Transcript
So what are we learning from this case about cybersecurity and crimes?
What we are learning is that it’s really complicated. The cross-border nature of it means it’s incredibly difficult to enforce. It’s not just about the money, but there is reputational damage. There is embarrassment for governments and people who work in these institutions. It’s really broad and wide-scale. What’s really appalling is that there’s very little risk for the people who are committing these crimes, and the cost to them is very little. They can just spam these instructions out and make a really significant amount of money. So in this case, they failed the vast majority of the time but still walked away with $81 million. In a normal bank heist, that’d be like the biggest bank heist of all time.
One thing that we think it’s important to ask is what are the failures that allowed this to happen in the first place? In other words, how do you lose $81 million?
When we think about cyber crimes, obviously there’s a technological component. Advances in technology will create more opportunities or different methods by which to steal money or, as we’re going to discuss in the next section, to steal data. But if we think about this Bangladeshi bank heist situation, it’s really interesting because it wasn’t just about the technology. It was a confluence of different factors. There were people involved, there were processes that failed, and there was old equipment that should’ve been updated but wasn’t. So a confluence of these things actually led to this significant outcome.
In a lot of situations, companies, banks, and governments even fail to perform the basics of security. These may include anti-virus software trying to filter out as much malware and viruses as possible, firewalls, updated equipment, and people who truly understand the processes, etc. These are measures that weren’t taken in this situation. After the incident, Bangladeshi bank, Swift and the New York Fed put out announcements warning members of the network to be aware of this type of hack. As a result, when subsequent attacks happened in Vietnam and Ecuador, they were able to stop that from.
So what’s our takeaway from this case?
On the one hand, it’s amazing that we’ve gotten to the point as a society where, with the push of a button, money is flying around the world. This probably happens millions upon millions of times every single day. Although our discussion was focusing on the negative side, it was actually pretty amazing that governments in developing countries like Bangladesh were able to bank with the New York Fed or transfer money all over the world. And it’s worth noting that most of the time, that works out for the benefit of everybody.
But the flip side is, we also have to be cognizant of the challenges and making sure we’re staying ahead of them. From a legal perspective, law and punishments are often reactionary, and they’re not able to stay ahead of problems that have not occurred. So unfortunately, we’ll always be responding to the last crime or last situation. And that means unfortunately, we may not be able to react effectively to the last situation either, as it takes time to put in good policy and to get relevant parties onboard.
This reminds us of a movie, Catch Me If You Can. Frank Abagnale is considered one of the greatest fraudsters of all time. A few years ago he spoke at an event about his life, which was compelling and really interesting. At the Q&A session, somebody asked him, “Do you think you could’ve been successful as a fraudster today, given all the advancements of security and technology?”
And his response: “It’s easier to be a fraudster today than ever before.”
