According to legend, the automatic telephone exchange was invented by an undertaker (Almon Strowger) who believed his business was being redirected to his competitors by corrupt telephone operators.
David Lazarus reports a vulnerability in call forwarding, whereby a fraudster persuades ATT to redirect a pizza parlour's calls to him. In this case, the fraud involved collecting credit card numbers, but as Lazarus suggests, this scam could also be used by a competitor to steal business.
Further comments on Bruce Schneier's blog, where greygeek points out the historical irony of the Strowger switch.
Fraud erodes the benefits of technological progress. What were the original benefits of the automatic telephone exchange? It was efficient, impersonal and less vulnerable to bribery and corruption. These are some of the benefits of the classic bureaucracy as identified by Max Weber - and many technological innovations provide similar benefits.
And now the benefits of Strowger's innovation are apparently reversed. Don't assume that technology progress is always onward and upward.
See also Laundry as Intelligence (October 2008)
Showing posts with label fraud. Show all posts
Showing posts with label fraud. Show all posts
Saturday, August 26, 2006
Wednesday, September 7, 2005
Noticing Data Misuse
On information leakage, Bruce Schneier comments:
It's easy to say "we haven't seen any cases of fraud using our information," because there's rarely a way to tell where information comes from. ... Everyone thinks their data practices are good because there have never been any documented abuses stemming from leaks of their data and everyone is fooling themselves.
Many years ago, when I worked on some information systems for direct mail marketing, it was standard practice to include fictional entries in a mailing list, which allowed for the rapid detection of abuse. In this context, abuse generally means using the mailing list for a purpose not authorized by the mailing list owner/administrator, and/or without proper payment. The data owner has an incentive to control abuse, because abuse degrades the value of the data to the owner. The relationship between the data owner and the data user is one of provisional trust, with retrospective sanctions whenever abuses of trust come to light. This relationship works because of the detection mechanism. And the mechanism works because the data user cannot discriminate between the fictional entries and the real ones.
So why doesn't this work for the current spate of privacy violations and identity theft vulnerabilities? Assuming that the fictional entries are properly constructed. There are some technical considerations and some social considerations (including regulation), but the value of such a mechanism should be obvious.
Technorati Tags: identity theft privacy security trust
It's easy to say "we haven't seen any cases of fraud using our information," because there's rarely a way to tell where information comes from. ... Everyone thinks their data practices are good because there have never been any documented abuses stemming from leaks of their data and everyone is fooling themselves.
Many years ago, when I worked on some information systems for direct mail marketing, it was standard practice to include fictional entries in a mailing list, which allowed for the rapid detection of abuse. In this context, abuse generally means using the mailing list for a purpose not authorized by the mailing list owner/administrator, and/or without proper payment. The data owner has an incentive to control abuse, because abuse degrades the value of the data to the owner. The relationship between the data owner and the data user is one of provisional trust, with retrospective sanctions whenever abuses of trust come to light. This relationship works because of the detection mechanism. And the mechanism works because the data user cannot discriminate between the fictional entries and the real ones.
So why doesn't this work for the current spate of privacy violations and identity theft vulnerabilities? Assuming that the fictional entries are properly constructed. There are some technical considerations and some social considerations (including regulation), but the value of such a mechanism should be obvious.
Technorati Tags: identity theft privacy security trust
Friday, April 29, 2005
Dividing Risk
Responsibility for security of credit card transactions is divided between credit card companies and merchants. The credit card companies don't entirely trust the merchants, and want to ensure they take every possible precaution against fraud.
Credit card companies are larger and fewer, so they call the shots. Some elements of risk are unilaterally exported onto the merchant. In case of doubt, the merchant bears the financial burden. This is surely an example of asymmetric trust.
So who is responsible for specifying the security requirements, and designing the security mechanisms? Steven Hofmeyr argues that the credit card companies should leave this as a problem for the merchants to solve. "My suggestion to the credit card companies would be to impose heavy penalties on merchants that get compromised, but not to specify what exactly those merchants should do to make themselves secure." He favours incentives for companies to secure their systems, "without restricting or constraining the way in which they should do so, leaving companies to choose the most effective way", on the grounds that this will encourage innovation in defence, and notes how legislation or regulation often generates such incentives. Hofmeyr's suggestion is endorsed by Adam Shostack.
Given the asymmetry of power, any requirements imposed on merchants by credit card companies are effectively equivalent to regulations. Leaving merchants free to interpret these regulations (and suffer the consequences if their interpretations aren't good enough) may affect the security of the whole ecosystem in some interesting ways.
Firstly, each merchant is faced with fear, uncertainty and doubt. The big companies probably know much more about the possible security mechanisms, and their advantages and disadvantages, but the small companies have to decide for themselves - and woe betide them if they get it wrong. This anxiety effect tends to erode confidence and trust in the network, thus reducing economic efficiency and ethical balance.
Secondly, we may expect considerable diversity of security mechanisms. This diversity may be one of the factors leading to the innovation argued by Hofmeyr. But at the same time, diversity may impede the communication and adoption of innovation, so the effective innovation benefits are not clearcut. Very occasionally, a centrally coordinated development effort may be both more cost-effective and more innovative than a large number of independent parallel developments. So it remains an open question whether the credit card companies should provide more specific guidance, whether they should "own" the security requirements.
Thirdly, the greater the diversity of security mechanism, the smaller the proportion of merchants likely to be affected by any given attack. This appears to be beneficial for the population of merchants as a whole, since it reduces the risk for any individual merchant, and makes some form of mutual insurance viable. Above all, it is beneficial to the credit card companies, whose business would only be seriously threatened by the loss of a significant number of merchants in one incident. However, given the incessant search for new modes of attack, this benefit depends on the collective ability to develop new forms of defence.
In a complex collaboration, a careful division of risk requires detailed analysis, robust negotiation, and attentive governance. Redistribution of risk-responsibility can have a huge effect on the total shared risk within the system, generating both economic and ethical benefits.
Technorati Tags: asymmetry innovation regulation requirements risk security trust
Credit card companies are larger and fewer, so they call the shots. Some elements of risk are unilaterally exported onto the merchant. In case of doubt, the merchant bears the financial burden. This is surely an example of asymmetric trust.
So who is responsible for specifying the security requirements, and designing the security mechanisms? Steven Hofmeyr argues that the credit card companies should leave this as a problem for the merchants to solve. "My suggestion to the credit card companies would be to impose heavy penalties on merchants that get compromised, but not to specify what exactly those merchants should do to make themselves secure." He favours incentives for companies to secure their systems, "without restricting or constraining the way in which they should do so, leaving companies to choose the most effective way", on the grounds that this will encourage innovation in defence, and notes how legislation or regulation often generates such incentives. Hofmeyr's suggestion is endorsed by Adam Shostack.
Given the asymmetry of power, any requirements imposed on merchants by credit card companies are effectively equivalent to regulations. Leaving merchants free to interpret these regulations (and suffer the consequences if their interpretations aren't good enough) may affect the security of the whole ecosystem in some interesting ways.
Firstly, each merchant is faced with fear, uncertainty and doubt. The big companies probably know much more about the possible security mechanisms, and their advantages and disadvantages, but the small companies have to decide for themselves - and woe betide them if they get it wrong. This anxiety effect tends to erode confidence and trust in the network, thus reducing economic efficiency and ethical balance.
Secondly, we may expect considerable diversity of security mechanisms. This diversity may be one of the factors leading to the innovation argued by Hofmeyr. But at the same time, diversity may impede the communication and adoption of innovation, so the effective innovation benefits are not clearcut. Very occasionally, a centrally coordinated development effort may be both more cost-effective and more innovative than a large number of independent parallel developments. So it remains an open question whether the credit card companies should provide more specific guidance, whether they should "own" the security requirements.
Thirdly, the greater the diversity of security mechanism, the smaller the proportion of merchants likely to be affected by any given attack. This appears to be beneficial for the population of merchants as a whole, since it reduces the risk for any individual merchant, and makes some form of mutual insurance viable. Above all, it is beneficial to the credit card companies, whose business would only be seriously threatened by the loss of a significant number of merchants in one incident. However, given the incessant search for new modes of attack, this benefit depends on the collective ability to develop new forms of defence.
In a complex collaboration, a careful division of risk requires detailed analysis, robust negotiation, and attentive governance. Redistribution of risk-responsibility can have a huge effect on the total shared risk within the system, generating both economic and ethical benefits.
Technorati Tags: asymmetry innovation regulation requirements risk security trust
Thursday, April 7, 2005
Click Fraud
Shock announcement: online advertising statistics may be unreliable and subject to manipulation.
The subject of click fraud has been worrying many people of late. It was acknowledged as a risk in the Google pre-IPO documents (Wired, Oct 2004), and was mentioned at an investor conference by George Reyes, Google CFO (CNN Money, Dec 2004). See also ClickZ Network Feb 2005 and Wired, March 2005. (Thanks to Masood Mortazavi.)
Update: further coverage Wired, January 2006.
Tools are quickly springing up, including ClickDefense, ClickLab and ClickSentinel.
Meanwhile, it seems that search engines are currently paying refunds without making much fuss.
Google: “We have regularly paid refunds related to fraudulent clicks and expect to do so in the future.”
Overtures: “We try to be very liberal in our refunds because a big part of what we do is instill trust in our model.”
But can advertisers rely on this? Of course not.
Click fraud is defined in terms of the intent associated with the click. This is inferred from patterns of click, such as the source and frequency (are we getting lots of spurious clicks from competitors, are they trying to increase our costs or distort the charging on certain keywords?) We may presume that as tools and refunds take care of simple click fraud patterns, more complex click fraud patterns will emerge, which will be more difficult to detect and demonstrate.
But all marketing campaigns are vulnerable to people who take the free offer without intending to purchase anything, people who ask lots of questions without having any money, people with nothing better to do than look at stuff they cannot afford and waste the salesman's time. (We call these "tyre-kickers".) Telemarketing is also vulnerable: an automatic dialler can be used to generate calls to a competitor's 800 freephone number. And so on.
Marketing campaigns are also vulnerable to channels that cheat, or can't be bothered to do things properly. Magazines artificially inflate their circulation figures. People paid to hand out leaflets in the street will "accidentally" give you more than one, so as to get through the pile more quickly. And so on.
In this domain, people generally trust because they have no choice - a given marketing opportunity comes with a take-it-or-leave-it trust package. This is commodity trust. Introducing other forms of trust into this domain seems like a tough assignment.
The subject of click fraud has been worrying many people of late. It was acknowledged as a risk in the Google pre-IPO documents (Wired, Oct 2004), and was mentioned at an investor conference by George Reyes, Google CFO (CNN Money, Dec 2004). See also ClickZ Network Feb 2005 and Wired, March 2005. (Thanks to Masood Mortazavi.)
Update: further coverage Wired, January 2006.
Tools are quickly springing up, including ClickDefense, ClickLab and ClickSentinel.
Meanwhile, it seems that search engines are currently paying refunds without making much fuss.
Google: “We have regularly paid refunds related to fraudulent clicks and expect to do so in the future.”
Overtures: “We try to be very liberal in our refunds because a big part of what we do is instill trust in our model.”
But can advertisers rely on this? Of course not.
Click fraud is defined in terms of the intent associated with the click. This is inferred from patterns of click, such as the source and frequency (are we getting lots of spurious clicks from competitors, are they trying to increase our costs or distort the charging on certain keywords?) We may presume that as tools and refunds take care of simple click fraud patterns, more complex click fraud patterns will emerge, which will be more difficult to detect and demonstrate.
But all marketing campaigns are vulnerable to people who take the free offer without intending to purchase anything, people who ask lots of questions without having any money, people with nothing better to do than look at stuff they cannot afford and waste the salesman's time. (We call these "tyre-kickers".) Telemarketing is also vulnerable: an automatic dialler can be used to generate calls to a competitor's 800 freephone number. And so on.
Marketing campaigns are also vulnerable to channels that cheat, or can't be bothered to do things properly. Magazines artificially inflate their circulation figures. People paid to hand out leaflets in the street will "accidentally" give you more than one, so as to get through the pile more quickly. And so on.
In this domain, people generally trust because they have no choice - a given marketing opportunity comes with a take-it-or-leave-it trust package. This is commodity trust. Introducing other forms of trust into this domain seems like a tough assignment.
Thursday, November 27, 2003
Metacommunication and Trust
The speech act "Trust Me" often conveys the exact opposite of its literal meaning. This is an example of metacommunication, as analysed by Gregory Bateson and his associates.
When an agency (whether the Home Office or Police, Inland Revenue or Customs and Excise) behaves mistrustingly towards the population, the rational and symmetrical response may be to regard the agency with equal mistrust. However, the actual response is often an asymmetrical one -- to regard the agency with elevated trust.
And when a technology puts forward a claim that it can perfectly detect fraud or impersonation, the rational and symmetric response may be to regard the technology as the fraudulent one. However, the preferred response is sometimes to wrap the technology in a sociopolitical casing, so that it becomes impervious to purely technical criticism. Notions of fraud, fallibility and repression are no longer amenable to technical judgement, but are under political control. This politically encapsulated technology is what is sometimes called a black box. We trust these black boxes because we have no choice.
Building Dynamic Coalitions (Jane Angelis)
When an agency (whether the Home Office or Police, Inland Revenue or Customs and Excise) behaves mistrustingly towards the population, the rational and symmetrical response may be to regard the agency with equal mistrust. However, the actual response is often an asymmetrical one -- to regard the agency with elevated trust.
And when a technology puts forward a claim that it can perfectly detect fraud or impersonation, the rational and symmetric response may be to regard the technology as the fraudulent one. However, the preferred response is sometimes to wrap the technology in a sociopolitical casing, so that it becomes impervious to purely technical criticism. Notions of fraud, fallibility and repression are no longer amenable to technical judgement, but are under political control. This politically encapsulated technology is what is sometimes called a black box. We trust these black boxes because we have no choice.
Building Dynamic Coalitions (Jane Angelis)
Subscribe to:
Posts (Atom)