NESTA Crime Online - University of Brighton Repository

fraud. Their methodology is still being developed, but differs from that adopted by the
UK Cabinet Office. 23
Information on data losses and security breaches is generally reported in the news
and IT security online journals, although some organisations are also dedicated to the
collection of this type of data. For instance, the DataLoss database 24 documents reported
data loss incidents worldwide. In the UK, the Department for Business, Enterprise &
Regulatory Reform (BERR, now the Department for Business, Innovation and Skills) 25
also conducts a regular survey of Information Security Breaches.
Other independent initiatives offer regular updates, trends and general information on
specific types of cybercrime techniques, such as: the Anti-Phishing Working Group, 26
focused on activities that direct people to fraudulent websites through phishing,
pharming and e-mail spoofing; or the Spamhaus Group, 27 which tracks and publishes
information about Internet spammers as well as about spam gangs and services.
Despite the abundance of cybercrime-related figures, the lack of consensus on measures
and methodologies remains a matter for public and professional concern. 28 Different
organisations have their own means for collecting data. Sometimes these come directly
from reports and complaints made by individuals and firms. In other cases, global and
national figures are statistically suspect extrapolations from observations extracted from
honeypots, 29 or relatively small populations. 30 It is important to recognise these
perceived to be in the banking industry’s interest to deflate cybercrime fraud figures so as to allay customer
fears.
23 See www.identity-theft.org.uk/cms/assets/Cost_of_Identity_Fraud_to_the_UK_Economy_2006-07.pdf.
24 See http://datalossdb.org/.
25 See www.berr.gov.uk/.
26 See www.antiphishing.org.
27 See www.spamhaus.org.
28 Wall, D. (2007), Cybercrime: The Transformation of Crime in the Information Age, Polity Press, UK; Fafinski,
S and Minassian, N (2008), “UK Cybercrime Report”, GARLIK.
29 A honeypot is a computer or a network of machines set up to look like a poorly protected system but which
records every attempt to compromise it. Although they are useful to identify the way intruders operate, the
activity recorded in honeypots often misrepresents the overall incidence of a certain type of attack since most
sophisticated malware is designed to avoid repetitive exposure to honeypots.
30 For instance, Symantec reported in 2008 a figure of £3.35 billion as the scale of credit card fraud by
multiplying the average amount of fraud perpetrated on credit card fraud by the millions of credit card details
Page 15