• Facebook says 600,000 account logins compromised every day

    Facebook said this week that hackers using stolen username and password credentials try to break into at least 600,000 accounts every day on the mammoth social networking site.

    The revelation was buried in a new security announcement issued by the company on Thursday describing the virtues of its new "Trusted Friends" password restoration technique. UK-based computer security firm Sophos first noticed the data.

    The Facebook blog entry includes an infographic explaining the success of the network's efforts to beat back spam, account hijacking, and other ills.  In it, Facebook says that "only 0.06 percent of 1 billion logins per day are compromised." The site is able to precisely count the number of stolen or otherwise compromised logins because it challenges the would-be hackers with additional authentication questions, such as asking users to identify friends in pictures, said spokesman Barry Schnitt. 

    "(This means) 600,000 times a day, we stop a bad guy from getting access to an account even though he has guessed, phished, or stolen the login and password of an account," Schnitt said. "This is something we're very proud of."

    An unknown additional number of hacking attempts are successful, Schnitt said, adding that it was "an extremely small percentage" of accounts.

    "If an unauthorized party has logged into your Facebook account, then you're far from alone," wrote Sophos' Graham Cluley in a post about Facebook on Friday.

    "Facebook ID theft" is a serious problem which lays the foundation for all manner of other cyber misbehavior. Recently, msnbc.com reported on a woman who sent $2,000 to a criminal, believing she was communicating with her sister through Facebook chat. Other common scams include criminals hijacking friends' accounts and trying to talk users into coughing up money. Much cyberbullying also begins with compromised FB accounts.  A woman recently contacted me complaining that her son's account had been hacked and classmates had posted pornographic pictures.

    "They changed his email address and his password; so my son could not get into his Facebook," the woman, who asked that she not be identified to protect her son's privacy, said. "Then they posted, more than once, pornographic pictures of men with a cut-out of my son's face on it and posted it as his profile picture. My son is only 15 and those pictures were so terrible that he was embarrassed, humiliated, and devastated over them."

    It's not hard to find similar stories about the dire consequences of Facebook login compromises.  One key to solving the problem is making it easier for the rightful holder of hacked accounts to restore their access, and Trusted Friends should help considerably. Still, in a world where consumers are continually adding to the number of identities and imposters they need to worry about, 600,000 daily stolen or otherwise compromised Facebook credentials is not a welcome data point.

    Don't miss the next Red Tape:
    *Get Red Tape headlines on your Facebook Wall
    *Follow Bob on Twitter. 
    *Get an e-mail newsletter with Red Tape stories (requires Newsvine registration).

     

  • Some big banks back down from debit-card fee

    Bank of America appears to be responding to criticism over their plan to implement a $5 monthly debit card fee. NBC's Tom Costello has more.

    Bank of America triggered outrage among customers last month when it announced plans to impose a $5 monthly fee next year for using a debit card. Even President Barack Obama weighed in, saying banks shouldn't take advantage of their customers.

    But other big banks are not following in the steps of the nation's No. 2 bank. And now Bank of America itself seems to be wavering in its resolve.

    The Wall Street Journal reported Friday that JPMorgan Chase & Co., which recently surpassed BofA to become the nation's biggest bank by assets, has decided it will not charge a fee to customers who use their debit cards to make purchases. The decision was made after eight months of testing, according to the story, which cited "a person familiar with the bank's plans."

    Wells Fargo also announced late Friday it is canceling its planned five-state pilot of a monthly $3 fee for users of its debit cards as a response to customer feedback.

    Several other banks, including Citigroup and Bancorp, also have decided against charging the fee.

    Reuters reported late Friday that Bank of America is "is likely to allow many customers to avoid the fee by taking measures such as maintaining minimum balances, having paychecks direct deposited or using Bank of America credit cards."

    Under earlier plans, customers might have needed balances totaling $20,000 across all their Bank of America accounts to avoid the fee, Reuters said. The Reuters story also was attributed to an unidentified "person familiar with the bank's plans."

    Bank of America and others have said new debit-card fees are needed to recoup income because of a law that went into effect Oct. 1, cutting in half the amount banks can charge merchants for debit-card transactions. Merchants have long been vocal about being charged too much to accept debit cards.

    SunTrust and Regions Financial have been among the banks saying they will charge a fee.

    None of the banks backing down from imposing the fee say it's because of the brouhaha over the announcement by Bank of America.

    "Unlike many of our competitors, we will not charge fees that discourage use or make it unreasonably expensive to take advantage of the tools and services that consumers say are important for managing their finances," Citi said in a statement last month. "The bottom line is that customers don't want to pay to use their debit card."

    Related: 

    ConsumerMan: Why banks want to wean you off debit cards

     

    
  • Siri lets strangers control some iPhone functions without a password

    Rosa Golijan / msnbc.com

    Msnbc.com's Rosa Golijan was able to send a message with a locked phone.

    Apple's new Siri iPhone 4S personal assistant may be a lot of fun, but she's far too willing to talk with strangers, says U.K.-based security research firm Sophos Ltd.

    There's been plenty of talk about Siri's funny personality quirks, and how she will respond with sharp wit -- even when owners swear at her or talk dirty to her.

    The problem is this same sense of wit wasn't applied to Siri's security settings, according to Sophos.


    By default, Siri will take commands from anyone, even if the phone itself is in lock-down mode,  researcher Graham Cluleysaid in a blog post. That means a stranger could pick up a locked iPhone 4S and send an e-mail, send a text message or many other things the rightful owner of the gadget can do -- without needing to enter a four-digit passcode.

    As software developers are fond of saying, this isn't a bug, it's a feature.

    Users who delve into their iPhone security settings will find an option, turned on by default, that says "allow access to Siri when locked with a passcode."

    That's a poor security design choice, Cluley said.

    "What's disappointing to me though is that Apple had a clear choice here," he said. "They could have chosen to implement Siri securely, but instead they decided to default to a mode which is more about impressing your buddies than securing your calendar and e-mail system," he wrote.

    Apple didn’t immediately respond to requests for comment.

    Tests at msnbc.com show Siri’s friendliness doesn’t extend to all iPhone features. She wouldn’t read out existing e-mails without prompting users for a passcode.

    Rosa Golijan / msnbc.com

    Siri coughed up contact information, too, without demanding a password.

    But msnbc.com's Rosa Golijan found a long list of iPhone features she could perform, even while the phone was locked. She was able to: look up contacts and retrieve full contact information, including nicknames; learn who sent text messages to the owner; make phone calls, including international calls; and turn alarms on and off.

    Curiously, Siri refused to do other things: she wouldn't reveal recent call history, for example, or spit out directions. And most critically, when asked to unlock the phone, Siri said, "I'm sorry, I can't do that." 

    The selective behavior means Apple considered security when creating Siri's locked-phone permissions.

    "But there's plenty you can do with the phone locked, and there's a lot of damage you can cause," Golijan said.

    Users concerned about Siri being overly friendly can turn off the Siri security bypass in the Settings/General/Passcode Lock menu on their iPhones.

    "Those of us who work in the security arena have often banged on about the importance of securing your smartphone with a password or passcode to prevent unauthorized access," Cluley said. "Most mobile phone manufacturers have recognized that as so many people use their smartphones to manage their diaries, their private communications and their social lives, it's good to have some form of security."

    With reporting by Rosa Golijan.

    Follow Bob Sullivan on Facebook or Twitter. 

    We take a moment to chat with the iPhone 4S's Siri personal servant, and find that she's not only very helpful and surprisingly accurate, she knows how to joke around and tell off smart alecks, too.

  • 'Son of Stuxnet' virus could be used to attack critical computers worldwide

    A powerful new computer virus that some are calling the "Son of Stuxnet" has been discovered, and researchers are concerned about its potential for attacking critical infrastructure computers around the world.

    The mysterious Stuxnet worm -- perhaps the most powerful ever created -- managed to infiltrate computer systems in Iran and do damage to that nation's nuclear research program. The new worm, dubbed Duqu, has no such targeted purpose. But it shares so much code with the original Stuxnet that researchers at Symantec Corp. say it must either have been created by the same group that authored Stuxnet, or by a group that somehow managed to obtain Stuxnet's source code. Either way, Duqu's authors are brilliant, and mean business, said Symantec's Vikrum Thakur.

    "There is a common trait among the (computers) being attacked," he said. "They involve industrial command and control systems."


    Symantec speculates that Duqu is merely gathering intelligence as a precursor to a future industrial-strength attack on infrastructure computers.

    “Duqu's purpose is to gather intelligence data and assets from entities, such as industrial control system manufacturers, in order to more easily conduct a future attack against another third party,” Symantec said in an announcement. “The attackers are looking for information such as design documents that could help them mount a future attack on an industrial control facility.”

    At the moment, Duqu only creates a back door into infected systems, connecting them to a command computer somewhere in India. No marching orders have yet been given, Thakur said. But those who control the machines could do virtually anything they wanted, Thakur said.

    "The kinds of consequences we could see ... if the computer is told download this file, it will download the file. If the file says shut off this service, and that had an effect on a power plant or a conveyor belt, it would do that," he said.

    Duku is so similar to Stuxnet that F-Secure's antivirus program initially identified it as Stuxnet, said F-Secure's Chief Research Officer Mikko Hypponen.

    "Duqu's kernel driver is so similar to Stuxnet's driver that our back-end systems actually thought it was Stuxnet," he said in a Tweet.

    The mysterious Duku is designed to leave the back door open for precisely 36 days, and then self-destruct.

    Symantec was first alerted to the existence of Duqu on Friday, when an unnamed security firm that had already worked with a Europe-based victim shared his research with the firm. Symantec researchers worked through the weekend trying to understand the virus, which they have since learned has infected industrial computers "around the globe," Thakur said.  He wouldn't identify the initial victim or say how many known victims there are.

    Symantec’s analysis shows the Duqu may have been used to surveil computers around the world as far back as December 2010.

    McAfee researchers Guilherme Venere and Peter Szor said in a blog post that they are pretty sure Duqu was written by Stuxnet's authors, in part because both programs utilize fraudulent "stolen" digital certificates which had been issued to companies in Taiwan. The use of what appear to be real digital certificate keys make both programs particularly deceptive. It also proves the programmers are clever enough to fool Certificate Authorities who issued the certificates.

    "It is highly likely that this key, just like the previous two, known cases, was not really stolen from the actual companies, but instead directly generated in the name of such companies at a CA as part of a direct attack," the blog entry said.

    Duqu’s attack pattern differs dramatically from Stuxnet, which was designed to attack a very specific computer system -- one that was involved in critical nuclear research inside Iran. The virus’ target led many to speculate that the virus was invented by Israeli programmers, or a cooperative effort of government-backed Israeli and American computer hackers. 

    This "Son of Stuxnet," with its much wider focus, might call into question the origin of the virus, but Thakur wouldn't speculate on that.

    "It's my personal belief that the guys who wrote Stuxnet knew exactly what they were doing, and if you thought they were good guys then, you probably don't have anything more to worry about now," he said. "But if you didn't, you probably have a lot to worry about."

    Symantec isn't finished analyzing Duqu; it has several other samples of the virus from other victims which it is analyzing now.

    "We wanted to put out the word so people know about the threat, and know what to watch out for, such as traffic to unknown servers or what files to look for so they can try to block them," he said. "In the coming days, we will look into information from other sources we have and see if we can get more information on what these guys are actually going for. The key thing missing here, unlike Stuxnet, is we don't know what they are looking for."

    Follow Bob Sullivan on Facebook or Twitter. 

  • Student banned after debit card/student ID card complaint is reinstated

    A college student, angry at what he sees as forced use of a school-branded debit card, which also doubles as college ID, gets kicked off campus after a Facebook rant. WCNC's Tony Burbeck reports.

    A North Carolina community college student who was banned from campus after complaining about being forced to use a school-branded debit card has been reinstated. Reversal of the decision leaves a critical question unanswered, however: Why are schools around the country forcing students to get into bad financial habits by using MasterCard-branded debit cards laden with booby-trap fees?

    Catawba Valley Community College student Marc Bechtol was suspended for two semesters earlier this week after complaining about the debit card on the school's Facebook page, according to the Foundation for Individual Rights in Education.  Bechtol's Facebook complaint included a suggestion urging readers to find "good viruses" to send to the school or register it for porn sites. On Oct. 4, Bechtol was pulled from class and told he was no longer allowed on campus.

    After the Foundation for Individual Rights in Education (FIRE) intervened, Bechtol was reinstated. The school viewed Bechtol’s post as a threat, but FIRE argued that it was protected free speech and not a serious threat.

    A letter from the school's vice president of student and technology services sent Oct. 14, and posted on FIRE's website, said the school has decided to modify its disciplinary action because Bechtol offered to publicly express his regret for his "poor choice of words."

    Bechtol complained last spring that school was forcing him to obtain a debit card issued by financial firm Higher One, and that his personal information would be shared with the company. When he did, he said he immediately began receiving credit card spam, which directly inspired his Facebook comment.

    "Did anyone else get a bunch of credit card spam in their CVCC inbox today? So, did CVCC sell our names to banks, or did Higher One? I think we should register CVCC's address with every porn site known to man. Anyone know any good viruses to send them?" he wrote, according to the letter FIRE published. 

    Connecticut-based Higher One works with hundreds of schools to create combination student ID cards/debit cards that can be used for direct deposit of financial aid funds. The cards can also be used to withdraw cash or make purchases. There have been frequent complaints that the school cards carry higher fees than traditional ATM cards. On many campuses, students are charged 50 cents for each "debit" card purchase at retail outlets in which they enter their PIN codes for verification -- known as PIN-debit purchases, as opposed to signature-debit. ATM withdrawals at non-Higher One cash machines cost $2.50.

    The fees led to the creation of a "Ignore the Higher One Debit Card Offer” Facebook page by a parent upset by the financial arrangement.

    Last year, the Portland Oregonian wrote a piece examining the "noodly" fees associated with the school debit cards in the Pacific Northwest. In response to complaints, some schools have been able to negotiate lower fees for students.

    The cards offer some advantages for both students and school. Similar to debit cards used to deliver unemployment benefits or other government payments, the cards are far cheaper than mailing checks. And recipients have quicker access to the funds.

    But confusion over debit-vs-credit purchases, and a $19 "abandoned account" non-use fee that hits after nine months, have irritated users.  The idea that a private firm is getting a cut of financial aid payments through debit card fees should also raise eyebrows.

    But the chief concern about forcing students to use ID cards with MasterCard logos should be obvious: Why start kids down the credit/debit card route before it's necessary? And why get them used to the nickel and diming?

    Follow Bob Sullivan on Facebook or Twitter. 

  • Gov't cameras in your car? E-toll patent hints at Big Brotherish future

    Imagine that you couldn't drive on major highways without agreeing to put a camera in your car -- one that could film either the occupants or the vehicle’s surroundings and transmit the images back to a central office for inspection.

    You don't have to read George Orwell to conjure up such an ominous surveillance state. You just have to skim through filings at the U.S. Patent Office. 

    It's hard to imagine Americans would tolerate such a direct, Big-Brotherish intrusionBut they might not notice if the all-seeing cameras were tucked inside another kind of government tracking technology that millions of Americans have already invited into their cars. 

    Kapsch TrafficCom AG, an Austrian company that just signed a 10-year contract to provide in-car transponders such as the E-Z Pass to 22 electronic highway toll collection systems around the U.S., recently filed a patent on technology to add multi-function mini-cameras to their toll gadgets. Today, transponders are in about 22 million cars around the U.S. Adding inward and outward facing cameras to the gadgets would create surveillance capabilities far beyond anything government agencies have tried until now.

    The stated reason for an inward-pointing camera is to verify the number of occupants in the car for enforcement of HOV and HOT lanes. The outward-pointing camera could be used for the same purpose, helping authorities enforce minimum occupant rules against drivers who aren't carrying transponders.

    But it's easy to imagine other uses.  The patent says the transponders would have the ability to store and transmit pictures, either at random intervals or on command from a central office. It would be tempting to use them as part of a search for a lost child, for example, and law enforcement officials might find the data treasure trove irresistible.  The gadget could also be instructed to take pictures when the acceleration of a car "exceeds a threshold," or when accidents occur, so it could be used like an airplane cockpit flight recorder.

    It's important to note that a patent filing is a far cry from the invention and manufacturing of a new product.  Many patent filings are nothing more than a defensive measure taken to protect the farthest reaches of intellectual property. Officials at Kapsch declined to be interviewed for this story, but in a statement said that citizens shouldn't read too much into the filing.

    “This patent filing is part of the standard intellectual property protection process followed by every company that invests in research and development," said Erwin Toplak, chief operating officer of Kapsch, in an e-mail. "Kapsch, for example, files approximately 20 patent applications a year. This process protects our unique ideas; it does not signify that a commercial product is in development or even contemplated .”

    And P.J. Wilkins, executive director of the E-Z Pass Group consortium that manages the massive toll collection cooperative, said he hadn't even heard of camera technology when told about the patent by msnbc.com.

    "It's not an upgrade we are working on here," said.  "We just signed a long-term contract with them and this wasn't a requirement."

    Enforcement of HOV and HOT lanes is a labor-intensive and expensive issue for many state agencies, he said, and he understood why a company like Kapsch would try to invent a technology to deal with the problem, But he said he couldn't imagine it being used in the E-Z Pass system.

    "Before anyone goes down that road there's a whole host of questions that would have to be answered,” he said. “What's the impact on privacy? What's the impact on the data stream? I just don't think it's something that would gain a lot of traction."

    Kapsch sells its technology in 41 countries around the globe, and 64 million cars worldwide have been outfitted with its transponders, according to the firm's website.  Occupant cameras could be attractive, and more acceptable, outside the U.S.

    And while it's possible cameras-in-cars technology would be a non-starter in America, that doesn't mean Americans shouldn't be worried, said Lee Tien, a privacy expert with the Electronic Frontier Foundation. 

    "I think (drivers) should be pretty concerned," he said. "You want to make sure any use of that technology is very carefully regulated. People should let the E-Z Pass folks know now what they think about any possible plans to introduce cameras in their cars, now, while it's being developed, rather than before it's already a fait accompli, and some agency says it's already spent millions on it and can't turn back now."

    Tien said there's nothing inherently bad about using new technology to enforce tolls, but he cautioned against what is sometimes called "surveillance spillover."  Technology designed for one function is inevitably used by law enforcement officials and other government agencies in unintended ways.

    "You could imagine that they could limit the capacity of devices  -- say the images would be destroyed after a very short period of time -- so it would not be as powerful a surveillance device. But that's not the general dynamic," he said. "Once you have the device out there, someone says, 'Why not use it for this, or that.' That's usually where the battle between privacy and other social goals is lost."

    The dynamic is playing out right now in a European scandal surrounding use of a secret government program used by German law enforcement officials to monitor citizens' Internet behavior through the use of Trojan horse software called R2D2.  German courts had permitted use of the software only when officials were fulfilling a legal wiretap order, and only to listen in on Skype conversations. But the R2D2 Trojan has allegedly been used by German authorities to send thousands of screen shots detailing suspects' Internet explorations, to keylog their typing, and in a host of other potentially illegal evidence-gathering methods.

    The solution, says Tien, is to design privacy right into the gadget in the first place, to minimize the inevitable temptations for law enforcement and security officials.

    "It doesn't bother me that (Kapsch) filed this patent. Surveillance technology is constantly being developed. There is money in surveillance," he said. "The question is less about lamenting the invention of these things and more about questioning our demand for surveillance, and thinking about the kind of society we are building and encouraging when we legitimize the continual, gradual architecting of the social world into a surveillance society."

    News of the camera patents comes as electronic toll collection continues to expand around the U.S. -- and while options for using the systems anonymously have finally become commonplace.  After years of complaints from skeptics that E-Z Pass toll paying created an undesirable public record that could be used to track individuals, systems in Texas and Washington state now allow users to register for the devices without disclosing their identities.  And a new "E-Z Pass On the Go" gadget is being sold in the Eastern U.S. that functions much like a disposable prepaid phone card, allowing anonymous use of the E-Z Pass tolls.

    E-Z Pass has had to beat back a lot of conspiracy theories through the years, Wilkins noted -- such as the idea that the gadgets would be used to catch speeders and issue tickets.  E-Z Pass users now register very few complaints, he said, and are overwhelmingly happy with a system that helps them avoid delays at long toll booth lines.

    "The whole tracking thing is a bogus argument," said Wilkins. "If you have a cell phone you are being tracked anyway. Law enforcement can get to cell phone records just as easily (as E-Z Pass records). And the phone company keeps that data a very long time."

    Follow Bob Sullivan on Facebook or Twitter. 

  • German officials admit using spyware on citizens, as Big Brother scandal grows

    A government surveillance software scandal that erupted in Germany this weekend has spread beyond that nation's borders, raising questions about how far government officials around the globe might go to monitor citizens through spyware.

    On Saturday, as reported on MSNBC.com, the German-based Chaos Computer Club announced it had examined a Trojan horse program allegedly spread by government officials to secretly spy on citizens' Internet travels, e-mail, chat and more. The software, originally intended only to help officials intercept Internet phone calls through legal wiretaps, went far beyond those permissible purposes, the hacker group alleged.  The group called the government's use of the software outrageous and demanded it be destroyed immediately.

    Since Saturday, new details have emerged which largely confirm suspicions raised by the hacker group. That has German officials calling for an investigation.

    "Clearly the limits set by the Federal Constitutional Court have been massively violated," said Claudia Roth, co-leader of the Green Party, according to Der Spiegel's online edition

    Justice Minister Sabine Leutheusser-Schnarrenberger has called for an investigation of the incident.

    So far, four German states -- including Bavaria -- have said they've used the program, though officials maintain it was implemented legally in concert with court orders. 

    But a lawyer representing a suspect in an illegal pharmaceutical trafficking case told journalists that his client's laptop computer had been deliberately infected with the Trojan horse by Customs agents in 2009 when he was traveling through Munich airport, according to Deutsche Wells.

    German firm DigiTask told several media outlets this week that the program inspected by the Chaos Computer Club was likely a tracking program it had sold to Bavarian authorities in 2007, and that it was looking into claims that the same software was sold to other German states.  DigiTask officials also said it had sold similar spy software to government officials in Austria, Switzerland, and the Netherlands, according to Deutsche Wells. The firm said it had never sold its software outside of Europe.

    Digitask's relationship with the German government first came to light in 2008, when documents released by WikiLeaks showed German law enforcement officials were working with the firm to develop software that would allow interception of Skype-based phone calls.

    A landmark court decision in Germany in 2008 permitted limited use of such spying software to help government officials enforce wiretap orders as a countermeasure to alleged increased use of encypted Internet telephony by criminals and terrorists.  Government agencies that used DigiTask's software had said it was limited to conducting legal wiretaps. But an English-language presentation  published by website cryptome.org suggests DigiTask offers "forbidden functions" to government clients.  The presentation describing the firm's "remote forensic software," talks about the ability of the software to be updated remotely and customized.

    Antivirus firm F-Secure, based in Finland, said in a blog entry that it had found a document indicating that the German Customs Investigation Bureau had purchased "surveillance services," from Digitask for $2.9 million in 2009.

    F-Secure, along with many other antivirus firms, is detecting and disabling the German Trojan horse, now known as R2D2 because of references made in the software's computer code to various “Star Wars” characters.

    The German spyware scandal touches on various sensitive subjects for Internet users and civil liberties advocates.  BBC commentator Stephen Evans said the incident has touched a nerve among Germans "who, given the country's Nazi and Communist past, feel strongly about spying on citizens."

    U.S. officials have long flirted with the idea of spying on private computers in America to fight crime or terrorism.  A program developed by the FBI in 2001 called Magic Lantern had capabilities similar to R2D2, but was abandoned after a series of critical news stories.  Wired Magazine has reported extensively on "Computer and Internet Protocol Address Verifier" software used by the FBI since at least 2007 to aid in investigations of hackers and terrorist threats.

     The R2D2 incident has implications far beyond German borders, prompting the Chaos Computer Club to call on government officials everywhere to reconsider the notion that electronic surveillance can be successfully implemented in a limited form.

    "This refutes the claim that an effective separation of just wiretapping Internet telephony and a full-blown Trojan is possible in practice – or even desired," the club said in a statement. "Our analysis revealed once again that law enforcement agencies will overstep their authority if not watched carefully." 

    Follow Bob Sullivan on Facebook or Twitter. 

  • Move to China for a job? Unemployed cope by leaving US

    For years, American jobs have been exported overseas, to places like China or India.  Now we're exporting our people there, too.

    "I just got tired of how the economy was going back home. I just figured things had to better somewhere else," said Francine, a former real estate agent in Las Vegas who recently moved to Xi'an, in central China, for work. 

    She has two jobs, but says her standard of living is a little bit better than when she left Nevada. "It's kind of ironic -- the middle class in China is growing while the middle class in America is shrinking."

    Francine, who spoke with msnbc.com on condition of anonymity, had never been to China before making the decision to move there with her husband, and she doesn’t speak Chinese. But she's found enough locals who speak her language, and "when I meet someone who doesn't speak English, I play charades with them." The couple moved into a small one-bedroom apartment where he works in the import/export business, and she works constantly as a freelance magazine writer and at a learning center. She said she was surprised by the difference she felt immediately in the way her new neighbors treated her.

    "Being poor anywhere in the world is bad, (but) if you are broke in the U.S., people just do not treat you very well,” said Francine, who is 28 years old. “In China, people are still very polite and respectful regardless of your financial status and I like that."

    There's no hard data on private-sector Americans working overseas. In 2004, the U.S. Census Bureau tried and abandoned an official count of the then-estimated 4 million Americans working outside the country.  In 2009, the U.S. State Department said it believed there were 5.3 million Americans living overseas, but cautioned that the number was an out-of-date guess. That means there's no way to know for sure how many Francines there are.  But the response to our recent series on "Crazy things Americans are doing to cope with the recession," and a collection of anecdotes from around the world, hints that many U.S. workers are performing the same analysis that multinational corporations have made -- life overseas is cheaper, and in some ways easier, than in America. Reversing a trend that’s perhaps 400 years old, workers are leaving America to find opportunity elsewhere.

    “After the market crashed, the only jobs that were available were temp jobs, or jobs with very high turnover.  Either way, I knew that I could not get by like that or even dare to save money,” Francine said. “So, after a grueling two month debate with myself, I finally decided to sell what little I had left of my belongings and put the rest in a small storage unit…and armed with $300, I flew to China.”

    To be sure, even people like Francine still believe success in America is sweeter than anywhere else on the planet -- and she hopes to return to the U.S. when the economy recovers. (That’s why she requested anonymity; “I wouldn’t want a future employer to think I’m unpatriotic,” she said.). But she believes her best chance of riding out the current economic storm is far from her home port.  And while she misses her laundry dryer, her car and being able to flush toilet paper down the toilet, living in China does offer some advantages.

    "The cost of living is really cheap," she said.  "I can go and get massages and manicures every week and it only costs about $13 for both. You can't get those prices back home.  In fact, those were luxuries I cut out in order to save money."

    Americans are finding their way to employment all around the globe. In the immediate aftermath of the financial crisis, many finance majors and investment bankers fled Wall Street for Hong Kong or other Asian destinations, where the banking industry was still thriving. With Australia benefitting from China’s economic growth, Americans are flocking there, too. Americans now rank third among those applying for work visas in Australia, behind only the U.K. and India, according  the Wall Street Journal, and their ranks have swelled 80 percent in the past five years. The story cited an unemployed California construction worker who now earns as much as $50 an hour laying flooring in Australia. Canada, with its proximity making it the easiest ex-patriot option, has seen temporary work visa applications from U.S. citizens double from 2008 to 2010, thanks in part to an unemployment rate that's nearly 2 percentage points lower than its neighbor to the south.  The thriving oil-charged economy in Alberta deserves much of the credit for that. Meanwhile, in 2009, when IBM laid off thousands of workers, the global giant offered jobs to those willing to relocate to India and other nations as long as they accepted “local terms and conditions.”

    "I constantly receive emails from people saying something along the lines of, 'I can’t find a job here in the States so I want to go overseas,' ” said William Beaver, who runs a website for U.S. emigrants at OverSeasDigest.com.  "At the very least, it seems that people may see it as a viable option."

    Wally, who also requested anonymity, left  the west coast of Florida to work in the United Arab Emirates about two years ago.  One happy surprise that made his family's move more tolerable: a thriving ex-pat community.

    "I have run into several fellow Americans who have chosen to move overseas and take advantage of the opportunities that utilize their skills, which in some cases have no or little demand back home ... due to the dreadful downsizing that U.S. companies have been doing in the past few years and moving jobs to the low-cost regions," said Wally, 41, who was an electrical engineer, but now is in industrial business development. "Those I run into saw it coming, so of speak, and decided to venture outside the U.S. while they could … afford a transition."

    Wally had the foresight -- and the money -- to carefully plan his departure, which made things much easier.

    "It is not easy to leave home," he said. "The biggest struggle I had was leaving my family back home -- a wife and two kids -- when I took the leap of moving here. My wife and I agreed that I move first and explore the situation before I commit them to moving. It is important that you have the family support before venturing into a move like this."

    Francine, the former real estate agent, didn't have the chance to plan as much – and hasn’t enjoyed as much support.

    "I looked online for jobs for expatriates and there were ads for Xi’an and after I did some research about the city, I went there," she said.  She said she put most of her personal belongings in storage and purchased the least expensive one-way ticket she could find.

    "My family was shocked to say the least, and I would have to say that many of them were against my decision to move," she said. "It took some time for my grandmother to even understand why an American would leave America." 

    But thanks to technology, leaving America is quite different than it was a generation ago, or even a few years ago.  During an interview via Skype, Francine said she's constantly in touch with friends and family at home.

    And "home" has come to China, too. There's a Walmart in a mall that's a five-minute walk from her apartment.  McDonald's, Kentucky Fried Chicken and other familiar restaurants are even closer. 

    "It's all here," she said. "Things are not as different here as you might think."

    There are unexpected benefits, too.  Both Wally and Francine said they feel much safer walking down the street in their new homes than they did in Nevada or Florida, as crime rates are considerably lower. Away from the intense time demands of U.S. business culture, Wally says he's been able to relax a bit more and even "develop some new hobbies."  Of course, being away from American efficiencies has its downsides, too.

    "The struggle was setting expectations," he said. "We are used to systematic things in the U.S.,  irrespective of the state you live in, and we should not expect that getting a driver’s license, opening a bank account, hiring a Realtor, returning merchandize, or even connecting the utilities to your apartment is anything like back home. It sounds petty, but in the beginning it feels like you are on another planet."

    That feeling can apply to getting the necessary paperwork for overseas work, too, said Beaver.  Getting rich as an ex-pat is almost always a pipe dream; obtaining permission for full-time employment is getting harder, too. Canada recently announced it is tightening its standards for granting even temporary work visas. 

    "(People) don't know the facts," he said. "The job market in the industry (they) deal with can be even more competitive than in the States in certain fields because of security clearance requirements and other factors."

    Wally and Francine shared one quality that made their overseas jump easier -- both had traveled extensively when they were young, preparing them for an adjustment to a radically new culture.  Still, Wally urged down-on-their-luck Americans to at least consider an overseas move "if all roads at home hit a dead end."

    And Francine said that ultimately, all that's required is an open mind. 

    "People are people everywhere. Ultimately, you'll find a way to survive," she said. "If you are brave ... just get a passport, and if you have enough money for a round trip ticket, get a storage unit and come to China."

    Follow Bob Sullivan on Facebook or Twitter. 

    Related links:
     Nevada's gamble in China pays off big
    U.S. Ambassador to China's top priority: jobs back home

  • Chaos Computer Club: German gov't software can spy on citizens

    A well-regarded Germany-based hacker group claims a German government-created Trojan horse program is capable of secretly spying on Web users without their consent.

    The group says on its website that it obtained and analyzed a piece of software that is supposed to be a "lawful interception" program designed to listen in on Internet-based phone calls as part of a legal wiretap, but its capabilities go far beyond legal bounds. 

    The program is capable of logging keystrokes, activating Webcams, monitoring Web users' activities and sending mountains of data to government officials, the club said.

    To cover its tracks, the data is routed through rented servers located in the United States, the club alleges.

    "To avoid revealing the location of the command and control server, all data is redirected through a rented dedicated server in a data center in the USA," the Club said on its website.

    The German government has yet to comment on the findings, but already, antivirus companies are reacting to them. Security firm F-Secure will detect and disable the alleged government monitoring software if found on clients' computers, it announced on Saturday.

    "Yes, it is possible the Trojan found by CCC is written by the German government. We just can't confirm that,” said Mikko Hypponen, F-Secure’s chief technology officer, via Twitter.


    The program, labeled a "backdoor" because it can open a computer to surreptitious access, targets certain applications for keylogging, including Firefox, Skype, MSN Messenger, ICQ and others, according to F-Secure.

    "We do not know who created this backdoor and what it was used for," Hypponen wrote on F-Secure's blog. "(But) We have no reason to suspect CCC's findings."

    German courts have long allowed use of a backdoor program known as "Bundestrojan" — "federal Trojan,” in English — which permits government investigators to listen in on Skype-based phone calls as part of a legal wiretap order.  Skype and other kinds of Internet phone calls that can be encrypted are particularly troubling for law enforcement, because they can be used by suspects to evade wiretaps. 

    After a court battle in 2008, Bundestrojan was ruled legal as long as it screened only very specific communications — essentially, Internet telephone calls.

    But the Chaos Computer Club announced Saturday that it had obtained a copy of what it believed was a copy Bundestrojan, and that the program has capabilities that go far beyond legal wiretapping. In addition to keylogging and screen shots, the software is also capable of remote control and upgrade.

    "This refutes the claim that an effective separation of just wiretapping internet telephony and a full-blown Trojan is possible in practice – or even desired.... The Trojan's developers never even tried to put in technical safeguards to make sure the malware can exclusively be used for wiretapping internet telephony, as set forth by the constitution court," said the club on its site. "Our analysis revealed once again that law enforcement agencies will overstep their authority if not watched carefully. In this case, functions clearly intended for breaking the law were implemented in this malware: they were meant for uploading and executing arbitrary code on the targeted system."

    The club also criticized security measures put in place by programmers of the alleged Trojan. Poor encryption implementation means a malicious third-party could intercept the government communications, or take control of government-infected machines, it said.

    "This complete control over the infected  PC – owing to the poor craftsmanship that went into this trojan –  is open not just to the agency that put it there, but to everyone," the club said. "The security level this trojan leaves the infected systems in is comparable to it setting all passwords to '1234.' "

    Worse yet, the flaws make it possible to place false evidence on a suspect's computer.

    "(This) puts the whole rationale for this method of investigation into question,” the club said.

    The well-regarded hacker group, founded in the 1970s, didn't say where it had obtained the program, but said it had analyzed several different copies. It said the German Ministry of the Interior had been informed about the findings, and the club publicly demand that the German government stop using the program and initiate its self-destruction capabilities.

    While Bundestrojan is designed to tap communications of suspects after a government official obtain permission from a German court, there is no technical reason that the software could not be used on U.S. citizens traveling in Germany, or even on Web users who are outside of Germany.

    Government use of voice-over-IP monitoring software first came to light in 2006 when the Swiss government announced it was considering software written by Swiss-based ERA IT Solutions. At the time, Switzerland said the program's use would require a court order. 

    Antivirus companies have long held that they would detect and disable any such government-monitoring software found on users' machines. That public stance dates from 2001, when an msnbc.com report revealed that the FBI had developed a Trojan called Magic Lantern, which had capabilities similar to Bundestrojan.  F-Secure's policy statement on Bundestrojan references Magic Lantern.

    Still, the firm said it has not yet faced a direct confrontation with a government agency over the policy.

    “We have never before analyzed a sample that has been suspected to be governmental backdoor," it said Saturday. "We have also never been asked by any government to avoid detecting their backdoors."

    The Chaos Computer Club used the announcement to make a generic plea for less electronic monitoring by government officials.

    "The (government) should put an end to the ever-growing expansion of computer spying that has been getting out of hand in recent years, and finally come up with an unambiguous definition for the digital privacy sphere and with a way to protect it effectively," it said.  "Unfortunately, for too long the (government) has been guided by demands for technical surveillance, not by values like freedom or the question of how to protect our values in a digital world. It is now obvious that he is no longer able to oversee the technology, let alone control it."

     Follow Bob Sullivan on Facebook or Twitter. 

     

  • Twisted government accounting behind Postal Service woes

    You might have heard that the United States Postal Service is in trouble: that it's losing billions, that it will have to end Saturday service and close branches — and most inflammatory, that it might need a government bailout. Perhaps you heard that the Postal Service couldn't pay $5.5 billion bill that came due Sept. 30 and that only an emergency postponement saved it from the government's equivalent of default.

    In fact, it's the Postal Service that’s currently bailing out the U.S. government. Politicians have been raiding Postal Service revenues for years, using them to make the federal deficit appear smaller than it really is. The fiscal gyrations are so twisted that the Postal Service is right now forced to pre-pay health care benefits for employees the agency hasn't even hired yet — in fact, for many future employees who haven't even been born yet — all to artificially shrink the federal deficit.

    It's these crushing accounting tricks, not the cost of delivering mail, that has pushed this 200-year-old institution to the brink.

    Welcome to the wacky world of Washington, D.C., accounting.

    There's a long and a short story to the tragic tale of Postal Service financial trouble. I'll start with the short one. Right now, the Postal Service is being forced to pre-pay health benefits for the next 75 years during a 10-year stretch. In the past four years, those prepayments have totaled $21 billion. The agency's deficit during that time is about $20 billion. Remove these crazy pre-payments — a requirement that no other government agency endures and no private industry would even consider — and the Postal Service would be in the black.

    Of course, it's not quite that simple. And no one denies that the rise of e-mail has meant the fall of first-class mail, creating a real long-term challenge to USPS relevancy. But the current fiscal "crisis" is entirely manufactured by the Washington way — in fact, the payment missed on Sept. 30 represents this year's tithe to the federal deficit, disguised as health care benefits layaway for a mail carrier the agency might not hire until the year 2060.

    The controversy over the future of the post office has been slowly coming to a head, and it reached a fever pitch around the Sept. 30 payment, meant to satisfy this year’s health care pre-payment costs. The agency begged for a delay, which it received — but that led to detractors’ calling for immediate reforms, such as post office closings and the elimination of Saturday delivery. But supporters have rallied to the agency’s side — about 500 rallies were held last week all around the country in support of the agency. 

    Meanwhile, some advocates are desperately trying to call attention to the USPS’s unique budget situation, which is not quite the crisis it appears.

    “It is clear that these prepayments for future retiree health care benefits are — at this point — the primary reason for the U.S. Postal Service's financial crisis,” Ralph Nader wrote in a letter to Congress last week. “In fact, simply looking at the numbers reveals that the Postal Service's ‘financial crisis’ is in fact an entirely manufactured crisis.”

    Why would the Postal Service find itself in this crazy arrangement, bleeding red ink today so it can pay for employees’ health benefits 50, 60, or 75 years from now? Believe it or not, there is an explanation, but it's not so simple — delivered with fair warning from Jim Sauber, chief of staff of the National Association of Letter Carriers.

    "It takes a long time to explain how crazy and complicated it is," he said.

    But a quick tour into this fiscal crisis is incredibly instructive as to the ways of Washington, and failing to understand it might mean someday soon you won’t get mail at your house any longer.

    First, it's important to note that the USPS is financially self-sufficient. Since the 1970s, it has been mandated by Congress to operate entirely on its own revenue, with no taxpayer money. It's an enormous agency — with $65 billion in annual revenue, it would be a Fortune 50 company if it were a private entity. As a quasi-government agency, it enjoys privileged fiscal status — its revenue and expenses are "off budget," meaning Congress isn't supposed to be able to toy with them. It shares this privileged state with only one other government entity: the Social Security Trust Fund. But as you know, Congress finds a way to toy with everything.

    In 2006, Congress passed the "Postal Accountability and Enhancement Act" to modernize the agency's stamp-price-setting tools and a host of other elements of mail delivery. That law set up this seemingly crazy health care prepayment fund.

    To bean counters at the U.S. Treasury Department, however, the fund made perfect sense. It was a crazy arrangement to cover for another crazy arrangement the Postal Service escaped in 2006.

    When former members of the U.S. military take a government job, their military service counts as annual credits toward pension eligibility. This holds true when service members take postal jobs — but who pays for the value of those credits? In 2006, the Postal Service was shouldering that cost on its balance sheet, even though there was general agreement that the Treasury Department should be responsible for pension credit earned prior to employment with the Postal Service. The 2006 law shifted the burden from the USPS, but that meant an addition burden on the Treasury — that is, it would have added to the federal deficit. So to balance out that negative on Treasury's balance sheet, the Postal Service was ordered to make health care pre-payments equivalent to the cost of the pension cost shift.

    The problem of military pension credits itself was a creation of just such a deficit-hiding accounting trick. In 2002, an audit of the USPS budget found it had overpaid into the federal government's pension plan by roughly $80 billion. Postal Service officials lobbied hard have its pension payments readjusted. They were, in 2003, but in order to make the shift revenue neutral, military pension credit costs were shifted from Treasury to the USPS.

    The 2006 law passed by Congress was designed to put an end to this fiscal football.

    In the middle part of the last decade, the Postal Service was so awash in operating cash that the 10-year tithe to the federal government seemed a small price to pay for a promise that the crazy cost shifting would be over in a decade. In the meantime, the cash played a small but measurable part in reducing the federal deficit.

    "But it became very clear that these payments were unaffordable once the economy tanked," Sauber said. In short order, the health care prepayments became “a million-pound weight” on the Postal Service budget.

    Sauber and other Postal Service advocates say the Postal Service would have no trouble balancing its own budget if Congress and the Treasury Department stopped adding billions to its annual expenses through fiscal maneuvering. 

    Still, powerful forces have gathered in an attempt to use this budget bickering as an excuse to reform the post office dramatically. Rep. Darrell Issa (R-Calif.), the Republicans’ top government cost-cutting advocate in the House and head of the powerful Committee on Oversight, has introduced legislation that would dramatically alter the agency. His Postal Reform Act of 2011 would end Saturday delivery, create a commission to study post office closings and create a Solvency Authority that could break union contracts if the agency fell into the red.

    Last month, President Barack Obama proposed that the Post Office end Saturday delivery. His proposal offered some relief from health care prepayments, but it merely by spreading the costs out over a longer period of time. Issa responded by calling Obama's plan a "thinly veiled attempt to offset continued operating losses with a taxpayer-funded bailout."

    Others have advocated complete dismantling of the service, turning mail delivery over entirely to private industry. Rarely do those arguing against mention that the Postal Service starts its year in a hole designed to hide a portion of the federal deficit.

    A Heritage Foundation report published last month called "You've Got (No) Mail: Is the End Near for the Post Service?" indicated that the agency "barely avoided default" and was down to "a week's worth of cash."

    "Congress should act quickly to address this not-so-slow-motion postal train wreck. The goal, however, should not be to ‘save’ USPS or even to save mail delivery," the report said. It mentioned the pension overpayments but made no mention of the health care costs prepayment, and it concluded that the USPS cannot survive unless supported by "tens of billions of dollars in subsidy."

    Sauber says it’s hard to counter such arguments with a long discussion of Washington accounting tricks.

    "It's so much easier to say, ‘Oh, it’s the Internet.’ That seems obvious, but that's not really what's going on,” he said. “It is frustrating for letter carriers to have to deal with all this misinformation. … It’s easy to demagogue on this, for people who don’t like government workers to say the Postal Service is failing because it’s a government agency. But in this case the easy explanation isn’t the right explanation."

    The postal workers' union favors legislation proposed by Reps. Elijah Cummings, D-Md., and Stephen Lynch, D-Mass., that would allow the agency to access overpayments to the federal pension system, and to restructure its health care prepayments, to solve its immediate budget woes.

    It's also hitting back at critics with an aggressive TV ad campaign that began running last month.

    "Congress created this problem, and Congress can fix it," the ads say.

    Sauber doesn't deny that the Postal Service has problems. Revenue shrank from $74 billion to $67 billion from 2008 to 2010. Mail volume plummeted from 202 billion to 170 billion pieces during that same stretch, a 22 percent fall. While the drop parallels the recession, common sense dictates that even a robust economic recovery probably won't lead to an increase in handwritten love letters.

    But Sauber says the rise of the Internet has created almost as many opportunities as problems for the Post Office — package delivery from online shopping has soared, for example. Meanwhile, the agency has shrunk full-time employee ranks from 663,000 to 583,000.

    The Postal Service hasn’t always done itself any favors — long lines, unhelpful employees and stories of double-dipping by pensioners feed the public’s notion that change is needed.

    "We know we have to change. But the right way to do that is to clear up this artificial fiscal crisis now, survive the recession and then see where we are," he said, "not to gut the Postal Service now based on misinformation and budget politics."

    Follow Bob Sullivan on Facebook or Twitter. 

     

  • Update: BofA blames site slowness on upgrade, says no risk for customers

    Updated 5:38 p.m. ET, Thursday, Oct. 6: Bank of America blamed system upgrades and heavier-than-normal traffic for sluggishness that hounded website users for the better part of five days. 

    Spokeswoman Tara Burke said the site was operating normally Thursday.

    "It was three things. We’ve been developing and deploying new capabilities for our customers ... migrating online banking to a new platform and we experienced heavier than normal volumes on several days, although these volumes were not beyond our normal capacity," Burke said in a statement to msnbc.com.

    The timing of the trouble is hard to ignore, as it began almost immediately after Bank of America announced it was adding a $5 monthly fee for account holders who make purchases with their debit card. But Burker reiterated that the slowness was unrelated to the new fee, and that the firm did not suffer from a hacker attack.

    Some customers who tried logging in this week received a message saying, "We're sorry our site is running slowly. As a result you may experience delays."

    The bank has steadfastly denied that the outages are the result of any foul play, as it did in March when widespread outages were reported. 

    "Customer information was not compromised," Burke said. 

    No hacking group has attempted to take credit for the outages, lending credence to the company’s claim. Data obtained by msnbc.com on what times of day the outages have occurred also seem to hint at an IT problem, rather than a hacking incident.

    An upgrade has been advertised for weeks. Account holders in the Pacific Northwest are currently being told that an upgrade planned for Oct. 17 will offer them "expanded capabilities like the ability to set up Alerts to monitor account activity, go green with paperless statements, pay bills with Mobile Banking, and more." It’s possible the website struggles are related to this upgrade.

    Customers who face overdraft fees or other problems because of the outage should contact a branch to request refunds.

    "We will work with each customer on an individual basis in regards to fees," Burke said.

    Ben Rushlo, director of performance management at Keynote Systems Inc., which monitors the performance of company websites, said the Bank of America outage has been highly unusual.

    "We've really never seen anything like this before, a prominent website having this kind of trouble for this long," he said. 

    Data provided to msnbc.com by SmartBear Software, produced through its AlertSite Internet monitoring service, tell the story of frustration Bank of America customers have experienced earlier this week. The outages have at times been severe and were worst at midday last Friday, when 90 percent of website requests failed, according to SmartBear. The heaviest outages have occurred during business hours, with none on Sunday, hinting that software or hardware upgrades being conducted by employees might be causing the trouble. 

    (all times are EST)

    Tue, Oct. 4

    [a few reports about site unavailable to users]

    • 6:00 a.m. – 10:00 a.m.: normal home page loading
    • 10:00 a.m. — just saw the "We're sorry our site is running slowly” page

    Mon, Oct. 3

    [users reporting site unavailable through 5:20 p.m.]

    • 6:00 a.m. – 10:25 a.m.: normal home page loading
    • 10:25 a.m. – 10:45a.m.: browser connection reset errors
    • 10:50 a.m. – 6:20 p.m.: displaying "Home Page Temporarily Unavailable"
    • 6:25 p.m. – 12:00 a.m.: normal home page loading

    Sun, Oct. 2

    [a few sporadic reports about site unavailable to users]

    • Normal home page loading all day

    Sat, Oct. 1

    [users reporting site unavailable through 8:00 p.m.]

    • 6:00 a.m. – 11:05 a.m.: normal home page loading
    • 11:10a.m. – 12:10 p.m.: approx. half the measurements resulted in browser connection reset error
    • 12:15 a.m. – 6:50 p.m.  displaying "Home Page Temporarily Unavailable"
    • 6:50 p.m. – 12:00 a.m.: normal home page loading

    Fri, Sept. 30

    [users reporting site unavailable most of day]

    • 6:00 a.m. – 9:15 a.m.: Home page loading normally in ~ 4 seconds
    • 9:20 a.m. – 10:00 a.m.: approx. half the measurements resulted in a timeout or error related to slow loading
    • 10:00 a.m. – 11:00 a.m.: 90% of samples returned the "Home Page Temporarily Unavailable" page
    • 11:00 a.m. – 12:15 p.m.: all samples except 1 successfully loaded a normal home page at typical speed
    • 12:20 p.m. – 6:10 p.m.: all samples returned the "Home Page Temporarily Unavailable" page
    • 6:15 p.m – 12:00 a.m.: normal home page loading – a little slowly in a few sample

     

      Follow Bob Sullivan on Facebook or Twitter. 

  • Stealing elderly parents' identities a hidden, common crime

    Child ID theft is a scourge of the digital age -- a terrible crime that often sees parents ruining their own kids’ futures by taking out mortgages, car loans and other financial obligations in their names. But a new study shows that another kind of family-based ID theft, which rarely grabs headlines, might be much more prevalent: Stealing the identities of elderly parents.

    Security firm ID Analytics looked at billions of credit applications and other related data recently to find people using the same Social Security number and last name, but different first names, with an eye toward determining the prevalence of child ID theft. The firm then narrowed the list by searching for pairs sharing SSNs who were 18 to 25 years apart in age, indicating a jump in generations.  After tossing out typographical errors and other potential inaccuracies, the firm found roughly 500,000 kids in the U.S. under 15 sharing their SSNs and last names with adults who were 25-40, making them likely victims of ID theft by their own parents. 

    But the massive data analysis turned up an even more dramatic finding when head researcher Stephen Coggeshall tried looking for people in their 70s and 80s who were sharing their SSN and family name with someone roughly 20 years younger. The result: More than 2 million elderly adults who are sharing an SSN with their adult children.

    "This was very surprising to me," Coggeshall said. "I didn't think there would be a substantially higher number than young parents using their kids' IDs."


    The study is imprecise.  For example, it's sometimes not possible strictly through data analysis to determine who is the criminal and who is the rightful SSN holder.

    "But when you have a 60-year-old and an 80-year-old sharing an identity, it's unlikely that the 80-year-old is the one seeking credit," Coggeshall said.  

    ID Analytics, which sells credit application fraud-detection services to a wide variety of firms, has a unique ability to peer inside credit data to look for trends. The firm sees more than 1 billion credit applications per year, and is able to identify criminals from patterns in the applications. For example, criminals often apply for credit simultaneously using the same stolen data at dozens of companies, hoping one or two won't catch the fraud. Similarly, criminals use stolen information with minor adjustments -- changing the birthday on each application by one day in sequence, like Nov. 1, Nov. 2, Nov. 3, etc.  Individual banks can't detect such crimes, but ID Analytics can.

    The firm has recently turned to looking for macro trends in its data to help researchers examine larger ID theft trends.  Last year, for example, ID Analytics announced that 40 million SSNs are attached to more than one name in the nation's credit system.

    Evidence of widespread prevalence of elder identity theft represents a new wrinkle in society’s battle against this digital age crime.

    “The realities of familial identity theft are far worse than anything you see in a soap opera. It is the ultimate in family betrayal,” Coggeshall said. “Most consumers think of this type of manipulation as something inflicted by a stranger or a criminal scamming the system, when in reality a lot of identity manipulation may be a betrayal by a trusted parent, child or another family member.”

    Jaimee Napp, a consultant and expert on ID theft victim rights, said she wasn't surprised by the findings.

    "Elder parents are often vulnerable and often dependent on caretakers who sometimes are children," Napp said. "Financial exploitation is a high yield, low risk crime. A crime can be easier for a child to commit against an older parent because of access to their information."

    Many adult children feel entitled to their parents' money, she said, believing that it will come to them through inheritance anyway. They can also justify the crime when parents suffer from dementia or other mentally debilitating illnesses.

    Elder family member ID theft hasn't gotten the attention of other identity crimes because it often happens silently, Napp said.

    "These crimes have very low reporting because victims sometimes (are unable to report the crime), or because of embarrassment and shame that their child would do this," she said. 

    Elders hit by imposters end up facing all the headaches of other ID theft victims – tarnished credit, paperwork nightmares, collection calls, paying bills on behalf of criminals – but with the added emotional trauma of a family crime.  Some victims just pay the bills rather than turn in a family member.  

    The crime falls under the larger category of elder financial abuse, which financial expert John Wasik has labeled "the crime of the 21st Century." An aging population with large retirement savings, combined with widespread unemployment, creates a recipe for elder theft.

    A report by MetLife Mature Institute released in June found that elder Americans are robbed of $2.9 billion annually -- and that one-third of the crimes are committed by family, friends, and neighbors.  That figure is likely low, however, because it only included published reports of elder crime.

    Recent high-profile cases, such as the mysterious case of Hugette Clark, have shined some light on that issue, but familial ID theft involving older victims needs much more attention, Coggeshall said. The temptation to commit the crime only becomes greater as the U.S. economy limps along and high unemployment persists.

    The study did not consider criminals who exploit both their children and their parents, a subject that might arise in later studies, Coggeshall said.

    "People (commit) intergenerational identity theft because (they) don’t think it’s wrong, especially when the going gets tough," he said.  "The biggest problem is the perpetrators tend to be the most aware and active credit seekers, and the victims often aren't in the credit market at all, so they don't discover the crime. ... The biggest lesson here is that even if you are in your 80s and think you aren't credit active, you are still at risk for your ID being stolen, not just buy a stranger but also by a family member."

    For more on elder financial abuse, see “Stealing from grandma and grandpa.”

     Follow Bob Sullivan on Facebook or Twitter.