6 ms·

Ransomware typically uses Bitcoin, which is rather hard to track if you do it properly. And it's not like solving a $1K ransom is a high priority case for LE,

by 21 11y ago

Ransomware typically uses Bitcoin, which is rather hard to track if you do it properly. And it's not like solving a $1K ransom is a high priority case for LE, so you are partially right. Like the saying goes, there is a lot of bike stealing because LE doesn't really care about stolen bikes.

MichaelGG 11y ago
In aggregate the $1Ks add up. But I suspect that they cash out in a place like Russia and even going after a few million there is more work than worthwhile.
tptacek 11y ago
LE doesn't care about stolen bikes because their constituency doesn't care about stolen bikes. Do some back- of- the- envelope math about what it would take in terms of person/hours to seriously investigate a single bike theft, then multiply that by the fully loaded cost of a single police officer. If a municipality decided to take bike theft seriously, by paying increased OT or expanding the police department employment rolls, law enforcement would be all over it. A similar problem exists for ransomware. Ransomware attacks are less frequent and more targeted, but drastically harder to investigate. We could spend many billions more to build an infosec investigative capability in state governments, and that would help, but we would rather spend those billions on other things.
- ufmace 11y ago
  Kinda OT, but this made me think of what would be involved in really cracking down on bike theft. You'd probably have to start by registering bikes and putting license plates on them, just like cars, and aggressively enforcing the maintenance of those registrations and license plates. So you'd start off by hassling legitimate riders first so that in the future it would be easier to spot a stolen bike and prove that it's stolen. Probably more trouble than it's worth, considering how many kids and low-income people use bikes for transportation. Similarly, getting serious about tracking Bitcoin movements would probably involve a lot of new regulations around the use of Bitcoin, and somehow enforcing them worldwide. I suppose the point was more that the police are likely to be very interested if you rip off one company for $50k, but it's harder to get them interested when you rip off $1k from 50 people spread around dozens of jurisdictions.
  - maxerickson 11y ago
    Bike registration gets lots of serious consideration: https://www.google.com/search?q=mandatory+bike+registration https://www.google.com/search?q=mandatory+bike+registration
  - reitanqild 11y ago
    > So you'd start off by hassling legitimate riders first so that in the future it would be easier to spot a stolen bike and prove that it's stolen. FWIW: Around here bike registration exists but is voluntary.
  - ScottBurson 11y ago
    The point I've seen made about bike theft is that although the reward from a successful bike theft is small, the risk -- the probability of being caught times the likely consequence if one is caught -- is extremely small in most places. So the reward/risk calculation easily supports committing the theft. But if a municipality devotes even a small amount of resources -- an officer or two, full-time, I guess -- to prosecuting bike theft, that can raise the odds of getting caught for a single theft, I don't know, maybe three orders of magnitude -- from 10^-6 to 10^-3, let's say. Someone who steals hundreds of bikes a year is then looking at a real chance of getting caught for one of them. What I've seen argued, and I seem to recall there's even experimental evidence to support this, is that that's enough to reduce the reward/risk ratio to the point where bike theft as a career, at least, is uneconomic. You might still get occasional opportunistic thefts -- leaving a bike unlocked would still not be recommended -- but the bulk of the problem would go away. Coming back to the topic, the same principle probably applies here. You don't have to even try to solve all the ransomware crimes; you just have to solve enough of them, and come down hard enough on the perpetrators, to change the reward/risk calculation. That will probably be a lot harder to do, though, since they're unlikely to even be in the same country as the victims.
    - mistermann 11y ago
      Get caught stealing a bike (maybe 2nd offense, whatever), you get 3 months in a labor camp. 2nd offense, one year. 2 years in run the stats and see if there's been an effect.
- marincounty 11y ago
  If they would stop their vigilant focus on collecting revenue, they might have a little more time to investigate the little stuff? The stuff that we all grew up thinking they did? Where I live, they hide beside hedges, or in blind spots, and ticket Soccer moms for California Stops at odd hours. Hours when no one is even out. Oh, and let's not forget, the real work. Pulling over 200 vechicles on Friday, Saturday nights, and Sunday afternoons(we all get rip roaring drunk after the big game?); and look for that guy who's just over .08.
  - tptacek 11y ago
    Nobody is going to deny that there's revenue-generating traffic policing happening --- though things are improving; many states now ban ticket quotas statewide --- but it's very unlikely that ending that practice would somehow result in police effectively investigating bike theft. I don't know how to respond to the weird point about drunk driving. If you have any uncertainty at all about whether you might be close to the limit, just don't drive. No excuses.
- srean 11y ago
  May be they could save some on the armored cars and assault rifles.
  - tptacek 11y ago
    Please work out the math on this (an estimate shouldn't be hard to get; just work from published numbers like headcount and weapons/ammunition costs), and then try to come up with an argument about how a change to police armament would recover more bikes (and, how many?).
- chatmasta 11y ago
  Why the assumption that state or local governments should be responsible for digital defense? If we could spend "many billions" to build this "infosec investigative capability," would it not be more efficient to implement at the federal level? Rather than training (and funding) N specialists at X different locations, why not train XN specialists at one single location?
- bobwaycott 11y ago
  Admittedly pedantic nitpick: you shouldn't use spaces after hyphens. Edit: Except for the obvious use case where you are using more than one compound in a row (e.g., high- and low-level).
  - tptacek 11y ago
    I put spaces after hyphens out of concern about linebreaks, not because I think it's grammatically correct. (I still shouldn't, since browsers will break lines intelligently anyways, but it's a force of habit).
- Ankaios 11y ago
  We need a solution that scales similarly or better than the problem. Anyone want to write some Black ICE? :)
- Zigurd 11y ago
  Aggregation, yo. Police shold investigate stolen bikes because most bikes are stolen by large-scale operations that steal, and sell, hundreds of bikes. Maybe thousands in mutiple cities. Finding and taking down these operations should be simple. Anyone paying attiention to craigslist could do it. It is a typical "traveler" scam.
nullc 11y ago
Ransomware widely used other things before Bitcoin; they're just using whatever works easiest-- right now thats Bitcoin. When they were using webmoney and western union no one cared to track that either. Cross border electronic crime has never had significant attention put at it, short of attacks on government systems.
- ufmace 11y ago
  Technically they have, but the use of Bitcoin seems to have breathed a lot of life into the ransomware space. I don't recall ransomware ever being enough of a concern to be reported on before they started using Bitcoin. I suppose this proves that Bitcoin is dramatically more effective at moving lots of money around the world in a way that's hard to track.
api 11y ago
$1k ransoms are in a category sometimes called "greasy crimes." These are crimes too small to trouble law enforcement much, especially if there are much bigger crimes around. Of course now that it's being done at scale that may change.
basicplus2 11y ago
but then again if its only a few groups in the world stealing bikes then it is very productive to investigate a few bike thefts..

by 21 11y ago

MichaelGG 11y ago

In aggregate the $1Ks add up. But I suspect that they cash out in a place like Russia and even going after a few million there is more work than worthwhile.

tptacek 11y ago

LE doesn't care about stolen bikes because their constituency doesn't care about stolen bikes. Do some back- of- the- envelope math about what it would take in terms of person/hours to seriously investigate a single bike theft, then multiply that by the fully loaded cost of a single police officer. If a municipality decided to take bike theft seriously, by paying increased OT or expanding the police department employment rolls, law enforcement would be all over it. A similar problem exists for ransomware. Ransomware attacks are less frequent and more targeted, but drastically harder to investigate. We could spend many billions more to build an infosec investigative capability in state governments, and that would help, but we would rather spend those billions on other things.

ufmace 11y ago
Kinda OT, but this made me think of what would be involved in really cracking down on bike theft. You'd probably have to start by registering bikes and putting license plates on them, just like cars, and aggressively enforcing the maintenance of those registrations and license plates. So you'd start off by hassling legitimate riders first so that in the future it would be easier to spot a stolen bike and prove that it's stolen. Probably more trouble than it's worth, considering how many kids and low-income people use bikes for transportation. Similarly, getting serious about tracking Bitcoin movements would probably involve a lot of new regulations around the use of Bitcoin, and somehow enforcing them worldwide. I suppose the point was more that the police are likely to be very interested if you rip off one company for $50k, but it's harder to get them interested when you rip off $1k from 50 people spread around dozens of jurisdictions.
- maxerickson 11y ago
  Bike registration gets lots of serious consideration: https://www.google.com/search?q=mandatory+bike+registration https://www.google.com/search?q=mandatory+bike+registration
- reitanqild 11y ago
  > So you'd start off by hassling legitimate riders first so that in the future it would be easier to spot a stolen bike and prove that it's stolen. FWIW: Around here bike registration exists but is voluntary.
- ScottBurson 11y ago
  The point I've seen made about bike theft is that although the reward from a successful bike theft is small, the risk -- the probability of being caught times the likely consequence if one is caught -- is extremely small in most places. So the reward/risk calculation easily supports committing the theft. But if a municipality devotes even a small amount of resources -- an officer or two, full-time, I guess -- to prosecuting bike theft, that can raise the odds of getting caught for a single theft, I don't know, maybe three orders of magnitude -- from 10^-6 to 10^-3, let's say. Someone who steals hundreds of bikes a year is then looking at a real chance of getting caught for one of them. What I've seen argued, and I seem to recall there's even experimental evidence to support this, is that that's enough to reduce the reward/risk ratio to the point where bike theft as a career, at least, is uneconomic. You might still get occasional opportunistic thefts -- leaving a bike unlocked would still not be recommended -- but the bulk of the problem would go away. Coming back to the topic, the same principle probably applies here. You don't have to even try to solve all the ransomware crimes; you just have to solve enough of them, and come down hard enough on the perpetrators, to change the reward/risk calculation. That will probably be a lot harder to do, though, since they're unlikely to even be in the same country as the victims.
  - mistermann 11y ago
    Get caught stealing a bike (maybe 2nd offense, whatever), you get 3 months in a labor camp. 2nd offense, one year. 2 years in run the stats and see if there's been an effect.
marincounty 11y ago
If they would stop their vigilant focus on collecting revenue, they might have a little more time to investigate the little stuff? The stuff that we all grew up thinking they did? Where I live, they hide beside hedges, or in blind spots, and ticket Soccer moms for California Stops at odd hours. Hours when no one is even out. Oh, and let's not forget, the real work. Pulling over 200 vechicles on Friday, Saturday nights, and Sunday afternoons(we all get rip roaring drunk after the big game?); and look for that guy who's just over .08.
- tptacek 11y ago
  Nobody is going to deny that there's revenue-generating traffic policing happening --- though things are improving; many states now ban ticket quotas statewide --- but it's very unlikely that ending that practice would somehow result in police effectively investigating bike theft. I don't know how to respond to the weird point about drunk driving. If you have any uncertainty at all about whether you might be close to the limit, just don't drive. No excuses.
srean 11y ago
May be they could save some on the armored cars and assault rifles.
- tptacek 11y ago
  Please work out the math on this (an estimate shouldn't be hard to get; just work from published numbers like headcount and weapons/ammunition costs), and then try to come up with an argument about how a change to police armament would recover more bikes (and, how many?).
chatmasta 11y ago
Why the assumption that state or local governments should be responsible for digital defense? If we could spend "many billions" to build this "infosec investigative capability," would it not be more efficient to implement at the federal level? Rather than training (and funding) N specialists at X different locations, why not train XN specialists at one single location?
bobwaycott 11y ago
Admittedly pedantic nitpick: you shouldn't use spaces after hyphens. Edit: Except for the obvious use case where you are using more than one compound in a row (e.g., high- and low-level).
- tptacek 11y ago
  I put spaces after hyphens out of concern about linebreaks, not because I think it's grammatically correct. (I still shouldn't, since browsers will break lines intelligently anyways, but it's a force of habit).
Ankaios 11y ago
We need a solution that scales similarly or better than the problem. Anyone want to write some Black ICE? :)
Zigurd 11y ago
Aggregation, yo. Police shold investigate stolen bikes because most bikes are stolen by large-scale operations that steal, and sell, hundreds of bikes. Maybe thousands in mutiple cities. Finding and taking down these operations should be simple. Anyone paying attiention to craigslist could do it. It is a typical "traveler" scam.

nullc 11y ago

Ransomware widely used other things before Bitcoin; they're just using whatever works easiest-- right now thats Bitcoin. When they were using webmoney and western union no one cared to track that either. Cross border electronic crime has never had significant attention put at it, short of attacks on government systems.

ufmace 11y ago
Technically they have, but the use of Bitcoin seems to have breathed a lot of life into the ransomware space. I don't recall ransomware ever being enough of a concern to be reported on before they started using Bitcoin. I suppose this proves that Bitcoin is dramatically more effective at moving lots of money around the world in a way that's hard to track.

api 11y ago

$1k ransoms are in a category sometimes called "greasy crimes." These are crimes too small to trouble law enforcement much, especially if there are much bigger crimes around. Of course now that it's being done at scale that may change.

basicplus2 11y ago

but then again if its only a few groups in the world stealing bikes then it is very productive to investigate a few bike thefts..