D5.2b: ID-related Crime: Towards a Common Ground for Interdisciplinary Research

Title: TOWARDS COMBATING THE SAME THING

Towards combating the same thing

Once we know better that we are talking about the same thing – let us call it ID-related crime for now, and focus in particular on ID fraud with as primary elements unlawfully creating and using an ID – the next step is trying to combat this thing. It is clear that ID-related crime has a large impact on society, particularly as the information society is relying more and more on IDM systems in ever increasing applications, and we therefore take it for granted that efforts should be made to combat this. What ingredients should we at least envision? 

Legal measures

The conclusion of Chapter 3 suggests that the problem is not so much a lack of legal provisions, far from it. It is more the lack of enforcement and absence of a comprehensive legal framework that are bottlenecks. Nevertheless, in some countries, certain gaps may exist that make it harder to effectively prosecute ID fraudsters, and hence, the details of criminal provisions may be improved. More important, however, is the need for enforcement and developing a legal framework that takes into account all the complex and multi-faceted aspects of ID fraud. It is clear that ‘the law’ cannot do this on its own, but that input is needed from other disciplines.  

Social-economic measures

Chapter 4 noted that, whereas figures on the incidence of ID fraud are abound in the US, European figures are scarce. There may be a large ‘dark number’ of ID-related crimes that do not show up in crime statistics, for one thing because the term ‘ID-related crime’ is not used as a separate category. Empirical research on the incidence and gravity of ID fraud seems urgently needed in this light. 

Apart from empirical research on the incidence of ID fraud, other social-scientific research is needed, for instance, on the way in which IDM systems are used in practice and which human or organisational aspects create vulnerabilities. After all, technical security measures are important to make ID fraud as difficult as possible, but if these measures do not go well with the way people in real life want to use ID systems, then there is a risk that less secure systems will continue to be used, or that people will find tricks to by-pass the technical security measures (for example, telling a password to their secretary).  

Technical measures

A lot of research is being done on the technical security of IDM systems, and this is obviously a key instrument in combating ID fraud. Promising technologies are being developed, with a lot of attention being paid to biometrics. As chapter 5 shows, however, biometrics are by all means not intrinsically secure, and so, ID fraud will not necessarily be effectively combated just by implementing biometrics.  

Moreover, IDM systems do not function in a vacuum but in a context of cultural, organisational, and legal norms and practices, which may differ from country to country, even within the European Union. Research on ID fraud prevention must therefore combine at least technical and social perspectives.  

The right mix of measures

At the core of combating ID fraud lies a combination of technical, organisational and socio- economic, and legal measures, and perhaps of other measures as well. The key question, we think, is how to determine the right combination of all these measures. Which efforts should be made in prevention, and which combination is needed of technical security measures and other efforts to prevent ID fraud, such as education, standardisation or tax measures? And how much effort should be devoted to detection and punishment of ID fraud, given that prevention can and will never be a 100% successful? How can detection and punishment best take place: through self-regulation, through civil-liability measures, or through policing and criminal prosecution? And can that be achieved at the national level (which is inappropriate to combat large-scale cross-border fraud, e.g., through Internet phishing) or at the international level (where mutual agreements usually take years to reach, and where cultural differences may easily block global efforts to harmonise legal approaches)?  

These questions call for answers – answers that can only be given when experts from the legal, socio-economic, and technical fields co-operate on a common ground of ID-related crime research.