Book summary “Future crimes”: summary

Introduction

You live in a hyper-connected world where software runs everything from your car to critical national infrastructure. This connectivity makes your daily life efficient, but it also exposes you to unprecedented security risks that you cannot see or easily defend against. Criminals, terrorists, and corporations rapidly exploit these digital vulnerabilities for profit and control.

Marc Goodman argues in Future Crimes that exponential technological growth creates a dark side where bad actors weaponize your own devices against you. Traditional law enforcement and legal systems cannot keep pace with borderless digital threats and automated criminal syndicates.

The book investigates the mechanics of modern cyber crime, the surveillance economy, and the expansion of the Internet of Things.

• How do criminal syndicates operate like Fortune 500 corporations in the digital underground?
• What are the hidden risks of massive data aggregation and mobile device tracking?
• How will emerging technologies like robotics and bio_hacking transform future threats?
• What practical steps can you take to secure your digital life against inevitable attacks?

1. The Borderless Nature of Cyber Crime

Traditional geographical borders and Westphalian legal systems are obsolete in cyberspace, where criminals launch borderless attacks and exploit complex, vulnerable software code.

You rely on a Westphalian system of physical borders that no longer applies in cyberspace. Criminals can instantly jump across multiple countries to evade law enforcement.

Vladimir Levin hacked Citibank corporate accounts from St. Petersburg in 1994, stealing $10.7 million and electronically transferring funds to Finland, the United States, the Netherlands, Germany, and Israel without ever entering the US.

The Malware Explosion

Malware has evolved from early prank viruses spread on floppy disks to massive industrial-scale operations driven by money, information, and power. AV-Test assessed 49 million strains of computer malware in 2010. Kaspersky Lab identified 200,000 new malware samples daily in the summer of 2013.

Traditional antivirus software is largely ineffective against modern threats, catching only a small fraction of newly released malware. An Imperva study testing eighty-two new computer viruses against over forty major antivirus engines found an initial threat-detection rate of only 5 percent. Worldwide spending on security software reached $20 billion in 2012.

Enterprise Vulnerabilities

Hackers successfully penetrate network defenses within minutes 75 percent of the time. Major corporations and enterprises fail to detect network intrusions promptly, usually remaining unaware until outside parties notify them.

A Verizon Data Breach Investigations Report noted that 62 percent of intrusions took at least two months to detect, and 92 percent of the time companies were notified of breaches by external sources rather than their own staff. Trustwave Holdings found the average time from initial breach to discovery was 210 days.

The economic impact of data breaches extends far beyond direct theft, inflicting massive losses through recovery costs, stock drops, and lawsuits. The Ponemon Institute estimated companies faced $188 for each stolen record, while credit card replacement fees cost $5.10 each. Hackers stole the credit card details of tens of millions of customers in the TJX retail hacking case, leading to hundreds of millions in settlement costs and estimated true costs approaching $1 billion.

2. The Crime Singularity and Exponential Tech

Exponential technological growth and software complexity combine to enable the Crime Singularity, allowing criminal enterprises to scale automated theft globally.

Information technology grows exponentially rather than linearly. Gordon Moore observed that processing power doubles over time. This compounding curve catches human intuition off guard.

The iPhone in your pocket possesses more computer processing power than NASA used during the Apollo 11 moon landing. By 2000, 360 million people were online globally. That number reached 1 billion by 2005.

Ray Kurzweil predicted the technological singularity will arrive by 2045. This rapid acceleration empowers both innovators and threat actors.

Code Complexity

Physical objects transform into software-driven code. Escalating complexity directly increases vulnerabilities and bugs.

Commercial software contains 20 to 30 bugs for every thousand lines of code, according to Carnegie Mellon University. Millions of potential errors exist in complex systems.

The 1969 Apollo 11 Guidance Computer used 145,000 lines of code. Early 1980s space shuttle primary flight software utilized 400,000 lines.

Modern systems demand massive scale:

• Microsoft Office 2013 contains 45 million lines of code;
• the Large Hadron Collider requires 50 million lines of code;
• the average modern automobile runs on 100 million lines of code;
• HealthCare.gov relied on 500 million lines of code.

Traditional criminals were limited by physical constraints on daily victims. Digital infrastructure enables global, automated theft on an unprecedented scale.

A Russian hacking group gathered 1.2 billion usernames, passwords, and confidential data from 420,000 websites in August 2014. The 2013 Target stores cyber attack compromised data from 110 million accounts.

3. The Surveillance Economy and Data Aggregation

When digital services are provided free of charge, you become the product whose data are packaged and sold to advertisers.

Marc Goodman notes that tech giants provide free platforms and tools to coax you into revealing intimate details about your life. This information is then compiled and sold to drive corporate profits and maximize value for advertisers and shareholders.

Bilal Ahmed used PatientsLikeMe to share his depression symptoms and medical treatments, only to discover that his private data were scraped and sold to the Nielsen company and pharmaceutical houses. The platform tracked 1,500 unique diseases across 200,000 patients, while Nielsen tracked 130 million blogs.

Google consolidates data across all its seventy products to build an unprecedented, unified profile of each individual user. Google creates diverse free tools ranging from search and Gmail to maps and operating systems to capture every possible facet of your digital and physical activity. In 2012, Google merged these previously separate data streams into a single unified profile to command top dollar from advertisers.

Google admitted that its Street View cars were pilfering personal data from home and office Wi-Fi networks, including passwords, emails, and photographs. The company processes 24 petabytes of data daily and reported $59 billion in consolidated revenue for 2013, alongside a $22.5 million FTC fine in 2012 for bypassing Apple Safari privacy settings.

Mobile Tracking and Location Data

Smartphones operate as continuous tracking beacons in your pocket, generating massive volumes of location and sensor data.

Mobile operating systems and downloaded applications function as efficient data-delivery systems, harvesting call logs, contact lists, ambient sounds, and exact physical locations. This continuous monitoring allows advertisers to deduce intimate details about your daily habits and life events.

The Russian app Girls Around Me allowed users to press a button and view an interactive map displaying nearby women, their exact locations, and their public Facebook profiles. U.S. mobile phones generate 600 billion unique data events daily, supported by 65 billion downloads from Apple's App Store since 2008 and a personal location data market valued at $100 billion over ten years.

4. Big Data Risks and the Surveillance State

Private data brokers operate a massive data surveillance industry that dwarfs government intelligence budgets. Companies such as Acxiom Corporation run 23,000 computer servers and analyze 50 trillion unique data transactions annually. The unregulated data broker industry amasses deep consumer profiles that weaponize personal information and erode Fourth Amendment protections under the third_party doctrine.

The Surveillance Economy

Acxiom maintains 700 million consumer profiles worldwide. Each profile contains 1,500 specific traits categorized into 70 distinct demographic clusters. These profiles are sold to marketers for behavioral targeting without your knowledge.

A grieving father named Mike Seay received an OfficeMax promotional flyer addressed with the note Daughter Killed in Car Crash after his seventeen-year-old daughter died in an accident. This invasive reach extends through rented mailing lists and automated consumer profiling. Free consumer services often serve as a cover story for extensive data extraction. Digital privacy specialist Ashkan Soltani used proxy tools on OkCupid and discovered that answering questions about drug usage instantly shared data with a broker named Lotame via a cookie file. Fifty companies shared information with OkCupid in total.

Opening Pandora’s Virtual Box

Under the third_party doctrine, data shared with online platforms are considered business records rather than private papers. This strips your digital footprint of Fourth Amendment protections.

Law enforcement agencies and civil authorities exploit these records constantly. AT&T received 300,000 requests for data in 2013 from civil and criminal authorities. Police used Sprint's warrant-less mobile phone geo-location portal 8 million times in a one-year period.

Private actors also weaponize your digital profile. In 2011, 33 percent of divorce filings explicitly mentioned the word Facebook, and 81 percent of divorce attorneys admitted to searching social media sites for evidence. Human resource professionals rejected 70 percent of job candidates based on online search discoveries. Eighty percent of American states allow employers to legally demand social media passwords from applicants.

5. Crime, Inc. and the Digital Underground

Cybercrime has matured into corporate syndicates utilizing C-suite management, quality assurance teams, ransomware toolkits, and anonymous Dark Net marketplaces.

Organized Cyber Crime

Crime enterprises operate for maximum profit by adopting modern corporate strategies such as supply chain management, outsourced labor, and jurisdictional arbitrage. They feature specialized divisions including CEOs for big-picture strategy, CFOs for financial reporting and money laundering, CIOs for bulletproof infrastructure, and dedicated R&D and quality assurance teams. A 2014 study by the Rand Corporation found that 80 percent of hackers are now working with or as part of an organized crime group.

Innovative Marketing in Kiev operated as a massive multilingual tech company with over 600 employees, outsourced call centers, HR departments, and employee retreats. They processed 4.5 million individual customer orders in 2009 and pulled in 500 million dollars in global sales over a three-year period.

Crimeware Mechanics

Criminal software developers do not release code directly; instead, they run their malware through automated online evaluation tools that test detection rates against 18 of the most popular antivirus programs. Software such as Malware Destructor, System Defender, and Windows AntiSpyware was sold for 49 dollars, generating 180 million dollars in revenue in 2009 alone.

Silk Road operated as a massive anonymous online illicit marketplace powered by Tor and Bitcoin, acting as an eBay for drugs, contraband, and illegal services. Founder Ross William Ulbricht used the pseudonym Dread Pirate Roberts and netted 80 million dollars in fees before the FBI arrested him at the San Francisco Public Library in 2013.

Crime as a Service allows operators to purchase bulletproof hosting, cloud computing power, automated exploit kits, and customer service call centers without needing deep technical expertise. A 2013 study found that 16 percent of the world's malware distribution channels were hosted in the Amazon Cloud and 14 percent emanated from GoDaddy's servers.

CryptoLocker infected nearly 250,000 individuals and businesses globally, using 256-bit AES encryption to lock files and earning an estimated 30 million dollars for its developer. The Swansea Police Department in Massachusetts paid 750 dollars in Bitcoin to recover police case files.

The laundering of illicit digital proceeds relies heavily on unsuspecting individuals recruited as money mules through fake job advertisements. You can become part of this cycle if you follow specific steps:

• respond to ads for jobs such as regional assistant, company representative, or accounts receivable;
• open two accounts in your own name, one for salary and one for funds processing;
• process funds via Western Union and take a percentage fee between 3 and 10 percent.

6. Mobile Insecurity and Cloud Concentrations

Insecure mobile operating systems and centralized cloud computing aggregate massive vulnerabilities, turning smartphones into constant tracking beacons and high-value targets.

Mobile phones are among the most insecure devices ever created. Attackers use viruses to access cell microphones, read texts, and turn on video cameras without warning lights. By 2014, McAfee identified 4 million distinct pieces of mobile malware, marking a 614 percent increase over the previous year. Google Android accounted for 99 percent of all mobile malware and 85 percent of worldwide smartphone handsets shipped as of mid-2014.

Mobile Phone Operating System Insecurity

Android devices suffer from customization and slow security updates. Device manufacturers add bloatware and custom skins that lead to 60 percent of security threats. Apple ensures fast patching by controlling its hardware and software. In 2013, 82 percent of Apple devices ran iOS 7 five months after release, while only 4 percent of Android users ran the latest OS version released that year.

Tabloid journalists from News of the World accessed and deleted Milly Dowler's mobile phone voice mail repeatedly after her abduction in 2002.

Mind the App

Mobile app stores rely on automated algorithms that fail to catch malicious code. By 2013, researchers found 42,000 apps in Google's store containing spyware and Trojans. Criminals also uploaded fake banking apps mimicking major institutions. Banking Trojans jumped from 67 identified in 2012 to 1,300 by the end of 2013.

Smartphone GPS chips and social apps enable pervasive tracking by stalkers. Simon Gittany used Mobistealth to monitor his fiancée Lisa Harnum and killed her after discovering via text message that she planned to leave him. In the United States, 3.4 million victims suffered from stalking annually as of 2012.

When you arrive at a domestic violence shelter, staff must follow specific steps:

• take away the mobile phone of a new client;
• remove the battery;
• disassemble the phone to avoid acting as a beacon to potential stalkers.

Cloud computing centralizes corporate and personal data into single repositories. Hundreds of private nude photographs of celebrities including Jennifer Lawrence and Kate Upton were stolen when hackers subverted Apple iCloud accounts. Intelligence agencies intercept billions of communications, and the NSA intercepted and stockpiled 1.7 billion emails, phone calls, and SMS messages daily.

7. When All Things Are Hackable

The expansion of the Internet of Things transforms everyday physical objects and smart infrastructure into networked entry points for remote hacking and extortion.

Kevin Ashton coined the term Internet of Things in 1999 to describe a world where physical objects connect to the internet. Ultra-cheap microcontrollers running on milliwatts process data from sensors monitoring pressure and temperature. The legacy IPv4 architecture supports only 4.3 billion connections and ran out of addresses. The new IPv6 protocol increases address length from 32 bits to 128 bits, generating 340 undecillion connections. Cisco Systems estimates 50 billion connected things by 2020.

Introduction to IoT

Every connected object reports detailed behavioral data to the cloud. You face an ambient intelligence network that eliminates traditional boundaries between public and private spaces. Progressive offers discounted rates for installing Snapshot black-box technology that tracks your driving habits.

School administrators covertly installed secret remote-access software on student laptops allegedly meant for tracking lost devices. Officials snapped 56,000 images, including 400 photos of student Blake Robbins in his Pennsylvania bedroom eating candy. Heather and Adam Schreck were awakened at midnight by a man screaming through their baby camera at their ten-month-old daughter. A high-roller used hacked live video feeds at the Crown Casino in Melbourne, Australia, to see cards and win U.S.$33 million in eight hands.

Wireless Protocol Insecurities

Radio-frequency identification tags lack effective encryption or security protocols. Francis Brown built custom RFID readers for under $400 and achieved a 100 percent success rate in cloning employee access badges of Fortune 500 companies.

Near-field communication chips embedded in smartphones for mobile payments can be compromised. Crooks hacked NFC train turnstiles using an app called UltraReset to provide free subway rides. Hackers built malicious USB chargers for under $50 that install backdoors to steal banking information in juice jacking. Russian customs officials discovered imported Chinese electric teakettles containing hidden Wi-Fi cards with a 200-meter range designed to spread malware.

8. Robotics, 3-D Printing, and Bio_Hacking

Emerging technologies bridge the digital and physical worlds, enabling weaponized drones, 3-D printed firearms, synthetic biology, and brain-computer interface vulnerabilities.

Robots connect the digital realm to the physical world, allowing cyber crime to escape virtual screens and manifest in three-dimensional living spaces. Powered by Moore's law and smartphone hardware, robots possess sensors and actuators that interact with corporeal reality. Standardized operating systems and network connectivity make these machines vulnerable to remote hacking.

University of Texas at Austin students successfully spoofed the GPS of a Department of Homeland Security drone using equipment built for under $1,000.

Criminal networks and terrorists are actively adopting drones and autonomous machines for smuggling and attacks. Mexican drug cartels hired aircraft factory workers to build 100-pound autonomous carbon-fiber drones capable of carrying 100 kilos of cocaine across the border per flight. The DEA has documented 150 narco-drone border crossings since 2012.

Additive manufacturing eliminates traditional supply chains and border inspections. You can digitally download and print regulated gun components and medical items on demand.

Cody Wilson founded Defense Distributed and created the Wiki Weapon Project, publishing blueprints for the Liberator, the world's first fully 3-D-printed plastic gun. Users downloaded these files 100,000 times worldwide, and Wilson fired 600 rounds successfully from a 3-D printed AR-15 lower receiver.

Rise of the Machines

Consumer and industrial robots create complex vulnerabilities. Intuitive Surgical's da Vinci robot was investigated by the FDA after incidents where it perforated a colon or clamped onto tissue.

In 2013, Prime Minister Shinzō Abe's government allocated ¥2.39 billion to develop elder-care robots like Paro, a baby harp seal robot that comforts dementia patients. At the same time, an Oxford University study in 2013 concluded that 47 percent of U.S. employees face a high risk of losing their jobs to robotic automation by 2023.

Synthetic Biology

Synthetic biology treats DNA as an information technology, making genetic engineering as straightforward as software programming. Exponential drops in DNA sequencing and chemical synthesis costs allow you to access genetic code easily.

By 2014, whole-genome mapping costs dropped to $1,000, while commercial DNA print shops allowed online ordering of custom genetic material for 10 cents per base. Researchers have successfully coaxed baker's yeast and E. coli bacteria into producing THC, LSD, and opium.

9. Practical Security and Prevention Protocols

Following a simple six-step protocol known as UPDATE can help users avoid more than 85 percent of daily digital threats.

The UPDATE Protocol requires you to secure systems using these practices:

• U pdate Frequently: Automatically update your operating system software, computer programs, and apps, paying special attention to browsers, plug-ins, media players, Flash, and Adobe Acrobat.
• P asswords: Use long passwords of twenty digits or more with mixed cases, symbols, and spaces, change them often, use password wallets like 1Password, LastPass, KeePass, and Dashlane, and enable two-factor authentication.
• D ownload: Download software only from official sites, avoid unofficial app stores and pirated media, and use operating system settings to white list approved software.
• A dministrator: Run your computer using a standard user account for everyday work and online browsing, reserving administrator accounts only for specific trusted tasks.
• T urn Off: Turn off your computer when sleeping and disable unused smart phone services like Bluetooth, Wi-Fi, NFC, and cellular hot spots.
• E ncrypt: Encrypt your digital life using full hard-disk encryption like BitLocker or FileVault, virtual private networks for public Wi-Fi, and encrypted mobile devices with biometric security.

Cyber Hygiene and Prevention

A small set of foundational cyber hygiene practices can prevent the vast majority of targeted intrusions and data breaches. Research by the Australian government and Verizon demonstrated that implementing basic controls prevents the overwhelming majority of data breaches and targeted intrusions.

You can apply these specific mitigation steps to protect your systems:

• Application white listing—only allow specifically authorized programs to run on your system and block all unknown executable files and installation routines.
• Patch all your devices’ applications by automatically running software updates for programs such as MS Office, Java, PDF viewers, Flash, and browsers.
• Patch operating system vulnerabilities by automatically updating your OS such as Windows, Mac, iOS, or Android.
• Restrict administrative privileges on your computer and spend the majority of your time logged in as a basic user.

Global Public Health Framework

Global cyber security must shift from a retrospective criminal prosecution model to a public health framework focused on prevention, epidemiology, and immunization. Just as the CDC and WHO handle biological disease propagation, a global cyber organization is needed to monitor networks and track digital pathogens.

Medical efforts against malaria failed until epidemiologists discovered the disease was spread by mosquitoes in standing water. You need similar systemic defenses that identify and drain digital swamps through specific measures:

• education—providing members of the public with proven methods of cyber hygiene
• network monitoring—detection of infection and outbreaks of malware in cyberspace
• epidemiology—using public health methodologies to study digital disease propagation
• immunization—helping to vaccinate the public against known threats through software patches and system updates
• incident response—sending in experts as required and coordinating global efforts to isolate sources of infection

10 Key Ideas

1. Traditional geographical borders are obsolete in cyberspace, where criminals launch borderless attacks and exploit complex, vulnerable software code.
2. Exponential technological growth and software complexity combine to enable the Crime Singularity, allowing criminal enterprises to scale automated theft globally.
3. When digital services are provided free of charge, you become the product whose data are packaged and sold to advertisers.
4. Private data brokers operate a massive data surveillance industry that amasses deep consumer profiles, weaponizing personal information and eroding Fourth Amendment protections under the third-party doctrine.
5. Cybercrime has matured into corporate syndicates utilizing C-suite management, quality assurance teams, ransomware toolkits, and anonymous Dark Net marketplaces.
6. Insecure mobile operating systems and centralized cloud computing aggregate massive vulnerabilities, turning smartphones into constant tracking beacons and high-value targets.
7. The expansion of the Internet of Things transforms everyday physical objects and smart infrastructure into networked entry points for remote hacking and extortion.
8. Emerging technologies bridge the digital and physical worlds, enabling weaponized drones, 3-D printed firearms, synthetic biology, and brain-computer interface vulnerabilities.
9. Software developers and manufacturers must face strict liability for insecure code to incentivize the creation of secure products.
10. Global cybersecurity must shift from a retrospective criminal prosecution model to a public health framework focused on prevention, epidemiology, and immunization.