Conclusion

Currently the term ‘identity theft’ is not mentioned in any German statute. The existing criminal and civil laws do cover acts related to as ‘identity theft’. The topic and use of the term ‘identity theft’ is not discussed widely among German legal scholars. The concept of identity related crime is not discussed applying the focus on ‘identity’. It is for these reasons that no meaningful figures with regard to numbers of identity related crime and damage caused by these acts exist. Identity related crimes are often carried out either by means of using the Internet or with regards to debit and credit card data. For some of these kinds of crimes declining figures were reported in 2006 in comparison to the numbers known for 2005. In 2007 rising figures are reported regarding offences committed by means of the Internet (8%), phishing (20%) and information and communications technology related crime were reported (17%). To which extend these cases can be mapped to the FIDIS typology is not clear. It has to be taken into account that the key ‘offence committed by means of the Internet’ was added to the Criminal Statistics only in 2004 and that by 2006 still not all German states were able to use this key when reporting their figures. The rising number of Internet related crimes (2005: 118,036; 2006: 150,785; 2007: 180,000) could only reflect the increased ability of states to report crimes using this key. The overall figure of phishing cases in 2007 (4,200) is surprisingly low considering the big attention phishing receives in the media. An average damage of more than 4,000 EURO per case could explain this attention.

Legal and technical countermeasures have been passed. Legal countermeasures include the amendment of the German Penal Code to incorporate requirements laid down by the cybercrime convention. Security breach notification laws are being discussed and would significantly raise the ability of victims to react quickly and possibly prevent considerable damage. Passing such a law does currently not find the necessary support of the required majority of members of parliament and a distinct agenda for progress on this matter is not available.

Technical countermeasures were developed in the online banking sector. However, measures known to be effective (like HBCI) are not used on a large scale. Instead, mainly the TAN and iTAN method is used which is known to be vulnerable to man-in-the-middle attacks.

Coming from an eGovernment approach, the German government currently explores the possibility of citizen portals ensuring binding authentication of citizens and service providers in the electronic world.

21 / 34

D12.10: Normality Mining: Results from a Tracking Study

Within FIDIS, WP3 and WP12 have dealt with RFID, WP11 has investigated
mobility and identity while WP6 has examined biometrics and WP7 profiling.
The aim of this report is to bring these disparate threads together into a tangible
study which will demonstrate privacy issues surrounding products and services
which are likely to start emerging on to the consumer market.
New generations of mobile handsets, with integrated devices like GPS and
internet capabilities, are becoming less like traditional phones. In fact we
should stop viewing them as simply mobile phones - they are now more like
mobile computers which can make phone calls. These advances in mobile
technologies will inevitably lead to new services which we can enjoy anywhere,
anytime. Location Based Services which utilise the phone’s GPS to tell us for
example where we are, or where the nearest cinema is, are an obvious first step
– but what happens if the phone monitors where we go at all times? Can these
new services build a picture of who we are based on where we have been? Can
they use this profile of us to understand what we like and tailor their results
specifically to us? And if so, at what cost to our privacy? In this report, aimed
at the potential consumers of such services, we will look at results from a recent
tracking study which examines these issues.

[ Download ]