Gaylen Arthur Duncan
Toronto, Ontario, Canada

Home | Photos | Writings | Press | Condolences 




FIGHTING CRIME IN INTERNET TIME

Notes for a Speech by Gaylen Duncan, President & CEO, ITAC
e-security 2000
June 12, 2000 - Toronto, Ontario

Good afternoon, ladies and gentlemen.

Life is good in Canada at the moment. Our economy is expanding, we're making important productivity gains and unemployment remains relatively low. This is the result of good management at home of course, but we're also a key beneficiary of the 'long boom' being enjoyed by our large neighbour to the south.

The United States is now celebrating the longest economic expansion in its history. Federal Reserve Board Chairman Alan Greenspan has the enviable job of having to account for this good fortune. He attributes it in large measure to the impact of information technology. Where he was once a skeptic about the impact of IT, today he is quite comfortable asserting that, 'information innovation lies at the root of productivity and economic growth.' Even Alan Greenspan acknowledges that the networked world we've created over the past twenty-five years has been good for business.

There are many prominent Canadians who agree with him. Our Prime Minister, Jean Chrétien has stated 'The information highway is revolutionizing business, government society and citizen participation.' This belief is at the heart of his government's commitment to expand the benefits of electronic commerce throughout the country and make Canada the most connected nation on earth.

The information technology revolution has fundamentally changed the way we do business. There are new realities and new rules of engagement.

Henry Miller suggested once that 'The study of crime begins with the knowledge of ourself.' So, my purpose today is to apply what we know about the rules that govern the new economy to our understanding of crime in this context. My thesis is that just as the new economy demands new attitudes and behaviours, so does our understanding of cyber-crime. Or put more bluntly, we can't solve new economy crime with industrial economy practices and processes.

Just over a month ago, ITAC invited the founding editor of Business 2.0, James Daly, to a meeting with our board of governors. He shared with us his views on the 10 driving principles of the economy. Many of them are useful in our examination of new economy crime.

For example, the first principle is matter. The new economy runs on electrical impulses that transform themselves into information not into goods. Market valuations seem to have very little to do with concrete assets and much to do with a company's knowledge and ideas.

This is true in the world of the cyber-criminal as well. They aren't cutting our purses, they're hacking our credit card information. They aren't knocking over mail trains, they're making fraudulent financial transfers with a few keystrokes. They aren't assaulting us with deadly weapons, they're getting on-line to promulgate hate.

The digital environment that supports cyber-crime enables a whole host of new crimes that don't have analogs in the bricks and mortar world. Identity theft used to be something from the realm of fiction – Alexandre Dumas' Man in the Iron Mask for example.

In that case the crime involved the imprisonment of the victim. But in cyberspace our identities are encoded as a dynamic sequence of bits of information. And, as an increasing number of citizens have found, that information can be stolen from them – and they don't feel a thing.

And then there's denial of service crimes ... what's happening there? Criminals aren't boosting merchandise from store shelves. They are tampering with an intangible but vital quality – a vendor's ability to interact with and serve customers. And the effect is as detrimental as if they'd set fire to the storefront. So you see, matter doesn't matter.

The second principle of the new economy is space.

The Economist declared distance dead over three years ago. We no longer define our markets in local or even national terms. E-Commerce means that your business has the capacity to reach everyone on the Internet.

This is great news for a small economy like Canada's. It means that a Canadian company like Just White Shirts can go toe-to-toe with a giant like Brooks Brothers. It means a company like Clearwater Foods can sell hard-shell lobster to consumers anywhere in the world – if they'll pay the price.

The Internet means new customers but it also means new competitors. What's to stop a Turkish shirt maker from running after Just White Shirts? It also presents a host of new challenges to establish processes like tax collection and dispute resolution. You may need to take a party in a web transaction to court someday. But what court?

One of the biggest challenges from the death of distance is in the areas of crime prevention. If commerce is global, so is crime. If you live in Winnipeg and you've been lured into a money laundering scheme by a fax you received from Nigeria, where do you go to report the crime?

Who does the investigation? Who makes the arrest? Where is the culprit tried? Geography doesn't matter so how can prosecutorial jurisdictions based on geography be relevant? And how is a victim of a crime to navigate all this ambiguity? There are no clear processes for handling crimes of this nature. Even those who work in the cyber-crime field are unsure. So how is a citizen to respond?

The third key principle of the new economy is time. Time is collapsing. Here's what Business 2.0 has to say about time -

'In a world of instantaneous connection, there is a huge premium on instant response and the ability to adapt to the marketplace in real time. Winning companies accept a culture of constant change and are willing to constantly break down and reconstruct their products and processes—even the most successful ones.'

The convention is that three months constitutes an Internet year. The new economy has accelerated the pace of business decision-making. It's also accelerated the pace of crime.

If the best practice of successful companies is a continuous cycle of deconstruction and reconstruction, what can we learn from this? Isn't it time that we began deconstructing the principles that govern international law and reconstructing new principles more appropriate for an era of collapsing time.

The current remedies for cyber-crime revolve around international conventions. They are not governed by Internet time. In the interval it takes to schedule, program and conduct an international meeting, two generations of computer viruses can spawn. We simply must adjust our clocks if we're going to effectively respond to Internet-based crime.

The fourth principle of the new economy is people, or more specifically, the knowledge they embody. Brainpower drives the new economy. The chief asset of modern companies is their employees' capacity for innovation.

Not only is this an intangible asset, it is highly mobile. It leaves the building every night.

This reality has changed the balance of power in the relationship between employer and employee. The labour practices that prevailed in the time of Dickens would be counter-productive today. Employers don't dictate hours of work. Knowledge workers work whenever and wherever they can most effectively complete a project. Instead of hardball wage rates, employers are using signing bonuses and stock options to attract and retain employees.

Instead of stark, nasty work environments, employers are struggling to outdo one another designing workplaces conducive to teamwork, creativity and innovation.

In the new economy knowledge is central not only to commercial endeavor, it's the cornerstone of cyber-crime as well.

If we can accept that an employer like Ebenezer Scrooge is ineffective in the new economy surely we can conclude that a jailer like Inspector Javert, of Les Miserables, is equally anachronistic. Is it appropriate to treat cyber-crime in the same way as we treat conventional crime? Nothing illustrates this conundrum better than the emergence of the ethical hacker. He shares the same skill set as the criminal hacker, but he uses his knowledge for good – and gets well compensated in the process. In an economy where knowledge is the most prized asset, does it make sense to lock a hacker away in a jail cell?

Isn't a more appropriate remedy to demand that society access the knowledge that perpetrated the crime in the first place? Jail terms and fines won't accomplish this. But maybe the new economy version of the chain gang might.

The fifth principle of the new economy is growth. Metcalfe's Law, which increasingly dominates the IT world, states that the cost of network connectivity increases linearly while the value of the network increases exponentially.

The Internet can dramatically boost the adoption of a product, service or idea. It can also have a catalytic influence on crime. No biological virus ever moved as swiftly as Melissa, Chernobyl or the Love Bug.

As we work to expand our networks and to bridge the digital divide we have new realities to face. Sure we have the potential to reach every possible buyer for our product on the market. But we have to be aware that every fraud artist on the planet will have the capacity to find us, too. I can protect myself against the criminals that inhabit my Toronto neighborhood. But what am I going to do to protect myself against the criminals of Paris and Moscow and Calcutta?

That's just five of the ten principles that Business 2.0 has identified. But I think they are sufficient to make my point. The world has changed dramatically. Business people are quickly realizing that the old ways of doing things don't work anymore.

Criminals have been quick to turn the same realization to their advantage. Isn't it time the legislative and law enforcement community caught up to them?

How are we going to do this? Well we have to start by seriously examining our processes for international law enforcement. Our mechanisms for international investigative cooperation, for warrants, arrest, trial and punishment were designed for an economy based on matter. They were not designed to respond to something as swift as the criminal use of information. So the hard reality is they won't work. And we can't make them work by tinkering with them. We can't re-engineer these processes in the hope that we can make them fit. We have to start from scratch - right at the very definition of the crime - and build appropriate tools and processes for this new environment.

This process of deconstruction and reconstruction demands that we examine everything with new eyes. It demands challenging established notions and having the courage to make outrageous suggestions.

Here's one: Are national governments and their law enforcement agencies the best hope we have for maintaining order and security in cyberspace? And here's another one: Isn't it just possible that, in an environment created entirely by technology, our best hope for crime prevention lies in technology?

For years, almost a generation, the Internet was a self-policed community governed by clear rules of conduct. That is the democratic heart of the Internet. Also at the heart of the Internet is a strong capacity to use technology to solve problems and ensure that the web stays free and delivers on its potential.

Maybe it's unrealistic as the community of web users grows to encompass the whole world that self-policing is enough. But the capacity for technological solutions to cyber-crime problems should not be ignored. If the Internet can no longer be self-policing, maybe it can be self-healing.

We have a number of companies in Canada working to develop encryption solutions to ensure exchange of data on the Internet. One of them is Montreal-based Zero-Knowledge Systems Inc. Zero-Knowledge designs tools and strategies to protect the privacy of Internet users. Their products can help prevent a range of cyber-crimes from credit card fraud to identity theft. They are clearly part of the solution.

Zero-Knowledge uses sophisticated technology to create pseudonyms for Internet users. But some international bodies seem to consider this to be part of the problem.

The Council of Europe's 'Draft Convention on Cyber-crime' suggests laws that would force individuals to release encryption keys to government officials. There's also a movement afoot to criminalize the production, sale, procurement and distribution of devices that could be used to test the security of on-line systems. How smart is that?

We seem to want to put the very people that could solve these problems behind bars. This is just another example of anachronistic and wrong-headed measures being brought to bear in the new economy.

I don't have all the answers. ITAC has just written a common view paper on cyber-crime for the International Information Industries Congress where we've made a number of recommendations. For example, we believe that more needs to be done to underscore the gravity of irresponsible use of the Internet. The time has passed when we think of hackers and virus writers as merry pranksters. The community posture must shift from amusement to censure.

We need to increase the resources we allocate to fighting cyber-crime. But this doesn't mean simply giving our police forces more money. We need to look at a serious investment to expand our knowledge of the nature of these crimes and to develop the tools to combat them.

We need to better fund research and development in forensics and inoculants against cyber-crime. To do so we need to be able to attract the men and women who specialize in advanced mathematics and computer science to help us in this. More beat-cops won't help.

And we need international cooperation to bolster investigation, prosecution and punishment. But we must make haste. We can't hope to address the crimes of cyberspace at the leisurely pace set for most international negotiations. We either have to get our international bodies to move more quickly or devise more agile organizations.

I don't have all the answers. I know these are difficult, complex problems. I also know they are far too complex for legislators to grapple with alone. We need all the help we can get on these issues. The knowledge of all players must be engaged.

The technology wizards who wired our world have an immense contribution to make. We should not, through oversight or through poorly considered legislation, ever foreclose on the potential for the technology industry to help us solve this problem.

The Internet is the most powerful creation of modern times. It has the capacity to create a true global community for the first time in the history of humanity. It has the capacity to liberate speech and thought throughout the world. It has the capacity to catalyze the world's store of knowledge and grow that knowledge at an exponential rate. We must never, in all our discussions about the dark side of the Internet lose sight of its tremendous potential.

Benjamin Franklin never even dreamed of the Internet. But he did have a lot to say about freedom and democracy. He once observed, "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty or safety".

Well I think Benjamin Franklin would agree that a civilization smart enough to invent the Internet deserves both. So let us be agile, let us be thoughtful and let us be wise. Above all let us design processes and remedies that meet this new phenomenon on its own terms. We owe this much to the generations that follow.

So the message from industry is clear: Don't isolate us from this problem … engage us in its solution. Understand that this is a new phenomenon unlike anything we have ever seen before and don't expect to solve it with traditional processes. Above all don't try to solve it at a traditional pace. If you're going to fight Internet crime, you're going to have to move in Internet time.

 

 

 

 

 

 

 

Home | Photos | Writings | Press | Condolences 
 

 

Contributions and Submissions Welcome
Contact John Duncan  1-306-789-3063 
admin@duncans.ca