How vulnerable are western banks to state-sponsored cybercrime?

How vulnerable are western banks to state-sponsored cybercrime?

The world breathed a sigh of relieve when Donald Trump de-escalated the tensions between the United States and Iran, which started when an American drone killed General Qasem Soleimani early in January and continued a few days later when Iran fired 15 missiles at several Iraqi military bases housing American and coalition forces.

Nevertheless, punitive sanctions remain in place and there has been an intense standoff since the United States withdrew from the Iran nuclear agreement. Iran knows it must pursue an asymmetric warfare strategy, which it is waging mainly through sponsorship of various allied militia in the Middle East, some of which are designated terrorist organizations by the United States and the European Union.

But there is another weapon that Iran has used in the past and may pick up again: cybercrime, and in particular, in order to destabilize the western banking system. It has form. Between 2012 and 2013 hackers brought down the internet sites of several American financial institutions, including global firms such as Bank of America, Morgan Chase, Citigroup and Wells Fargo. Seven Iranians, who worked for the IT company that serves the Revolutionary Guards were subsequently arrested and sentenced.

As a form of warfare, cybercrime has the two distinct advantages of being much less expensive than traditional military warfare, and much harder to detect. Directly after the killing of Soleimani, Neil Walsh, who leads the UN’s cybercrime initiative from Vienna, warned both countries not to resort to cybercrime as a means of retaliation. Walsh cautioned that targeting computer systems can have as much impact as physical attacks – and that nation states should think twice before carrying them out. As reported in the New Scientist magazine, there is a rather bizarre etiquette evolving around cyberwarfare. “There is an ongoing cybersecurity diplomatic process, which is where countries sit together to discuss what they can and can’t do against each other in cyberspace, and try to agree norms,” Walsh said. He too emphasized the difficulty of detecting cyberattacks and identifying the people behind them, and the dangers of misattribution of cyberattacks. “If a country sends a missile up from one place to another, you see where it came from, you know where it went. In terms of attribution, that’s relatively easy to do,” he said. But attributing cyberattacks can be much more difficult, increasing the risk of escalation. “That gap between is it an individual, is it a criminal, is it a terrorist, versus an intelligence agency, a military body or an advanced persistent threat group, is so grey now that for one to say it was a criminal or state-based activity might be incredibly difficult to do.”

As Iran’s record already shows, it is not just the military-industrial complex that has a legitimate concern about cyber terrorism and state-sponsored cyberattacks. Attacks on businesses by state-sponsored sources have significantly increased over the past few years for businesses.  In this form of warfare, financial services companies are in the frontline, while healthcare and retail businesses are not far behind.

Iran is not the only culprit here. State-sponsored cybercrime is on the increase worldwide. The Centre for Strategic & International Studies has been tracking major incidents for some time. In December 2019 alone, it recorded the following:

  • Microsoft won a legal battle to take control of 50 web domains used by a North Korean hacking group to target government employees, think tank experts, university staff, and others involved in nuclear proliferation issues.
  • An alleged Chinese state-sponsored hacking group attacked government entities and managed service providers by bypassing the two-factor authentication used by their targets.
  • Chinese hackers used custom malware to target a Cambodian government organization.
  • Unknown hackers stole login credentials from government agencies in 22 nations across North America, Europe, and Asia.
  • Iran announced that it had foiled a major cyber-attack by a foreign government targeting the country’s e-government infrastructure.
  • A suspected Vietnamese state-sponsored hacking group attacked BMW and Hyundai networks.
  • Russian government hackers targeted Ukrainian diplomats, government officials, military officers, law enforcement, journalists, and nongovernmental organizations in a spear phishing campaign.

Some businesses already take the threat seriously, which has resulted in a massive growth in the cybersecurity industry. Gartner Inc. values at $124 billion per annum. In a recent survey report into financial crime, cybercrime was identified as by far the biggest external threat and 20% of the respondents said their organizations had been the victims of financial cybercrime in the previous 12 months. Among publicly listed companies, that figure rose to 26%. Refinitiv calculated the total losses from cybercrime by the 2,373 global companies surveyed at $ 241 billion. According to the insurance brokerage and risk management consulting firm Marsh, cybercrime cost half a trillion dollars in economic damage in 2018, far more than the $300 billion in economic losses from natural disasters. Yet spending on cybersecurity insurance premiums ($4 billion in the USA) is dwarfed by the that spent on property insurance ($180 billion).

The threat of state-sponsored cybercrime was back in the news at the end of January, as the British government debated whether to award lucrative 5G network contracts to the Chinese firm Huawei. It decided not to ban the company outright, but to set clear limits that would exclude Huawei from any infrastructure that the UK government deems sensitive (what it calls “core” as opposed to “peripheral” infrastructure). At most only 35 percent of 5G or gigabit network traffic will be allowed to pass through equipment made by “high risk vendors”, and only 35 percent of cellular base stations can include equipment from those vendors. Without mentioning Huawei by name, the UK Culture Secretary said, “The government is certain that these measures, taken together, will allow us to mitigate the potential risk posed by the supply chain and to combat the range of threats, whether cyber criminals, or state sponsored attacks.”

The European Union issued similar guidance. But the US government is less sanguine. It effectively bans carriers from using the company’s equipment in US networks; it has long warned that Huawei could build backdoors into its products that could be accessed by the Chinese government, something the company denies it has done or would do.

Warnings from experts in the field of cybersecurity suggest that setting percentage limits or distinguishing between “core” and “peripheral” could be ineffective. The demarcation lines between the two are blurring as all components become more software driven. As a result, even the simplest equipment can be vulnerable to hacking. As UC Berkeley security researcher Nicholas Weaver told Wired magazine, “5G antennas aren’t simply wires, but complex computers in their own right doing a lot of signal processing.”

The concerns in the United Kingdom, expressed by a number of prominent MPs in the House of Commons, have focused mainly on personal privacy and the security of defense and intelligence establishments such as GCHQ. As one MP put it, Huawei has more people employed in its research department (90,000) than the UK has servicemen and intelligence personnel. But the potential for cybercriminals, state sponsored or otherwise, to exploit vulnerabilities in new networks should not be underestimated. Even if the Chinese government is not directly involved in cybercrime, it is not entirely unreasonable to assume that Huawei will pay rather less attention to network security matters in the UK than it would in China itself. We know this because only last year the UK’s National Cyber Security Centre reported that Huawei has basic but deeply problematic flaws in its product code that create security risks, which it blamed on low standards of “basic engineering competence and cyber security hygiene”.

The bottom line is that the threats are there, and they come from an unknown number of invisible actors from many countries. And the attack could come at any time. It is certain that further attacks will come from “rogue” states such as Iran and North Korea, either directly from government intelligence and espionage agencies and departments or from proxies and freelances. The institutions that are most vulnerable to cyberattacks include, perhaps most significantly, small to medium sized banks and financial services companies that do not have strong cybersecurity processes and infrastructure in place. If they have not already done so, they should commission a security audit soon: antivirus and anti-malware apps are simply no match for today’s cyberterrorists and criminals.

Written by Paul Allen Hamilton

To participate or join the AML Knowledge Centre go to https://www.linkedin.com/groups/8196279/

Blockchain Fraud: New Policies and Technologies to Stop Crypto Criminals

Blockchain Fraud: New Policies and Technologies to Stop Crypto Criminals

Blockchain fraud continues to be a massive problem that has hindered the possibilities of new user adoption. Crypto criminals primarily participate in three types of fraud: tax evasion, money laundering, and terrorist funding schemes. Let’s take a look at each of those categories and how legislation and blockchain technology can reduce, or even eliminate, these and other crimes in the near future.

Tax Evasion

Tax evasion is one of the most widespread types of blockchain fraud. Prior to 2017, there wasn’t much crypto-related legislation in existence in most countries. Plus there was little enforcement of what regulations did exist. As we have previously reported, this began to change drastically in 2017.
Despite the fact that regulations are tightening, crypto-related tax evasion is still prevalent. In November 2017, LendEDU conducted a survey that included 564 US-based bitcoin investors. According to the results, approximately 36% of participants planned to knowingly avoid paying capital gains taxes in their 2018 tax filings.

There aren’t any stats to determine if this was the actual result. Still, it’s obvious that many people didn’t view crypto tax evasion as a major crime. And it’s possible that those surveyed weren’t exactly sure how to follow the tax regulations. In 2018, however, there are several guides online on how to follow crypto taxation laws in specific countries. Information is even available on specific categories like taxation on cryptocurrency mining.

New Tax Regulations

Investors need to understand and comply with cryptocurrency tax regulations. In some cases, compliance can be beneficial beyond avoiding the obvious consequences of jail time or fines. For example, it’s possible to report capital losses on crypto investments when filing taxes.

Even in the bear market of 2018, regulatory agencies are focusing more on crypto taxation policies. These efforts aren’t just limited to individual, domestic government policies. International collaboration appears to be on the rise as well. For example, a coalition of five governments (Australia, Canada, the Netherlands, the United Kingdom, and the United States) joined together to form the Joint Chiefs of Global Tax Enforcement (J5). According to the IRS, this organization aims to “reduce the growing threat posed to tax administrations by cryptocurrencies and cybercrime.”

Blockchain Fraud: An image of a phone showing bitcoin on top of 4 $20 bills, displaying fiat and cryptocurrency
Tax evasion is one of the most common types of blockchain fraud.

Money Laundering

There are several major cases involving the use of cryptocurrencies to launder money. Jerome Powell, Chairman of the U.S. Federal Reserve, said in a House Financial Services Committee testimony in July 2018 that “they are very challenging because cryptocurrencies are great if you’re trying to hide or launder money, we have to be very conscious of that.”

Evidence shows that crypto-based money laundering is indeed a major issue. For example, according to a Q2 2018 report released by CipherTrace, crypto criminals laundered $1.2 billion through bitcoin tumblers and privacy coins in a one-year time period during 2017-2018.

Similar to policies dealing with crypto tax evasion, governments are increasing international collaboration to tackle this type of blockchain fraud. G20 member countries are reviewing a possible global anti-money laundering (AML) standard on cryptocurrency before an October 2018 deadline. In addition, member nations have called upon the Financial Action Task Force (FATF) – an intergovernmental organization formed to combat money laundering and terrorist financing – to review how AML standards that are already in place can potentially be applied to regulate cryptocurrencies.

Blockchain fraud: An image showing a dark hallway of jail cells
Governments are collaborating on an international level to stop crypto criminals involved in money laundering.

Terrorist Funding

Some financial institutions (including the Bank of England) and regulatory agencies have warned against the potential use of cryptocurrencies in terrorist funding. For the most part, various studies don’t show any alarming correlation between crypto and terrorist funding. For example, the European Parliament’s Policy Department for Citizens’ Rights and Constitutional Affairs conducted tests on the risks of cryptocurrencies. According to the results, cryptocurrencies don’t pose a greater risk than fiat when it comes to enabling terrorist funding.

Since 2017, there has been a push to enact legislation that would try to prevent this kind of blockchain fraud. For example, U.S. lawmakers introduced the “Homeland Security Assessment of Terrorists Use of Virtual Currencies Act” in May 2017. They also proposed the “Financial Technology Innovation and Defense Act” in January 2018. Additionally, another bill called “The FinCen Improvement Act of 2018″ was introduced in the US House of Representatives in July 2018. This bill mentions, “anti-terrorism and anti-money laundering initiatives, including matters involving emerging technologies or value that substitutes for currency, and similar efforts’’.

As of August 2018, none of these bills have gained much traction. Only the “Homeland Security Assessment of Terrorists Use of Virtual Currencies Act” has been able to pass the U.S. House of Representatives.

Blockchain Fraud: A photo of the United States Capitol.
The US Congress has introduced a few bills to stop terrorist funding through cryptocurrencies.

Using Blockchain to Combat Blockchain Fraud and Other Crimes

Yes, in some instances, blockchain fraud makes certain crimes easier for criminals to commit. However, it’s also crucial to understand that many of the above-mentioned crimes have been going on for many decades in the fiat economy.

Even though blockchain fraud is a major issue, blockchain technology has also made it possible to stop many types of crime. For example, some blockchain technologies like Ricardian smart contracts aim to vastly improve the future enforcement of legal agreements. In addition, KYC and AML-focused projects can make transactions in the crypto-based economy much more transparent than what’s possible in the current fiat-based economy.

Conclusion

Crypto criminals do exist and present a challenge to the mainstream adoption of digital currencies. Nonetheless, technical innovation should not be viewed as the foundations for a future dystopia. Likewise, the legislation doesn’t have to stunt the progress of technology.

When it comes to stopping crime and fostering innovation, there isn’t a simple solution. How the future will play out depends a lot on how technologies and legislation develop in the coming years. The reality is that both regulations and technologies are needed in order to empower a future where blockchain can benefit society and mitigate the possibilities of blockchain fraud.

This article was originally published on Coincentral.

Author:

Delton Rhodes

I enjoy researching new, innovative, and interesting blockchain/crypto projects that have the potential to impact the world. Whenever I’m not writing, I’m usually playing sports or producing music.

 

“Top Misconceptions of Cryptocurrency as a Payment System”

 

Which can be read on Amazon Kindle Unlimited for Free  You can find more interesting articles by visiting us on one of the following platforms: AML Knowledge Centre (LinkedIn) or Anti-Bribery and Compliance at the Front-Lines (LinkedIn)

By continuing to use the site, you agree to the use of cookies. more information

The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this.

Close