NWA-PCUG Newsletter Article, November 2009
dotCrime Manifesto
Reviewed by John Lundgren, Member,
NOCCC (North Orange County Computer Club) California Orange Bytes, August 2009

http://www.noccc.org
editor (at) noccc.org (click to email author)

This article has been obtained from APCUG with the author’s permission for publication by APCUG member groups; all other uses require the permission of the author (see e-mail address above).

This is a book review of the above hard cover book, which has a subtitle (in upper case) of HOW TO STOP INTERNET CRIME. The ISBN-13 is 978-0-321-50358-9; the publisher is Addison-Wesley. The book has four sections: 1. 'People not bits', 2. 'Stopping the cycle', 3. 'Tools of the trade', and 4. 'The accountable web'.

The book is a bit more than 400 pages. MSRP=$24. A 35% discount is available when ordered from the publisher if your user group is a member of the Pearson User Group Program) (http://www.informit.com/store/product.aspx?isbn=0321544714)

The author, Phillip Hallam-Baker, lectures and knows how to keep his audience's attention, at least in print, since I can't speak for his in-person lectures. Although the book's subject seems rather dry, this author kept me entertained with anecdotes such as the Mr. Coffee machine example on P. 62, and good Web historical content. It's not filled with geek speak, it's an excellent Layman's guide, and I think it's a good read. I should point out that although the author is British, I thought it odd that I didn't find the text to have typically British grammar; perhaps that's because his employer is a U.S. company. To help the reader refresh, each chapter is ended with a page of Key Points for revue. Some examples have a reference number and in the back of the book there is a list of reference notes for each chapter.

This book discusses the Internet crime problem with historical examples and in the future what must be changed to reduce this problem. The book describes the crimes on the web, and points out that they are essentially the same crimes that have been going on for eternity, just that they have now been adapted to the web. It’s the same old fraud, confidence games, tricksters, liars, cheats and thieves. Hallam then points out that the reason these crimes prosper on the Net is lack of accountability, and how this makes it difficult or impossible for law enforcement to trace down the suspect. He explains his well thought-out solutions to these problems.

One example he uses is the automobile, and how early on people found that license plates and driver’s licenses, and traffic laws that made people accountable have helped to make the highways a much safer place.

Hallam then shows how to make the net accountable through the widespread use of public key encryption to make certain that transmissions are really from where they say they're from. Again I should point out that as the author stated in the preface he has deliberately avoided the use of Geek Speak, or jargon. This helps the layman to truly understand the simple, underlying principles and methods he lays out.

The author is a senior at Verisign, and thus has to speak for his company at times when he puts forth solutions, since his company is involved in this. But the book is not a sales brochure for his company's products. Throughout the book, he stresses the user’s experience, and how security and accountability must not negatively impact the user. I quote one of my favorites: "The user is ... bombarded with information he simply doesn't need, such as warning dialogs of the type that lawyers write to dump responsibility for security onto the user." I can speak from my own experience how important this is. I have seen situations where, in the name of security, the password complexity and mandatory change intervals are so onerous that most users have their passwords written on a Post-it on their monitor. This completely defeats the security! Anyone can walk up and sign on as another person.

In one example that Hallam used, you want to know that your child is visiting a chat room that is for children, and that other chatters are not pedophiles posing as children. Some form of authentication must be required so that the chat room users must prove that they are children, yet must not require the child to reveal his or her true identity. Then I had to think about his example of Alice, and her visit to the local bar. He points out that the bartender only needs to know that Alice is of legal drinking age, but Alice does not need to prove that she is Alice - that's none of the bartender's business. And the bartender does not need to know how many times Alice has been there before. Thus, when Alice shows her driver’s license, it is really revealing too much information. These are interesting thoughts, now that he has compared the online world to a situation in the real world I hope you find this book as enjoyable as I did. I just hope that his accountability solutions are soon implemented; they were desperately needed long ago.

A Few Closing words
I must mention spam, for that is one subject the author discusses. Right now our email statistics show that more than 90 percent of all emails are spam, which means we are continually deluged with a tsunami of junk emails. Of the remaining 10%, some of those emails are spam that managed to sneak through, so the actual percentage is even higher than 90 percent. Statistics from some authoritative sources say it’s 92 percent. That small percentage that sneaks through is still enough to make it worthwhile for the spammers. If no one bought any of their fraudulently advertised products, the spammers would have to do something else to make money. Two wise advisories are: 1. Never buy anything advertised in junk email. 2. Never click on a link that is in a junk email. This is especially true for phishing emails, those that say your bank or Paypal requires you to verify your account. If you have reason to believe that the email might be true, go to your web browser and type in the URL for the bank or http://www.paypal.com, and log in using this method. If you click on a link in a junk email, it will steal your account and password. My hope is that all the spammers get thrown in jail. I was elated to read recently that a prolific spammer was locked up for 3-1/2 years. The problem is there are many more out there. Will the Net survive? Only time will tell.

Click here to return to top



==================================================================