Hackers stole $650k and got away, showing limits to law enforcement’s reach
wsj.com
wsj.com
Luckily, several of those customers theoretically had policies against changing payment directives without phone confirmation, which were not followed, so they are taking some shared responsibility for this.
I can recommend their portal/system so far, maybe it’s shit, I don’t think so though.
This is like saying: If you leave the door to your house open, and someone robs you, we will pay to show you how to lock your front door.
He once offered me (with no witnesses) a check writing machine that was still loaded with a spool of thousands of blank corporate checks. Knowing what would be considered a rounding error with the billing & accounting systems there, I probably could have made off with a fair amount of loot. It still surprises me to this day that he didn't really realize what he had and what it could do, but then again he didn't get a lot of sunlight, so...
More and more people finally realizing the police don’t help them, one crime at a time.
So yes, not every crime gets investigated. No, it's not because they just don't feel like helping people.
Also, some people think there are different people working on these types crimes. But because every criminal has a phone, a lot of work in physical crimes is digital. Therefore the amount of people working on on digital crimes is small and they often work on really large cases, like Darknet markets etc.
That's the thing, I don't focus on cyber crimes, I focus on regular crime. There's always a digital aspect in crimes these days.
I can't tell you what you can join in the US, however, since that's not where I'm located. But it could be useful to check vacancies at local police forces, since they might also have positions for people with digital skill sets, just not cyber crime related, per se.
https://medium.com/@ScottMcGready/breaking-the-lock-on-cscv-...
Good people shouldn't do that job, because either they'll stop being good people (either by becoming like other police or not whistleblowing on bad police) or suffer the consequences (being forced out or retaliated against).
The police want to catch the bad guys too, but after 8 hrs has passed, it becomes virtually impossible to succeed.
Hmmm. Maybe the problem is that the police are Luddites.
Before you can bust down a door, you often need to do a lot of work. People tend to underestimate this greatly. And any hours spent on this one iPhone isn't spent catching rapists (for example). If only the issues were as simple to solve as people commenting here make it seem.
The perceived emergency in the bogus 911 call adds some weight of course, but in lots of cases the Police seem far too gung ho to roll out heavy and bust down some doors. Not to say that it is an appropriate response to go raid a house in search of a reportedly stolen phone, but goddamn.
Now, I'm not saying cops don't abuse their power nor what response they should give to an "obviously" bogus threat, but even for a trigger happy cop, why bother the risk for someone's phone when there are gonna be hundreds of "credible" threats? I doubt even a crooked cop would be willing to break the rules over someone's stole phone.
But there was no attempt to get one, or even just to knock on the door. There was no attempt to do anything apart from record the fact that a crime had (allegedly) occurred. Which, no matter how understandable, is not exactly the pursuit of justice.
> And any hours spent on this one iPhone isn't spent catching rapists (for example).
Okay, so I understand that you have recently taken a job with law enforcement and I can see why you feel the need to defend your workplace but the point remains that objectively speaking, whether one thinks the US police is benevolent or malicious, they don't really do much for the vast majority of property crimes. It's simply not a priority, as you've inadvertently said yourself.
Plus law enforcement...doesn't exactly catch a lot of rapists either.
That wasn't inadvertent, that was precisely the point they're trying to make to you — resources aren't unlimited and thus need to be triaged.
This would be true even if law enforcement didn't completely suck for orthogonal reasons.
Old roommate's company in SF - Car, bikes and computers. Car was stashed in Bayview & cops waited till they had enough backup to lock down the blocks around the house, thieves weren't there unfortunately.
There are places around the world with extremely wide rollout of CCTV cameras across the city, where the crime is recorded and police literally could trace a criminal back to his home. Yet even there police are often uninterested in doing more than providing victims of "petty" crime a copy of the police report for insurance purposes.
They can't even be certain from the outset that a crime has been committed - maybe there is some sort of complicated fraud afoot. There is a soft cap on how much they can spend on this of a bit less than $600k, which is not that massive given the skillsets needed to track this down.
Most of the time the criminal is in another country and the money is no longer in the US which is just a general nightmare to solve.
I understand that there’s a resources allocation problem here and the current solution is prioritizing bigger crimes. But given the resources of the victims, maybe the priorities should be inverted. Help the people that can’t pay for their own investigations, or just charge for the investigation services in proportion to the “size of the crime”.
I'd estimate orgs with roughly 100k to 5 million in revenue it is mostly small players and assuming margins of 20% they are really only doing 20k to 1 million in profit/discretionary spending.
Add in a few factors like charity vs Inc, and it shouldn't be hard to narrow down who LE should assist.
Meanwhile the US oil pipeline gets hacked by a exposed password and the whole Federal Government comes in to fix the mess and agrees to spend more money.
Alternitively, these industries are already heavily regulated including extensive safetly regulations - so perhaps a basic level of security practices should also be required. We regulated how high of a ladder an employee can climb without safety equipment but we don't really do anything if a company reuses passwords, runs known vulnerable software, etc. Occasionally there are fines after the fact but that is too late.
Perhaps the crime should be looked at in context. Stealing $100 from a homeless person is equivalent to stealing $1,000 from an averagely salaried person.
As you said, limited manpower, expertise, time, and budget are an issue for law enforcement. Not just for US law enforcement. For law enforcement world-wide.
Police officers earnings often rank in the top 1% of their communities.
Compare your city's police budget with their investments in communities and education and services - things that can actually make lives better and prevent the economic desperation that leads to crime.
An ounce of prevention is worth a pound of cure, and police are the very inefficient, violent cure.
There are police departments out there that are a valued contributor to the community, and there are some departments that seem to exist wholly to extract money and pain from the citizenry.
One bad apple spoils the bunch, unfortunately.
I think an order of magnitude (or three) increase in independent accountability of police across the board is the only way you'll see the trust start to rebuild, but certain organizations seem dead set against letting that ever happen.
I don't know how OSes solve these problems.
Round robin is one of the algorithms that may be employed by an OS to handle scheduling. The problem you're talking about is known as 'starvation'.
The frequent context switching is a source of inefficiency here- if you interrupt one job to switch to another, you've got to ditch everything in memory from job 1 and load a bunch of new data from disk for job 2. And then when you switch back to job 1- same deal. I'd imagine the same would apply, maybe even more so, for people
It means only the top 5-10% are getting help. And probably most of them are not people but companies.
There are only a finite number of people who commit crimes like this, and if you can find them at any point after they have committed one or more crimes, you ought to be able to arrest them.
It therefore doesn't really matter the size of the crime - it still enables an arrest of someone who might be involved in large numbers of crimes both big and small, but that you couldn't arrest before for lack of evidence they are involved in crime.
In many cases smaller crimes will be less well concealed too (hiding stuff costs money, paying more middlemen costs money, not worth it for smaller crimes)
It’s the latter. And not for nothing, but I don’t think that policy is working out so well for some businesses specifically in the Bay Area.
https://www.msn.com/en-us/news/crime/organized-crime-drives-...
How much of that is because they won't allocate time for that but rather allocate time for a more profitable operation, like writing traffic citations?
Has there ever been a public accounting on what police departments spend their time on? My medium sized city spends about $500 million a year on police. That seems like a lot. It's the largest single expenditure.
On the other crime types, for example drug related, law enforcement seems to pay a lot attention to the small-time criminals.
Why not? Seems like a waste of time and $. If they get the $50k or $650k back, they at least have a chance at civil forfeiture.
Drugs are right there in front of the cops most of the time.
The cost of prosecution could trivially run into thousands of dollars including public defenders the cost of incarceration 36k per year.
A 5 year stint could run the people almost 200k to punish someone for hurting themselves by hurting them worse.
But they are a fairly large bank so hard to say how they do relative to others for their volume.
Its not $650k either, its more like 10 or 20 x 650k. Why? These are criminals operating a business. They will do this again.
Best case scenario is, assuming they are in on it, that they are a money mule and will immediately split up the money, transfer it 5-10 times (sometimes to themselves, sometimes to other people), and after several jumps, it usually ends up as bitcoin, if you get that far.
Every single transfer of money requires going to a judge and getting a search warrant for the next account or accounts. Each search warrant takes several weeks to a couple months for the bank to respond. So if the money jumps 5 times, we are taking pages and pages of search warrants before we find out where the money truly went. Probably over a year. Probably into crypto. Probably overseas.
The prosecutors would love to prosecute the scammer, but are typically left with someone who just passed on the money and says they had no idea there was a scam happening.
https://www.cbc.ca/news/canada/edmonton/macewan-university-p...
It looks like they were able to recover much of the money, but at a cost of $250,000 in legal and banking fees:
https://www.cbc.ca/news/canada/edmonton/macewan-university-r...
And not even high tech, people used to do the exact same thing with paper cheques by mail.
There's a sending bank account, a receiving bank account and a digital trail. With the newer KYC laws, it should be easier to find the criminals.
Happens a lot in the UK and they don't do anything about it because the police has been defunded to hell.
I had a motorbike jacket stolen once which contained my house keys and wallet. The police found the guy and he was fined £40 or something. I lost the £100 bike jacket and had to pay around £40 to get my keys recut. Was it really worth it?
I suppose the hardest part is recruiting the "money mules" to open the destination bank accounts.
No, it isn't.
To me, a hacker is someone who exploit a RCE or something like that.
I recall in 90's we had this kids who got access to ton of companies all around the world. They would have conquered the earth along with the FBI.
Note to future supervillian self: steal from widows and orphans in increments of $499,999.99.
- No one is fooled by a penny. Do it in increments of $400,000.
- You need to prevent your thefts from being tied together; as soon as someone notices that you stole a small-time $400,000 from a widow AND another small-time $400,000 from an orphan, you've become a big-time $800,000 thief.