DarkMarket_ Cyberthieves, Cybercops and You - Misha Glenny [2]
In Brazil, I learned very quickly that twenty-first-century crime is different.
Most importantly, it is much much harder to identify when people are up to no good on the Web. Laws governing the Internet vary greatly from country to country. This matters because in general a criminal act over the Web will be perpetrated from an IP (Internet Protocol) address in one country against an individual or corporation in a second country, before being realised (or cashed out) in a third. A police officer in Colombia, for example, may be able to identify that the IP address coordinating an assault on a Colombian bank emanates from Kazakhstan. But then he discovers that this is not considered a crime in Kazakhstan, and so his opposite number in the Kazakh capital will have no reason to investigate the crime.
Many cyber criminals have the intelligence to research and exploit such discrepancies. ‘I never use American credit or debit cards,’ one of Sweden’s most successful ‘carders’ told me, ‘because that would put me under the legal jurisdiction of the United States wherever I am on the planet. So I just do European and Canadian cards, and I feel both happy and safe with that – they will never catch me.’
The divide separating the United States from Europe and Canada is most important, as these are the areas where the highest concentration of cybercrime victims live. The latter territories have much stronger laws in force to protect individual liberties and rights on the Web. Successive US governments have granted greater powers to law enforcement than most European governments would contemplate, allowing officers easier access to data from private companies, in the name of fighting crime and terrorism.
The implications of this are both profound and, for the moment, impenetrable. Concerns about crime, surveillance, privacy, the accumulation of data by both private and state institutions, freedom of speech (step forward WikiLeaks), ease of access to websites (the so-called net neutrality debate), social networking as a political tool, and national-security interests constantly bump up against one another in cyberspace.
One might argue, for example, that Google’s multi-platform, multitasking omnipresence violates the principles of America’s anti-trust legislation and that the agglomeration of all that personal data is both an opportunity for criminals and a threat to civil liberties. Yet Google might well respond that the very essence of its genius and success lies in its multi-platform, multitasking omnipresence and that this in itself promotes America’s commercial and security interests. If it wishes, the US government can access Google’s data using legal procedures within hours and, because Google gathers data from all over the world, this gives Washington an immense strategic advantage. Other governments should be so lucky. Unlike its Chinese, Russian or Middle Eastern counterparts, the American government does not need to hack Google to explore its secrets. It can get a court order instead. Would you really give that up in the name of anti-trust legislation?
The Internet is one big-bubble theory – you solve one problem affecting it, but another, seemingly intractable, pops up elsewhere.
And the biggest problem of all for law enforcement is anonymity. For the moment, it remains perfectly possible for anybody accessing the Internet with the requisite and learnable knowledge to mask the physical location of a computer.
There are two primary ways of doing this – the first cyber wall is the VPN or Virtual Private Network, whereby a group of computers can share a single IP address. Usually the IP address relates to a single machine, but with a VPN several computers in entirely different places around the world can appear to be situated in Botswana, for example.
For those who are not satisfied with the VPN as protection, they may also build a second cyber wall by using so-called proxy servers. A computer that is located in the