Is Everything We Know About Password-Stealing Wrong? [pdf]
research.microsoft.com
research.microsoft.com
"In July 2009 a teller at a Key Bank branch in Seattle pursued a would-be robber after a botched hold-up attempt (Seattle Times, Aug. 1, 2009). He leapt over the counter, chased the man for several blocks, knocked him down, and held him until the police arrived. Two days later Key Bank fired the teller. He had violated long-standing bank policy to cooperate in every way and never resist a robbery. The reason for this policy, we suggest, is that banks understand a very simple principle: fear is bad for business. It is far better to comply with the demand than to risk a brawl, or a gun fight in the bank lobby. No bank wants the perception that they valued money more than customer and employee safety. The $40 million that traditional bank robbers in the US steal per year (FBI Bank Crime Statistics) is entirely manageable."
It's even simpler than that: no bank, and more importantly, no insurance company which carries banks as clients, wants to defend or settle a lawsuit alleging wrongful death through negligence of a would-be hero bank employee. The predicted loss of a bank robbery is high four figures. A wrongful death lawsuit would cost six or seven figures. This suggests a simple strategy which works fine: invest in the low-hanging fruit for physical security, comply with robbers, and pay for robberies out of the petty cash.
Having worked as a bank teller, that figure is much, much lower. Often they'll only get away with a couple of hundred dollars.
Otherwise you're right. I think a lot of people still have the romantic picture of Bonnie & Clyde or Hollywood style movies like Heat. The reality is that bank robbers nowadays are idiots. They're high on crack or otherwise don't know what they're doing. They are dumb. All bank robberies are investigated by the FBI, and these guys get caught.
This isn't just fear for the customers or perception, it's a dangerous situation where the loss is really not that great. Meanwhile a teller that tries to act like a hero could get himself or others shot, over a couple of hundred dollars.
So this claim surprised me -- I'm always willing to be wrong, but didn't think I was here -- so I went bouncing around in my backfiles to find the statistic I had quoted off the cuff.
It turns out, after following a few citations in papers, that the FBI keeps fairly accessible info on this.
http://www.fbi.gov/stats-services/publications/bank-crime-st...
$7.5k per incident, give or take.
* No-one gets up early on a Monday to rob a bank,
* 1 in 10 bank robberies leave without a penny - one in ten !
* Perps die a lot more than anyone else.
* They only identify (catch?) 50% - but incredibly 95% of robbers can have their race identified (doesn't anyone wear masks anymore?)
* There is a high number (78% of those caught) of first time bank robbers. (Then again that might be obvious)
Well they can all go on my list of things I did not know yesterday.
A ski mask or similar does not necessarily obscure all racially identifying characteristics (e.g. you can see skin color, eye color, eye shape and often pick up the gist of bone structure — as well as hear their voice if they speak).
http://www.mirror.co.uk/news/uk-news/white-bank-robber-chang...
Interesting that even with those precautions he was still caught.
Once when I was getting off the bus, a police car pulled up right in front of us, 3 more police cars pulled in behind the bus, and even more were approaching. The police pulled a guy off the bus and took a roll of cash out of his pocket and put it into an evidence bag. I found out later from the girl who'd been sitting next to him that the police asked him if he'd just robbed a bank and he confessed right there on the bus.
One of my bus driver friends told me it's common enough that they have a procedure for bank robberies -- their dispatch phone rings, they listen to a description of the bank robber, and if he's on their bus they call back with some sort of code word. Of course, the robbers think they're being oh-so-clever getting onto a city bus, because nobody would ever guess that's your getaway car.
In the third world, I've seen banks with military/police with automatic weapons set up outside banks, or private security at the same level. (also, in these places, liability in the event of wrongful death is lower (or, by outsourcing to the government, you get to take advantage of sovereign immunity), and there is more cash on-site)
In Central America, my house is fully encased in steel bars (in addition to a wall), so you'll need to spend a bit of time and noise getting in. And we have 24/7 armed guards on rotation, and the entire subdivision is walled off with ~15-20 foot gates.
A friend I know consulted on a few bank robbery cases and reviewed the security videos. The firepower the criminals would bring in was astounding. Big long machine gun (not rifle) type things. I believe I read reports of grenades/RPG or something, too.
Whereas in the states, none of the places I've lived would take much more than a pointed stick to get in.
Not all countries have that./
What surprised me is at the end - that "hacking" (for want of a better term) is less destructive socially when it is aimed at financial gain.
It is why society can handle bank robbers more easily than terrorists, and worryingly gives an attack vector - buy 100,000 credentials (if they exist) and just randomly move money around using scripts. The whole consumer banking system would be DDOSd as they reversed transactions, sorted out fraud and stopped people taking all their money out.
I saw on TVN some months ago the news of a couple doing this credit card fraud and the bank was returning the money, perhaps due to the public outcry.
While I understand why the problem exists, it really is one of the most perplexing issues with LaTeX, since it completely breaks through that layer of encapsulation that's supposed to be provided for you (i.e. you now care about specifics of the layout, which was supposed to be handled for you by the system).