At his press conference this morning entitled Taking Responsibility for the Internet, Eugene Kaspersky, never a man to avoid controversy, called for the creation of a global Internet Police that would secure the Internet against criminals.
To back up his demand, Kaspersky gave some stark reminders about how little we know or understand about Cybercrime. "No-one knows how many active cybercriminals there are" said Kaspersky. "All we can do is guess and the number is probably in the 10's of thousands, but this is a guess. The same is true of the financial gains to be made from cybercrime. The true cost is probably in the billions of dollars every year."
Kaspersky told the audience "there are three reasons for cybercrime - It's profitable, it's easy to do and it is a low risk business." Among the examples of profitability, Kaspersky pointed cited the case where hackers gained access to the details of credit cards, including their security code. In a worldwide co-ordinated attack, people queued up at ATM machines and in just 30 minutes withdrew over $9m. To make matters worse Kaspersky said that the police had just a few poor photos from ATM machines and had made no arrests over this incident.
So why is it so easy to do? According to Kaspersky, "it's just software so technically speaking, it's simple. There is no physical contact with the victims and modern operating systems are insecure." This latter point is something Kaspersky returned to later on.
Kaspersky also pointed out that what helps cybercriminals is that "this is a low risk business. In some countries the penalty for sending spam can be as little at $100 yet the spammer can earn $300. The penalty clearly doesn't work. It is also very difficult to trace many of these professionals as their hiding place is where they live - in the Internet."
One way to stop the cybercriminal is "to limit Internet services" said Kaspersky. "The problems is that less services in the Internet is not going to happen. Part of the whole problem is that we have designed the Internet in a human fashion so we have made it easy to use." It is this ease of use that Kaspersky believes is at the real heart of the problem.
"Modern OSes are flexible and insecure" believes Kaspersky. "Security is compromised by the need to make it easy for software vendors to write and deploy applications. If we look at the past we saw Microsoft win over Novell and IBM OS/2 because Microsoft was easy to write and deploy applications on. The same, in 10 years, maybe well be the case with the GooglePhone winning out over the iPhone and the Blackberry unless they change the way software writers can develop and deploy applications."
If we are to solve the problem of cybercriminals we need to develop secures OSes. These would use white lists to restrict which applications could run on the computers. Software vendors would have to get a certificate to say that their applications are safe but this would lead to less products and services. "Users will always choose devices with more applications and flexibility so security loses out" Kaspersky told journalists.