financial losses and business disruptions. It erodes public confidence in digital technologies and connectivity.

Politically, TSOC poses significant challenges to governance, stability and the rule of law. Corruption, facilitated by criminal enterprises, undermines democratic processes, erodes institutional legitimacy and perpetuates a culture of impunity. Weak governance structures, porous borders and inadequate law-enforcement capacities create fertile ground for transnational criminal networks to operate with relative impunity, evading justice and perpetuating criminal activities across jurisdictions.

Of concern is the possibility that some countries would seek to weaponise TSOC. A May 2024 report by the US Government’s Select Committee on the Strategic Competition between the United States and the Chinese Community Party, titled The CCP’s role in the fentanyl crisis, alleges that China has used illicit-drug warfare as an asymmetric tactic to cause social and economic costs.

The environmental cost of TSOC is also substantial, encompassing illegal activities such as wildlife trafficking, illegal logging and environmental pollution. Wildlife trafficking threatens biodiversity, contributes to species extinction and undermines conservation efforts. Illegal logging and fishing deplete natural resources, degrade ecosystems and exacerbate environmental degradation, with far-reaching ecological consequences.

Addressing the real cost of TSOC requires a multifaceted approach that integrates legal, law enforcement, diplomatic, social and economic measures. Enhanced international cooperation, information-sharing and capacity-building efforts are paramount to disrupt transnational criminal networks, dismantle illicit markets and strengthen regulatory frameworks. Investing in crime-prevention strategies, victim-support services and community resilience programs is essential to mitigate TSOC’s social and humanitarian impacts. Moreover, fostering a culture of transparency, accountability and integrity within institutions is crucial to combat corruption, strengthen governance structures and uphold the rule of law. International conventions, treaties and agreements are pivotal in coordinating responses, harmonising legal frameworks and facilitating mutual assistance among countries in combating TSOC. Getting all of that effort synchronised and coordinated requires new thinking.

Given the multidisciplinary nature of this challenge and its complexity, a TSOC white paper could play a crucial role in developing a whole-of-nation approach. At the very least, it would provide an opportunity to improve public policy discourse. Moreover, the white paper process would assist with integrating multidisciplinary insights, allowing stakeholders to understand the problem holistically and explore diverse solutions. Without new thinking, our current policies will not prevent TSOC costs from rising.

Policy, Guns and Money: Weaponised deep fakes

/in

In this episode, Hannah Smith of ASPI’s International Cyber Policy Centre and the Australian National University’s Katherine Mansted speak about their new ASPI report, Weaponised deep fakes.

Deep fakes are digital forgeries created through artificial intelligence that can be used to make entirely new content or manipulate existing content, including video, images, audio and text.

They could be used to defame targets or impersonate or blackmail elected officials. They can also be used in conjunction with cybercrime operations.

Cyber wrap

/in

A flurry of activity on the cyber-policy front has accompanied the one year anniversary of Australia’s Cyber Security Strategy, which was launched by Prime Minister Malcolm Turnbull on 21 April 2016.

The Australian Cyber Security Growth Network, the industry-led, not-for-profit company tasked with boosting Australia’s cyber industry, released its first Cyber Security Sector Competitiveness Plan in Sydney last Thursday. The report, developed in conjunction with AlphaBeta is intended to help Australia’s cybersecurity industry ‘reach its full potential’ by identifying and overcoming roadblocks to small business, commercialisation of research and a cyber skilled workforce.

The Minister Assisting the Prime Minister on Cyber Security, Dan Tehan, recently launched the ASX100 Cyber Health Check Report, another key deliverable of the Cyber Security Strategy. The report, which reveals how Australia’s biggest businesses approach cybersecurity, was developed by Australian Securities Exchange, the Australian Securities and Investments Commission, the Department of the Prime Minister and Cabinet, Deloitte, EY, KPMG and PwC. One of the report’s many findings is that only 11% of companies have a clear idea of what data is shared with third parties, or have initiatives designed to reassure investors and customers of their cybersecurity.

The Minister’s been busy, also publishing an op-ed calling for a ‘step change’ from passive to ‘active cyberdefence’ to combat cybercrime in Australia. The article advocates for telcos and ISPs to take more responsibility for the dangerous content they inadvertently propagate and that users should be able to opt into services that provide a filtered and more secure version of the internet. While the Minister assured readers that he knows that ‘laws must be respected’, he said the government will ‘investigate existing legislation and, where appropriate, remove any roadblocks’ that may prevent this type of active defence from being possible. The controversial article has been described as a ‘radical plan’ and has been criticised for its poor understanding of the existing services and limited powers of telcos.

Australia took some strides on the international cyber stage this week when it hosted the inaugural Australia–China High-Level Security Dialogue in the wake of Premier Li Keqiang’s March visit. At the meeting Prime Minister Turnbull, Foreign Minister Julie Bishop and Secretary of the Chinese Communist Party’s Central Commission for Political and Legal Affairs Meng Jianzhu reached the significant agreement that ‘neither country would conduct or support cyber-enabled theft of intellectual property, trade secrets or confidential business information with the intent of obtaining competitive advantage’. The pact reflects the principle of the September 2015 agreement between China and the US, which reportedly correlated with a decrease of Chinese commercial espionage. Fingers crossed for similar success Down Under.

Stateside, the CIA and FBI have launched a joint investigation to identify those responsible for leaking the contents of the Wikileaks’ multi-tranche ‘Vault 7’ disclosures. Wikileaks has claimed that the documents, purporting to detail CIA cyber tools for hacking smartphones, televisions and computer systems, come from a former US intelligence contractor. Unsurprisingly, the CIA is staying tight-lipped on the investigation into the source of the leak.

Looking at the date, it appears that the Trump administration’s much-anticipated cybersecurity plan is now officially late. As President-elect, Trump promised to deliver a fresh federal cyber plan ‘within 90 days of taking office’. We’re now past 90 days and the administration still has nothing to show other than a false start and two leaked drafts. Unsurprisingly, assurances have surfaced that Trump will sign a version of the long-awaited Executive Order this week, but we won’t be holding our breath.

French presidential candidate Emmanuel Macron appears to have been targeted by the same Russian operatives behind the 2016 hack of the Democratic National Committee (DNC). A series of phishing attempts and web assaults sought to obtain the email passwords of individuals working on the Macron campaign and gain access to confidential correspondence. New research by cybersecurity firm Trend Micro has compared the digital fingerprints on the Macron system to those found after the DNC hack, finding that they were also from APT28—though the research stops short of saying who’s behind the malicious group. Not that they needed to, with US intelligence agencies having already explicitly attributed the work of APT28 to Russian intelligence services. While the efforts against the Macron campaign were reportedly unsuccessful, Macron’s digital director Mounir Mahjoubi noted ‘there was talent behind it and time went into it: talent, money experience, time and will’.

And finally, in a development unlikely to boost international confidence in democratic security, a Russian government think tank reportedly outlined a plan to influence the US election in June 2016. US officials have anonymously disclosed that the US government is in possession of a Russian strategy paper written by the Russian Institute for Strategic Studies and circulated to the highest levels of the Russian government last year. Hold on to your votes, people!

Internet or Splinternet?

/in

Who owns the Internet? The answer is no one and everyone. The Internet is a network of networks. Each of the separate networks belongs to different companies and organisations, and they rely on physical servers in different countries with varying laws and regulations. But without some common rules and norms, these networks cannot be linked effectively. Fragmentation—meaning the end of the Internet—is a real threat.

Some estimates put the Internet’s economic contribution to global GDP as high as $4.2 trillion in 2016. A fragmented “splinternet” would be very costly to the world, but that is one of the possible futures outlined last month in the report of the Global Commission on Internet Governance, chaired by former Swedish Prime Minister Carl Bildt. The Internet now connects nearly half the world’s population, and another billion people—as well as some 20 billion devices—are forecast to be connected in the next five years.

But further expansion is not guaranteed. In the Commission’s worst-case scenario, the costs imposed by the malicious actions of criminals and the political controls imposed by governments would cause people to lose trust in the Internet and reduce their use of it.

The cost of cybercrime in 2016 has been estimated to be as high as $445 billion, and it could grow rapidly. As more devices, ranging from automobiles to pacemakers, are placed online, malicious hackers could turn the “Internet of Things” (IOT) into ‘the weaponization of everything.’ Massive privacy violations by companies and governments, and cyber attacks on civilian infrastructure such as power grids (as recently happened in Ukraine), could create insecurity that undercuts the Internet’s potential.

A second scenario is what the Commission calls ‘stunted growth.’ Some users capture disproportionate gains, while others fail to benefit. Three or four billion people are still offline, and the Internet’s economic value for many who are connected is compromised by trade barriers, censorship, laws requiring local storage of data, and other rules that limit the free flow of goods, services, and ideas.

The movement toward sovereign control of the Internet is growing, and a degree of fragmentation already exists. China has the largest number of Internet users, but its “Great Fire Wall” has created barriers with parts of the outside world.

Many governments censor services that they think threaten their political control. If this trend continues, it could cost more than 1% of GDP per year, and also impinge on peoples’ privacy, free speech, and access to knowledge. While the world could muddle along this path, a great deal will be lost and many will be left behind.

In the Commission’s third scenario, a healthy Internet provides unprecedented opportunities for innovation and economic growth. The Internet revolution of the past two decades has contributed something like 8% of global GDP and brought three billion users online, narrowing digital, physical, economic, and educational divides. The Commission’s report states that the IOT may result in up to $11 trillion in additional GDP by 2025.

The Commission concluded that sustaining unhindered innovation will require that the Internet’s standards are openly developed and available; that all users develop better digital “hygiene” to discourage hackers; that security and resilience be at the core of system design (rather than an afterthought, as they currently are); that governments not require third parties to compromise encryption; that countries agree not to attack the Internet’s core infrastructure; and that governments mandate liability and compel transparent reporting of technological problems to provide a market-based insurance industry to enhance the IOT’s security.

Until recently, the debate about the most appropriate approach to Internet governance revolved around three main camps. The first, multi-stakeholder approach, originated organically from the community that developed the Internet, which ensured technical proficiency but not international legitimacy, because it was heavily dominated by American technocrats. A second camp favored greater control by the International Telecommunications Union, a United Nations specialised agency, which ensured legitimacy but at the cost of efficiency. And authoritarian countries like Russia and China championed international treaties guaranteeing no interference with states’ strong sovereign control over their portion of the Internet.

More recently, the Commission argues, a fourth model is developing in which a broadened multi-stakeholder community involves more conscious planning for the participation of each stakeholder (the technical community, private organisations, companies, governments) in international conferences.

An important step in this direction was the US Commerce Department’s decision last month to hand oversight of the so-called IANA functions—the “address book” of the Internet—to the Internet Corporation for Assigned Names and Numbers. ICANN, with a Government Advisory Committee of 162 members and 35 observers, is not a typical inter-governmental organisation: the governments do not control the organisation. At the same time, ICANN is consistent with the multi-stakeholder approach formulated and legitimated by the Internet Governance Forum, established by the UN General Assembly.

Some American senators complained that when President Barack Obama’s Commerce Department handed its oversight of the IANA functions to ICANN, it was ‘giving away the Internet.’ But the US could not ‘give away’ the Internet, because the United States does not own it. While the original Internet linked computers entirely in the US, today’s Internet connects billions of people worldwide. Moreover, the IANA address book (of which there are many copies) is not the Internet.

The US action last month was a step toward a more stable and open multi-stakeholder Internet of the type that the Global Commission applauded. Let’s hope that further steps in this direction follow.

Virtual currencies: do we need a new approach?

/in


Last December, Australian authorities searched the Sydney home of the alleged founder of Bitcoin, and in doing so brought virtual currencies back into the spotlight—this time with an Australian flavour. The search served as a timely reminder to the rest of us about the need to expand government oversight of virtual currencies.

But just what are virtual currencies? And why should we care?

A virtual currency is a digital representation of value that can be traded online and isn’t regarded as the ‘legal tender’ of any country. As the IMF explains, virtual currencies cover a wide array of ‘currencies’ including simple ‘IOUs’ (for example, internet/mobile coupons or airlines miles), those backed by assets such as gold, and cryptocurrencies including Bitcoin, Ripple and Litecoin.

According to the Financial Action Task Force, some virtual currencies can be exchanged for real (fiat) currency (for example, Bitcoin, Ripple and Litecoin) while others are ‘non‑convertible’ and can only be used on certain websites (for example, World of Warcraft Gold).

Given the pace of technology, there’s a chance digital currency will achieve wider acceptance and disrupt our traditional finance model faster than our regulatory processes can manage. Before being disbanded for money laundering activities, Liberty Reserve (a Costa-Rican money transmitter) had over ‘one million users worldwide’ and ‘handled 55 million transactions daily’, most of which were illegal. So there’s a chance that we could miss an opportunity to implement mechanisms that serve to limit the criminal and terrorist use of these technologies, and provides consumers, businesses and investors with confidence in their use.

Although virtual currencies offer potential benefits, including speed and efficiency in making payments and transfers, they also have the ability to harm society and individuals. By not requiring transactions to be monitored and verified by ‘a trusted third party’, they’re also anonymous and therefore not easily traced by law enforcement agencies.

As Tobias Feakin writes, the pseudo-anonymity offered by virtual currencies and the anonymity of dark net sites (such as Evolution and the now defunct Silk Road) provides a cover for trade in illicit goods (including drugs and child pornography) and services (like contract-assassinations).

The potential for such misuse is not lost on governments. The UK government’s 2015 National Strategic Assessment of Serious and Organised Crime commented that virtual currencies have become ‘the payment system of choice’ for individuals and organisations involved in some areas of cyber-crime. In Australia, the Australian Crime Commission’s Organised Crime in Australia 2015 report examined how victims of cyber and technology-enabled crimes paid ransoms in Bitcoin.

While ‘traditional’ (non-cyber) criminals might appreciate their value for laundering funds and paying for illicit goods and services, some cases are emerging on how virtual currencies are also being used to support terrorist organisations.

For instance, Ali Shukri Amin—a 17 year old from Virginia (US)–was sentenced to 11 years imprisonment in June 2015 after pleading guilty to providing material support and resources to ISIS, including instructions on how to use Bitcoin to conceal donations to the terrorist organisation.

Governments around the world have taken a variety of approaches when it comes to regulating virtual currencies, ranging from a complete ban on their use (China, Russia), proposals to introduce new anti-money laundering and terrorist financing laws (Canada), and developing regulations covering digital currency firms (New York State).

In Australia, the Attorney-General’s Department described virtual currencies as a ‘powerful new tool’ at last year’s Senate inquiry into digital currencies. At the inquiry, ASIC said it was aware that some banks had ceased doing business with ‘Bitcoin related companies’ due to concerns about the risks Bitcoin posed to their business and reputation. In response, the Senate committee strongly supported applying anti-money laundering and counter-terrorism financing laws to digital exchanges but noted the statutory review of the Anti-Money Laundering and Counter-Terrorism Act 2006 was already considering this issue.

With an election expected later this year, it’s doubtful whether the statutory review’s recommendations could be implemented into law before 2017-18. And implementation into practice would take longer still.

That’s too long to wait. We’re already seeing these currency technologies entering the mainstream, albeit in small numbers. At present it’s difficult to exchange virtual currencies for hard currency. But a greater acceptance by the general public of virtual currencies could increase their use.

With a number of financial institutions and securities exchanges already investigating how to make better use of the technology underpinning virtual currencies, it’s probable that virtual currencies will grow in use. With growing use comes the possibility of misuse, and without satisfactory regulation or monitoring there won’t be an ‘administrative body to report illicit activity’.

Over the next year, ASPI will follow developments in this area and seek to provide options for government to strike a balance between stimulating the development of new technologies and avoiding their misuse. Issues to be explored include blockchain and the need to increase funding and research on combatting crime through the use of innovative technologies.

Virtual currencies are an important issue for the future of our society and economy. The Australian government is in a position to promote these innovative technologies and shape how virtual currencies are monitored and used while taking action to limit the potential for their misuse by organised crime and terrorist financiers.

Cyber maturity in the Asia–Pacific 2015

/in

FEAK2Today ASPI’s International Cyber Policy Centre launches the second edition of its Cyber Maturity in the Asia–Pacific 2015 Report. It analyses the cyber maturity of 20 countries, representing a wide geographical and economic cross-section of the region. For a more holistic picture of regional developments, this year’s maturity metric has expanded to incorporate five additional countries: Vietnam, Laos and Brunei in Southeast Asia; and New Zealand and Fiji in the South Pacific (see image for rankings). With these additions, this study now assesses the entire Association of Southeast Asian Nations (ASEAN) grouping and seven of the ten ASEAN dialogue partners.

An additional layer of analysis, a standalone ‘cyber engagement scale’, is also provided. The scale is intended to be a reference tool to identify opportunities for the sharing of best practice, capacity building and development, plus commercial opportunities. Using this scale governments and the private sector can tailor engagement strategies to best fit existing levels of maturity in each policy area in each country.

Online, 2015 has been a significant year for the Asia–Pacific: the internet has played a pivotal and ongoing role in many of the region’s political disputes, economic growth spurts and social movements.

Throughout the year, awareness among regional governments of cyber threats and opportunities remains uneven. Governments that prioritise the development of coherent cyber policy frameworks understand that those frameworks are necessary for their countries to advance digitally. Others, specifically South Korea and the US, have also been subject to incidents in cyberspace that have critically affected their economic and national security. Those left behind are usually struggling to develop the required infrastructure to open up cyberspace to more of their population, challenging their capacity to develop adequate policy frameworks. However, it’s critical that those frameworks are established as cyber infrastructure is developed and not ‘bolted on’ retrospectively.

New national organisational bodies were established in 2015 and cyber issues given new ministerial prominence in several countries such as Singapore, Japan and South Korea. Governments are also taking a progressively more active role in trying to bridge the internet connectivity divide between urban and rural areas by expanding internet infrastructure, often with the support of foreign-owned private enterprise. Fixed-line and, perhaps more dramatically, mobile internet networks have expanded access to online services and markets, allowing the region’s digital economies to continue to grow.

The potential for social, economic and political change continues to expand as online technology advances and access to the internet grows. This is invigorating and enabling the next generation of technologists and entrepreneurs, but also creates avenues for new forms of crime. To reflect the increasing prominence of financial cybercrime and the need for adequate responses to it, this year’s cyber maturity metric includes a standalone assessment criterion on financial cybercrime.

Beyond domestic cyber issues, governance structures and connectivity are part of an international strategic landscape that’s continually evolving. While cyber quarrels frequently break out between various state and non-state actors, for the most part, traditional geopolitical rivalries  are being replicated online, accounting for the most significant cyber incidents. This has led militaries to deepen their thinking on cyberspace, prompting to an uptick in recruiting, training and strategic planning.

The Asia–Pacific region continues to be a major source of interest for major and middle powers. Many countries are increasing their region-based capacity-building efforts. While critical to developing cyber maturity, these efforts also underpin a larger observable trend in targeted ideological persuasion and manoeuvring.

What about Australia’s position in this picture? Unfortunately, Australia has lost ground relative to progress made in Japan, South Korea and Singapore. Those countries have implemented stronger government approaches to cyber issues, and focused on invigorating innovative digital business and start-ups. Due to more rapid implementation of cyber policies in other countries, Australia’s rank has dropped from three to five, despite improving on its overall 2014 score. Strong implementation of the renewed Cyber Strategy is required to keep up with the rapidly increasing maturity of cyber policy approaches in the region.

On the plus side, Australia is a regional leader in financial cybercrime enforcement and capacity building, ranking second only to the US in the new cybercrime category. It’s highly likely that, with the implementation of the forthcoming Cyber Strategy in the coming months, 2016 will see Australia improve its ranking.

The report will be launched at a free ASPI event with special guest David Irvine AO, tonight at 5.30pm at our Barton offices. Registration and information here.

The Beat

/in

The spectre of crime in sport remains.

This week on The Beat, indigenous communities, piracy, remittance services closing, sport, calls for a greater transnational focus on organised crime and a former PM gets a rude shock on social media.

Organised crime targeting indigenous communities

An Australian Crime Commission internal report claims that organised criminal groups are planning to steal from indigenous communities who survive on mining royalties and land use agreements.

Following an eight year investigation across the country, the National Indigenous Intelligence Taskforce commented that the increasing sources of revenue for indigenous communities, including commercial and social enterprises generating significant incomes, created an environment of significant inducements and extensive opportunities for criminal exploitation.

Piracy and Australia

Still at home, an international insurance firm notes an increasing incidence of piracy near Australia. While the incidents are low level, there’s potential that they may increase in size and scale if not bought under control.

Interestingly, the report highlights the decreasing incidence of piracy in the Gulf of Aden and an increase near Indonesia, as well as the new ‘hotspot’ in the Gulf of Guinea off western Africa.

Westpac close remittance services

Westpac this week became the last of the Big Four Australian banks to close their remittance services. This move has severely disappointed Australia’s Somali community, who rely on the services to send much-needed funds to families in Somalia for food, water and essential services, according to Dr Hussein Haraco of the Somali Remittance Action Group. He  notes that Somali-Australians send $10.5 million each year, and expressed fears that a lack of funds could lead to humanitarian disasters.

Australian banks have been moving away from remittance services thanks to increased restrictions and concerns that their services will be used to launder money and finance terrorism. This, however, appears to be one example of legitimate essential services being comprised without a viable alternative being offered, a move detrimental to our communities.

RUSI Report: Preventing Serious and Organised Crime Needs to Move Upstream

New analysis of the Home Office Strategic Centre for Organised Crime’s Prevent guide from the Royal United Services Institute has appraised the adoption of the ‘4P Strategy’ (Prevent, Pursue, Protect, Prepare) from countering terrorism to countering organised crime.

Whilst these programs have made a positive contribution towards eliminating organised crime domestically, there’s more work that could be done transnationally. Extending the ‘Prevent’ strategy further upstream to deter international engagement with organised crime within the United Kingdom will strengthen the response’s effectiveness.

Football and organised crime

Essendon players have been cleared of wrongdoing in the long-running drugs probe just before the 2015 AFL season begins. But the spectre of crime in sport remains. In this profile, Mike Marinetto looks at how major sporting clubs have become implicated in money laundering in Colombia, Italy and the United Kingdom.

One case Marinetto examines is the investigation into oligarch and Chelsea FC owner Roman Abramovich by Alexander Litvinenko, whose murder inquiry we’ve discussed recently.

Former PM gets catfished

Barely a week goes by where we don’t mention identity or cyber fraud in some way. So perhaps it’s comforting that even our most eminent fall victim, too.

John Howard was recently shocked to discover that someone had set up a rather convincing fake Facebook profile for him, giving status updates on cricket and politics. The account amassed 37,000 followers before a journalist mentioned it to Howard. Perhaps this serves as reminder for us all to check our cyber footprint.

Underground web – the cybercrime challenge

/in

Cybercrime isn’t an emerging threat, it has already arrived, and law enforcement must adapt quickly to meet the challenge that it poses.

At the launch of the Australian Cyber Security Centre in November 2014, Prime Minister Abbott underlined the importance of cybercrime in the Government’s thinking, estimating that cybercrime costs Australia around $1.2 billion per year. That number would seem conservative as most cybercrime incidents go unreported—especially at the top end of the private sector, with few companies coming forward with information on their losses resulting from cybercrime. As more and more of us go online, and companies increasingly switch to an online business model, criminality has also shifted its focus.

Cybercrime isn’t an emerging threat, it has already arrived, and law enforcement must adapt quickly to meet the challenge that it poses. This new reality is explored in the Australian Strategic Policy Institute’s latest report Underground web – the cybercrime challenge. In the report’s introduction Australian Federal Police Commissioner Andrew Colvin explains:

‘Cyber technologies create a new paradigm for the criminal – a more sophisticated method to attack the vulnerable – and a new fear for the victim. No longer is the evidence of the perpetrator visible to the victim…Modern cybercrime draws no distinction between government targets, larger corporations and individual users. Its sole purpose is to exploit vulnerabilities for gain.’

Read more

Cyber wrap

/in

Bitcoin Logo - Bitcoin Accepted Here Neon SignAs allied forces begin the air campaign against Islamic State forces in Iraq and Syria, there are concerns in the US that IS could turn to cryptocurrencies to bolster their already substantial funding base. Reports have stated that ISIS already generates upward of US$3 million per day from oil revenues, kidnap for ransom, taxation, theft, and pillaging, and these funds could be added to through the use of cryptocurrencies such as bitcoin. The US military is studying these types of currencies to determine if they can be traced and to see how they could be used by groups such as ISIS. A US Defense official stated that ‘We’re trying to do our best to understand the true scope of the threat that we are dealing with. …We have to fully understand all of the components and functions of the adversary across the globe—not just in Syria and Iraq—and the manner in which those adversaries raise, hide and move money.’

But if ISIS are using bitcoins, they’ll find themselves in a difficult financial position as the value of the cryptocurrency has fallen to its lowest level for almost a year, having lost 18% of its face value over the weekend. Since December 2013, when it reached the highest value of US$1,100 per unit, it has decreased to US$290 per unit, illustrating how volatile an investment it can be. Read more

You may not be interested in the internet but the internet is interested in you: the international scrap over cyber continues @ the ITU

/in

At an ASPI national security lunch talk last week, Roger Wilkins, Secretary of the Attorney General’s Department, gave a wide-ranging talk that examined Australia’s national and international efforts to counter cyber crime. He warned against the temptation to create rules to govern the internet, despite the obvious temptation to do so. And, although he indicated that a ‘paradigm shift’ was required, he warned that the last thing any government should do is ‘gum up’ the internet as a source of innovation and free enterprise. His comments reflected a debate that is taking place within most nations and on the international stage (see my previous post): to what extent should a government or the international community have control over the internet?

This week is one of high activity as the International Telecommunications Union (ITU) began hosting its two-week World Conference. While this might seem mundane, its significance is hard to underestimate. First established in 1865, the ITU creates worldwide standards, coordinates shared global use of the radio spectrum and improves the infrastructure of telecommunications. It has become the wing of the UN with prime responsibilities for information technologies. This is the first time that the ITU has overseen a major overhaul of telecommunication regulations since 1988, when it helped develop the current standards. Given the expansion of internet use and data volumes being exchanged between networks, the ITU wants to introduce internet governance rules. Some 124 input documents have been submitted by the 193 member states, with around 450 proposals under consideration. Many nations, including the US, Canada and a number of European states, are deeply concerned that the ITU is expanding its remit to cover the internet when it should confine itself to telecommunications. Of particular concern are security and spam issues, with the worry being that censorship or control of the web will become the norm. Read more

Tag Archive for: cyber crime

Some light amid the enduring cyber nightmares

/in

The  cyber security strategy released last week by the Albanese government is about collaboration and communication, not about conjuring our worst national security nightmares. It’s focused on industry and consumers.

The government, industry and citizens must work together with trust for Australia to make real change in our cyber security, and this strategy recognises that.

One of Cyber Security Minister Clare O’Neil’s objectives seems to be humanising cyber and making it appealing and accessible to everyday Australians.

Of the six “cyber shields” in the strategy, “strong businesses and citizens” is number one. The first actions out of the gate are directly helping small and medium-sized businesses with free cyber health checks and the establishment of a small business cyber security resilience service to give advice.

Arguably, these are things the Australian Cyber Security Centre should be doing already, but the $7.2 million health checks and $11 million advice program have been welcomed by industry groups.

The government is also inviting business to “co-design options” for regulation or legislative changes that affect industry.

These include a ransomware reporting obligation, a new cyber incident review board, a code of practice for cyber incident response providers, mandatory standards for smart devices, a voluntary labelling scheme for smart devices and a code of practice for software development.

It’s great that the government is including industry in the conversation, but open-ended “co-design” risks delaying real action. These phases must be strictly controlled with defined end dates.

More broadly, the strategy isn’t revolutionary. On a generous assessment, perhaps eight of the 48 prescribed actions are new initiatives. The rest Australia has tried before, or has already introduced.

This shows that, even in a constantly moving cyber security landscape, there are enduring problems. It also shows that the government is willing to build on what has been done before rather than wipe the slate clean for the sake of politics.

The two most important enduring problems that frustrate Australia’s cyber security are information sharing and cyber workforce shortages, and each has a “cyber shield” dedicated to it.

Information asymmetries between consumers, companies and governments makes stopping threats and incident responses slow, ineffective and expensive. The strategy seeks to improve information-sharing by creating better motivations and opportunities to share.

Share prices drops, reputation risks and legal ramifications are among the reasons companies avoid reporting cyber incidents to the government. Sometimes it’s honest confusion about when and how to report. The strategy proposes a range of actions to create the right environment to motivate information-sharing.

The “no fault, no liability” ransomware reporting proposal and a proposed “limited use obligation” that clarifies how the Australian Signals Directorate and the cyber security co-ordinator may use cyber incident reporting will give companies greater peace of mind. Clarifying cyber security reporting obligations under existing security of critical infrastructure legislation will remove ambiguity about how and when to report.

The strategy also creates opportunities and platforms to foster industry-government threat intelligence sharing through a cyber executive council, streamlining ASD’s reporting portal and establishing or scaling-up Information Sharing and Analysis Centres (ISACs) – a model that has worked fairly effectively in the United States for 20 years.

The co-led Microsoft-ASD Cyber Shield (MACS) – although presently opaque – should also enhance national threat intelligence sharing and capabilities. It will focus on detecting, analysing and defending against sophisticated nation-state cyber threats.

Australia’s cyber workforce, however, is the fly in the ointment. Our workforce shortage has been around for decades and is only getting bigger.

The problem is even more acute in government, where below-market salaries and onerous security requirements are additional barriers to an adequate cyber workforce.

The strategy refers to building the local cyber skills pipeline through better workforce analysis, vocational training, changes to the primary and secondary curriculum and providing additional higher education Commonwealth supported places.

These are good but existing policies. The strategy’s only real new action is increasing skilled migration. In the same breath, questions of detail are shifted to the government’s upcoming migration strategy to answer.

Australia is not alone in the global struggle to attract talent, and skilled migration settings are difficult to get right. It also raises complex questions about other major policy areas, not least of which are housing, infrastructure and the cost of living.

There is a sense that increasing migration is an easy answer to what should be a more expensive and difficult conversation on how to build on the existing policies. One moonshot would be to redirect some of the $15 billion National Reconstruction Fund into subsidising education to get tens of thousands of young Australians into cyber training and careers.

As with all strategies, implementation is essential. An action plan naming lead agencies offers welcome accountability.

The strategy’s two-year “horizons” also create a realistic runway with what should be built-in evaluation and pivot points.

And we should expect to pivot, given the degrading security environment and the rate of development of transformational technologies like artificial intelligence. On these, the strategy’s actions are unlikely to put Australia ahead of the curve, being limited to “embedding cyber security” into ongoing work and updating the Information Security Manual.

In many ways, the Department of Home Affairs and the broader Australian government are well-placed to move forward on cyber security.

As the strategy itself states, we have robust regulation in the recent Security of Critical Infrastructure legislation and strong offensive and defensive capabilities with ASD’s REDSPICE funding of $9.9bn over 10 years. Australia is a trusted partner sitting within a powerful set of multilateral arrangements, including the five eyes, AUKUS, the Quad dialogue and the Pacific Islands Forum.

Home Affairs has also established the new cyber security co-ordinator’s office, a separate team to manage the strategy’s implementation, and a detailed Action Plan to execute.

On the other hand, the department is still reeling from the departures of Secretary Mike Pezzulo in September, and cyber security co-ordinator Darren Goldie last week, after only four months in the job.

Dennis Richardson’s scathing review of Home Affairs’ handling of offshore detention was leaked around the same time Goldie’s recall was announced. One of the unspoken actions of this strategy’s first horizon out to 2025 will be navigating Home Affairs’ leadership uncertainty, fiscal constraint and external scrutiny.