05.08.2011
computer security, cyber crime, cyber security, cyber warfare
War has been defined as “a state of organized, armed and often prolonged conflict carried on between states, nations, or other parties typified by extreme aggression, societal disruption, and usually high mortality.[Wikipedia]” Cyber Warfare has been defined as “politically motivated hacking to conduct sabotage and espionage. [DOD]”
While some of what we’ve recently can be construed as Cyber Warfare (including the recent hacktivism), the bulk of what’s really going (largely beneath the surface) is a) efforts by organized criminal elements using new technologies and capabilities to do what they have always done—steal money, or b) continued acts by nation states to steal military secrets (espionage) or corporate secrets (economic espionage).
While the latter (b) get the big press, I am worried that that the former (a) is actually the bigger problem of the two. I was personally hit by identity theft a few years ago when a group got access to my credit card details from a retailer I had done business with. This group proceeded to charge 250 rubles (about $9US) twice a month to one of my credit cards. While not a significant amount of money for me, I would guess that they had thousands of victims like me, and together, the monthly booty would add up quite quickly. Two hypotheses…
- More of this type of cyber-crime is occurring today than the stuff showing up on the front page of any newspaper; and
- What we mean when we say “Cyber Warfare” is really just the 21st century version of crime; criminals using cyber means.
I’m also afraid that our law enforcement forces (internationally) are nowhere near being prepared to dealing with crime using cyber technologies—two points from a National Criminal Justice Association (NCJA) Forum I recently attended:
- One of the sessions I participated in was entitled “Why Does the Crime Rate Continue to Decline?” The speaker (a well-respected professor) informed us that crime in America is actually down to the levels it was in 1964—this represents a significant drop. I asked the question “Did crime really drop or have criminals begun to use technology to steal rather than a pistol?” His response was “criminals aren’t smart enough to use computers.” I found this very hard to believe. Criminals have always adapted to stay a step ahead of law enforcement, and I fear that they now have a significant upper-hand, especially if law enforcement feels the way the speaker did and they fail to re-tool their ranks to detect, deter, and dismantle the new cyber-oriented criminal threats.
- Another session I attended was entitled “A Clear and Present Threat: A Look at Cybercrime.” In this session, one of the speakers spoke of the growing problem of crime in virtual worlds—people with avatars in virtual worlds are stealing other peoples virtual property and assets, and real lawsuits are being tried in real courts by real people. If you don’t believe me, read this article – Virtual add-ons draw real-world lawsuits – that I found in researching this further. I would submit that today’s criminals are more tech/cyber-savvy and have realized that there are safer (cyber) ways to steal money and property without having to physically point a gun at someone’s face.
Now ask yourself, how many law enforcement officers are prepare to investigate this type of crime, let alone basic identity theft, software piracy, child pornography, and cyber-extortion? And what about their readiness to preserve digital evidence in computers, laptops, routers, firewalls, servers, and handheld devices?
Today these skill sets are confined to special divisions within a police department, segregated from the bulk of the force. I would like to offer that just like the weapon, handcuffs, and radio on their utility belt,it’s time to equip many more, if not all law enforcement officers with the training and tools to understand, detect, and investigate cyber-crime…we’ll never get fully ahead of the problem, but maybe we can catch-up a bit.
your comments and thoughts welcome…r/Chuck
07.10.2008
data sharing, Information sharing, Technology
I had the pleasure of attending a briefing today on the Virtual Alabama (VA) Project. Jim Walker, Director, Alabama Department of Homeland Security, and Chris Johnson, VA Project Manager gave a full blown, real-time demonstration of VA’s capabilities. While just seeing Google Earth Enterprise technology is cool in itself, what was really astonishing was to see how the project has worked to get access to an amazing number of data sources–they have engaged over 1,100 agencies in implementing information sharing accross the state!
Driven by specific business needs, the VA project now supports law enforcement, fire, emergency management, business and economic development, property tax assessment, port security, emergency evacuation, and they’re only into the project about 10% (their number). Other states would do well to take a look at what they’ve done in about 18 months for about $500,000 with a team of four people. And, don’t focus solely on the specific technology they chose–the real lesson here is what they did to get Alabama agencies to share their data! This is the true accomplishment.
I hope the project can find time write up and share a white paper to document the various strategies they employed to get access to the data–arm twisting, the shame game, Friday afternoon strategy sessions at local watering holes, etc.
Here’s a YouTube movie about it: Google Earth Enterprise Case Study: Virtual Alabama
Enjoy!…r/Chuck Georgo
30.09.2008
data sharing, Information sharing, Strategy, Uncategorized
LInX is the Naval Criminal Investigative Service’s Law Enforcement Information Sharing Project. Those of you that know me know that I was an architect of the LInX approach and a project manager for many of the LInX locations over a five year period. What many don’t realize is that LInX was started by the Navy with a mere $50,000 purchase order. Through what was a largely grass-roots efforts by state and local law enforcement executives, fueled by the leadership of John McKay (one of the fired U.S.Attorneys) and Dave Brant (former NCIS Director), LInX has grown to a nearly $100 million dollar project in nine major regions around the U.S.
What’s particularly interesting about this whole saga is that when John took this information sharing success story to his leadership and offered it up as a “proven approach to nationwide information sharing,” they put the politics of internal DOJ projects ahead of the needs of state and local law enforcement and in the process took a good man down.
Unfortunately, they saw LInX as a competing “IT system” and not as what I and others believed–that LInX really was “a proven and standardized process for organizing, implementing, and evaluating regional law enforcement information sharing.” I and others believed the LInX approach could have been implemented with many of the other IT systems currently in use around the country at that time (or being developed) for information sharing. We also recognized that LInX was not a threat to any of the national-level systems being developed by DOJ (or DHS) and, in-fact, (as DOJ would attest to today) are now convinced that those national efforts CANNOT succeed unless LInX-like information sharing projects are quickly replicated in other parts of the country.
While I am sure the final chapter in the U.S. Attorney firings has yet to be written, my hope is that the recently released report will help us to move past federal politics and realize that the true victims here are the state and local law enforcement agencies who were cheated out of a proven approach to enabling the electronic sharing of each other’s law enforcement records–let’s give the LInX approach (and what John and Dave started) its due and develop a formal project to make the process available to other’s who are still struggling with getting it done. I’ve summarized the LInX approach below.
STEPS IN THE LINX APPROACH—It is NOT about the technology.
-
Strategy – Develop a regional law enforcement plan detailing areas of concern and how to leverage information sharing for the desired impact.
-
Governance – Establish an information sharing governance infrastructure that gives each participating Chief Executive Officer an equal vote on all matters pertaining to the regional LInX system.
-
Data – Identify and agree to integrate ALL relevant data. The key to success is sharing more not less information.
-
Capabilities – Provide easy to use query and analysis tools, with multi-levels of security. LInX is a system developed by law enforcement personnel for law enforcement personnel. Feedback from user groups and the flexibility to make enhancements to the system keeps the LInX system robust and valuable to the community.
-
Technology – The LInX system is built with open standards and leverages existing technology to integrate diverse systems. An open standards architecture that is flexible, scalable, sharable, and possess the ability to enhance current systems interfaced with.
-
Full Support – There are some requirements for the participating agencies. The goal is to have minimal impact on a participating agency’s resources, however, there is a need to support user training, system administration, and maintenance.
-
Evaluation – Conduct formal evaluations to assess achievement of desired impact. The LInX system is being developed to enhance law enforcement utilizing technology to assist the investigator and patrol officer.