It's been an extraordinarily active week on the cybercrime front and it feels like a good time to initiate a new blog I've been thinking about for some time. For those of us that track cybercrime, identity theft and the other activities of Internet miscreants, it's clear that the nature of the game has changed in the last year. Cybercrime, historically an activity driven by testosterone impaired geeks, has become the latest growth industry for organized crime. I'll look at some of the facts and statistics that demonstrate this in the coming weeks, but for now I want to look at some of the more interesting evolving stories.
First, there was the arrest of eleven suspects in the TJX case. For those of you that don't follow internet crime closely, this was the data breach that caused the release of 41 million records (mostly credit card numbers) into the wild. Estimates of losses to date run in the hundreds of millions of dollars. The FBI has been working this case for three years and has arrested the alleged ring leader and the accomplices to which they had access. There are undoubtedly more co-conspirators still at large, but they are most likely in jurisdictions that make their arrest most unlikely.
This is going to be a really interesting case to watch as it evolves as I think we'll learn quite a bit about the current capabilities of law enforcement to investigate this type of crime. It took three years to get the investigation to this point. Given how quickly cybercrime technology and techniques are evolving, it doesn't bode particularly well for the "good guys" in my view.
The second piece of news that struck me last week was Judge Douglas Woodlock's decision to issue a restraining order preventing three MIT students from presenting a paper at the Defcon security conference outlining a series of security holes in the MTA's ticketing system. I'm not sure when the interests of the MTA superseded the first amendment, but Judge Woodlock seems to think they do.
It's somewhat academic at this point as the research paper itself is now available online from the MIT web site. It's going to be interesting to see how long it takes Judge Woodlock order to be overturned and just how much grief he takes from the appellate court if and when that occurs.