From 1963 to 2013: Two Robberies and How The Thieves Got Away

Last week brought news of two robberies that happened five decades apart:  the Great Train Robbery of 1963 and the Great Target Data Breach of 2013.  A comparison of the two tells us something about how the business of thievery has changed over the years, and how likely it is that criminals who execute large-scale thefts like these today will be punished for their misdeeds.

But first, the tale of Ronald Biggs.  On his 34th birthday, August 8, 1963, he assisted a dozen or so partners in crime in an elaborate scheme to divert a British mail train carrying some $7 million in banknotes (equivalent to about $50 million today).  Back then, the Bank of England had the bad habit of shipping large amounts of physical currency from one bank to another, and the thieves caught wind of a shipment and successfully heisted it all.  Biggs' fingerprints were found and he was captured quickly and sentenced to a long jail term.  But less than two years later, he staged a daring escape and made his way first to Australia, then to Brazil, living a life of debauched indolence and occasionally taunting the British authorities by consenting to interviews with visiting newspeople.  However, as he became aged and sick, home looked better than ever, and he returned to England in 2001, expecting a pardon.  What he got instead was a jail sentence, which he served until 2009 when he was released on account of poor health.  He died Dec. 18, a hero to rebels everywhere but a convicted criminal nonetheless.

Only three days earlier, the giant U. S. retailer Target announced that from Nov. 27 to Dec. 15, an elaborately planned hack of their point-of-sale terminals acccomplished the theft of as many as 40 million credit and debit card numbers, names, and one of the two types of card security codes (the one embedded in the magnetic stripe, not the one printed on back of the card).  The potential value of this data on the black market is comparable to the $50 million or so that Biggs and his cohorts nabbed.  This particular piece of information came uncomfortably close to home when I discovered that my wife had used our debit card at Target for Christmas shopping recently.  Fortunately, she used it after Target said they had stopped the breach, but some 40 million people weren't so fortunate.

Catching Ronald Biggs was a matter of examining physical evidence such as fingerprints.  The digital fingerprints left by the Target thieves are much harder to trace.  Late word is that security experts have localized the source of the hack to Southeast Asia, but they may well encounter a brick (or bamboo) wall in their investigation at that point.  The global village metaphor is overused, but from a digital point of view, we really do live practically in each others' laps, with millisecond access to any of millions of computers around the world possible from my lowly laptop here on my desk in Texas.  But the uniformity of jurisdiction that allowed English detectives to move freely and quickly to investigate the Great Train Robbery does not exist across international boundaries, and it's hard to imagine how this situation would change.

There is some precedent in the way that international technical standards are worked out by so-called "working groups" that gather voluntarily to decide on a given technical problem.  But such groups have an automatic unity of purpose that the law-enforcement agencies of different countries do not share.  In some parts of the world, the criminal element is almost indistinguishable from the legitimate government.  Somalia comes to mind, and North Korea, where counterfeiting is regarded as a legitimate act of war.  The only way you could catch cyber-criminals who are harbored by such governments is to go to war with the government, and that measure is a little extreme even for the most dedicated law-and-order types. 

Fortunately for the millions of Target shoppers who were caught with their numbers down, so to speak, the big losers in such thefts are not the individual credit-card holders (whose liability is usually limited to $50) but the retailer whose system was breached, and the credit-card companies and banks themselves.  There will be lawsuits, surely, but the chances of recovering either the data or the money stolen by means of the data are small, if the history of similar breaches is any guide. 

In many European countries, a more complex type of credit card is used, one which has a microchip embedded in it that generates a different security code every time it is used.  It's much harder to hack the microchip type of card than it is to hack the old-fashioned magnetic-stripe variety that dominates the U. S. market.  But because the microchip card will require massive retooling at retailer point-of-sale systems and in the systems of credit-card issuers, the industry has resisted it so far.  According to the president of the Connecticut Bankers Association, MasterCard and Visa have promised to roll out the microchip cards by 2015, but this assumes that retailers won't block it by protesting it will cost them too much.  However, if the banks tell the retailers that they will be liable for fraudulent charges unless they switch to the new system, that may persuade reluctant retailers to get with the program.

As long as there is money and other valuables, there will be people who want to steal.  And the Target data breach is just the latest in a long series of cops-and-robbers escapades that goes all the way back to cavemen filching another tribe's giant-mastodon meat, no doubt.  But let's hope that the credit companies, banks, and retailers get their act together sufficiently to give us a well-tried microchip technology soon, one that at least makes it harder for thieves to break in and steal your credit-card number. 

Sources:  I referred to articles on Ronald Biggs in the Washington Post at

http://www.washingtonpost.com/world/europe/ronnie-biggs-notorious-participant-in-great-train-robbery-dies-at-84/2013/12/18/3f142a38-c5da-11df-94e1-c5afa35a9e59_story.html and the New York Times at http://www.nytimes.com/2013/12/19/world/europe/ronnie-biggs-great-train-robber-dies-at-84.html.  I used information on the Target data breach from NBC News at

http://www.nbcnews.com/technology/massive-target-credit-card-breach-new-step-security-war-hackers-2D11778083, from Forbes at http://www.forbes.com/sites/anthonykosner/2013/12/20/targets-biggest-pr-mistake-with-credit-card-security-breach/, and from an AP report carried by the Boston Globe at

http://www.boston.com/2013/12/20/fury-and-frustration-over-target-data-breach/LAEw7wmAeKBl0MJk0lBRDL/story.html as well as a Fox News report at

http://www.myfoxtwincities.com/story/24274470/target-victims-not-financially-responsible-for-credit-fraud.  The Connecticut banker was quoted by the Connecticut Post at http://www.ctpost.com/local/article/New-credit-card-features-may-prevent-breaches-5083388.php, and I referred to the Wikipedia article on card security codes. 

Cybercrime: Prevention or Punishment?

Last week I needed an item at a Harbor Freight store in Austin.  Harbor Freight deals in low- to mid-priced tools imported from China, and unless you’re looking for something that will last for decades, it’s a good place to shop.  As soon as I walked in the door, one of the cash-register attendants came up to me and said, “Just to let you know, our registers are down and all we’re taking is cash right now.”  I’m one of those troglodytes (look it up) who prefers cash anyway, so this didn’t bother me other than the fact that I had to wait in a long line that was backed up because the sales clerk had to look up each item’s SKU on a handheld unit, write down the price by hand, add up the total on a calculator, and make change. When I paid for my item, the clerk asked me if I minded not getting a receipt.  I replied, “Not as long as somebody doesn’t stop me at the door for shoplifting.” 

While I was waiting in line, I saw posted next to the register a notice from Eric Smidt, Harbor Freight’s president.  It was about a recent incident of hacking that resulted in the theft of a large number of their customers’ credit-card numbers, and said that the firm was taking every possible step to deal with the problem.  Whether this issue had anything to do with their registers going down that day is unclear, but it got me to thinking about the differences between old-fashioned analog theft and cybercrime.

Now if dozens of Harbor Freight customers had been koshed on the heads as they left the stores and had their wallets taken, I bet you would have heard about it in the news.  Old-fashioned personalized one-on-one crime like that is much more likely to be reported by the injured individual, and because the criminals tend to be local, the local jurisdiction responsible has a fairly straightforward job on its hands, once the crook is identified.  But those responsible for the Harbor Freight data breach could be literally anywhere in the world that there is an Internet connection, which means just about anywhere in the world. 

Cybercrime is a lot less risky.  According to online reports, the Harbor Freight breach may have been one of 2013’s largest in terms of numbers stolen, comparable to a similar attack that netted about 2.4 million customer debit and credit card numbers.  The company found out about the attack in June, when credit-card firms began noticing a lot of fraudulent charges to accounts owned by Harbor Freight customers.  Apparently the hackers penetrated the company’s main network and gained access to data from all 400 of its retail stores.

There are several ways the criminals can profit from their ill-gotten numbers.  The retail way is to use the cards themselves to buy stuff they want.  My own credit-card number was stolen this way once, and in the list of charges that my bank seriously doubted I’d made were things like services at an upstate New York spa and jewelry charged to a Las Vegas store.  But the big money is in the wholesale underground exchange of hard cash for hot credit-card lists, and I suspect that is what the Harbor Freight crooks did with their numbers.

Because it’s so hard to catch and convict cyber criminals, most companies rely instead on anti-virus software, firewalls, and other protective measures rather than spending a lot of effort in working with law enforcement personnel to catch the perpetrators.  But a recent study by a group of researchers based in Cambridge, England points out that this may not be the most cost-effective approach. 

The study shows that the amount of money lost per person to number theivery such as occurred with the Harbor Freight customers is in the range of a few dollars per customer per year.  On the other hand, the money spent by firms on computer security measures may exceed what is lost to this type of cybercrime.  The authors say it might be cheaper overall to spend more money on tracking down the relatively small number of cyber criminals, and less on security measures.

That is good advice as far as it goes, but it neglects the hard problem of jurisdictional diversity, as you might call it.  Say you can locate the Harbor Freight perpetrators, and they turn out to live in a country that has a dysfunctional government that can’t enforce ordinary laws, let alone laws about cybercrime.  Short of mounting an armed invasion of the country to catch the crooks, a private firm or even another sovereign country has its hands tied.  Unless some effective international agreements could be made for the extradition of cyber criminals, and some uniform laws passed in every host country that makes the same actions illegal everywhere, it will continue to be very hard to punish those who steal data across international boundaries.  Look at the trouble the U. S. government has had with Eric Snowden, who committed a data breach of NSA information right here in the U. S. and then ran off with it to Russia, which has recently granted him asylum.  Once international relations and antagonisms get mixed into a criminal act, things get vastly more complicated.

Overall, we benefit greatly from the worldwide coverage of the Internet for both global commerce and less quantifiable benefits such as the freedom to communicate political and cultural ideas across boundaries.  These benefits come at a cost, however, and it looks like unless the international jurisdiction problem can be addressed more effectively than it has been in the past, we will have international cybercrime with us for the foreseeable future.  And despite Eric Smidt’s assurances, which I’m sure are sincere, the next time I go to Harbor Freight I think I’ll bring cash along.  But I think I’ll ask for a receipt.

Sources:  A report on the Harbor Freight data breach can be found at the Bank Info Security website at http://www.bankinfosecurity.com/impact-harbor-freight-attack-grows-a-5970/op-1.  The Cambridge cybercrime report is discussed at gcn.com/Articles/2012/06/18/Cost-of-cybercrime-Cambridge-study.aspx.  And the difficulties of prosecuting crimes in different jurisdictions are described well by Deb Shinder at http://www.techrepublic.com/blog/it-security/what-makes-cybercrime-laws-so-difficult-to-enforce/.