New technology has enabled cyber-crime on an industrial scale

NOBODY LIKES a call from the taxman. Donald Rumsfeld, who as America’s defence secretary oversaw a budget bigger than the economy of a typical country, nonetheless finds the rules so confusing that he writes to the Internal Revenue Service each year complaining that he has “no idea” whether he has filed his taxes correctly. So it is hardly surprising that, when the phone rings and an official-sounding voice says you have underpaid your taxes and will be connected to an adviser to pay the balance, ordinary folk tremble.

It is, however, invariably a scam. Few tax authorities call individuals about their taxes. If you are lucky, they will send you a letter a year later, to the wrong address. They will certainly not menace you, as bogus calls often do, with the threat of arrest if you do not stump up the cash right now.

Such scams have become vastly more common. Phone calls from tricksters claiming to be taxmen almost doubled in number last year, according to UK Finance, a trade association of banks. Other countries show increases at least as dramatic.

Even as rates of most crimes remain low in rich countries, the spectacular growth of cyber-crime—crime committed mostly or entirely by digital means—stands out. According to the Crime Survey of England and Wales, the best indicator of long-term trends in Britain, in 2019 there were 3.8m incidents of fraud, mostly online, representing a third of all crimes committed. That figure has increased every year since 2017 when the government started collecting data. Around 7% of all adults were victims. Three-quarters lost money, and 15% lost more than £1,000 ($1,390). In America the number of reported cases of internet fraud increased by 69% last year. Reported losses there (excluding bank or credit-card fraud) reached $4.2bn, three times higher than in 2017.

Other kinds of internet-enabled crime are growing too. Computer-enabled spam phone calls and text messages, typically trying to defraud people, extract billions of dollars a year. Illegal gambling websites, many of which steal from their customers, have multiplied. And new technology makes many old-fashioned crimes easier to perpetrate. Drug-dealers use Bitcoin, a cryptocurrency, to take payments and move money around. They rely on specialised criminal encrypted-communications software to organise their affairs. “There is no serious organised crime that does not have a digital component,” says Nigel Leary of Britain’s National Crime Agency (NCA).

Most significant over the past year is the growth in “ransomware”—hacking attacks where victims’ files are locked up until money is paid. Such attacks were once crude. Ransomware arrived in spam emails and targeted ordinary people’s computers. The sums demanded were often small, to encourage people to pay up.

These days hackers focus on large organisations and demand big ransoms (see chart). Malicious software is injected into specific computer systems. It steals data before locking them. A ransom is then demanded to unlock the files or, increasingly, to prevent them from being leaked (backups of important data are common now). It is almost always in Bitcoin. Chainalysis, a cyber-security firm, says the amount paid in Bitcoin ransoms increased by 311% last year compared with 2019, to around $350m. Victims are usually businesses but more and more include governments and their departments, including the police. On April 27th Washington DC’s coppers revealed that they had been hit by hackers, who say they will expose police informants to gangs if the authorities do not pay up.

Ransomware is “the single biggest threat” in the organised-crime world, says Alan Woodward, a computer scientist at the University of Sussex who advises Europol, the EU’s police agency. On April 29th Alejandro Mayorkas, America’s secretary of homeland security, described it as “a threat to national security”. The damage is enormous. Maersk, a global shipping company, wrote down $300m in losses related to a ransomware attack in 2017. Travelex, a British currency trader, collapsed last year, with the loss of 1,300 jobs. An attack that took its systems down at the end of 2019 was partly to blame. Despite coughing up 285 Bitcoin—then worth around $2.3m—the firm lost about £25m that quarter. It attributed most of that to the attack.

Ransoms can be eye-watering: an attack in March on the Broward County school system, which includes Fort Lauderdale in Florida, came with a demand for $40m in Bitcoin. In messages leaked by the hackers, one of the district’s negotiators was incredulous: “You cannot possibly think we have anything close to this.”

Most government bodies do not. But the consequences of not paying can be just as costly. In Baltimore County, in Maryland, schools had to stop online teaching last year for several days after their systems were locked by a ransomware attack. In 2019 an attack on the neighbouring City of Baltimore cost its taxpayers $18m. During the pandemic, hospitals have been hit, too. France reported 27 attacks on hospitals last year, as part of a 255% increase in ransomware attacks generally. Medical treatments have been delayed in Germany and America because of attacks.

Bitcoin buccaneers

The criminals who do it are a mixed bunch. Many seem to be based in Russia, other parts of eastern Europe, or China. In Russia and Belarus, cyber-criminals thrive because the state tolerates them, as long as they scam only foreigners. Some reportedly have links to the security services.

But cyber-criminals do not seem to operate in tightly organised crime groups, like drug cartels or mafias. Their strength comes from their decentralisation. Individual elements of each crime are provided as a service to organisers. One lot may write and sell the software. Others may get it into targets’ computers. Others may collect and launder the ransom. And a few kingpins may finance the entire operation. And yet they may never know each other’s names or locations.

Crimes such as bank robbery used to be artisanal, says the NCA’s Mr Leary. Big jobs like the Brink’s-Mat robbery of 1983, when gold, diamonds and cash worth £26m (£100m in today’s money) were stolen from a warehouse at Heathrow airport in London, required a large specialist staff who all knew and trusted one another. These days large-scale crime is being industrialised by technology. “The barriers to entry are really very low,” says Mr Leary.

That is largely because an entire internet infrastructure has developed to facilitate attacks. Cryptocurrency is key. Ransomware criminals like to use Bitcoin, says Kemba Walden, a lawyer with Microsoft’s digital-crimes unit because it is very liquid and relatively anonymous. The end recipient is anonymous unless his real-world identity can be connected to his virtual address. Criminals can trade Bitcoin between themselves. Cashing out their earnings into real money is risky; in most rich countries Bitcoin exchanges apply strict “know your customer” requirements. But it is not impossible. Some exchanges in less-regulated countries apply looser criteria. And coins can be “tumbled”—swapped between cryptocurrencies by money-launderers—to conceal their origins, and then sold on well-regulated exchanges. In Russia and China “it’s just incredibly difficult” to trace stolen money, says Ms Walden.

Other technological innovations are vital, too. SIMboxes, which allow people to “spoof” (conceal the origin of) phone calls, are sold for legitimate purposes, to marketing firms, for example. But they also allow criminals to spam people or communicate without revealing their location. TOR, softwarewhich anonymises internet connections by bouncing data around the world, lets the “dark web” thrive, hosting the forums on which criminals anonymously trade their wares. “Bulletproof hosting”—server farms with a high level of security and privacy—operate like virtual safe houses, where compromising data can be moved off at a moment’s notice, invariably before the police are able to get to it.

What is the future of such crime? As ransomware has grown, so has the industry promising to protect firms from it. The crime is “becoming more high-profile”, says Michael Levi of Cardiff University, because of attacks such as the one on Maersk. Organisations are trying to buttress their defences. But many do not want to report hacking attempts or fraud. Data breaches are not only damaging in themselves; they are embarrassing, too. Individuals rarely think to report cyber-crimes to the police. The costs may be borne indirectly. Banks and insurers will often compensate people for losses. Security is improving but the crimes are increasingly profitable.

The police fret that more traditional criminals are moving into cyber-crime, and vice versa. “Now the dark web is used for the commodity trade [fencing of stolen goods], the drugs trade and firearms,” says Mr Leary. In raids in Belgium in March police seized 28 tonnes of cocaine, as well as cash, guns, police uniforms and a torture chamber in a shipping container. The criminals had reportedly been using Sky ECC, an encrypted phone network sold by a Canadian firm. The phones were seemingly designed to hide criminal activity, with end-to-end encryption, disappearing messages and no GPS data. Subscriptions were paid in Bitcoin. That gave them a great deal of anonymity—at least until European police forces managed to inject their own malware into the phones to spy on them.

Governments are starting to take cyber-crime more seriously. America’s Justice Department has appointed a team to tackle ransomware. The “five eyes” allies—America, Australia, Britain, Canada and New Zealand—are sharing intelligence on it. But there is a long way to go. In Britain only one in 200 police officers focuses on fraud, despite its outsized footprint, according to figures revealed through the Freedom of Information Act by the Times newspaper.

And the opportunities are growing. In the past six months the value of the world’s Bitcoin has soared to over $1trn. That surge of liquidity makes it even easier to hide crime. And as Mr Woodward puts it: “Why would you walk into a bank with a sawn-off shotgun to steal £30,000 when, if you’ve got some money to invest, you can go on the dark web and start a ransomware campaign and make millions?” ■

A version of this article was published online on May 3rd, 2021