The Investigators' Resource Centre

Tips To Avoid Check Fraud

2012-02-17T07:22:00.000-08:00

The 15 worst data security breaches of the 21st Century

2012-02-16T05:57:00.000-08:00

Data security breaches happen daily in too many places at once to keep count. But what constitutes a huge breach versus a small one? For some perspective, we take a look at 15 of the biggest incidents in recent memory. Helping us out are security practitioners from a variety of industries, including more than a dozen members of LinkedIn's Information Security Community, who provided nominations for the list.

1. Heartland Payment Systems
Date: March 2008
Impact: 134 million credit cards exposed through SQL injection to install spyware on Heartland's data systems.

A federal grand jury indicted Albert Gonzalez and two unnamed Russian accomplices in 2009. Gonzalez, a Cuban-American, was alleged to have masterminded the international operation that stole the credit and debit cards. In March 2010 he was sentenced to 20 years in federal prison. The vulnerability to SQL injection was well understood and security analysts had warned retailers about it for several years. Yet, the continuing vulnerability of many Web-facing applications made SQL injection the most common form of attack against Web sites at the time.

2. TJX Companies Inc.
Date: December 2006
Impact: 94 million credit cards exposed.

3. Epsilon
Date: March 2011
Impact: Exposed names and e-mails of millions of customers stored in more than 108 retail stores plus several huge financial firms like CitiGroup Inc. and the non-profit educational organization, College Board.

4. RSA Security
Date: March 2011
Impact: Possibly 40 million employee records stolen.

5. Stuxnet
Date: Sometime in 2010, but origins date to 2007
Impact: Meant to attack Iran's nuclear power program, but will also serve as a template for real-world intrusion and service disruption of power grids, water supplies or public transportation systems.

6. Department of Veterans Affairs
Date: May 2006
Impact: An unencrypted national database with names, Social Security numbers, dates of births, and some disability ratings for 26.5 million veterans, active-duty military personnel and spouses was stolen.

7. Sony's PlayStation Network
Date: April 20, 2011
Impact: 77 million PlayStation Network accounts hacked; Sony is said to have lost millions while the site was down for a month.

8. ESTsoft
Date: July-August 2011
Impact: The personal information of 35 million South Koreans was exposed after hackers breached the security of a popular software provider.

9. Gawker Media
Date: December 2010
Impact: Compromised e-mail addresses and passwords of about 1.3 million commenters on popular blogs like Lifehacker, Gizmodo, and Jezebel, plus the theft of the source code for Gawker's custom-built content management system.

10. Google/other Silicon Valley companies
Date: Mid-2009
Impact: Stolen intellectual property

11. VeriSign
Date: Throughout 2010
Impact: Undisclosed information stolen

12. CardSystems Solutions
Date: June 2005
Impact: 40 million credit card accounts exposed. CSS, one of the top payment processors for Visa, MasterCard, American Express is ultimately forced into acquisition.

13. AOL
Date: August 6, 2006
Impact: Data on more than 20 million web inquiries, from more than 650,000 users, including shopping and banking data were posted publicly on a web site.

14. Monster.com
Date: August 2007
Impact: Confidential information of 1.3 million job seekers stolen and used in a phishing scam.

15. Fidelity National Information Services
Date: July 2007
Impact: An employee of FIS subsidiary Certegy Check Services stole 3.2 million customer records including credit card, banking and personal information.

By Taylor Armerding
http://www.csoonline.com

Nortel hit by suspected Chinese cyberattacks for a decade

2012-02-14T09:15:00.000-08:00

Chinese hackers had access to Nortel files for nearly a decade, the Wall Street Journal reported on Tuesday (Nathan Denette/Canadian Press)

___________________________________________________________________________

Hackers based in China enjoyed widespread access to Nortel's computer network for nearly a decade, according to a report.

The hackers – who appeared to be based in China – had unfettered access to the former telecommunications giant as far back as 2000, according to Brian Shields, a former Nortel employee who launched an internal investigation of the attacks, the Wall Street Journal reports.

They “had access to everything”, Shields told the Journal. “They had plenty of time. All they had to do was figure out what they wanted.”

Over the years, the hackers downloaded business plans, research and development reports, employee emails and other documents.

According to the internal report, Nortel “did nothing from a security standpoint” about the attacks.
Corporate espionage is a growing problem for North American companies, with the majority of attacks coming from China.

China rejects cyberspying allegations

Last November, a group of U.S. analysts said there were as many as 12 different Chinese groups participating in cyberattacks on U.S. companies and government agencies.

China has rejected allegations of cyberspying, saying it is also a target of attacks.

The long-term attack on Nortel isn’t the only time a Canadian company has been targeted by hackers.
During BHP Billiton’s hostile takeover bid for Saskatchewan’s PotashCorp, hackers traced to China targeted Bay Street law firms and other companies to get insider information on the $38-billion corporate takeover.

Those same hackers also targeted Canadian government computers in fall 2010, targeting the Finance Department, the Treasury Board, and Defence Research and Development Canada, a civilian agency of the Department of National Defence.

Nortel attacks went unreported

Nortel, currently selling off assets as part of a 2009 bankruptcy filing, failed to disclose the attacks to potential buyers of its patents and business units, according to the Journal.

During the investigation, the telecom giant made no effort to determine if any of its products were compromised. Nortel, as a publicly traded company, would have been required by the U.S. Securities and Exchange Commission to disclose any “material” risks to investors.

According to Shields, Nortel discovered the hacking in 2004, and the company’s silence put acquiring companies at risk. Three former Nortel executives are currently on trial for allegedly tampering with quarterly results in order to trigger millions of dollars in bonus payments.

With files from The Associated Press

Satellite Phones Hacked! – Eavesdropping On James Bond

2012-02-09T17:50:00.000-08:00

Researchers at a university in Germany have used open-source software to crack the encryption key for satellite telephones in about an hour.

The team bought two readily-available sat phones and downloaded firmware updates for them. The updates revealed the encryption on the sat phones was not much different from regular cell phone GSM encryption, which has been cracked in the past. From there, it did not take much to crack the sat phone encryption.

In some regions of the world standard cell phone communication is still not available. In war zones, developing countries and on the high seas, satellite phones are used instead. Here, the telephone is connected via radio directly to a satellite. This passes the incoming call to a station on the ground. From there, the call is fed into the public telephone network. So far this method was considered secure.

Encryption algorithms are implemented to protect the privacy of the user. There is, as yet, no alternative to the current standards. Since users cannot rely on their security against interception, similar to the security of standard cell phones, they will have to wait for the development of new technologies and standards, or make use of other means of communication for confidential calls.

By Mike Tuttle · February 8, 2012

Innocent Suspects' Response to Interrogation

2012-01-13T09:40:00.000-08:00

The process of interrogation is reserved for suspects whose guilt is reasonably certain. This assessment may be based on a combination of forensic or testimonial evidence implicating the suspect in the crime, circumstantial evidence revealing the suspect's opportunity, access, motive and propensity to commit the crime, or the suspect's behavior, e.g., going into seclusion following the crime, catching the suspect in a known lie, etc.

At John E. Reid and Associates about 80% of suspects who are interrogated provide a corroborated, trustworthy confession.1 We believe that many of the remaining 20% of suspects are guilty of the crime but simply resistant to legally permissible interrogation tactics. However, some of those suspects were deemed by the investigator to be innocent of committing the crime resulting in the termination of the interrogation. This web tip addresses the typical behavior of an innocent suspect during an interrogation.

To understand the innocent suspect's response to interrogation it is important to consider that prior to an interrogation, the investigator has spent 30 or 45 minutes interviewing the suspect. This interview is totally non-accusatory and the suspect does most of the talking. Because of this format, a rapport or trust has been established between the investigator and suspect. On the other hand, during the interrogation of the suspect the investigator does most of the talking. The interrogation represents an effort to persuade the suspect to tell the truth about involvement in the crime under investigation. These persuasive efforts cannot involve threats of consequences or promises of leniency.

Initial Response

When an innocent suspect is initially accused of committing a crime, at the outset of the interrogation, it would be typical for the suspect to reveal indications of disbelief and confusion. On the verbal level the suspect may offer an unequivocal denial as the following dialog illustrates:

I: Joe, our investigation clearly indicates that you are the person who broke into your neighbor's home. I would like to sit down with you so we can get this clarified, OK?

S: That's crazy! I never broke into their house or stole anything from them!

Sometimes however, because of the rapport that has been established between the suspect and investigator during the interview, the innocent suspect will not immediately offer a strong denial following the direct confrontation. Rather, his initial reaction will still be one of disbelief as the suspect patiently waits for the investigator to explain why it is that he thinks the suspect committed the crime.

Early Responses

Even if the innocent suspect offers a denial following the direct confrontation, it is typical of the suspect to sit back in the chair and listen to the investigator for several minutes. In the suspect's mind, he is trying to figure out what went wrong - "Why does the investigator think I committed this crime?"

During early stages of the interrogation, however, the investigator does not present any evidence of the suspect's guilt. Presentation of real or fictitious evidence implicating the suspect in the crime is a possible tactic reserved for later in the interrogation, in response to denials typical of a guilty suspect. Rather, during early stages of the interrogation the investigator attempts to encourage the suspect to accept a concept called a transition statement. An example of a transition statement is, "What will be very important to establish in this case is why this whole thing happened." In an effort to reduce the moral seriousness of the offense, the investigator will then offer the suspect face-saving justifications for committing the crime. These justifications are termed an interrogation theme.

After listening to the investigator's theme for a several minutes the innocent suspect realizes that the investigator is not offering any evidence or explanations as to why the investigation indicates the suspect's guilt. Consequently, the suspect will lean forward in the chair in an aggressive posture reflecting confidence and certainty - he is no longer willing to allow the investigator to dominate the conversation and falsely accuse him of involvement in the crime. The suspect's eye contact will be direct and appear resentful. The investigator will then hear a denial.

Evaluating the Suspect's Denial

This is such a critical stage of the interrogation that an entire step of the Reid Nine Steps of Interrogation is devoted to handling a suspect's denial. Because both innocent and guilty suspects will offer denials during an interrogation, the first objective is to evaluate whether the denial is typical of an innocent or guilty suspect.

The innocent suspect's denial will often be broad and all-encompassing, e.g., "I've never accepted a bribe in my life!" It is also typical of the innocent suspects to use descriptive language during their denial. Examples of descriptive language include "rape", "steal", "rob", "molest" and "murder."

On the paralinguistic level, the innocent suspect's denial has a very characteristic delivery referred to as the use of "clipped-word" endings. Each word of the statement is delivered in a staccato and separated fashion, e.g., "I - did - not - break - into - that - house!" This is a good indication that the suspect is experiencing sincere resentment at being accused of committing the crime, i.e., the suspect is innocent.

Certainly some innocent suspects have less confidence than others; some innocent suspects are introverted, non-emotional or adhere strongly to a belief that it is wrong to challenge authority. Regardless of these intrinsic personality differences, once the innocent suspect offers a denial, he will be persistent in his position. He does not sit back in his chair and entertain the possibility that he may have committed the crime for a morally justifiable reason. Rather, his denials become stronger and stronger and transmit the same message - "You are wrong. I didn't do it!" It may take ten or fifteen minutes, but eventually all innocent suspects will offer persistent, strong, definitive denials.2

Attempts to Terminate the Interrogation

A non-custodial suspect is free to leave the interrogation room at any time. A suspect who is in custody merely has to say, "I don't want to answer any more questions" or, "I want an attorney." If those or similar phrases are uttered by a custodial suspect, the interrogation must be terminated.

However, from a behavioral perspective, the suspect who, upon being confronted with his guilt, immediately leaves the room or invokes his Miranda rights is revealing a clear symptom of guilt. Innocent suspects will remain in the room, argue their innocence and offer strong and persistent denials. Even after the investigator is convinced of the suspect's innocence and goes through a process called, "stepping down" the interrogation, the innocent suspect remains in the room to make certain that the investigator understands that suspect was in no way involved in the offense.

Conclusion

Investigators are not perfect and the process of rendering opinions of guilt or innocence during an investigation is not an exact science. Because of this, innocent suspects will occasionally be interrogated. Critics have tried to suggest that when most innocent suspects are told that there is no question they committed a crime and then are falsely told that evidence implicates them in the crime, that they collapse in the chair, put their head in their hands and blurt out a full confession. As anyone who interrogates on a regular basis can attest, this is certainly not true. However, innocent suspects do respond differently to the interrogation process than guilty suspects. When a suspect's behavioral response to the interrogation fits the description of an innocent person, the investigator should "step down" the interrogation and consider terminating it altogether.

------------------------------------------------------------------------------------------------------------------------
1 In our office we rarely have specific physical or forensic evidence implicating a suspect in a crime prior to an interrogation. When such evidence does exist, the confession rate would likely be higher.

2 This statement assumes that the suspect does not suffer from a significant mental or intellectual impairment and that the investigator did not engage in improper interrogation techniques that threatened consequences or offered promises of leniency. Credit and Permission Statement: This Investigator Tip was developed by JohnE. Reid and Associates Inc. Permission is hereby granted to those who wish toshare or copy the article. For additional 'tips' visit www.reid.com; select'Educational Information' and 'Investigator Tip'. Inquiries regardingInvestigator Tips should be directed to Janet Finnerty johnreid@htc.net. Formore information regarding Reid seminars and training products, contact JohnE. Reid and Associates, Inc. at 800-255-5747 or www.reid.com.

Thousands to be Stripped of Canadian Citizenship in Historic Fraud Sweep

2011-12-23T10:36:00.000-08:00

OTTAWA — The federal government is set to crack down on 4,700 more people believed to have obtained citizenship or permanent resident status illegally in what’s being dubbed the biggest citizenship fraud sweep in Canadian history.

Immigration Minister Jason Kenney is expected to make the announcement that “Canadian citizenship is not for sale” on Friday.

He will unveil the details in Montreal where Nizar Zakka — an immigration consultant suspected of fraud — was arrested in 2009. Zakka is suspected of providing would-be Lebanese immigrants with false evidence — indicating that they were living in Quebec when they were not — to support their cases for permanent residency.

He’s also accused of filing or contributing to the filing of 861 false tax returns for at least 380 clients between 2004 and 2007. The returns allegedly were then used to claim refunds for child care and property taxes as well as the provincial sales-tax credit.

The announcement comes six months after the government moved to strip 1,800 people of their Canadian citizenship or permanent resident status for the same reasons. Up until this year, Canada had revoked just 67 citizenships since the Citizenship Act came into force in 1947.

The bulk of the citizenship fraud cases are said to be linked to Zakka as well as Halifax immigration consultant Hassan Al-Awaid, who was charged in March with more than 50 citizenship fraud-related offences.

The cases are also tied to a third consultant from Mississauga, Ont., west of Toronto, who remains under investigation, according to a government source who noted the others were brought to light thanks to the new citizenship fraud tip line.

Unveiled in September, the tip line already has fielded 5,366 calls.

Letters are currently being sent to the 6,500 people from 100 countries indicating that Canada is revoking their citizenship or permanent resident status due to fraud.

This comes following a lengthy investigation by the RCMP and the Department of Citizenship and Immigration.

Alleged fraudsters, the majority of whom are not currently living in Canada, have up to 60 days to appeal the decision in Federal Court before cabinet moves to void their passports and strip them of all rights and privileges.

According to Citizenship and Immigration, to maintain permanent resident status a person must reside in Canada for at least two years within a five-year period. Permanent residents seeking citizenship must show proof that they’ve lived in Canada for at least three of the last four years before applying.

At the time of Al-Awaid’s arrest, Kenney said he was suspected of helping people “create the appearance they were residing in Canada in order to keep their permanent resident status, and ultimately attempt to acquire citizenship.”

He said investigators had linked Al-Awaid to 1,100 applicants and their dependents, 76 of whom had obtained Canadian citizenship.

He noted that many people were prevented from “fraudulently obtaining citizenship” as a result of the investigation.

The government has been taking action against citizenship fraud for some time. The Cracking Down on Crooked Consultants Act, which imposes tough new penalties for immigration consultants convicted of fraud, including fines and/or prison, is now law in Canada.

Postmedia News

CTTA Offering Surveillance Course

2011-11-03T08:58:00.000-07:00

Level 1 Surveillance Techniques - 3 days

Time:	18 November at 09:00 - 20 November at 17:00

Location:	Canadian Tactical Training Academy 7000, chemin Cote-de-Liesse, Suite #8A, Montreal, Quebec, H4T 1E7

Website:	www.ctta-global.com

	Course Dates: November 18, 19, 20, 2011 Course Description: This is an introductory course designed for individuals and organizations involved with conducting surveillance. This course is 65% hands on accompanied by lectures that focus on the techniques used in conducting a moving or stationary surveillance. The 3-day course consists of 1 day theory, 1 day practical and 1 day scenario based. Requirements: No criminal record, provincial investigator’s permit preferred but not required. Cost: $450 $100 deposit required by November 15, 2011. This course is being given in English. A French course will be offered in spring 2012.

The Social Media Canvass: A 21st Century Law Enforcement Tool

2011-11-01T19:08:00.000-07:00

When a violent crime occurs and the police respond they begin to establish a command post where they plan on where and how to conduct the canvass for additional witnesses. There are many types of canvasses that the police conduct and now we have one with a 21st century twist. Properly conducted canvasses SHAVES hours off investigative time. Here are the different types of canvasses investigators should deploy during a major investigation:

Surveillance Camera Canvass
Hospital Canvass
Additional Witness Canvass
Vehicle Canvass
Evidence Canvass
Social Media Canvass

At the makeshift command post an investigative strategy takes place with the supervisor and the investigators. They develop a plan on what buildings to canvass first for additional witnesses. Generally, they start with the building that faces the scene and spiral outwards from there. However, before doing the traditional canvasses, investigators have a new tool at their disposal, the Social Media Canvass.

The Social Media Canvass allows investigators to follow the conversations about the incident via social media. A couple of clicks or swipes and investigators are “listening to the chatter on the electronic street.” The two most popular social media venues are Twitter and Facebook. Twitter is a lot easier to work with because you don’t need an account to start conducting searches.

For instance, the investigator arrives at the scene of a homicide on Main Street in Anytown. They step over the yellow tape and into the hot zone. Before the investigator whips out his/her’s reporter’s notebook and starts knocking on doors, they’ll pull out the department issued wireless tablet, laptop or smartphone and start searching. This is a better strategy then deciding on what door to knock on. Within seconds of an incident, people in the neighborhood, and sometimes those that are involved, are tweeting or posting on Facebook.

Here is how a search could work. The investigator goes to the Twitter.com search box and uses the hashtag (#) and types what they are looking for. In this scenario, the shooting occurred on Main Street in Anytown, so the separate searches would look something like this: #MainStreet, #MainSt, #Anytown, #ShootingMainStreet or any other combination. Based on the information they see, a better canvass strategy can be developed. Recently while searching for information on a past shooting incident, I found a Tweet that stated in sum and substance, “the cops just showed up at “Bill’s” house be careful of what you post.”

Catching conversations on Facebook is challenging because the investigator needs an account to start searching. That account should be an authorized department account, not their personal one. As easy it is for law enforcement to track suspects, they can track us!

Since there are over 700 million users on Facebook there is a good chance that your suspect has an account, especially if they are in the young adult age range. Before signing onto Facebook with the department’s password, the investigator should conduct a few general searches to narrow the focus. Most, if not all investigators will go straight to Google, but that is not the best search for Facebook. Microsoft’s Bing is Facebook’s default search engine. Another free site that provides an individual’s social media page information without signing up for an account is http://pipl.com.

Once the page is discovered it maybe public, which means limited information, such as a photo, street name, etc., can be viewed without being friends. However, if the page is for friends only, look at the lower left hand part of the screen. It often provides friends of the target’s page. Click on the target’s friends because one of their sites maybe public, which would allow the investigator to enter their world.

As the use of social media by police investigators increases in the short term, there will be many court challenges regarding it’s use in the future. It is important for investigators to follow the policies and procedures set forth by their departments. Do not do anything that can jeopardize your career, the case or your personal safety.

Joseph L. Giacalone is a 19 year NYPD Detective Sergeant with an extensive background in criminal investigations. He has held many prestigious positions, but his favorite was the Commanding Officer of the Cold Case Homicide Squad. Joe obtained a Master of Arts Degree in Criminal Justice with a Specialty in Crime and Deviance from John Jay College of Criminal Justice in 2005. He has been an Adjunct Professor at John Jay since January of 2006 and is the author of the Criminal Investigative Function: A Guide for New Investigators, published by Looseleaf Law. You can follow Joe on Twitter: @ColdCaseSquad or @JoeGiacalone or on the web at: coldcasesquad.com

CSIS spies must follow same rules abroad, watchdog says

2011-10-15T06:28:00.000-07:00

The watchdog body for Canada’s intelligence service has issued its spies a reminder: Rules governing their conduct do not relax once they leave the country.

A partly censored review of the Canadian Security Intelligence Service’s role in interrogating Afghan prisoners overseas was released Thursday. While it cleared CSIS of complicity in any detainee abuse, the report did criticize the country’s spymasters for lax record keeping and for sending CSIS officers overseas without sufficient guidance.

“The standards don’t change because of the arena and theatre that you’re working in,” Arthur Porter, chair of the Security Intelligence Review Committee, said in an interview with The Globe. “We are in a learning curve and we need to point out where things could get tightened up.”

The Security Intelligence Review Committee report concludes the spy service must “ensure that the management of its operations abroad mirrors, to the extent practicable, the standard of accountability and professionalism that is set and maintained domestically.”

Formed in 1984 as a domestic spy service, CSIS has grown increasingly inclined to venture overseas to gather intelligence. Yet Parliament has never given it much direction on its overseas intelligence-gathering – what to do and what not to do.

Dr. Porter pointed out in the interview that Canada’s intelligence operations had been going on in Afghanistan since 2002, but for CSIS “it wasn’t until 2007 and 2008 that the directives matched the field operations.”

One major policy question was how CSIS operatives were to work with agencies who busied themselves with capturing and interrogating Taliban prisoners – including Canadian Special Forces teams and Afghanistan’s notorious National Directorate of Security. Recurring accounts of brutal NDS practices have led NATO countries in Afghanistan to suspend prisoner transfers.

During the review, CSIS officials stressed their role in prison interviews was “very limited.”
“We’re effectively sitting in on CANSOF [Canadian Special Operations] interviews and providing advice if/when warranted,” one said.

The SIRC report finds CSIS operatives never witnessed any prison abuse or torture. Though CSIS tended to espouse that such brutality was unconfirmed, it still took a very “cautious” approach to any information emanating from Afghan prisons – giving much of it “low weight,” the report says.

The problems SIRC did identify were technical. For example, CSIS was so lax in logging prison interviews that it couldn’t say how many it sat in on. “Should CSIS continue to expand its activities abroad .... it will need to improve its record management practices,” the report says.

There was also a lack of guidance from CSIS headquarters as to how field operatives were to weigh and circulate intelligence that might be regarded as tainted.

By Colin Freeze

Biggest ID Theft Bust in History

2011-10-14T08:18:00.000-07:00

The biggest ID theft bust in history is the result of equally impressive international cooperation, observers say.

On Oct. 7, the District Attorney of Queens County, N.Y., and City of New York Police announced the results of a two-year investigation that resulted in the biggest identity theft takedown in U.S. history.
The elaborate scheme, which involved five organized crime rings with ties to Europe, Asia, Africa and the Middle East, resulted in financial losses exceeding $13 million over a 16-month period.
So far, 111 individuals have been indicted, and authorities say 86 are now in custody.

McAfee consultant Robert Siciliano says the bust is a reflection of more international cooperation. "Despite bad blood between countries and their politics, when it comes to fraud regarding economic systems, governments and their security forces are coming together like never before," he says.

The Bust

Dubbed "Operation Swiper," the investigation involved physical surveillance, intelligence gathering and court-authorized electronic eavesdropping on dozens of telephone conversations, many of which required translation from Russian, Mandarin Chinese and Arabic.The fraudsters' focus: credit card fraud, which exploited magnetic-stripe weaknesses the criminals could use to their buying advantage in the United States. Chip-and-PIN technology, known as the Europay, MasterCard, Visa standard in other parts of the world, is not widely deployed in U.S.

More than 90 of the defendants have been charged with Enterprise Corruption under New York State's Organized Crime Control Act. They are accused of being members and associates of organized criminal enterprises that operated in Queens County and elsewhere. Between May 2010 and September 2011, the defendants allegedly defrauded thousands of unsuspecting consumers, financial institutions and card brands, including American Express, Visa, MasterCard and Discover Card.
According to the indictments, the defendants fraudulently obtained credit card numbers that were used to create counterfeit credit and identification cards.

Card numbers are believed to have been sent to crime bosses from individuals in Russia, Libya, Lebanon and China. U.S. employees at restaurants, bars, retail stores and financial institutions also have been linked, using handheld skimming devices and illegal websites to collect consumers' card details.

The counterfeit cards were supplied to hired shoppers who were instructed to purchase high-end electronics and other merchandise, items that could easily be fenced and re-sold, usually over the Internet. Some of the shoppers also have been accused of using counterfeit cards to stay in five-star hotels and rent luxury cars during their so-called shops. In one case, a shopper allegedly commissioned a private jet to travel from New York to Florida.
Fraud analyst and consultant Jerry Silva says the busts should serve as a wake-up call about the growing threat of insider fraud. The use of money mules at restaurants and bank branches is a particularly disturbing part of the case.

"For banks, this calls for renewed focus on employment policies, security measures at the point of customer contact and, at the legislative level, new and stiffer laws and penalties covering workers entrusted with sensitive information - and I would include waiters and merchants in the same breath as bank tellers and representatives - that are found to be misusing or collecting financial data."
Some 20 defendants also have been linked to suspicions of burglaries and robberies throughout Queens County. Seven have been accused of stealing approximately $850,000 worth of computer equipment from the Citigroup Building in Long Island City.

"This is by far the largest - and certainly among the most sophisticated - identity theft/credit card fraud cases that law enforcement has come across," said District Attorney Brown. "Credit card fraud and identity theft are two of the fastest growing crimes in the United States, afflicting millions of victims and costing billions of dollars in losses to consumers, businesses and financial institutions. ... Even after the culprits are caught and prosecuted, their victims are still faced with the difficult task of having to repair their credit ratings and financial reputations. In some cases, that process can take years."

EMV: Lessons for the Financial Industry

International cooperation among various law enforcement agencies and governments cannot be ignored. John Buzzard, who tracks card transaction anomalies for FICO's Card Alert Service, says that level of global interaction is helping to bring down more crime rings than the average consumer realizes.

But the case also highlights the need for a more global approach to payments security. The United States' slow migration away from mag-stripe payments is definitely enabling a sweet spot for fraud.
"The move to chip cards will make an enormous difference in the way our industry manages risk, with the ultimate goal being a significant reduction [in fraud]," Buzzard says. "The U.S. has finally set its sights on chip cards, and over the course of the next three to four years we are going to see a tidal wave of work (and some critical debate) for getting this incredible milestone accomplished. The U.S. is a criminal's playground right now, but this arrest is an excellent beginning."

It's clear the U.S. needs to move to EMV, many experts agree. And Visa's recent announcement to support such a move will undoubtedly prove to be the catalyst U.S. card issuers need.
"MasterCard and the other card brands need to do the same thing, beyond the small ATM-Maestro-related announcement by MasterCard following the Visa one, in order for the global card industry to finally eliminate the Achilles heel of the card industry - magnetic stripes on the back of the cards," says Gartner analyst Avivah Litan.

Enforcement and Global Cooperation

Litan says the international perspective of this bust is interesting. "I think this does point out that U.S. law enforcement has beefed up in multilingual capabilities in Russian, Mandarin and Arabic, which is critical to its activities, and is a big improvement over the situation pre- 9/11," she says.

The bust also highlights the growing global nature of financial fraud. That said, organized crime rings are not localized, but their operations often are, says Aite analyst Julie McNelley. "While the operation spanned the five continents, the focus of this bust appears to be the hub of the operation in Queens," she says.

Unfortunately, many more entities were likely involved and will never get charged.
Neal O'Farrell says scams like the one in Queens are taking place in most large cities, and most times go undetected, uninvestigated and unprosecuted.

"We know there are scams like this being run in almost every city, usually in the $500,000 to $1 million range. That usually makes them too big for local law enforcement to investigate and too small for federal agencies to pick up," O'Farrell says. "The big problem we're seeing is that because the low- to mid-level crooks and gangs are going unchallenged, they simply have more time to get better, perfect their art, steal more, and hide their tracks. By the time law enforcement uncovers them, there's little left to prosecute."

http://www.bankinfosecurity.com/articles.php?art_id=4138

Theresa May loses her diary: It reveals police meetings and, er, a booking to open a furniture shop

2011-09-30T07:56:00.000-07:00

Home Secretary Theresa May was left red-faced after her personal engagements diary was left at a concert hall.

The document contained a print-out of her weekly engagements and included mobile phone numbers, details of meetings with top police officers, and even records of her gym visits.

Scotland Yard was yesterday investigating the blunder, although Home Office officials insisted that the incident was an embarrassment rather than security breach.

The five-page A4 document is circulated every week to officials and detectives.

Loss: Home Secretary Theresa May and Scotland's First Minister Alex Salmond, centre, at the police memorial event in Glasgow where her diary was lost

It was reportedly mislaid by a member of Mrs May’s protection team at Glasgow’s Concert Halls on Sunday, where the Home Secretary had attended a National Police Memorial Day to honour fallen officers.

According to the diary, she was set to meet Keith Bristow, chief constable of Warwickshire, to discuss the role of head of the National Crime Agency.

Other events included the opening of a furniture repair shop called Chissock Woodcraft, near Reading, and a charity cabaret evening at Wentworth Golf Club.

Keith Vaz, Labour chairman of the Home Affairs Select Committee, said: ‘It’s serious that someone with the security importance of the Home Secretary should have her security compromised in this way. It is very disappointing that this has happened.’

Embarrassment: The lost diary belonged to Mrs May, tasked with the nation's domestic security

Shadow home affairs minister Vernon Coaker added: ‘We’ve been warning for some time that you can’t trust Theresa May with public safety and security.

‘This just confirms our worries. She needs to get a grip – not just on her diary, but also her brief.’

The diary – which had the words ‘News of the World’ scribbled in black pen on its front page – was passed to Police Review magazine, which returned it to the Home Office.

A Scotland Yard spokesman said: ‘We are aware that a document was misplaced and are looking into the circumstances of how this occurred. Security was not compromised.

'Following an investigation, and as partof the MPS misconduct process, an officer has been subject to local management action. The officer has not been suspended.'
Britain’s biggest data security breach occurred in 2007, when two discs containing all 25million child benefit records were lost in the Government’s internal postal system.

The diary also revealed a lunch in Glasgow with Police Minister Nick Herbert last Sunday after talks with Strathclyde Police about gang warfare.

By Kirsty Walker

'We didn't mean to track you' says Facebook as social network giant admits to 'bugs' in new privacy row

2011-09-28T08:57:00.000-07:00

Facebook has admitted that it has been watching the web pages its members visit – even when they have logged out.

In its latest privacy blunder, the social networking site was forced to confirm that it has been constantly tracking its 750million users, even when they are using other sites.

The social networking giant says the huge privacy breach was simply a mistake - that software automatically downloaded to users' computers when they logged in to Facebook 'inadvertently' sent information to the company, whether or not they were logged in at the time.

Most would assume that Facebook stops monitoring them after they leave its site, but technology bloggers discovered this was not the case.

In fact, data has been regularly sent back to the social network’s servers – data that could be worth billions when creating 'targeted' advertising based on the sites users visit.

The website’s practices were exposed by Australian technology blogger Nik Cubrilovic and have provoked a furious response across the internet.

Facebook claims to have 'fixed' the issue - and 'thanked' Mr Cubrilovic for pointing it out - while simultaneously claiming that it wasn't really an issue in the first place.

Mr Cubrilovic found that when you sign up to Facebook it automatically puts files known as ‘cookies’ on your computer which monitor your browsing history.

This is still the case. But Facebook claims the cookies no longer send information while you are logged out of its site. If you are logged in to Facebook, the cookies will still send the information, and they remain on your computer unless you manually delete them.

They send Facebook your IP address - the 'unique identifier' address of your PC - and information on whether you have visited millions of websites: anything with aFacebook ‘like’ or ‘recommend’ button on it.

'We place cookies on the computer of the user,' said a Facebook spokesperson - and admitted that some Facebook cookies send back the address of users' PCs and sites they had visited, even while logged out.

'Three of these cookies inadvertently included unique identifiers when the user had logged out of Facebook. We did not store these for logged out users. We could not have used this information.'

However, the site spokesperson said that the 'potential issue' had now been 'fixed' so that the cookies will no longer broadcast information: 'We fixed the cookies so they won't include unique information in the future when people log out.'

'It's just the latest privacy issue to affect a company that has a long history of blunders relating to user's private information.

Mr Cubrilovic wrote: ‘Even if you are logged out, Facebook still knows and can track every page you visit.

‘The only solution is to delete every Facebook cookie in your browser, or to use a separate (web) browser for Facebook interactions.

‘This is not what "logout" is supposed to mean’.

The admission is the latest in a series of privacy blunders from Facebook, which has a record of only correcting such matters when they are brought to light by other people.

Earlierthis year it stopped gathering browser data from users who had never even been to Facebook.com after it was exposed by a Dutch researcher.

The site was forced into a partial climbdown over changes to privacy settings which many claimed made too much public.

Italso came under attack for launching a ‘stalker button’ which allowed users to track another person’s every move in a list which was constantly being updated.

New Design: Mark Zuckerberg talks about a new look for Facebook at a conference earlier this month

Arturo Bejar, one of Facebook’s directors of engineering, admitted that users continue to be tracked after they log out but said that the data was deleted right away.

He said it was to do with the way the ‘like’ feature works, which is a button users can click on to show they like something.

Hesaid: ‘The onus is on us is to take all the data and scrub it. What really matters is what we say as a company and back it up.’

On technology blog CNET, however, users were outraged at what was going on.
One wrote: ‘Who the hell do these people think they are? ‘Trust us?’ Why? Why should we trust a company that spies on us without our knowledge and consent?’
Another added: ‘Holy wow.... they've just lept way past Google on the creepy meter’.

According to U.S. reports Facebook has recently set up its own Political Action Committee, an American term for a lobbying outfit to get its views heard on Capitol Hill.

So far this year it has already spent £352,000 on lobbying, already ahead of last year’s total of £224,000.

The website has also been forced to deny Internet rumours it will begin charging for its services and said it will ‘always be free’.

A spokesman for Facebook said that the login and log out measures were designed for security and were there to prevent fraud.

He added: ‘We to do not use this information to target adverts’.

By Daniel Bates

Pistols Allowed on a Plane

2011-09-22T11:36:00.000-07:00

Police called it a “scary mistake”. But how did it all actually happen? by Zebunnisa Mirza

Aaron Haight was travelling from Vancouver to Collingwood, Ont. for a shooting competition on June 14th, 2011.

With him, he carried a Glock 22 and Baby Eagle 941. Both were legitimately licensed to him. He was given permission by the RCMP to travel with the weapons.

“You’re supposed to declare these and they’re supposed to go through special baggage,” Haight told CTV News. “That’s not what happened this day.”

Air Canada’s customer service agents were on strike. At the check-in counter, Haight told a manager he had two guns. He asked for the form that he knew he needed to fill out in order to bring his firearms with him.

He never said he was a police officer, but what he was handed was police paperwork. The form looked unfamiliar to Haight. But since he was asked to, he went ahead and filled it out anyway. On it he specified that the RCMP had authorized his travel with firearms.

While going through airport security, he was told not to walk through the metal detector. Instead, he was once again asked for his badge. Haight said he didn’t have one and produced his gun license instead. He was allowed to proceed.

“They proceeded me onto the plane,” Haight said. “I was looking around and wondering why are they letting me on here with two pistols in a briefcase?”

Before boarding the flight, Haight asked if it would be a problem to bring the guns on the plane. He was told to give the case to a flight attendant who brought them on board for him.

Midflight, he was asked to produce a badge. Once again he said he didn’t have one. This is when the pilot sounded the alarm and police were called.

Haight was arrested and jailed for three hours before release. The charge? – impersonating an officer.

“Through the investigation it was determined that there was no mention whatsoever on his part that he was a police officer,” Cst. Thomas Ruttan from the Peel Regional police told CTV News. “At some point someone believed he was a police officer, gave him the proper documentation to fill out to actually board the plane with his firearms. It’s a scary mistake.”

A mistake that worries Haight for more than the obvious reason.

“Now as a Canadian I’m wondering, how lenient are we being?”

In a statement issued by Steven Fletcher of the Ministry of state transport he said:

“There are stringent security regulations in place and we expect them to be followed. We take all allegations very seriously.”

Both the airline and the Canadian Airline Transportation Safety Authority (CATSA) have acknowledged the error.

CATSA says they have investigated and taken steps to identify proper paperwork.

Air Canada has also moved to remind their employees of the proper procedures around such dealings.

Let’s hope such a mistake doesn’t happen again.

Now You See It, Now You Don't

2011-09-12T11:19:00.000-07:00

Company Check and Credit Card Fraud

Paul Rodrigues, CFE, CPA, MST, CFF, closed the manila case folder and pondered its contents. A company had engaged his firm to investigate an apparent — but difficult to identify — embezzlement.

Rodrigues heads the fraud and litigation practice and is a principal at Chortek & Gottschalk, LLP, a CPA and business advisory firm specializing in forensic accounting and government and private sector auditing in Chicago, Milwaukee and Washington, D.C.

Pulling out a legal pad, he briefly recapped the facts of the case: $1.2 million missing, and neither the client nor the external auditors had any idea how, when and who might have committed it. "Clever," Rodrigues thought. "What kind of person would be smart and knowledgeable enough to pull this off?" he asked himself.

With 20 years of experience, it did not take Rodrigues long to come up with an answer: someone who knows the client's books inside out and has close tabs on what the auditors look at. Primary suspect: the CFO, who was a CPA and arranged the company's external audits.

Doodling on the pad, Rodrigues next asked himself what a person with that kind of power and information would do to conceal her embezzlement: Perform the illicit transactions during a period outside the audit scope.

That query led to another: Even if the CFO had succeeded in hiding the evidence from the auditors during the review period, how did she hide it from everyone in the company for the rest of the fiscal year?

Rodrigues thought that a key clue in this fraud just might resemble one in Arthur Conan Doyle's "Silver Blaze," a short story that appeared in The Strand magazine in December 1892.

RECOGNIZING WHAT IS MISSING

"The solution to this case depended on a detection technique that's far from new, but that investigators sometimes overlook," Rodrigues said.

He recounted how, in Doyle's intricate tale, Sherlock Holmes is engaged to investigate a case of horse-racing-related fraud. In short order, Holmes noticed that a typical and reasonable occurrence mysteriously had not taken place in this case. It all began in the dead of night when a fraudster abducted Silver Blaze, a champion stallion, from its guarded stable. The horse's groom could not alert anybody because the thief had drugged him. But that was not all.

Here is how Dr. Watson chronicled Holmes's detection of a further clue — one both elusive and informative — that Inspector Gregory of Scotland Yard and everyone else had missed: the stable guard dog had never barked.

" 'Is there any other point to which you wish to draw my attention?' [Gregory asked Holmes].

'To the curious incident of the dog in the night-time.'

'The dog did nothing in the night-time.'

'That was the curious incident,' remarked Sherlock Holmes."

APPLIED ANALYSIS

Rodrigues reasoned that the absence of incriminating transactions during the audited period might spur the auditors to review payments made during the rest of the year. However, unless those payments were suspicious, they would be difficult to distinguish from legitimate ones. Was the only alternative a painstaking and expensive review of the documentation for every transaction over the past year? No, there was a better way, Rodrigues decided. He would look for a typical and reasonable occurrence that had not taken place.

In "Silver Blaze," Holmes correctly concluded that if a stranger had approached the stable, especially at night, the dog would have barked loudly. It therefore was clear that the dog had kept silent because the nocturnal visitor was familiar to him. In fact, the trainer had abducted the horse to inflict a hard-to-detect wound that would hobble the champion in an upcoming race and enrich the crooked trainer, who bet against it.

Analogously, Rodrigues looked for apparently legitimate transactions that occurred throughout the year but not during the period under audit.

"That's exactly what was going on," Rodrigues said. "The CFO knew that the auditors typically examined transactions made during the first and fourth quarters."

Rodrigues saw that seemingly normal payments to certain vendors recurred from April through September each year but not during the auditor's testing periods. That subtle red flag led him to examine those remittances.

"Some of them were 'double' payments to a vendor the CFO's employer did business with," Rodrigues said. "She had obtained a personal credit card from the same issuer that served the company. Because all her personal billing statements went to her home, no one at work knew she had her own account. When the CFO's personal credit card bills were due, she paid them by executing fraudulent transactions at work. Unless you had examined the documentation of the company's payments, you wouldn't have suspected that some of them were for the company's debts and others were for the CFO's personal debts, which of course were not documented in the company's records. The hard part was knowing exactly which payments to look for."

But Rodrigues had made the hard part easy by identifying apparently routine payments that were absent during audit periods. That promptly led him to the fraudulent "needles" in a "haystack" of legitimate transactions. Thus, he quickly solved the case at minimal expense to the greatly relieved and appreciative client. The fraudster avoided prosecution by agreeing to an out-of-court structured settlement that confiscated the proceeds of her company retirement account. The company's insurer also covered part of the embezzlement loss.

TRACKING DOWN THE TRACES
Armed with specialized knowledge and access to every part of an organization's accounting system, such fraudsters as the CFO above can do great damage quickly while leaving few visible signs of their crimes.

"This type of perpetrator won't leave any evidence of disbursements to themselves," Rodrigues said. "And they'll also keep the books in balance by recording off-setting transactions. So, after you've preserved the accounting system's evidence by creating a forensic image, look for changes in check numbers, payees and amounts."

Accounting systems of all sizes have options for maintaining a transaction history. If this feature is turned on, auditors and investigators can use it to examine transactions and determine who executed them and when, Rodrigues said. Even if the log has been disabled, the system still might contain valuable evidence a CFE can retrieve with the help of the system vendor.

The objective is to identify all modified, deleted or voided transactions. Focus first on any modified checks, Rodrigues said, and request images of them from the client company's bank. Then compare each image to how its related disbursement is recorded in the system. This should reveal any instances in which a fraudster has issued checks to himself or to a shell company and modified the system to falsely reflect disbursements to legitimate payees.

In this manner, a CFE also can determine whether fraudsters have altered check payment amounts or check numbers. Rodrigues recalled a case in which a fraudster forged five checks, all with the same check number. Amazingly, the bank paid them all, he said, demonstrating its inattention to protecting depositor funds.

Likewise, CFEs should compare deleted and voided transactions with checks that actually cleared. Send the bank a list of the numbers of all deletes and voids, and request images of any paid checks bearing those numbers. Any matches are leads to whoever endorsed those checks and to the bank where they deposited them.

Equally dangerous and resourceful are fraudsters who cannot modify transactions but succeed in adding phony vendors to the accounting system.

Most businesses search their records monthly or quarterly for vendors that are unapproved or have a name or address similar to that of an employee, Rodrigues said.

"That process will detect the clumsy fraudster," Rodrigues acknowledged. "But a clever fraudster will add to the system an illegitimate vendor he controls, cut a check to that account and then immediately change its status to 'inactive.' Often that conceals the fraud; many companies review only their active vendors. So CFEs should check for payments to inactive vendors. In one of my cases, whenever the fraudster wanted to steal some money, he re-activated the illegitimate vendor he had created, printed a check payable to it, and then changed the status back to 'inactive.' "

A THIEF IN IPANEMA

Chortek & Gottschalk partner David Friedman, CFE, CPA, CFF, CICA, also plays a key role in the fraud and litigation practice, investigating a wide range of check and payment frauds. A common factor in such cases, he said, is insufficient or nonexistent segregation of duties.

"One big case I worked on years ago had this problem in spades," Friedman said. The controller of a small accounting department of a manufacturing company had complete autonomy, including the ability to make wire transfers into and out of — for investment purposes — the $50-million profit-sharing plan. Senior management just did not want to get involved; they found monitoring the plan activity too detailed and tedious.

On the Friday before Labor Day, under the guise of investing, the controller fraudulently wired $9 million from the profit-sharing plan to his bank in Baltimore. He subsequently moved the money to a bank in Miami, then to Bermuda and then on to his bank in Brazil. Saturday morning he flew to Rio de Janeiro.

By the time his employer realized what had happened, the controller had escaped. He had planned and executed his fraud perfectly, knowing that the extradition treaty between the U.S. and Brazil does not apply to money-laundering charges. Years later, he returned to the U.S. after agreeing to return what was left of the money in return for not being prosecuted.

"The moral," Friedman said, "is to segregate all duties that might enable an employee to single-handedly commit such frauds without anyone realizing it."

Do not judge the effectiveness of a transaction approval process solely on quantitative criteria, Friedman cautioned. It is also a matter of which — not just how many — employees are involved. For example, no single officer should be capable of unilaterally authorizing large transactions. Obtaining a second officer's OK should be mandatory.

PAPER'S PRICE AND PERILS

The 2010 Federal Reserve Payments Study observed that although more than three quarters of noncash payments are electronic, paper checks will be with us for some time to come. In 2009 — the most recent period for which data are available — U.S. businesses and individuals wrote 27.5 billion checks.

CFEs therefore must strive to maintain and strengthen their employers' and clients' awareness and mitigation of the risks of paper checks. The ACFE's "Fraud Examiners Manual" and the ACFE website (ACFE Check Fraud Resources) offer extensive technical background and practical guidance on this topic.

Friedman described a client company that devised and then neglected its own unusual plan for protecting its paper check stock.

"A small company converted a gun safe into a storage case for thousands of blank checks," Friedman said. "The storage case was unlocked all day. If a check had disappeared from the bottom of a pile, no one would have noticed for months. Forging a signature was no big deal. Unless the company had additional protection, that check would clear."

Banks offer businesses two versions of additional protection: positive pay and reverse positive pay.

With positive pay, every time a business writes checks, it sends its bank a list of their numbers, amounts, dates and payees, which shows that the checks are valid and that the bank should honor them. The bank will not pay checks that are not on the list. Typically, the system automatically generates the list and sends it to the bank.

With reverse positive pay, the bank notifies the client when someone presents a check for payment. The bank will honor the check unless —within a brief period — the client says not to.

"CFEs should advise their clients never to agree to reverse positive pay," Friedman said. "If you somehow don't timely instruct the bank not to pay a check you don't recognize, the bank has the right to honor it and stick you with the loss if the check turns out to be fraudulent. Positive pay is the safer alternative."

Friedman said he knows of a business that used reverse positive pay because it was cheaper than positive pay. And the company chose an unusual option that Friedman suspects might no longer be available: When a check would come in, the bank would ask the company for permission to honor it. If the company said no or did not answer, the bank would not clear the check.

For a while, the company diligently responded to the bank's requests, and there were no problems. However, when the company closed for the December holidays, the bank did not. Unfortunately, many of the company's checks still had not yet been presented. And when the bank contacted the company no one was there to answer.

"Hundreds of valid checks bounced because the bank never received permission to clear them," Friedman said. "The company had to stop payment on the originals and re-issue them. It reimbursed clients for any losses and changed its procedures, but the damage had been done. It hurt their reputation and cost them $100,000."

Recently, another reason emerged for some companies to consider positive pay.

"Increasingly, businesses that decline positive pay might have to sign a waiver in which they release their bank from liability for any check fraud that would have been discovered if the company had accepted positive pay," Friedman said. "One of the larger banks has implemented this policy, and many smaller ones are following its lead. Positive pay isn't cost-effective for every company. But it's good insurance, and CFEs should recommend it to clients that write numerous checks. Right now it's one of the best ways to protect yourself from counterfeit checks."

Robert Tie is a New York business writer.

The Association of Certified Fraud Examiners assumes sole copyright of any article published on www.fraud-magazine.com or www.ACFE.com. ACFE follows a policy of exclusive publication. Permission of the publisher is required before an article can be copied or reproduced. Requests for reprinting an article in any form must be e-mailed to FraudMagazine@ACFE.com.

Hackers steal SSL certificates for CIA, MI6, Mossad

2011-09-06T11:16:00.000-07:00

Criminals acquired over 500 DigiNotar digital certificates; Mozilla and Google issue 'death sentence'

Computerworld - The tally of digital certificates stolen from a Dutch company in July has exploded to more than 500, including ones for intelligence services like the CIA, the U.K.'s MI6 and Israel's Mossad, a Mozilla developer said Sunday.

The confirmed count of fraudulently-issued SSL (secure socket layer) certificates now stands at 531, said Gervase Markham, a Mozilla developer who is part of the team that has been working to modify Firefox to blocks all sites signed with the purloined certificates.

Among the affected domains, said Markham, are those for the CIA, MI6, Mossad, Microsoft, Yahoo, Skype, Facebook, Twitter and Microsoft's Windows Update service.

"Now that someone (presumably from Iran) has obtained a legit HTTPS cert for CIA.gov, I wonder if the US gov will pay attention to this mess," Christopher Soghoian, a Washington D.C.-based researcher noted for his work on online privacy, said in a tweet Saturday.

Soghoian was referring to assumptions by many experts that Iranian hackers, perhaps supported by that country's government, were behind the attack. Google has pointed fingers at Iran, saying that attacks using an ill-gotten certificate for google.com had targeted Iranian users.

All the certificates were issued by DigiNotar, a Dutch issuing firm that last week admitted its network had been hacked in July.

The company claimed that it had revoked all the fraudulent certificates, but then realized it had overlooked one that could be used to impersonate any Google service, including Gmail. DigiNotar went public only after users reported their findings to Google.

Criminals or governments could use the stolen certificates to conduct "man-in-the-middle" attacks, tricking users into thinking they were at a legitimate site when in fact their communications were being secretly intercepted.

Google and Mozilla said this weekend that they would permanently block all the digital certificates issued by DigiNotar, including those used by the Dutch government.

Their decisions come less than a week after Google, Mozilla and Microsoft all revoked more than 200 SSL (secure socket layer) certificates for use in their browsers, but left untouched hundreds more, many of which were used by the Dutch government to secure its websites.

"Based on the findings and decision of the Dutch government, as well as conversations with other browser makers, we have decided to reject all of the Certificate Authorities operated by DigiNotar," Heather Adkins, an information security manager for Google, said in a Saturday blog post.

Johnathan Nightingale, director of Firefox engineering, echoed that late on Friday.

"All DigiNotar certificates will be untrusted by Mozilla products," said Nightingale, who also said that the Dutch government had reversed its position of last week -- when it had asked browser makers to exempt its DigiNotar certificates.

"The Dutch government has since audited DigiNotar's performance and rescinded this assessment," Nightingale said. "This is not a temporary suspension, it is a complete removal from our trusted root program."

On Saturday, Piet Hein Donner, the Netherlands's Minister of the Interior, said the government could not guarantee the security of its websites because of the DigiNotar hack, and told citizens not to log into its sites until new certificates had been obtained from other sources.

The DigiNotar breach is being audited by Fox-IT, which told the Dutch government that it was likely certificates for its sites had been fraudulently acquired by hackers.

Several security researchers said the move by browser makers puts an end to DigiNotar's certificate business.

"Effectively a death sentence for DigiNotar," said Jeremiah Grossman, CTO of WhiteHat Security, in a Friday tweet.

Mozilla was scathing in its criticism of DigiNotar.

Nightingale ticked off the missteps that led Mozilla to permanently block all sites signed with the company's certificates, including DigiNotar's failure to notify browser vendors in July and its inability to tell how many certificates had been illegally obtained. "[And] the attack is not theoretical," Nightingale added. "We have received multiple reports of these certificates being used in the wild."

Markham went into greater detail on the hack and its ramifications. "It has now emerged that DigiNotar had not noticed the full extent of the compromise," said Markham in a Saturday post to his personal blog. "The attackers had managed to hide the traces of the misissuance -- perhaps by corrupting log files."

Because the Google certificate that prompted DigiNotar to acknowledge the intrusion was obtained before most of the others, Markham speculated that there had actually been two separate attacks, perhaps by different groups.

"It is at least possible (but entirely speculative) that an initial competent attacker has had access to [DigiNotar's] systems for an unknown amount of time, and a second attacker gained access more recently and their less-subtle, bull-in-a-china shop approach in issuing the [hundreds of] certificates triggered the alarms," he said.

Last week, Helsinki-based antivirus company F-Secure said it had found signs that DigiNotar's network had been compromised as early as May 2009.

Mozilla will update Firefox 6 and Firefox 3.6 on Tuesday to permanently block all DigiNotar-issued certificates, including those used by the Dutch government.
On Saturday Google updated Chrome to do the same.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, on Google+ or subscribe to Gregg's RSS feed . His e-mail address is gkeizer@computerworld.com.

Canadian Tactical Training Academy: The Passing Of A legend And A Friend - John T. McA...

2011-08-28T08:54:00.000-07:00

Canadian Tactical Training Academy: The Passing Of A legend And A Friend - John T. McA...: It is with a heavy heart that we mourn the passing of our adjunct instructor, warrior, friend, colleague, and mentor John T. McAleese. Jo...

Anti-Terror Program ‘Kept New York Safe,’ – NYPD

2011-08-25T18:59:00.000-07:00

The NYPD and CIA sent undercover agents to watch mosques, bookstores and cafés in Muslim neighborhoods to sniff out terror plots – a tactic cops say helped them thwart seven planned attacks.

The Daily News largely confirmed the details of an Associated Press report revealing the existence of what it called the NYPD’s Demographic Unit, which uses “mosque crawlers” to gather information.

Critics charge the operation to gather intel on the city’s imams, cabbies and street-meat sellers blurs the line between foreign and domestic spying and stretches legal limits on racial profiling.

NYPD Deputy Commissioner Paul Browne blasted the AP story, saying it was “marked by outright fiction,” and insisting there’s no such thing as “mosque crawlers.”

Browne said cops did nothing wrong in their efforts to combat terrorism – and foiled some major plots in the process.

“We’re going to do all we reasonably can to keep New York safe,” he said. “And we uphold the Constitution in doing so.”

He said there have been at least 13 major plots against New York since 9/11 and pointed to seven cases in which information from the NYPD’s Intelligence Unit helped nab would-be terrorists.

“We commit over a thousand officers to the fight every day to stop terrorists who’ve demonstrated an undiminished appetite to come back and kill more New Yorkers,” Browne said.

“We don’t apologize for it.”

City Councilman Peter Vallone, head of the Public Safety Committee, was even more blunt.

“Maybe they should infiltrate a few sewing clubs, just to be politically correct?” he asked rhetorically. “Clearly, they are going where they reasonably believe terrorist activity could be.”

One source said the department has deep undercovers who live as members of different communities to keep a constant watch for danger.

Top cop taps CIA veteran

The counterrorism operation was started by CIA veteran David Cohen, who was tapped in 2002 by Police Commissioner Raymond Kelly, who thought the 9/11 attacks proved the NYPD could no longer rely on the feds to protect the city.

Cohen and another agency veteran, Larry Sanchez, created an operation inside the NYPD with spies and analysts and an unprecedented international scope. The AP said Sanchez stayed on the CIA payroll while maintaining offices at Police Headquarters and the CIA station in New York.

The revelations of surveillance of New York’s Muslim community reignited the verbal battle about freedom versus security, one that has been smoldering since 9/11.

“The question we should all have is whether the NYPD is operating a domestic CIA – but without the oversight or regulations that hold it in check,” said Donna Lieberman, executive director of the New York Civil Liberties Union.

“You call the U.S. a free country and you do this?” asked Shahid Malick, 28, a Pakistani cabbie from Bay Ridge.

“From now on, I can’t feel safe in my own mosque because someone might be sitting behind me spying.”

But Saleem Akbar, 58, a fabric store owner who is the unofficial mayor of Midwood‘s large Pakistani community, said the cops are trying to protect everyone in the city.

“They are doing it for your children and my children. I don’t mind even if they are doing it secretly. If someone is hatching a conspiracy, they are hiding it from me, too. I want them found out,” Akbar said.

“U.S. security comes first. I don’t care if they are doing it in mosques. I don’t care if they are doing it in airports. I’m glad they are doing it.”

The AP said arrests for even minor crimes could become leverage to persuade someone to become an informant and young Middle Eastern men are singled out for extra questioning.

Rep. Peter King (R-L.I.), chairman of the House Homeland Security Committee, said he’s confident the department is abiding by the Constitution.

“I don’t see civil rights abuses,” King said.

“Everyone was critical of law enforcement after 9/11 for not thinking out of the box. The NYPD is getting the job done.”

One source familiar with the NYPD counterterror operations said the only way to root out jihadists is to hang out where they might be.

“If you’re looking for the IRA, you don’t go to Katz’s Deli – you go to an Irish pub,” the source said.

The cases against Shahawar Matin Siraj, who was found guilty in 2006 of plotting to bomb the subway, and the two men arrested at Kennedy Airport on their way to join terrorists in Somalia, were developed in such a manner.