Skip Tags

Popular Tags

Decorative icon

The Resource Center Online Security Issues & Protection | post

Cybercrime complaints are down. Really? Says who?

by Neal O'Farrell on

Neil O’Farrell, Intersections Consumer Security Adviser is back today with his take on recent cyber crime statistics released by the US Government.

So says the Internet Crime Complaint Center (or IC3), that's who. But before you start pulling your hair out trying to figure out exactly what IC3 is, let me enlighten you.

IC3 was founded a decade ago as a partnership between the FBI, the Department of Justice, and National White Collar Complaint Center. It seems to have been created for two purposes — as a place for cybercrime victims to report about their crime, and to provide law enforcement with valuable intelligence about cybercrime cases.

And according to the latest report by the IC3 on cybercrime statistics, cybercrimes in the US actually dropped last year, nearly 10% in fact.

So why does this report matter? Well obviously whenever the FBI or Department of Justice release a report detailing any important changes in the criminal landscape, people pay attention. And people really pay attention when a report like this seems to be suggesting that cybercrime is going down — especially when that's not the word on the street.

Now let's be clear. The IC3 report is simply claiming that reports of cybercrimes to their offices went down in 2010, and not that the actual number of crimes went down. But it's already clear from numerous media reports that the research is being welcomed as good news and a sign that maybe, just maybe, we're winning the battle. How wrong they are.

I think the biggest and brightest red flag in all this is the simple reality that the vast majority of consumers and victims have probably never heard of IC3 and would never even think of reporting a crime to them anyway.

And it may be counterproductive to the fight to maintain consumer awareness and vigilance if readers of the report get the idea that cybercrime is actually down. Especially, when we all know that it is not the case.

IC3 reports receiving its 2 millionth complaint — an average of 200,000 cases per year, and now claims to receive an average of 25,000 complaints every month.

The most common complaints are:

  • Non-delivery of payments or merchandise.
  • Scams impersonating the FBI.
  • And identity theft.

Here are just some of the problems I have with this report:

  • I've yet to come across a victim or a cop who has ever heard of IC3. I've heard of them, but only barely, so if few victims have ever heard of them, their credibility as any kind of measure of the number of crimes has to be in question.
  • There's little point in sharing cybercrime reports with law enforcement if law enforcement doesn't investigate cybercrime. Sure they investigate some cases, usually the biggest or most egregious, and will often pick the cases that will get them the most PR and budget consideration. But cybercrime investigations are still as rare as bull's milk.
  • Most consumers and victims I've come across in the last decade would never even think of reporting a cybercrime because they think they're wasting their time. Probably the only exception is identity theft, where victims may have to report it in order to avoid further losses, get their money back, or meet legal obligations.

Another finding of the report that really surprised me was that impersonating the FBI was one of the top three complaints to IC3. Now I understand that impersonating the FBI does happen, but I've never seen that complaint on any list or in any previous research I've seen.

Like most users, I can recall receiving the occasional spam email purporting to be from the FBI, but it's happened so rarely that I can't remember the last one I received. And I receive a ton of spam every day. So I find it very hard to believe that there are more victims of FBI related scams than victims of identity theft. I can only suspect that the FBI's involvement in IC3 has something to do with this otherwise inexplicable statistic.

It makes you wonder if the IC3 is some sort of public relations effort by law enforcement. The information generated by the report doesn't really offer any original insight. And it is worth remembering that the number of complaints about a crime is not the same as the number of crimes being committed.

It's a nice tool to help law enforcement get a better idea of the scams that are circulating, but we already know what most of those scams are. And if law enforcement is investigating less than 1% of all cases anyway, maybe we need to rethink efforts like this and look for better ways to handle victim complaints.