2 (âTJX Agrees to Class-Action Settlement,â 2007).
6 Class-action lawsuits were filed both by consumers and by several bank associations in an attempt to recover the costs of reissuing credit card numbers compromised in the breach. (Gaudin, 2007).
13 (âMore Businesses Are Buying over the Internet,â 2004). For a discussion of the consequences of technological adoption and the values embodied therein, see, for example, (M. Rogers, 2003), discussing the consequences of innovations, examining the value implications of different innovations, and arguing that technologies need to be critically evaluated from utilitarian and moral perspectives before being adopted.
14 H.R. Rep. No. 106â74, pt. 3, at 106â7 (1999). As a result of the explosion of information available via electronic services such as the internet, as well as the expansion of financial institutions through affiliations and other means as they seek to provide more and better products to consumers, the privacy of personal financial information has become an increasing concern of consumers.
15 (Winn and Wrathall, 2000).
16 For example, most law firms use document management systems to centralize work product. For a discussion of document management software, see Kennedy and Gelagin, 2003. This use of information technology facilitates knowledge management, the sharing of institutional intellectual resources such as form contracts, and control over access to certain information.
17 These attempts to centralize built in high dependencies between systems. (Labs, 2006).
18 In the context of manufacturing, this meant connecting up âislands of automationâ into a single communication network.
20 (Sandeen, 2003). As a consequence of this transformation, numerous state corporate statutes have been amended to allow for email notice, virtual shareholder meetings, and internet proxy voting. (Derrick and Faught 2003; Pozen, 2003).
22 Databases with financial data and social security numbers became targets of choice because of their usefulness in identity theft.
23 For example, some professional spammer employees earn salaries in excess of $100,000 per year while professional spammer entity owners earn millions of dollars per year. (âComments of Simple Nomad,â 2003).
25 Phishing attacks are becoming increasingly sophisticated. (Desai, 2004).
26 (Federal Trade Commission, 2004). The FTC estimates that U.S. corporations lost as much as $48 billion to identity theft alone between September 2002 and September 2003. (MailFrontier, n.d.; Federal Trade Commission, 2003).
27 (âGood News,â 2004; Webb, 2004; Gartner, 2004).
28 In particular, phishing attacks usually infringe the trademarks of the spoofed entity as well as the look-and-feel of the entityâs website.
29 (âPhishing Alert,â n.d.; Valetk, 2004).
30 Spoofing is defined as sending a message to make it appear as if it is arriving from someone else. (âSpoofing,â n.d.).
31 One entity whose email is spoofed frequently is Citibank. For statistics on phishing see (Antiphishing Working Group, n.d.) For additional discussion of phishing, see (Federal Trade Commission, âPhishing Alertâ; Valetk, 2004).
32 The term âphishingâ is derived from the idea that internet con artists use email lures to âfishâ for passwords and other personally identifiable data from the sea of internet users. The letters âphâ are a frequent replacement for âfâ in hacker language, and most likely reflect an act of verbal homage to the original form of hacking, called âphreaking,â a term coined by the first hacker, John Draper, known as âCapân Crunch.â By 1996, hacked accounts had come to be known as âphish,â and by 1997 phish were used as currency by hackers in exchange for items such as hacking software. (Anti-Phishing Working Group, n.d.).
33 Even a highly technology-savvy consumer may have difficulty distinguishing between a phishing email and a legitimate commercial communication from an entity with whom the consumer has a preexisting relationship. (MailFrontier Phishing IQ Test II, n.d.). Even the author of this article misidentified one of the items in this quiz as fraudulent when in fact it was legitimate.
34 Monster chose not to notify the affected consumers until ten days after the discovery of the security problem, and a public relations maelstrom erupted. (âMonster. com Admits Keeping Data Breach Under Wraps,â 2007).
37 Zombie drones are security compromised machines that can be controlled remotely without the userâs knowledge for sending spam or other malicious purposes. (âPrimer: Zombie Drone,â 2004; Testimony of Thomas M. Dailey, 2004).
38 For example, one Polish spam group uses more than 450,000 compromised systems, âmost of them home computers running Windows high-speed connectionsâ all over the world. (Ciphertrust, n.d.). Powerful economic incentives exist for information criminality. The black market in security-compromised machines is an international market. Recent arrests in Germany and elsewhere have provided useful information into the international market in zombie drones. (Leyden, 2004). The market in compromised machines is big international business: the price of these botNets (doSNets) was roughly $500 for 10,000 hosts during summer 2004 when the MyDoom and Blaster (the RPC exploit worm)...