I'm hesitating to read or listen to this for fear it oversi…

Looking through our empirical data, we see that scam calls dominate the world of Cyber-enabled (which doesn't include ransomware or network intrusion/takeover, but does include crime that leverages a digital channel for some aspect of the attack).

We found that NYPD officers, when empowered to combat this kind of crime with training and tools, were champing at the bit to get out there and fight it. They all know the scams are out there - many told us of family members who'd fallen victim - but they felt powerless to act...

I personally blame the Feds, who over the past two decades have worked hard to make all "Cybercrime" seem (a) mysterious and sophisticated to the extent that (b) only the Feds could combat it, through tools like the IC3 survey. That tool is actually quite ineffective.

As I said at RSA2020, for Cyber-enabled scams, IC3's survey is the place where good leads go to die. For example, in 2018 around zero point three three percent of cases reported to it were ultimately investigated by a task force. They're just snowed under. https://t.co/IxjM6t0cfm

And conventional wisdom - that victims of these call scams and other cyber-enabled crimes are older - collapses like a cheap accordion when we look at the demography of those who actually report. The race, gender, and age of these victims surprise many - they're digital natives.

We also found that many of the perps were local, regional, or national. That even when the calls are placed using foreign call centers, an entire apparatus exists in the US to manage the mules, aggregate and launder stolen funds, etc. Which makes sense.

Gangs get in on the action, finding that Cyber enabled crime is less risky and more lucrative than other schemes. I'm gratified that NYPD and many other agencies and groups are working very hard to bring some law to this essentially lawless, but fast-growing sector of crime.

So while I am encouraged to see reporting like the article I began this thread with, I'm concerned that reporters may miss the forest for the trees and move too quickly to point the finger at one group, or country, as "the" source of scam calls. A source, certainly. . .

NYPD is doing an amazing job of educating citizens. It's discouraging so many don't hear the warnings until they've been victimized. Or even afterwards, when told for example that they can't pay their bills at a BTC ATM, or no government will ask for gift cards they still do it.

In the end the solutions are: Police must take reports, gather data and evidence, and try to work these cases, of which many are VERY solvable without sophisticated forensics. Victims must be better educated. DAs too need education, so they'll take more of these cases.

What is most exquisitely frustrating to me is that this has been going on for some time with no change. I think people should be up in arms that the FBI can say utter tosh like, "We can't help you because you lost less than $100,000." https://t.co/uaMhrJXG5w

I think people should be up in arms that local police in turn tell people to call the same people who refuse to work cases. It is a huge shell game. This must change. /end