Most Dangerous Cities for Cyber Crime?

Symantec Riskiest Cybercrime Cities

Symantec released a study today in conjunction with Sperling's Best Places today. According to their Executive Summary to make their list they considered a number of factors, including:

- Number of malicious attacks
- Number of potential malware infections
- Number of spam zombies
- Number of bot infected computers
- Level of Internet Access
- Expenditures on computer hardware and software
- Wireless hotspots
- Broadband connectivity
- Internet usage
- Online purchase

The report lists the Ten Riskiest Cities, and then gives a list of recommendations, the first of which is of course to buy Security software. (#2 - keep your computer patched, and #3 - Stay Educated about current threats. They recommend www.everyclickmatters.com for that. I actually would add to that recommendation that geeks should read this blog and non-geeks should visit StaySafeOnline.org, a great site by the NCSA that has advice for Home users, K-12, Higher Ed, and Small Business users.

Here's the Top Ten "Riskiest Cities for Cyber Crime":

1. Seattle
2. Boston
3. Washington DC
4. San Francisco
5. Raleigh
6. Atlanta
7. Minneapolis
8. Denver
9. Austin
10. Portland

PC World's JR Raphael reported today on The 50 Riskiest Cities for Cybercrime in America, from the same Symantec report. Disappointed that your city is not on the list? I was too. No Birmingham, Alabama, which points out a flaw in the methodology. The Symantec report assumes that the greatest dangers are in the most wired cities (rate goes up for broadband acceptance, wifi hotspots, etc.)

I honestly believe that a different look at the numbers would show that rates of cybercrime are higher in places with higher populations of retired computer users, a lower education (or at least CYBER education) level, and places where computers have only recently been added to the home and are new to concepts of email and online banking. These are likely to be the exact opposite places as found in the Symantec report.

Just to look at a couple examples . . .

Symantec says Seattle is #1 for Cybercrime.
The FTC Consumer Sentinel put them at #78 for complaints about Fraud.
The FTC Consumer Sentinel put them at #148 for complaints about Identity Theft.

Symantec says Boston is #2 for Cybercrime.
The FTC Consumer Sentinel put them at #254 for complaints about Fraud.
The FTC Consumer Sentinel put them at #252 for complaints about Identity Theft.

Symantec says Washington DC is #3 for Cybercrime.
The FTC Consumer Sentinel put them at #36 for complaints about Fraud.
The FTC Consumer Sentinel put them at #82 for complaints about Identity Theft.

Symantec definitely considers other factors that WOULD increase with higher rates of acceptance - bots like high speed broadband, and if you have more computer users, you'll have more spammers, etc. They are in a unique position to model that, and I give them their due for studying their numbers and sharing them with the public. But . . . I think when most people think about Cyber Crime Risk, they want to know if they are going to have their money or their identities stolen. The Symantec model just doesn't answer that question very well.


What is the FTC's Consumer Sentinel? Funny you should ask!

FTC's Consumer Sentinel Report

One way of spot-checking the data would be to review what the likely threats are in each city based on actual criminal complaints. Its called the "Consumer Sentinel" report from the Federal Trade Commission. Each year about this time, the FTC puts out their annual report gathered from a variety of sources, including the FBI's Internet Crime & Complaint Center (IC3.gov), one of the best places a consumer can report cyber crime victimization.

This year's Consumer Sentinel Network Data Book for January - December 2009 was released on February 22nd. 1.3 Million complaints were received, including 721,418 complaints of online Fraud were made to the network, with 630,604 victims reporting average losses of $2,721 for a total of $1.7 Billion in fraud losses last year.

48% of those frauds were originated by email - part of the reason that the UAB Spam Data Mine is such an important part of our research at UAB. With $850 Million worth of fraud being linked to email last year, we think email-based crimes are well worth studying.

The Consumer Sentinel report breaks down complaints per capita on a state-by-state in the categories of "Identity Theft" and "Fraud & Other Complaints".

The Top Ten states for Identity Theft:
(# = Complaints per 100,000 residents)

1. Florida	122.3
2. Arizona	119.4
3. Texas	116.4
4. California	114.2
5. Nevada	106
6. New Mexico	98
7. Georgia	97.2
8. New York	95
9. Colorado	93.8
10. Illinois	91.8
(17. Alabama)	76.2

Top Ten States for Fraud & Other Complaints

1. Nevada	412.9
2. Arizona	412.4
3. Texas	397.2
4. California	393.6
5. Nevada	391.7
6. New Mexico	377.7
7. Georgia	376.1
8. New York	369.3
9. Colorado	366.8
10. Illinois	361.9
(20. Alabama)	296.1

Top Ten Large Metropolitan Areas for Fraud and Other Consumer Complaints
# per 100,000 residents

1. Mount Vernon-Anacortes, WA	684.7
2. Dunn, NC	684.3
3. Greeley, CO	656.8
4. Boulder, CO	640.5
5. Allegan, MI	631.4
6. Gainesville, GA	625.5
7. Roseburg, OR	618.5
8. Thomasville-Lexington, NC	617.8
9. Eugene-Springfield, OR	564.9
10. Montgomery, AL	549.8
171. Birmingham-Hoover, AL	351.5

Top Ten Large Metropolitan Areas for Identity Theft Complaints
# per 100,000 residents

1. Brownsville-Harlingen, TX	262.4
2. McAllen-Edinburg-Mission, TX	247.4
3. Laredo, TX	196
4. Miami-Fort Lauderdale-Pompano Beach, FL	193.2
5. Madera, CA	180.9
6. Dunn, NC	173.8
7. Merced, CA	172.7
8. Corpus Christi, TX	171.3
9. Greeley, CO	169.4
10. Bakersfield, CA	168.2
11. Visalia-Porterville, CA	168.2
12. Thomasville-Lexington, NC	160.4
13. Montgomery, AL	155.8

Consumer Reports "State of the Net"

I first heard about the Consumer Reports "State of the Net" survey when I attended the National Press Club kick-off for "October is Cyber Security Awareness Month" in 2008 and met Jeffrey Fox, the Consumer Reports Technology Editor. I was amazed by the quality of the data! Finally we could make some reasonable statements about the level of phishing losses to consumers! We'll hopefully see the 2010 edition soon, but in the meantime, let me recommend their work from June 2009, Boom Time For Cybercrime, where they estimate the cost of cybercrime to $8 Billion per year.

Why is their number so much larger than the number from the Federal Trade Commission Report? The FTC report is ACTUAL VICTIMS who have taken the time to report their victimization to one of the agencies represented in the Consumer Sentinel. The Consumer Reports model builds a statistically supported model and surveys enough folks to project across the entire US population. For instance, Consumer Reports says that 1 in 13 online households in the US knows that they gave their personal information to a phisher during the previous two years, and that 1 in 7 of these lost money (so 1 in 90 households lost money to phishing - or roughly $483 Million). Their costs also include other damages however, such as the fact that 1 in 12 households replaced a computer in the past six months due to "serious problems" with viruses or spyware ($1.7 Billion), and that 1 in 7 households had experienced a "serious" virus problem ($5.8 Billion in clean-up costs).

Alabama's Top Cities for Fraud and Identity Theft

Here's a little special section for friends in Alabama (where UAB is based)

Alabama had 8,546 Fraud Complaints, for $13,739,250 in losses last year.
Alabama also had 3,586 Identity Theft Complaints.

For Fraud, our "Metropolitan Areas" on the list were:

#10. Montgomery 2,012 complaints / 549.8 per 100,000
#101. Huntsville 1,539 complaints / 398.1 per 100,000
#139. Gadsden 387 complaints / 374.9 per 100,000
#171. Birmingham-Hoover 3,895 complaints / 351.5 per 100,000
#206. Anniston-Oxford 378 complaints / 334.2 per 100,000
#212. Decatur 496 complaints / 332.3 per 100,000
#217. Auburn-Opelika 430 complaints / 329.5 per 100,000
#247. Tuscaloosa 650 complaints / 316.7 per 100,000
#256. Daphne-Fairhope-Foley 535 complaints / 311.5 per 100,000
#258. Dothan 431 complaints / 309 per 100,000
#272. Mobile 1,235 complaints / 305.4 per 100,000
#336. Florence-Muscle Shoals 391 complaints / 273.1 per 100,000

For Identity Theft in Alabama

#13. Montgomery 570 complaints / 155.8 per 100,000
#77. Tuscaloosa 221 complaints / 107.7 per 100,000
#130. Birmingham-Hoover 1,023 complaints / 92.3 per 100,000
#136. Gadsden 94 complaints / 91.1 per 100,000
#141. Dothan 125 complaints / 89.6 per 100,000
#160. Anniston-Oxford 98 complaints / 86.6 per 100,000
#176. Mobile 339 complaints / 83.8 per 100,000
#188. Auburn-Opelika 107 complaints / 82 per 100,000
#210. Decatur 116 complaints / 77.7 per 100,000
#219. Daphne-Fairhope-Foley 130 complaints / 75.7 per 100,000
#312. Florence-Muscle Shoals 83 complaints / 58 per 100,000
#315. Huntsville 218 complaints / 56.4 per 100,000