As in the real world, cyberspace has bad neighborhoods.  But unlike the real world, risks in cyberspace are not easy to spot -- and the location of those digital bad neighborhoods can change all the time.

When security experts look back at 2010, they will see a major turning point in the world of cyberscares. The virtual and the real collided in new, dramatic ways during the past 12 months, and the Internet will never be the same. 

Gone for good is the glamour of annoying outages caused by hackers sending e-mail attachments and launching Web page attacks.  Now, computer criminals are being credited with stalling a rogue nuclear power plant program, and with bringing world diplomacy to its knees.   Things are getting serious.

There's still a lot we don't know about the virus named Stuxnet. Unlike 99 percent of the viruses written before it, this malicious program was designed to leave most of the Internet untouched. In fact, it wasn't even written in a language that could infect normal Web users. Instead, it apparently was written to cripple nuclear power plants by some entity that had insider knowledge of how utilities work.  Stuxnet may have found its way into an Iranian nuclear power plant and mucked up its operations, according to various reports. True or not, Stuxnet sent shudders through the computer security world, and will likely inspire copycat "targeted" attacks for years.

Meanwhile, WikiLeaks showed how technology can turn a David-vs.-Goliath match into a fairly even battle.  Non-tech journalists were simply flabbergasted that a man like Julian Assange could take on the U.S. government -- or any government -- so directly, and that government had so little power to stop him. What Assange did has already had serious real-world consequences, and they are ongoing. Assange was a teenage hacker before he became a political activist, and he might be considered the first Web-age hacker to have "grown up" -- he is what a hacker who doesn't ultimately get a job in computer security can turn into. He is destined to become the hero of every teenager with a little programming skill and a cause.

Sure, there have been plenty of cyberskirmishes fought in the name of activism, and there have been Twitter and Facebook campaigns aplenty - such as the Twitter-aided Iranian "revolution" of 2009. But those did not have anywhere near the impact of Stuxnet or WikiLeaks. Indeed, 2010 will be remembered as the year things changed. And those changes headline the top 10 things Internet users need to fear most in 2011.

At the same time, a more subtle, but perhaps more immediate danger for Web consumers surrounds the explosion of off-the-PC Internet applications.  The Web is on nearly half of U.S. cell phones now, but that's only the beginning.  It's also on TVs, DVD players, tablets like the iPad and even kitchen appliances.  What's the risk?  How many consumers do you know that are ready to purchase anti-virus software for their blu-ray players?  Predictions have been made for a long time about mobile Web viruses.  Given the explosion of new, unprotected gadgets, 2011 appears to be their year. 

On to the list. We will begin with the biggest consumer-grade threats, then work our way up to the most dramatic possibilities created by the success of Stuxnet and WikiLeaks.

1.Geolocation
I use Twitter because I have to, and I play around with Foursquare for research purposes only.  I am amazed that anyone uses the location-based services provided by these companies for anything but the most limited of applications.  Sure, Foursquare creates some neat possibilities for finding friends.  But even the most dimwitted of stalkers can turn these tools into playgrounds. It's trivial to know where people on Foursquare live, work and  play, and when they will be at each of these locations.  Criminals will catch up to this during 2011 and I hope you don't end up in the headlines.  Use location services with extreme care.  One tip: Have a friend "stalk" you to see how easily a stranger could follow you, then adjust your usage accordingly.

Physical stalking is far from the only risk, however.  Computer criminals can observe a person's traveling behavior to craft incredibly convincing phishing e-mails or other cyberattacks ("Hey, it was fun meeting you last night at Sullivan's Pub!").  Location-based service users need to add an extra helping of suspicion to their Web travels.

2. New media platforms
Consumers are welcoming browser-enabled gadgets all over their homes, and why not? It's great to stream movies to your television without having to bother with tricky laptop-to-TV connections.  But beware, says security firm McAfee. Many device application creators are rushing their products to market to meet demand, taking shortcuts on critical security issues (We've heard that story before).

"These tools have historically weak coding and security practices, and will allow cybercriminals to manipulate a variety of physical devices through compromised or controlled apps," the company warns.  The threats could be simple, such as fake Web pages that pop up on TVs, asking users to submit personal information. Or they could be complex, such as theft of stored passwords, or even hijacking of the machines for use in botnets. "This danger will eventually lead to data exposure and threats through new media platforms such as Google TV," McAfee warns.

3. Mobile phones
Every year since about 2004, security experts have predicted an explosion in viruses targeting cell phones.  They are beginning to sound like the boy who cried wolf, but this year could be different.  Until now, cell phones -- even smart phones -- have operated in very controlled environments. But the proliferation of the open-application environment of Android, and the "jailbreaking" of iPhones, has created a much more hacker-friendly world for cell phones.  As the prevalence of these gadgets reach critical mass, hackers will be drawn to them like gnats to a porch light. 

4. Mobile gadgets
In a related category, the explosion of mobile gadgets this year will create both a new playground for bad guys, and a new incentive to target operating systems that also control smart phones.  Analysts predict some 50 million tablets of all flavors will be sold in 2011. Most will use Apple's operating system, but perhaps 10 million to 20 million will be variations on that theme, running Google's Android.  The market for tablet-based antivirus software, meanwhile, is virtually non-existent. 

"Those devices are in some ways more powerful than computers, yet people are treating them like mobile phones," warned Piero DePaoli, a security researcher at Symantec Corp.  "They don't do much to secure them."

The combination of tablets and smart phones will prove to be a target-rich environment for the bad guys.

5. URL shortening
When you only have 140 characters to express your thoughts and feelings, you sure don't want to get bogged down passing along a wordy link like http://redtape.msnbc.com/2010/11/sherrilynn-palladino-lives-in-a-modest-three-bedroom-home-with-an-affordable-mortgage-about-15-miles-from-the-ocean-in-grov.html

(My New Year's resolution: Shorter URLs)

The solution? URL shortening services like bit.ly. They're great. Here's a better link for my story above, by the way http://bit.ly/erORys. But they are also an incredibly easy way for hackers to send you to an unexpected Web page.  After all, bit.ly, by definition, obscures the destination URL.   I could have claimed that this http://bit.ly/CNbKx was the link to my story above, when in fact it's a link to my favorite hockey team's Web site. It could just as easily be a link to a malicious Web page. URL shortening services undo years of safety training online, with security experts telling consumers to make sure the link they clicked really looked like it was headed to their intended destination. McAfee says there are more than 3,000 URLs being shortened every minute online. That's a lot of hacker potential.

6. Friendly fire
By now, you probably know enough not to click on an e-mail sent to you by AnneMarie0876 promising to help you enhance your private parts.  But what about an e-mail from a close friend offering you a chance at a free iPod, or a coupon for 20 percent off at your favorite department store?  This year, next generation viruses like Koobface made it easy for hackers to personalize their attacks, using tools to gather information about you leading to specially crafted e-mails and other attacks.   Their success will lead to widespread imitation, McAfee warns.

"Personalized attacks are about to get a whole lot more personal," the firm says.

7. The end of spam.  What?
Last year saw the lowest level in spam in years. Why? Criminals go where the people are. Both are moving on to more sophisticated communications platforms like Facebook.  Spam is so 2004.  Facebook wall posts apparently from friends asking for money are much more 2011.

 "Social media connections will eventually replace e-mail as the primary vector for distributing malicious code and links," McAfee says." The massive amount of personal information online coupled with the lack of user knowledge of how to secure this data will make it far easier for cybercriminals to engage in identity theft and user profiling." 

Tweets from "friends" will lead to widespread infections. Facebook chats will trick people into giving up personal information, or clicking on malicious links. Promiscuous friending will allow bad guys to connect with all of your friends, creating an easy attack vector with a wide footprint. All of this will happen in an environment where consumers tend to trust more than traditional Web pages or e-mail -- in other words, their guard is down, and attacks will be up.

"This shift will completely alter the threat landscape in 2011," McAfee says. 

8. Cloud computing
Remember Web 2.0? Me neither. It was just a marketing term that attempted to clarify what would happen if Internet applications started communicating with each other, such as Facebook and your phone's GPS service.  Cloud computing is much the same thing: a marketing term that describes a world where people store data and use applications on remote computers, rather than on their own desktops or laptops. It's not new -- in fact, it's a rather 1960s concept.  But technology firms would much rather rent computer space and services to users than sell them one-time products like a shrink-wrapped box of software.  Think of it this way: Who would you rather be, the cell phone maker ($200 gadget sales) or the cell phone service provider ($100 monthly bills)? The TV maker ($400 gadget) or the cable company ($120 monthly bills).

All that's well and good, and the cloud will provide some neat additional features for users, such as instant backup. But as the cloud moves into mainstream usage, hackers will follow.  Only the payoff for hacking cloud services will be massive, warns ISCA Labs.

"Cloud services will become prime targets for hackers wanting to gain access, not just to a specific company's data but possibly to multiple victims simultaneously," the computer security company says.  "As more users move to the cloud, we believe we will see more attacks directed at cloud-based services."

The cloud will also raise fascinating and troubling legal issues for users. Say you've stored all your family photos, or all your company's data, on a cloud service.  What happens if there's a billing dispute, like those that arise with cable companies and cell phone providers? And what if that cloud provider refuses to release your data until you pay that hefty early termination fee?  The best defense against that: Backing up all your data on your own computers, a rather un-cloud-like activity.

Meanwhile, many in the computer security world see widespread and lasting implications for cloud computing from the WikiLeaks incident.  Forget Julian Assange for a moment, if you can. When Amazon Web Services decided to dump WikiLeaks content from its cloud servers, observers were left wondering: How trustworthy is the cloud? What if a provider like Amazon decides it doesn't like my data? Conceptually, if WikiLeaks can be cut off, anyone can.

9.  Hactivism outbreaks
Whatever you think of Julian Assange, from a security standpoint WikiLeaks is clearly the most successful and influential "hactivism" event ever. It will inspire others aplenty.  Its success lies in part on the different nature of Assange's strategy.

Until now, virtually all hacktivist efforts landed in two camps: online graffiti, such as Web page defacement, or online protests, such as denial of service attacks.  The spreading of previously non-public information, against a government's will, is a new form of attack, and one that can't be stopped by added improved packet filtering.  The only way it can be stopped is by government officials taking a huge step backward and following the advice of many lawyers I know -- never type anything that you wouldn't want to see in the newspapers.  Expect a lot more secure phone calls and a lot fewer "secure" e-mails between government officials. That might have a detrimental impact on important information sharing -- say, between terrorism researchers at the Department of Homeland Security and airport security officials.  But WikiLeaks inevitably will lead to this kind of chilling.

One lesser-discussed aspect of the WikiLeaks release of U.S. diplomatic cables is Assange's hacker background, and the architecture of the WikiLeaks distribution system. It's built in global redundancies and clever booby traps, such as that encrypted insurance file. And it's proven the ability of one small organization to evade a powerful government's ability to shut it down. That will inspire other groups.  That loose hacker organizations like Anonymous responded to the incident by brazenly attacking major firms like Visa and MasterCard shows that renegade hackers are feeling their oats right now.

Meanwhile, attacks by organizations that claim to be acting privately raise important questions in cyberspace.  After all, who believes that the attacks on Google emanating from China were completely independent from government influence?

"Whether governments drive these manipulations and activities covertly is open to debate, but it is likely enough that states will adopt a privateer model," warns McAfee. "Hacktivism as a diversion could be the first step in cyberwarfare."

Just how far into conflict could vigilante hacking that may or may not be state-sponsored lead America? In a small research facility in Tallinn, Estonia, called Cooperative Cyber Defence Centre of Excellence, a NATO lawyer named Eneken Tikk is working to develop policy defining just what cyberwar is, and just what kind of response a NATO member must take if another member comes under attack.

Can a cyber-attack elicit a physical response? Can it trigger NATO's mutual defense obligation? What if the next WikiLeaks-like organization manages to shut down power to parts of France or Germany, or to expose government secrets such as the location of military assets? Would the U.S. be required to respond?

The problem, she says, is when it comes to cyber-response, whom do you bomb? That's why the bar for a "kinetic" response to an electronic attack should remain high, she said, limited to "a cyber attack on a country's power networks or critical infrastructure (that) resulted in casualties and destruction comparable to an armed attack."

10. More Targeted Malware, backed by nation-states
We now know cyberwarfare can go pretty far. The Stuxnet virus broke new ground in the computer security world, as it was clearly designed to take down utility plants -- and may have been written to take down one particular plant in one particular part of the world.

In late November, Iranian President Mahmoud Ahmadinejad said that enemies of the country succeeded in "creating problems for a limited number of our centerfuges with software," admitting for the first time that Stuxnet had indeed hit what seemed to be its intended target.  Of course, low-level cyberwar has been occurring for years, and the U.S. public knows precious little about many of these attacks. But it's hard to imagine a more successful cyberattack in history than Stuxnet.  No one knows who created the virus, but the specialized knowledge required to write it points to very few organizations and governments. Clearly, the efforts are being repeated and imitated as you read this.

One specialized form of government-sponsored attack is something McAfee calls the "Advanced Persistent Threat," which has the ability to remain undetected for a long stretch of time and activate only when the attacking country sees the need.  Who knows how many virus or bugs have been installed in vital computers around the world, back-doors and booby traps that are waiting for orders from headquarters. This kind of cyber cold war has been imaged for years, but McAfee thinks its time has arrived.

"There are numerous … attack teams located around the world, all with varying degrees of capabilities and expertise," the firm says. "… Some have access to massive amounts of resources (hardware, software, and human) and even traditional intelligence, surveillance and reconnaissance capabilities. Others borrow, steal or purchase ready-made tools offered and frequently used by established cybercriminal gangs and conduct themselves in a similar manner to gangs. McAfee warns that companies of all sizes that have any involvement in national security or major global economic activities should expect to come under pervasive and continuous … attacks that go after e-mail archives, document stores, intellectual property repositories and other databases."

In other words, it appears cyberspace is going to be much chillier in 2011.

(Wondering how I did with last year's predictions? Click here.)

“The CADJPY is testing the rising trend line dating back to Nov. 2,” announced the blonde bombshell in a low-cut bikini top, discussing with seeming gravitas and authority technical levels for the value of the Canadian dollar against the Japanese yen. “Despite consumer prices and retails sales topping expectations.”

Her Twitter name, 15k, gave little hint to her identity, but there was something about her that made me more interested than usual in currency exchange rates.

So I clicked through to her account, and then to her Twitter page, hoping for exciting fever charts, perhaps of the British Pound against the U.S. Dollar.

Instead, I saw this rather disappointing picture:

Whoever he is, he looks nothing like the blonde. Even more disappointing, he seems to know nothing about exchange rates. He just wants my money.

The Web page I've landed on, PS-Capital.com, says it represents a "Singapore Arbitraged Hedge Fund." This pilot seems polite -- notice the words "thank you" imprinted on the photograph.  He doesn't inspire confidence, but at least he's honest in explaining that the fund is a startup "awaiting funding to establish a track record." Then, he pleads for $1,000 to $10,000 payments via PayPal to help establish seed funding.

Not tempted by the offer, I scroll down further, and realize this page is a two-for-one sales pitch.  The pilot is also an Internet marketing expert, it seems.  For $50, he will sell me 500 Twitter followers.

"Let me further sweeten the deal for you. I am an expert on Twitter, self taught. I am also good enough on Wordpress, again self taught," he writes. "I am not good enough to do fancy stuff but I can create an automated blog. What does an automated blog do? ... Basically it pulls in traffic, lots of it. And by plugging in a Clickbank Id, an Adsense Id it could automatically generate revenue which is ENDLESS. It may not be much initially but it would grow and small even as it is, it just goes on and on."

Welcome to the seedy world of Twitter marketing. Spammers and other web advertising click scams have made their way through every Internet technology, so it's no surprise that they've taken over Twitter, too.  Their methods are always the same -- steal clicks, sell ads against them, then try to upsell some other crazy service.  Clicking through 15k's original Canadian currency post -- instead of her profile -- yields a link to a page promising a rather precise return on a Facebook investment: "Here's How YOU Can Make $144,823.37 Using Facebook™!"

At least the author honors Facebook's trademark. He or she does hijack your browser on that page, however, and won't let visitors leave without quitting the application.

The spam scam plays out in a unique way on Twitter, however, as marketers are forced to get attention in 140 characters or less.  Enter the "Women of Twitter." The women likely have nothing to do with the ads, and their images may have been used without their knowledge. That's a common and distasteful tactic. In a particularly egregious form of image theft, msnbc.com several years ago chronicled the story of a woman whose picture was stolen from a personal ad, then widely used as an ad for a pornography Web site.

So I decided to follow up on 10 Women of Twitter tweets to see where they took us. They are easy to find: Just do a search for any popular topic, like 'iPad." Many of them feign interest in financial news or other world events, but the accounts are simply set up to automatically pull in and post news headlines and to generate keyword hits based on newsworthy topics. The crazy tweets this generates is reminiscent of the "word salad," spam that was in vogue a couple of years ago, when billions of emails were sent containing what seemed to be the world's worst Haiku. 

In each case, I attempted to directly contact the poster and conduct an interview but had no luck. I did get one rather ironic response, however.

In my Top 10 list, which consists of 15k and nine others, I'm using the pronoun "her" to describe each account because the picture is female. But I have no idea of the real gender of the account holder.

Twitter, of course, has publicly said it is trying to fight spam like this, but it did not respond to requests for comment for this story. You can see our ongoing list of the Women of Twitter here, but please don't click on any of their profiles. You can also http://twitter.com/RedTapeChron">follow me.

"Toopweb" is pretty direct in her pose, and her message. The "try me" note posted on her picture has little to do with struggling British homeowners, but we clicked anyway.  Her profile page goes nowhere, but she's a prolific writer. She's already posted 6,000 tweets -- sometimes, she posts several an hour -- and has pulled in 600 followers. Her current concern at our last visit? "Early childhood education schools LearnmoreMN Blog: How to rebuild the foundation of Minnesota's education system."

This Twitter user has a much more obvious business model.  Her "real name" is "DVD Bluray," and her profile links to a website that upsells movies.  Mind you, she carries no merchandise -- all the links on that site are affiliate links for Amazon.com, where Naritiwas gets a cut for every sale. She has about 4,500 followers. Her Tweets are equally varied. Her most recent tweet on our visit? "Car accidents in Los Angeles County -- Expert Attorneys Wanted."

I write a lot about personal finance issues, so it was natural for me to visit the account named "Budgetingtips4u." I was disappointed, however, with the advice I got there. The first Tweet I read: "Alarm Clock Lamp Article: Alarm Clock Lamp Article It's difficult to provide accurate Alarm Clock Lamp information."  If anything, alarm clocks in my life are far too accurate. The "real" name Budgetingtips4u gives is Kasy Alutman, but that gets me nowhere. It's not hard to discern her real motivation, however: Her most recent tweet was "Traffic Building Tips When You Get Stuck | TRAFFIC BUILDING « Learn Traffic Building."

I came closest to real contact when I reached out to Savvypromoter. She seems to be a real person engaged in real Internet marketing promotion -- at least judging by her YouTube videos, which promise watchers a work-at-home business that includes a "system that is going to change your life," and enable early retirement. She says her name is Amanda Powlesland and that she's originally from New Zealand. She describes herself as an "Entrepreneur, Internet Marketer, Counsellor, Philanthropist, International traveller, Nature lover, CarbonCopyPro Member." Despite this, her tweets also seem like automated headlines. Here's one: "China mobile subscriber total rises to 833.1 million in Nov (Reuters): Reuters - China Mobile…."

I followed her on Twitter, and sent her an e-mail at what seems to be her legitimate e-mail account, requesting an interview.  I had hard-hitting questions in mind.  Here's the response I got:

"Thanks for trusting me! Do you want to know an easy 'paint by numbers' approach to earning an extra $3000 per month: "

I wouldn't trust her.

"KC Fong" is the name connected to this account, which holds the record in our group for most prolific. She's sent 186,000 tweets. She also seems oddly interested in small-town New Jersey property crimes, despite her stated location of Las Vegas.  Her profile page is about as subtle as her picture. It links to "lofu.offershop.us," an amalgamation of online retailer clicks.

"Our Web site is a third party marketing website for companies such as Netflix, Cash4Gold, and many more," the site says. You'll notice that Toopweb, mentioned earlier, follows KC Fong suggesting a) She wants to learn from a master Tweeter or b) the accounts might be controlled by the same person or organization.

This not-the-girl-next-door account posts innocuous and varied headlines all day long. Some sports headlines ("Packers backup QB nearly knocks off Tom Brady!), some tech news ("Sonex electric completes first test flight") and even world entertainment news ("Survivor: Nicaragua – Live Reunion Show!). On my first visit, she was tweeting about Yogi Bear, the movie.  But the account is really a doorway to something more serious. She follows 730 other tweeters, most of which seem to be escort services. Her first five Twitter pals are "Lost Angeles Escorts," "Detroit Escorts," "Washington D.C. escorts," "Calgary escorts," and "Toronto escorts" -- she obviously has gone international. Notes left on those pages seem to suggest they serve as authentic classified ads for paid sex.

Acaiberrybible takes a very different tack than our other Women of Twitter.  Her tweets are all on one topic, focused on weight loss and health benefits of certain foods. Like the others here, she both follows and is following about 2,400 accounts, suggesting quite a bit of account sharing going on. It also suggests the spammers know just how many followers they can accumulate before getting on the radar of Twitter's spam fighters.  This account holder says she's in Los Angeles, and I'm sure you won't be surprised to hear that her profile links to a Web page devoted to selling a "free" trial of acai berries.  In an interesting mix of techniques, the page is also part of the "fakosphere," complete with a blog and supposed random reader comments from people who lost weight after signing up. There's even advertisements from Groupon, pulled in via one of those marketing affiliate arrangements.

LainaMedoza3200, whose names sounds more like a computer model than a clothing model, also takes a different strategy. She claims to be giving away from iPads!  But interspersed with those aggressive offers, she produces some of the best poetry among the Women of Twitter.

"My good lord, I am so pleased to see you, he gushed, a soft eunuch's smile on his powdered face," reads one tweet. "The weirwoods were beyond the Wall, yet he knew Sam meant what he said," reads another.

A quick Internet search reveals the posts are pulled -- not from a news feed -- but from a fantasy novel called "A Game of Thrones" by George R. R. Martin. At least she's literary.  I hope Martin receives some royalties for this.

Finally, it should be obvious why I was attracted to "hotnewss."  I'm interested in any and all news scoops. Without apology, hotnewss -- who says her name is, ironically, Jane Rich -- links to random wire stories from around the world, like "Police arrest 12 men in counter-terrorism raids (Reuters)." And her profile links to a webpage that also throws together random headlines, Google News style, called wharfyouth.org, with the awkward label "Latest Update Headline News" -- but not before passing users through a page named MyGoogleTrends.info. The domain for that page is registered to someone listing the name "Bung Sa" in Singapore. No word if Bung Sa is starting a hedge fund.

Admit it, you've done it.  Despite all the vague warnings you've heard about public Wi-Fi hotspots, you've paid an online bill while surfing at a coffee shop. Or you've purchased something and entered your credit card number into a Web page. When you do that, you know you are sending private information through the air via radio waves, and that someone else in the coffee shop with some clever tools could suck down those waves, decode them and steal your personal information. 

Perhaps you've made a perfectly reasonable risk assessment that you trust the people sitting in your local coffee shop. And you know too well how limited the range of your Wi-Fi is. But what if you fired up your laptop, clicked to send your personal information into the air and had to trust everyone within a few miles? 

That's the choice a fast-growing segment of consumers is making every day, as usage of mobile broadband services like MiFi explodes. Shrinking prices, the attraction of connecting a laptop to the Web from virtually anywhere and the introduction of new wireless gadgets like Apple's iPad mean the market for mobile broadband will continue to expand from around 6 million U.S. users in 2009 to about 30 million by 2014, according to International Data Corp.  

All those users will have to trust that no one nearby will intercept  their transmissions. And that has some security experts saying, "Not so fast." 

An axiom in computer security holds that hackers go where the people are. As mobile broadband services become more mainstream, attacks will come fast and furious. While the encryption protecting long-range wireless connectivity has so far proven robust, there have been enough cracks around the edges that consumers should act with care when flinging their personal and corporate lives through the air.

Long ago, hackers with programs like Kismet and AirSnort discovered they could sniff and read data sent over coffee-shop style networks, even if wireless encryption like WEP (Wired Equivalent Privacy) was used.  The risks, however, are mitigated by the short-range nature of the radio signals. But mobile broadband rides over cellular networks, meaning their transmissions can span up to 10 kilometers, or more than 6 miles. That dramatically increases the opportunity for attacks.

Divided over the risk
Experts on wireless security are divided over the seriousness of the hacker threat.

Patrick Donegan, a wireless equipment analyst for security firm Heavy Reading, said the encryption used in the 3G and 4G networks that provide the new generation high-speed mobile broadband transmission has yet to show a single crack.

"Mobile broadband is secure.  Nobody has suggested that the 3G algorithms are vulnerable," Donegan said.

Still, a new report from Heavy Reading, called "Mobile Networks Face a Growing Security Crisis," warned that cellular firms must be ready for a coming wave of attacks from hackers.

"Mobile broadband is a train that has barely left the station. It will get bigger very quickly," Donegon said.  "And hackers go where the market is.  They look for scale."

'Wiretapping' possible
Amit Klein, chief technology officer of security firm Trusteer, is considerably more worried about the current risk than Donegan. He said hackers have already demonstrated a Wi-Fi-like attack on the GSM mobile standard, which is used by many current mobile broadband providers.

"GSM is stronger than Wi-Fi, but conceptually it is now proven vulnerable," he said.  "It's feasible to decrypt in real time GSM packets, thereby gaining wire-like wiretapping capabilities. ... It has been shown to be practical. Dedicated attackers can intercept and modify data, even an individual with a few thousand dollars to spare."

But Piero DePaoli, director of Symantec's Core Security Group, said he isn't worried at all about GSM eavesdropping. Plenty of contextual factors make successful attacks extremely unlikely, he said. Among them: Cell phone transmissions often move from tower to tower, which make things very difficult for a would-be attacker.  In general, encryption attacks require a hacker to initially suck in a massive amount of data, then look for patterns in that data. Cell tower hopping is one of many reasons that attack wouldn't fare well in the real world, DePaoli said.

"It seems very far-fetched," he said. "I'm personally not worried about it."

That doesn't mean MiFi and related hotspot technologies are completely safe, however. As usual, hackers have already found faults by avoiding a direct attack on the encryption and looking for other weaknesses.

Earlier this year, hackers found a flaw in MiFi gadgets made by Novatel that allowed an attacker to connect with the device, turn on its GPS feature and trick it into disclosing its location. The vulnerability was quickly patched and the attack did not put transmitted data at risk, but it did show that software flaws at the endpoints of mobile broadband networks offer enticing targets to hackers.

DePaoli said he also is concerned about user error with mobile broadband gadgets.  MiFi devices combine Wi-Fi and mobile broadband technologies, and where they connect, vulnerabilities can exist. Incorrectly configured MiFi devices -- some consumers might be tempted to turn off the included wireless encryption used between the laptop and the gadget –  can allow easy access for hackers.

Also, the password for hopping onto most gadgets is printed on an attached sticker.  Someone who obtained that password and then logged in would then be on the same physical network.

"They you have the same risk as using a coffee shop network," he said. So turning off MiFi encryption would be "a huge mistake."

On the more complex end of the spectrum, analysts have always worried about attacks that have dogged all wireless networks: "man-in-the-middle attacks" involving so-called "rogue access points."  Criminals could set up a fake network access device and trick a mobile broadband user into connecting to it, rather than the legitimate network.  The attacker could then steal data, then pass along requests to the appropriate network, thereby evading detection.  

Man in the middle attacks have been well-documented in the Wi-Fi world, because equipment required is inexpensive and the data easy to decode.  While it's also possible in mobile broadband, DePaoli isn't very worried, because impersonating a cell phone tower is difficult and expensive -- and, as previously mentioned, intercepted data would be useless to attackers without encryption keys.

Donegan is more concerned about the massive transition that is going on with mobile infrastructure equipment, and the vulnerabilities that could be created. Telecom equipment is rapidly being changed from proprietary software to more off-the-shelf, Internet Protocol-based software, making Internet telephony traffic more common.  That only makes life easier for hackers: few knew their way around old telecom networks, but IP-based networks are their playground. A simple flaw in a server, switch, or access point could mean big headaches for consumers and providers.

"There is evidence of nasty things happening out there," said Donegon. "As mobile firms are become true ISPs (Internet Service Providers), I'm telling operators that up until now security has been something of a tick box issue for their vendors, not high up on their priority list.  You will see it creep up in their agendas now."

While use of mobile broadband hotspots to connect laptops, tablets and other gadgets is a new and emerging technology -- suggesting it's a new arena for hacker attack -- DePaoli points out that the very same technology has been used for years without incident by mobile telephones accessing the Internet. So far, the only practical risks for consumers with those gadgets have been theft of the actual device.

"The main risk there is that people don't do very much to secure those devices," he said.

RED TAPE WRESTLING TIPS
For now, there's not much consumers can do about threats to mobile broadband, other than a bit of heightened awareness. As with cell phones, the greatest practical risk at the moment comes from theft of service through theft of the device -- either a MiFi gadget or a dongle that connects to the laptop. Because data overages can be very costly, lost or stolen gadgets should be reported immediately.

Klein said consumers should be aware that they are sending their data through the air, and act accordingly. While cellular networks are inherently much safer than coffee shop networks -- I always switch from one to the other when I'm doing my online banking -- nothing is 100 percent safe.  Even mobile broadband might not be suitable for transmission of very critical personal or corporate information.

Employees working remotely should tunnel in through a virtual private network to provide an added layer of security, Klein said.  Trusteer, his company, also sells a browser security product named Rapport, which creates a temporary "tunnel" between Web users and critical Web sites like online banks, preventing eavesdropping and warning off other attacks.  Traditional SSL encryption used by consumers when connecting to banks through web browsers will also add a layer of protection against sniffing, Klein said. That can be easily recognized through the presence of the letter "s" at the beginning of Web addresses, like this: https://bank.com  

Become a Red Tape Chronicles Facebook fan and follow RedTapeChron on Twitter.

The hackers who say they are sticking up for WikiLeaks and Julian Assange continued to flex their digital muscles on Thursday, extending outages at Mastercard.com and Visa.com to a second day. And even as the group claiming responsibility for the attacks openly discussed big new targets like Amazon, Twitter, and Facebook, Twitter took unsuccessful steps to disperse the virtual mob.

Meanwhile, published reports say a 16-year-old was arrested by Dutch authorities on Thursday in connection with the attacks. The youth was arrested in The Hague; authorities did not release his name, or say how promient a figure the suspect was in the attacks.

A loose-knit group of hackers who gather on the website 4Chan.org under the name Anonymous spent most of the past 24 hours playing cat-and-mouse with Twitter, where the group announces its attack plans. On Wednesday night, Twitter suspended its main account -- Anon_Operation -- soon after an attack on Visa.com was announced there. At the time, the account had amassed 22,000 followers.

There were immediate calls for an attack on Twitter that either didn't materialize or wasn't strong enough to impact the site's performance. Meanwhile, the group managed to quickly regroup using slight variations on its Twitter account name, such as Anon_Operationn.

A Facebook page devoted to the attacks, called "Operation Payback," also was suspended Wednesday night.

Members refer to the cyberattacks as "Operation Payback," or "Operation Avenge Assange." On Thursday morning, many had decided their next target should be Amazon.com, which last week decided to stop hosting Wikileaks-related material.

"Sharpen your arrows, get ready to fire at Amazon 30min til impact," wrote one alleged ringleader on Twitter at 10:30 ET.

It was unclear whether the group had any immediate impact on Amazon's website, which appeared to be generally available throughout the morning.

The threats were just the latest episode in a vigilante cyberskirmish surrounding Wikileaks that spilled over onto the wider Internet on Wednesday, creating big headaches for household name brands MasterCard and Visa.

The online conflict began recently when a hacker named The Jester claimed to have temporarily taken down the WikiLeaks website.

Copycats then began hitting WikiLeaks and its mirror websites. Soon after, other hackers began a pro-Wikileaks campaign, attacking government agencies and corporations that appear to oppose Wikileaks.

The attacks have generated a lot of noise online -- and a lot of media coverage -- but so far, neither side has scored many political points or landed a serious digital body blow. In fact, the hacker battle might best be compared to a bar fight that's spilled out onto main street and bloodied a few bystanders.

The first high-profile victim in the skirmish was Mastercard.com, which was still reeling from the effects of the attack on Thursday. The Anonymous group also claims to have attacked PayPal, Swiss bank PostFinance and a Swedish government website -- all in the name of sticking up for WikiLeaks.

"They are not just making noise. Everyday consumers, everyday people are getting caught up in this now," said Dean Turner, a computer security researcher at Symantec Corp.

On all sides, the attacks have been mostly a nuisance. Both Mastercard.com and Visa.com are more like virtual brochures, notwishstanding headlines that say, "MasterCard is down." Knocking those Web sites offline didn't interfere with the standard processing of credit card payments, for example.  The PayPal attack was relatively harmless, also -- the firm's blog was disabled, but payments were not disrupted.  Anonymous did cause real headaches for PostFinance, however, as the bank's online banking site was disabled for the better part of a day.

The attacks shouldn't be confused with a political movement, however.  Groups like Anonymous and 4Chan are amorphous. Even among 4Chan users there's disagreement over what side to take on the conflict.

Nor do the attacks represent the first time a political argument spilled out onto the Internet and led to denial of service attacks that disabled Web sites.  Politically motivated attacks reach back at least as far as 2001, when a U.S. Navy plane landed on Hainan Island in China. A Chinese hacking group named "Honker Union" attacked U.S. websites in the days that followed.  There have been at least a dozen high-profile political denial of service attacks since then, the most famous being attacks that crippled Estonian government and corporate websites after a dispute involving the moving of a Russian statue there. For a comprehensive list of such attacks, follow this link.

The WikiLeaks attacks are not the first time that the Anonymous group has taken on a cause.  It has attacked the Motion Pictures Association of America and the Recording Industry Association of America, for example, when both those groups took action against Internet music and movie piracy. It also attacked the Church of Scientology.

It would be a mistake to see the group as an organized force, however.  The attacks are being conducted with a simple tool the group calls "LOIC." It allows a volunteer to simply enter the name of a website to join an attack. The volunteer's Internet connection is then routed through a "command and control" server, which amplifies the number of requests being sent to the target website from that volunteer's computer, eventually overwhelming the Web server.

"Really, it's very simple. Anyone can do it," Turner said.

Turner estimated that it took about 5,000 volunteers to topple Mastercard.com.

Organizers in the Anonymous group simply publish the name of their next target, and invite volunteers to join the attack.

Websites overcome denial of service attacks by filtering out attacking traffic -- usually by recognizing the IP addresses of computers that initiate the attack and dropping, or "black holing," the requests.  But attacks initiated through distributed denial of service tools like LOIC can be hard to deal with because the volunteer computer requests blend in with normal Web traffic.  The target website then must either go off-line until the attack subsides or implement much finer filtering tools, which can be expensive and slow down the flow of normal Web requests.

Even then, clever attackers can route requests through proxy servers and rotate them, making it even hard to separate good traffic from bad.

"There really isn't necessarily a good way to filter out what appear to be good requests," Turner said, "That's why (these attacks) are still such a problem."

While the recent attacks have yet to cause much damage, Turner said, they are no laughing matter.

"This kind of thing can get out of hand, and that's the problem," he said. "The downtime costs companies real money. And there are people (In Switzerland) who couldn't pay their bills."

One interesting element in the WikiLeaks cyberskirmish: Wikileaks leader Julian Assange himself has a background in computer hacking. In 1992, he pleaded guilty to relatively minor hacking-related charges in Australia and paid a fine.  Later, he wrote a tool that scans the Internet for vulnerable computers, and even helped write a book titled "Underground: Tales of Hacking."

Security researcher Jeff Bardin, an expert in international cyberattacks, said he's not surprised the hackers have risen up in support of Assange, given his past.

"I bet Assange's hacking past is leveraging his ties to the hacking community," said Bardin, the chief security strategist at XA Systems. WikiLeaks hacker supports could merely feel a kinship with him, or there could be an even stronger connection, he speculated.

"I bet this was premeditated by Assange," Bardin said.

Julian Assange of WikiLeaks is fighting a lot of enemies right now, including at least one from an unexpected place: The computer underground.

A hacker calling himself The Jester – or "th3 j35t3r" in hacker spelling – said he took on WikiLeaks and was able to render the site useless temporarily on several occasions.

"TANGO DOWN - for attempting to endanger the lives of our troops, 'other assets' & foreign relations," The Jester wrote on his Twitter feed after his first alleged success at disrupting WikiLeaks on Nov. 28. 

The Jester appeared on the underground scene in January and has been tormenting pro-jihadist websites for months, employing denial of service attacks with a specialized tool he calls "Xerxes." But he has risen to international fame since he turned his virtual weapon on WikiLeaks. He's also spurred debate about a touchy subject among computer hackers and other security experts:  Is vigilante "hacktivism" ethical and productive, or does it do more harm than good?

The Jester's identity and location are unknown, but plenty of security experts have made educated guesses. In an e-mail interview conducted in January with security researcher Richard Stiennon, he identified himself as "an ex-soldier with a rather famous unit … involved with supporting Special Forces." In subsequent conversations with a security organization called InfoSecIsland, The Jester told researchers that he shuts down Islamic Web sites because he has personally witnessed soldiers "murdered" by jihadists and says they use the Internet to coordinate attacks.

Across the Internet, Jester supporters sing his praises. One posted this message on Monday: "th3 j35t3r: Where can I apply to be your apprentice?" Security experts believe he's already inspired imitators, and that WikiLeaks is now under constant threat of denial of attack. Predictably, WikiLeaks supporters see things differently, and have criticized the rogue programmer for his one-person attacks on freedom of speech.

That same divide is evident among leaders in the high-tech world.

"I think launching denial of service attacks is always a bad idea, regardless of the motivation," said Mikko Hypponen, chief research officer for security firm F-Secure. "There are often innocent victims in denial of service attacks."

He pointed to a 2009 attack on a Georgian blogger than caused millions of Facebook, Twitter and LiveJournal users to experience slowdowns.

'I applaud his work'
But Jeff Bardin, who translates Arab-language jihadist Web sites for a living, sees things differently. 

"Professionally speaking, he is taking matters into his own hands to remove sites that he believes are threatening to U.S. soldiers," said Bardin, a former U.S. Army soldier in the Middle East and now chief security strategist at XA Systems.   "Should a U.S. citizen be given (authority) to remove websites, especially if and when law enforcement either refuses or cannot become involved in a timely manner, or at all? ... Personally, I do not find fault with his current actions and applaud his work."

While the debate might be long overdue, lone-wolf hacktivism is nothing new, Hypponen said.

"Almost any real-world crisis has a reflection crisis happening online, often related to attacks like this," he said.  

'No collateral damange'
Of course, all acts of hacktivism are not equal. Since January, The Jester has taken pains to support claims that his newly minted version of denial of service attack does not harm intermediaries, and only takes down individual Web sites temporarily. While most denial of service attacks today involve distributed attacks using thousands or millions of hijacked PCs, The Jester claims his attack requires only a single computer, and does not harm Internet Service providers or other servers between his machine and the target Web site.

"No collateral damage," he has written several times.

He even released two cryptic videos showing the attack tool in action, accompanied only by The Jester typing into a notepad file on screen.

"My task is to make their chosen communication method unreliable," The Jester wrote of the jihadist sites in January to InfoSecIsland. "By taking them down at random intervals, for random intervals, they can't rely on them -- they become unreliable and useless."

The Jester says he takes down websites because traditional methods for doing so often seem frustratingly slow and ineffective.

"You can ask an ISP nicely to perform a takedown, but mostly they don't, that's where I seem to fit in," he told InfoSecIsland.

To answer criticism that taking down jihadist Web sites can harm U.S. intelligence-gathering efforts, The Jester said his takedowns are only temporary.

"My plan is to disrupt, not destroy," he said.

Rumor of a raid
Michael S. Menefee is principal consultant with WireHead Security and a member of InfoSecIsland who participated in the e-mail interviews with The Jester. He wouldn't offer an opinion on the legitimacy of hacktivism, but he said the group believes The Jester sincerely considers his attacks noble and justified.

"My interactions with the Jester have all been pleasant and he really envisions himself as a vigilante, as a good guy," Menefee said. 

That is until Thursday, when InfoSecIsland wrote a blog post accusing The Jester of staging a fake raid on his home to encourage supporters to donate to a legal defense fund.  Earlier in the week, someone posting a note from a Twitter account similar to The Jester's account said federal authorities had barged into his home and carted away his computers. Later, The Jester posted on his usual account that the raid notice was fake, posted by an imposter. The folks at InfoSecIsland didn't buy the explanation and suggested The Jester was trying to capitalize on newfound fame to raise money. He didn't appreciate the accusation.

"He was very clear he would never speak to us again," Menefee said.

Both Menefee and Bardin say they have reason to believe The Jester might be U.S.-based -- Bardin notes that he is well-versed in U.S. culture.  But there are other possibilities. The cyber-attack tool he uses is named "Xerxes," after a famous Persian king, suggesting familiarity with Middle Eastern culture. Bardin notes that Xerxes was a Zoroastrian, and speculates that faith's world view may color The Jester's attacks.

"In Zoroastrian tradition, life is a temporary state in which a mortal is expected to actively participate in the continuing battle between truth and falsehood," Bardin said. 

"I do wrestle with whether what I am doing is right'
Earlier this year, even The Jester expressed some ambivalence about his activity.

"I do wrestle with whether what I am doing is right, but figure if I can make their communications unreliable for them, all the better," he told InfoSecIsland.  And he signs many communications with the phrase: "There is an equal amount of good and bad in most things. The trick is to work out the ratio."

When asked how long he plans to continue his vigilante attacks, he sounded even more ambivalent.

"As long as my nerves will hold out. It's a serious situation I find myself in, the bad guys want to slice my head off on YouTube with a rusty blade, and the good guys want to lock me up in an orange jumpsuit ... along with the bad guys," he wrote.

Meanwhile, security experts fret about the implications of the Xerxes attack tool and what it might mean for other websites. The Jester has vowed not to release it to anyone else, but copy-cats are inevitable.  Menefee says the tool may have been preceded by two other attack tools, named Slowloris and Sockstress, that have been circulating since last year.  Any one of them could be used to knock millions of websites offline temporarily.

Such cyberassaults are more successful on smaller sites that don't have built in redundancies or aren't hardened against attack, Barden said, which stands to reason. But The Jester, or any future imitator, will have plenty of opportunity to continue vigilante attacks going forward.

"Based upon the number of jihadist websites -- now over 10,000 as of September 2010, he has a target rich environment to go after," Bardin said.

Become a Red Tape Chronicles Facebook fan and follow RedTapeChron on Twitter.

NOTE: Comments about Julian Assange and Wikileaks are welcome here. The discussion thread below is about the Wikileaks hacker, th3 j35t3r.

What are the odds someone else has used your Social Security number? One in 7.

That's the stunning conclusion of a San Diego company's analysis of 290 million Social Security numbers, which found that 40 million of them have been attached to more than one name. The study, conducted by the fraud-fighting firm ID Analytics, is the first of its kind that's been made available to the public.

We first wrote about the problem of "SSN-only" identity theft five years ago, and estimated that millions of Americans were on the "secret list of identity theft victims" whose SSNs had been misappropriated by an imposter to obtain work or credit.

The IRS often knows when this happens, when the imposter pays taxes. The Social Security Administration knows, too, for the same reason. And the nation's credit bureaus usually know, because the imposter often ends up applying for some form of credit.  Plenty of financial institutions also have access to this information.

But no one is telling you. In short, all these government agencies and financial firms don't think you have a right to know.

We're no closer to finding out who's on that list today, but at least we now know how big the problem is: much bigger than we originally estimated.

ID Analytics is a data collection firm that specializes in helping companies separate imposters from honest consumers.  Its client list is long, and includes many major financial firms as well as the Social Security Administration. Over the past decade, it has amassed files on virtually every American who is active in the financial system. It now tracks 290 million Social Security numbers and nearly 300 million people.

Normally, the company receives credit applications from clients and checks them against its vast database, looking for signs of fraud.  Criminals do crafty things like apply for a credit card at 10 different banks using SSNs that are only one digit away from each other. Or they use slightly different first names or street addresses in an attempt to evade a poor credit history or crime record. Because ID Analytics receives applications from multiple industries, it can spot these signs of fraud in ways that the individual companies cannot.

20 million use more than one SSN
One typical pattern: An imposter uses one name but alternate Social Security numbers in an attempt to circumvent the credit reporting system;  ID Analytics is geared up to spot just that kind of evasion.  It's a tough job, because the incidence of multiple numbers connected to the same name is enormous: Dr. Stephen Coggeshall, chief technology officer at the firm, said 20 million Americans have multiple SSNs associated with their names, or 6 percent of the total population.

That doesn't mean there are 20 million identity thieves out there, even though it might feel like that. In many cases, typos are the culprit, Coggeshall said. Any time a consumer gives an SSN to a company, there's a chance it will be incorrectly entered into its system, and the error will then propagate throughout the credit system. Once that happens, SSN No. 2 is forever connected to the rightful holder of SSN No. 1. The incorrect SSN might belong to a real person, which can cause a headache for both people, or it might be "synthetic" -- an unassigned number that becomes a new entity in the credit system. No one knows how many of these synthetic “people” exist in our credit system, but there are likely millions of them.

It's relatively easy to spot innocent mistakes, Coggeshall said, because the number is used only once in connection with the name. It's easy to spot fraud, too -- any time a person shows up in the system using SSN No. 2, or No. 3, or No. 4, over and over again. Deliberate fraud is responsible for less than half of the 20 million names attached to multiple SSNs, but it is still a large percentage.

"A good fraction of that group, maybe 15 to 20 percent, of these mistakes are deliberate," Coggeshall said. "There are systematic variations, deliberate manipulations. ... I see many people who have a lot of Socials (SSNs)." 

How many? ID Analytics says it has 3 million to 4 million names that have been used to commit identity fraud.

That's an astonishing number, but it pales in comparison to the next figure.

Five million SSNs attached to three or more people
Recently, Coggeshall decided to reverse his research. Instead of looking for people connected to multiple SSNs, which is most useful for businesses, he looked at SSNs that are connected to multiple people, much more interesting to consumers. In other words, how many people in the U.S. are essentially sharing their identities with someone else?

The answer:  40 million. That means nearly one in 7 SSN holders in the U.S. have two or more names attached to their SSN records.

Please note, this is not an estimate conjured up from a sample. This is ID Analytics looking at its own data, picking out SSNs that have more than one name attached and building its own list.  We now know: The secret list of ID theft victims has 40 million people on it.

Coggeshall said it's important to note that not every one of those consumers is hit with fraud. Many are on the list because of typographical errors. For example, if a company incorrectly enters an SSN and the number accidentally belongs to someone else, as explained above, the rightful holder of SSN No. 2 would end up on this list. Coggeshall said he believes many of the 40 million are on the list as the result of such mistakes.

But millions of those SSNs are being used to commit fraud.  Some cases are obvious. More than 140,000 SSNs are associated with five or more people, and 27,000 are connected to 10 or more people, for example.

"Once an SSN is connected to even three people, it's pretty clear something is wrong," he said. The firm found that 5 million SSNs have been connected to three or more people.

In addition to criminals committing financial fraud, there's a more controversial reason that some consumers end up on this list: They are essentially sharing identities with undocumented workers who buy or borrow an SSN in order to fill out necessary paperwork to obtain employment. 

The number of illegal immigrants using Americans' SSNs to obtain work is unknown, but a series of studies provides some hints. 

The Pew Hispanic Center estimates that there are about 12 million unauthorized immigrants in the United States. Those who are working are required to give a SSN to their employer. In 2007, the IRS said it believes 6 million undocumented workers paid federal taxes.  And every year, according to the Social Security Administration, nearly 10 million workers pay taxes using the wrong SSN, ending up in what the agency calls a "no-match" situation.

Again, no study has been conducted to identify precisely how many of those can be attributed to mistakes and how many to undocumented immigrants.  In 2006, the Social Security Administration sampled its records and determined that 12.7 million out of 17.8 million discrepancies were caused by clerical errors. On the other hand, an earlier study by congressional investigators found the majority of filers on the no-match list worked in industries like restaurants and agriculture, where the presence of undocumented workers is high.

Workers who pay taxes using the wrong Social Security number are a boon to government tax revenues.  Social Security taxes paid in such situations don't earn proper "wage credits," because the agency doesn't know whom to give credit to. The funds are tracked in what's called the Earnings Suspense File, which has shown explosive growth this decade.  From 1932-1999, the fund accumulated $300 billion.  By 2005, the most recent data available, the file accounted for nearly $585 billion in uncredited wage credits, ultimately adding roughly $40 billion to the U.S. Treasury during that six-year span.  

The issue of "shared identities" is among the forgotten elements of the immigration debate, but it rears its head once in a while. Recently, two U.S. courts ruled that using someone else's SSN is not an identity theft crime, drawing widespread criticism.

SSN is not a secret
Viewed purely as an identity management problem, Coggeshall said his study produced one clear result: "The Social Security number is not a secret," he said.  "It was never intended to be a secret. In today's world, it is used incorrectly. A lot of businesses have the assumption it's a number known only to you. That's not the case."

Unfortunately, the actual list of victims remains a secret, for now.  ID Analytics has contracts with its data providers that forbid it from sharing the information with the public. 

"The way we've been able to get visibility into the data … is by assuring companies we will not release this data," Coggeshall said. 

The firm has presented some of its findings, including the location of fraud rings, to law enforcement and "that information was well received." But generally the company does not work with law enforcement on specific cases.

"ID Analytics provides a service to our customers and only they can determine whether or not to pursue law enforcement actions," Coggeshall said.

The firm does offer a Web-based tool that allows consumers to get a sense of their risk, called MyIDScore.com, but that only generates a score based on a 1-1,000 scale suggesting the likelihood that someone else might be using your SSN or other elements of your identity.  The tool is free, and consumers can check their score without supplying their SSN, but the website includes advertising for paid identity theft protection services.

Further, even if there's a second SSN connected to your name, your score might not be high -- if ID Analytics believes that incident is an accident, as opposed to a malicious data theft.

And if your score is high? The tool points you to the nonprofit Identity Theft Resource Center and the Federal Trade Commission. Neither of those agencies can tell you if someone else has your SSN either. But they can help you clean up an identity theft mess after the fact.

Consumers who obtain their credit report hoping to see if anyone else might be using their SSN are often disappointed; records of such imposters are often kept on separate reports, sometimes called sub-files, which cannot be view by the rightful holder of the SSN.

Annual Social Security wage earnings statements also don't include the data, because wages earned by workers using their SSNs go into that Earnings Suspense File and don't show up on the report.

The most recent systematic effort to deal with the problem occurred in 2007, but it didn't involve victims. Instead, the Social Security Administration announced it was sending a round of so-called "no-match" letters to businesses with employees whose names and SSNs didn't match on their employment verification forms. Simultaneously, the Department of Homeland Security said it would crack down on companies that didn't respond to the letters. Citing widespread inaccuracy of the data, immigration rights groups sued and managed to stop the process.

Credit bureau Experian, when asked about the report, said that it believes most errors surrounding SSNs involve honest mistakes.

"Social Security numbers can be associated with multiple individuals, and that individuals can have multiple SSNs associated with them. The majority of these conditions are associated with data entry errors during a creditor's reporting process to a credit reporting agency like Experian, or joint account activity related to family members or legitimate associations," said spokeswoman Susan Henson. "Only a small percentage of these conditions are related to malicious intent, and Experian's fraud prevention tools detect and compensate for the majority of these cases."

Credit bureau Equifax declined to comment, and Trans Union did not immediately respond to requests for comment.

Coggeshall said he believes consumers should have the right to know more about what has been called the "secret life" of their SSN, and the recent court cases that seemed to downplay risk of SSN-only ID theft concern him.

"Certainly you are causing harm" to the victim, he said. Even if the number is used only for employment purposes, eventually it "gets around," he said.

But solutions to the problem are hard to come by.  One agency he doesn't blame: The Social Security Administration.

"Certainly, they know there are problems. They are the first to understand this," he said. "It's not a problem of them issuing numbers.  They were never intended to be a unique identifier ... but in the past few decades, businesses have used it because it's easy."

Become a Red Tape Chronicles Facebook fan and follow RedTapeChron on Twitter.