The Great Cyberheist

One night in July 2003, a little before midnight, a plainclothes N.Y.P.D. detective, investigating a series of car thefts in upper Manhattan, followed a suspicious-looking young man with long, stringy hair and a nose ring into the A.T.M. lobby of a bank. Pretending to use one of the machines, the detective watched as the man pulled a debit card from his pocket and withdrew hundreds of dollars in cash. Then he pulled out another card and did the same thing. Then another, and another. The guy wasn’t stealing cars, but the detective figured he was stealing something.

Indeed, the young man was in the act of “cashing out,” as he would later admit. He had programmed a stack of blank debit cards with stolen card numbers and was withdrawing as much cash as he could from each account. He was doing this just before 12 a.m., because that’s when daily withdrawal limits end, and a “casher” can double his take with another withdrawal a few minutes later. To throw off anyone who might later look at surveillance footage, the young man was wearing a woman’s wig and a costume-jewelry nose ring. The detective asked his name, and though the man went by many aliases on the Internet — sometimes he was cumbajohny, sometimes segvec, but his favorite was soupnazi — he politely told the truth. “Albert Gonzalez,” he said.

===============================

 

For the rest of this interesting story, go to: http://www.nytimes.com/2010/11/14/magazine/14Hacker-t.html?_r=2

CUs Filing More Reports of Suspicious Activities

Credit unions filed 9% more Suspicious Activity Reports last year, according to data released by the Treasury Department.

Last year there were 57,179 such reports, compared with 52,432 in 2007. At all depository institutions, there were 732,563 reports last year, compared with 649,176 in 2007.

Since 1996, when the information began being gathered in its present form, there have been 227,865 suspicious activity reports filed by credit unions, 48% were filed in 2007 and 2008.The data is compiled by the Financial Crimes Enforcement Network, a division of the Treasury Department.

Credit unions filed 9% more Suspicious Activity Reports last year, according to data released by the Treasury Department.Last year there were 57,179 such reports, compared with 52,432 in 2007. At all depository institutions, there were 732,563 reports last year, compared with 649,176 in 2007.Since 1996, when the information began being gathered in its present form, there have been 227,865 suspicious activity reports filed by credit unions, 48% were filed in 2007 and 2008.

The data is compiled by the Financial Crimes Enforcement Network, a division of the Treasury Department.

Biometric Face Recognition System Leads to First Arrest

The Sagem Morpho MorphoFace Investigate (MFI) system has scored its first arrest in Pierce County, Washington. The Pierce County Sheriff’s Department used the MFI biometric facial recognition application to identify a suspect by comparing an automatic teller machine (ATM) photograph against the department’s digital database of 350,000 mug shots.

Sagem Morpho’s MFI is a robust and scalable facial recognition application that includes case evidence management, biometric matching, and forensic evaluation tools for investigative and crime solving tasks. The automated system enables law enforcement and intelligence analysts to quickly compare photographs of suspects against large databases of images, such as mug shot, driver’s license, or terrorist watch lists, and make identifications within seconds.

Located in the Seattle Metropolitan area, the Pierce County Sheriff’s Department (PCSD) became the first law enforcement agency in the United States to deploy the MFI system as part of a pilot initiated in summer 2008. In the booking process, PCSD uses an Automated Fingerprint Identification System (AFIS) to check if a suspect is in its criminal database and then fingerprint examiners to validate the results. The addition of the facial recognition tool for mug shot comparison allows PCSD to validate biometric identifications with a single examiner, reducing demands on staff and speeding the overall process.

“[MFI] eliminates 80 to 85 percent of the work in booking repeat offenders,” said Steve Wilkins, PCSD Forensic Investigations Manager. “Within minutes, the criminal record can be updated.”
PCSD took the MFI application a step further in September to help break up a local identity theft ring that had been stealing ATM cards and using them to withdraw money from the victims’ bank accounts. The only evidence obtained by detectives was a grainy photograph taken of a suspect by an ATM camera during one of the fraudulent transactions. Despite the poor quality of the photo, MFI searched the 350,000-mug shot digital database and returned two possible matches in less than 5 seconds.

Hundreds of Thousands of Laptops Lost at U.S. Airports Annually

This is a weird statistic:

Some of the largest and medium-sized U.S. airports report close to 637,000 laptops lost each year, according to the Ponemon Institute survey released Monday. Laptops are most commonly lost at security checkpoints, according to the survey.

Close to 10,278 laptops are reported lost every week at 36 of the largest U.S. airports, and 65 percent of those laptops are not reclaimed, the survey said. Around 2,000 laptops are recorded lost at the medium-sized airports, and 69 percent are not reclaimed.

Travelers seem to lack confidence that they will recover lost laptops. About 77 percent of people surveyed said they had no hope of recovering a lost laptop at the airport, with 16 percent saying they wouldn't do anything if they lost their laptop during business travel. About 53 percent said that laptops contain confidential company information, with 65 percent taking no steps to protect the information.

I don't know how to generalize that to a total number of lost laptops in the U.S.; let's call it 750,000. At $1,000 per laptop -- a very conservative estimate -- that's $750 million in lost laptops annually. Most are lost at security checkpoints, and I'm sure the numbers went up considerably since those checkpoints got more annoying after 9/11.

Ten Most Recent Database Thefts

University Health Care (Utah) - [2008-03-13]
(Stolen laptop contains 4,800 patients' names, Social Security numbers, and health information) [archive]

Harvard University - [2008-03-12
(Personal information of 10,000 including 6,500 Social Security numbers possibly compromised from hack) [archive]

Blue Cross Blue Shield of Western New York - [2008-03-10]
(Missing laptop contains "vital information" of an estimated 40,000) [archive]

MTV Networks - [2008-03-08]
(External breach exposes about 5,000 names and Social Security numbers) [archive]

Cascade Healthcare Community - [2008-03-06]
(Computer virus exposes credit card information, names, and addresses of more than 11,500) [archive]

Nevada Department of Public Safety - [2008-03-05]
(Social Security numbers and addresses of 109 on lost thumb drive) [archive]

Madeley Health Centre (UK) - [2008-03-05]
(Names, addresses, dates of birth and medical treatment details of 238 on stolen memory stick) [archive]

Kraft Foods - [2008-03-03]
(Missing laptop contains names and possibly Social Security numbers of 20,000) [archive]

Wellesley Health Department - [2008-02-29]
(Social Security numbers, names, addresses, and dates of birth for about 480 lost from open envelope) [archive]

Health Net Federal Services - [2008-02-27]
(Social Security numbers for 103,000 posted on web) [archive]

More information is available at: http://attrition.org/dataloss/

For a graphic of the top 10 database breaches since 2000, go to: http://tinyurl.com/244gwl

An inside job: Funds missing from Houston Police FCU

More than $300,000 may be missing from the Houston Police Department FCU the credit union recently discovered. A branch manager discovered an undetermined amount of missing funds from the credit union's vault Tuesday while conducting an audit, police said (Khou.com Jan. 30).

Although neither the credit union nor police would say how much money was missing, sources said it was more than $300,000, according to sources. The Houston Police Department scheduled polygraph tests at the credit union Tuesday, KHOU said.

Houston Police FCU has more than 25,000 members--mostly police, civilian employees of the police force and their families. The credit union has about $300 million in assets.