Inside and under the mine

 

Image from Pixabay

In the previous century, mining flourished in the south of Dutch province of Limburg. Incidentally, this activity began around the year 1100, when the monks of the Rolduc Abbey in Kerkrade were already digging in the ground. From the 17th century , things became a bit more serious, and in 1902 the Dutch State Mines were established. I remember two striking points from my youth: a large, pitch-black mound in the landscape when we drove on the highway to Heerlen and the Lange Jan (“Long John”), the 135-metre-tall (443 ft) chimney of the power station that belonged to a mine, in the center of that same town. In 1973, the government closed the mines. In Landgraaf, several street names still remind us of that time: Koempel (Miner), Pungel (Bundled Clothes), Houwer (Mason), Zeverij (Sievery), Mijnlamp (Miner’s Lamp), Galerij (Gallery), Aan de Schacht (At the Shaft) and more.

Perhaps it is this history that makes it somewhat difficult for me to grasp the term undermining. After all, those mine shafts are already underground, what else could be under them? On the other hand, there is a beautiful metaphor in it. Because undermining indicates the intertwining of the underworld and the straight world, or criminality and legality. Things happen in the underworld that cannot stand the light of day, and in the mine shafts it was also dark.

But what exactly is this undermining? The government website does not provide a very specific definition either: “Criminals use legal companies and services for illegal activities. As a result, standards blur and the feeling of safety and liveability decreases. This effect is also called undermining.” If you click through, it becomes a lot clearer. It’s about influencing and suppressing of, for example, members of parliament, civil servants and “innocent citizens” (as if the other two are always guilty…). Serious violence can be used, “even to the point of liquidations and explosions in residential areas”.

Examples shed some more light on what it is all about when legal companies are involved in criminal activities: banks are used to launder criminal assets, drug and human trafficking takes place via ports and airports, and an electrician is needed to set up a cannabis farm. Civil servants are pressured or paid to pass on information. This may involve the address details of someone with whom they still have a bone to pick. This brings us to the jurisdiction of the Internal Investigations Department: an investigative service that falls directly under the Public Prosecution Service. Tracking down and investigating possible criminal behaviour by civil servants is one of their most important tasks.

Our intranet has a mandatory e-learning course on the topic of undermining. Using compelling videos, it makes clear how insidious undermining works: a concerned acquaintance notices that you are a bit short of money, lends you a few thousand euros and then urges you to return the favor, leveraging moral obligation. Once you get caught up in that, there’s no easy way out. The e-learning course was impressive.

What is a pity, however, is that according to the same course there are no less than five different reporting points: four internal ones plus 112 (911 and the likes) in case of acute danger. "How well do you know the different reporting points to turn to?" Well, you know, if I ever happen stumble upon a case of possible undermining, then I will find out where I can go. It seems a bit pointless to me to learn by heart which counter I should go to in a specific situation.

Criminals do not distinguish well between what is theirs and what is of others. That is the distinction between mine and thine. Which takes me back to that coal mine of old.

There will be no Security (b)log next week.

 

And in the big bad world…

• phishing tests are pointless. [DUTCH]
• you’ll have to wait a bit longer for your new watch to arrive.
• ransomware's modus operandi shifts from encryption to extortion.
• British intelligence agencies offer to protect all schools in that country from ransomware.
• Twitter/X will no longer use EU user data to train its AI.
• Generative AI requires a different approach to cybersecurity. [DUTCH]
• the Dutch government is currently making full use of AI (but AI is not the same as generative AI). [DUTCH]
• AI chatbots see things you don't – and that's dangerous.
• banning ladders is not a good measure against burglaries. [DUTCH]
• Some Americans are circumventing the ban on Kaspersky 's malware scanner.

 

Crime

 

Image from Pixabay

Last week, as you could read in the previous Security (b)log, I stood in front of a group of girls from high school. This week I was invited by the next generation: the Tax and Customs Administration’s Young IT Auditors, whose annual YIA day was themed cybersecurity. The “young” turned out not to refer so much to the age of the participants, but to how long they have been in the auditor profession. And let me put it this way: this audience was still familiar with Facebook. Fortunately, I had not tailored my presentation to an overly young audience (-;

In this Utrecht conference room I talked about current developments, among other things. Lately I have been reading more and more worrying stories from the US about sickening criminal activities. Like this story. A woman receives a call from her son, who tells her that he has had a traffic accident and that he will hand over the phone to a police officer, who will tell her more. The officer tells her that her son caused the accident, which injured a pregnant woman, and that he is taken into custody. He announces that a lawyer will call her to discuss further proceedings.

A little later the lawyer calls. The son is in deep trouble, but it is possible to get him released on bail. If the mother gives $15,000 in cash to a courier arranged by the lawyer, her boy will not have to spend the night in jail. And she shouldn't tell the bank what the money is for, because then they would ask questions. No sooner said than done.

In reality, that mother did not receive a call from her son at all. It was a deepfake, in which artificial intelligence was used to create a new text with the same voice based on an existing sound recording (thanks to social media). So the mother did hear her son's voice, but he had never spoken those words himself. It was necessary to quickly hand over the phone to the officer to prevent a conversation between mother and son. And that lawyer, who called a little later, was of course not a lawyer at all, but just as much of a criminal as the fake cop.

In the above story we see a number of elements from the theories of Robert Cialdini and Ian Mann*. Cialdini says people obey authorities. Now I wonder to what extent this is true in the Netherlands, but in many countries people will indeed quickly believe that they are really dealing with an authority figure, even if it is only on the telephone. It’s just a matter of striking the right tone. Mann tells us that people are gullible. That can work both ways. On the one hand you would like to receive the reward that an African prince promises you if you help him free up a particularly well-filled bank account, on the other hand you naturally become stressed if it your child seems to be in trouble and you eagerly believe what all kinds of people tell you. Moreover, Mann says, being consciously incompetent also makes you docile: if you know that you have no knowledge of certain matters (such as an arrest), you will easily follow someone who at least radiates that he is an expert in that area.

In another story, someone received a call from the FBI saying she had been a victim of identity theft. Because fraud had been committed under her name, her bank assets would be frozen. To ensure that she could move on for a while, the helpful officer offered to put a large part of her savings in a safe bank account that would remain outside the confiscation. That money also had to be delivered in cash and you guessed it right: the money disappeared. And there was no case of identity theft whatsoever.

IT played no role at all in this case, but the criminal did act as if that was the source of the misery, because that’s how identity goes. The following case also had no IT background, but that could easily have been the case: an 81-year-old American was extorted, and when the Uber ordered by the criminal drove up to pick up “a package” (with the money), he shot the driver dead, under the assumption that she was part of the plot.

If you ever find yourself in such an unreal situation, try not to act on your emotions. Ignore instructions not to involve anyone, but ask someone you trust for help. Be alert if it suddenly becomes about money; try calling your son first to check whether he really has had an accident. Some may find it a bit scary, but in our family we can, by mutual consent, see where everyone is in an app. That would be of great help in such a scary situation.

* Robert Cialdini, Influence: The psychology of Persuasion, 1984; Ian Mann, Hacking the human: Social Engineering Techniques and Security Countermeasures, 2008

 

And in the big bad world...

This section contains a selection of news articles I came across in the past week. Because the original version of this blog post is aimed at readers in the Netherlands, it contains some links to articles in Dutch. Where no language is indicated, the article is in English.

• deepfake detection tools do not always work accurately.
• criminals threaten to publish a database containing criminals.
• the Russians attack Western infrastructure.
• of course you have to choose the right target.
• Traffic lights also infringe on your privacy. [DUTCH]
• Telecom employees are offered money to participate in SIM swapping.
• a British computer divorced the wrong couple.
• a Dutch ID wallet is being developed. [DUTCH]