Preventing Identity Crime: Identity Theft and Identity Fraud: An Identity Crime Model and Legislative Analysis with Recommendations for Preventing Identity Crime [1 ed.] 9789004395978, 9789004395961

Citation preview

Preventing Identity Crime: Identity Theft and Identity Fraud

Preventing Identity Crime: Identity Theft and Identity Fraud An Identity Crime Model and Legislative Analysis with Recommendations for Preventing Identity Crime

By

Syed R. Ahmed

LEIDEN | BOSTON

Library of Congress Cataloging-in-Publication Data Names: Ahmed, Syed R. (writer on identity theft), author Title: Preventing identity crime: identity theft and identity fraud : an identity crime model and legislative analysis with recommendations for preventing identity crime / by Syed R. Ahmed. Description: Leiden ; Boston : Brill Nijhoff, 2020. | Includes bibliographical references and index. Identifiers: LCCN 2019055570 (print) | LCCN 2019055571 (ebook) | ISBN 9789004395961 (hardback) | ISBN 9789004395978 (ebook) Subjects: LCSH: Identity theft–Law and legislation. Classification: LCC K5223 .A36 2020 (print) | LCC K5223 (ebook) | DDC 332.024–dc23 LC record available at https://lccn.loc.gov/2019055570 LC ebook record available at https://lccn.loc.gov/2019055571

Typeface for the Latin, Greek, and Cyrillic scripts: “Brill”. See and download: brill.com/​brill-​typeface. isbn 978-​9 0-​0 4-​3 9596-​1 (hardback) isbn 978-​9 0-​0 4-​3 9597-​8 (e-​book) Copyright 2020 by Koninklijke Brill NV, Leiden, The Netherlands. Koninklijke Brill NV incorporates the imprints Brill, Brill Hes & De Graaf, Brill Nijhoff, Brill Rodopi, Brill Sense, Hotei Publishing, mentis Verlag, Verlag Ferdinand Schöningh and Wilhelm Fink Verlag. All rights reserved. No part of this publication may be reproduced, translated, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording or otherwise, without prior written permission from the publisher. Authorization to photocopy items for internal or personal use is granted by Koninklijke Brill NV provided that the appropriate fees are paid directly to The Copyright Clearance Center, 222 Rosewood Drive, Suite 910, Danvers, MA 01923, USA. Fees are subject to change. This book is printed on acid-​free paper and produced in a sustainable manner.

Contents

Preface ix Acknowledgements xi List of Illustrations xii

1

The Problem of Identity Crime 1

2

What is Identity? 24 Introduction 24 2.1 When We Say “Identity,” What Do We Mean? 25 2.2 Identity –​Dictionary Definitions 26 2.3 Identity Properties and Attributes 28 2.4 Identity –​the Psychological View 31 2.5 Identity –​the Philosophical View 33 2.6 Identity –​the Legal View 34 2.7 Means of Verifying Legal Identity 40 2.8 Digital Identity 41 2.9 Conclusion 44

3

Identity Crime Framework and Model: Five Components of Identity Crime and the Different Illegal Methods of Acquiring and Using Identity Information and Documents 46 Introduction 46 3 .1 Clarification of Terms: Identity Theft, Identity Fraud, and Identity Crime 47 3 .2 Goal of Identity Crimes 54 3 .3 The Identity Crime Framework 55 3 .4 Identity Crime Framework 57 3 .5 Five Components of Identity Crime Model 62 3 .6 Techniques and Strategies Used for Illegal Acquisition 66 3 .7 Producing and Manipulating Identity Information and Documents 99 3 .8 Transfer –​ Identity Trafficking 107 3 .9 Possession 113 3 .10 Use –​Criminals’ Goals and the Kinds of Crimes They Commit When Using Acquired Information or Documents 114 3 .11 Conclusion 186



vi Contents 4

Threat Agents and the Impact of Identity Crime 187 Introduction 187 4 .1 Identity Crime Threat Assessment Model and Threat Agent Identification and Analysis 187 4 .2 The Impact of Identity Crime 205 4 .3 Costs of Identity Crime by Use 227 4 .4 Conclusion 234

5

International Trends in Addressing Identity Crime 236 Introduction 236 5.1 International Organizations 236 5.2 Conclusion 250

6

Identity Crime Legislation in the United States, Canada, Australia and the United Kingdom 252 Introduction 252 Part A: United States Statutes 6 A.1 Introduction 254 6 A.2 Identity-​Crime-​Specific Statutes 269 6 A.3 Identity-​Crime-​Related Statutes 296 6 A.4 Civil Statutes to Prevent Identity Crimes and Recover Identity 322 6 A.5 State Statutes 349 Part B: Canadian Statutes 6 B.1 Introduction 404 6 B.2 Analysis of Canada’s Identity Crime Statutes and Related Statutes 407 6 B.3 Criminal Code 408 6 B.4 Privacy Act 433 6 B.5 Personal Information Protection and Electronic Documents Act 436 6 B.6 Changes Recommended by Concerned Organizations 440 Part C: Australia 6 C .1 Introduction 444 6 C .2 National Identity Security Strategy 452 6 C .3 Federal System –​State and Territorial Laws 454 6 C .4 Australian Criminal Code 456 6 C .5 Financial Transaction Reports Act 1988 472 6 C .6 Travel Document Offenses 473 6 C .7 Privacy Act 1988 481 6 C .8 South Australia’s Identity Crime Provisions 484

Contents

vii

6 C .9 Queensland’s Identity Crime Provisions 488 6 C .10 New South Wales’ Crimes Act 1900 490 6 C .11 Tasmania’s Computer Fraud Statute 494 Part D: United Kingdom Statutes 6 D.1 Introduction 497 6 D.2 Analysis of the U.K.’s Identity-​Crime-​Related Statutes 499 6 D.3 Identity Cards Act 2006 502 6 D.4 Fraud Act 2006 509 6 D.5 Theft Act 1968 513 6 D.6 Computer Misuse Act 1990 516 6 D.7 Forgery and Counterfeiting Act 1981 518 6 D.8 Data Protection Act 1998 521 6 D.9 Conclusion 533 7

Identity Crime Prevention and Impact Minimization Strategy 543 Introduction 543 7 .1 Proposed Approaches to Identity Crime Prevention 545 7 .2 Developing an International Identity Crime Treaty 547 7 .3 Developing Identity Information and Documents with Real Time Authentication and Verification 547 7 .4 Authentication 548 7 .5 Business Policies 551 7 .6 Consumer Education 559 7 .7 Consumer Actions 561 7 .8 Foundation Documents 562 7 .9 Medical Identity Crime Prevention 563 7 .10 Victim Cooperation 564 7 .11 Offenders 565 7 .12 Law Enforcement Policies 568 7 .13 Government Policies 573 7 .14 Information Sharing 574 7 .15 International Collaboration and Efforts 575 7 .16 Public-​Private Partnerships 578 7 .17 Data Protection through Technology 580 7 .18 Training Programs and Initiatives 583 7 .19 Meeting the Challenges of Identity Fraud Prevention 585 7 .20 Evaluating Identity Crime Prevention and Impact Minimization Techniques 586 7 .21 Conclusion 587 7 .22 Appendix: Table of Identity Crime Prevention and Impact Minimization Techniques 588

viii Contents 8

Privacy, Anonymity, and Identity Crime 601 Introduction 601 8.1 The Identity Crime Privacy Model 604 8.2 Fair Information Practices (fip s) 609 8.3 Privacy Taxonomies 618 8.4 Personally Identifiable Information (pii) 624 8.5 Data Mining 626 8.6 Privacy-​Enhancing Technologies (pet s) 634 8.7 Anonymity 649 8.8 Anonymization 658 8.9 Data Loss and Data Loss Prevention (dlp) 663 8.10 The Identity Crime Prevention Model and Privacy by Design 666 8.11 Conclusion 668

9

Convention on Identity Crime 670 Introduction 670 9 .1 Preamble 673 9 .2 Chapter i –​Use of Terms 677 9.3 Chapter ii –​Measures To Be Taken at the National Level 681 9 .4 Chapter iii –​International Cooperation 690 9 .5 Chapter iv –​Final Provisions 698

10

Conclusion 703



Appendix 1: Table of Cases 709 Appendix 2: Table of Statutes 712 Bibliography 727 Index 746

Preface Identity crime is the fastest growing crime in the United States and other countries around the world, yet it lacks its own identity: there is no universally accepted definition, little understanding of what the crime is or should be, and no legal framework placing the crime into a coherent and effective grouping of criminal sanctions. Because the crime is little understood, most of the world does not have laws focusing on identity crime, even though the crime is committed in almost every country. Only the United States and Canada have sets of laws, under the rubrics “identity theft” and “identity fraud,” that specifically address identity crime. Even with these laws, the number of identity crime victims is steadily increasing. This book tackles head-​on the various facets of what is needed to deal with identity crime on an international scale. The strategy of the book proceeds as follows: First, the meaning of “identity” is addressed and a range of personal information and documents that might inform or define one’s identity are surveyed. Second, the need for a universal definition of identity crime is examined. To arrive at a workable definition of identity crime, a framework and an Identity Crime Model (idcm) are created to identify five principal components of identity crime. idcm visually represents the unique Identity Crime Framework. It provides a new way of analyzing the acts that constitute identity crime. It shows every facet of the crime and provides a comprehensive list of frauds and other crimes that identity criminals commit. idcm is a paradigm shift from the traditional methodology for looking at Identity Crimes. Until now this crime has been understood and represented as a linear incident with a start, middle and an end. The idcm illustrates the true essence of this crime, which by nature, is circular and can continue in a never-​ending loop. Third, techniques and strategies for acquiring personal information and documents are covered, including the acquisition of physical items and data theft techniques that rely on computer technology. A comparison of identity-​ related frauds with generic fraud is performed, revealing the unique features of the former. Different types of identity-​related frauds are discussed in detail, including identity-​related frauds. Fourth, an identity crime threat agent assessment is performed. Threat agent assessment is useful for both prevention and correction purposes. The author assembles different variables that directly or indirectly affect all threat agents. However, the total elimination of identity crime is impossible in the real world, so the impact that identity crimes have upon the individuals and

x Preface organizations that are victimized by such crimes is studied. Due to the lack of any models to understand the true impact of various identity crimes a model is developed for understanding the identity crime impact –​based on each of type of identity crime separately. Fifth, a review of the actions taken by a variety of international and regional organizations to combat identity crimes is presented. Additionally, worldwide statutes and treaties pertinent to identity crime are evaluated. Specific statutes are analyzed, as defined by several different nations, that pertain to identity. Some are identity-​crime-​specific such as identity theft and identity fraud statutes in Canada and United States. The others are merely identity-​ crime-​related, such as general fraud and theft statutes. Included in this study are four countries: United States, Canada, Australia, and the United Kingdom. Sixth, this book scrutinizes identity crime prevention. Most efforts to prevent identity crime or minimize the impact of identity crime, while laudable, are uncoordinated and do not go far enough in developing a strategy to prevent identity crime. Therefore, a broader framework is created by the author that can be used to evaluate the various prevention strategies. A  list of different methods to prevent identity crime is presented, and a model is developed to evaluate these methods to determine which ones offer the highest success rates. Seventh, the Identity Crime Privacy Model is developed to show the interaction between privacy, anonymity, and identity crime. Traditional approaches attempt to reduce identity crime by providing less and less privacy. The Model suggests that it is possible to achieve a reduction in identity crime by enhancing privacy and leveraging the benefits of anonymity, while recognizing that absolute privacy and total anonymity can only lead to an environment in which there can be no exchange of information at all. Eight, the author examines the need for an international convention to deal with identity crime. The international community will continue to experience a rise in identity crime, and no matter how much progress the various nations and regional organizations make in dealing with identity crime, there is still a need for an international convention that presents genuinely common rules and guidelines to deal with a genuinely international problem. Accordingly, the draft text of an international convention on identity crime is proposed. The substantive law in the convention is based on the Identity Crime Model and the resulting definition of identity crime proposed in this book.

Acknowledgements In the name of God, the compassionate, the merciful, I thank you Uzma, my amazing wife, for teaching me how to love and how to live my life. Without her support, understanding and encouragement, I  wouldn’t be the person I  am. I owe my life, my achievements and accomplishments to her. We went through times of struggle and financial hardships to make this book happen. To my two boys, Rayan and Arsh, Baba loves you. To my mother, Nasira, a remarkable woman –​I miss you. My mother was a victim of identity crime and the culprits responsible for this were known to us. I witnessed firsthand the devastation it can cause in someone’s life and it sparked an interest in me. At the time, there were very limited resources and scholarly content available to us on this subject matter, so I started to work towards getting my PhD, specializing in identity crime prevention and laws on a global scale. To my grandfather, Rashid Akhter Nadvi, for teaching me about dedication and perseverance. He spent hours writing his books and made sure I was right by him every hour focusing on my studies. This book is only complete because of two individuals, Professor Munro and Professor Burns, who kept on pushing me to tackle this extremely difficult and uncharted subject matter. I owe a debt of gratitude to Dr. Munro for his priceless feedback on this book. He is my mentor, my first reader and my first critic. Thank you to the United Nations, U.S. Justice Department, Federal Bureau Investigation, Canadian, United Kingdom & Australian Justice department and Columbia Law School for providing me the resources and research tools. Lastly, the most important people in my life and biggest supporters, Joel and my 3 beautiful sisters, Asma, Sadaf and Mahvish –​I love you.

Illustrations Figures 1 2 3 4 5 6 7

Chart showing the increases in, and impact of identity crimes 3 Identity crimes related to one another 59 Risk impact/​probability chart 191 The four costs of identity crime 210 Type of crime 216 Identity crime privacy model 605 Concepts of identity crime, privacy and anonymity: interdependencies and overlap 648

Tables 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

Credit card fraud (based on total complaints filed) 117 Types of bank fraud in 2006–​2008 126 Loan fraud (based on the total complaints) 130 Phone or utilities fraud (based on the total numbers of complaints filed) 153 Indiana phone or utilities fraud 154 Ohio phone or utilities fraud 154 Impacts of identity crime 208 U.S. identity crime related statutes 258 Identity crime California 2009 350 Identity crime California 2008 351 Identity crime Texas 2009 361 Identity crime Texas 2008 362 Identity crime New York 2009 371 Identity crime New York 2008 372 Identity crime Florida 2009 384 Identity crime Florida 2008 385 Identity crime Illinois 2009 393 Identity crime Illinois 2008 393 Canada’s identity crime statutes and related statutes 409 Australian identity crime statutes and related statutes 446 South Australian identity crime statute 485 Queensland’s identity crime statute 488

newgenprepdf

Illustrations 23 24 25 26 27

U.K. identity crime related statutes 499 Comparison of hew and oecd privacy principles 611 Versions of fip s by year 614 Privacy goals 621 Potential privacy violations 621

xiii

­c hapter 1

The Problem of Identity Crime Identity crime is the fastest growing crime in the United States1 and other countries around the world,2 yet it lacks its own identity because there is no universally accepted definition,3 little understanding of what constitutes the 1 Identity theft is America’s fastest –​growing crime, U.S. Postal Inspector Service, https://​ postalinspectors.uspis.gov/​investigations/​MailFraud/​fraudschemes/​mailtheft/​IdentityTheft.aspx (last visited March 24, 2010). A marketing research firm, Javelin Strategy & Research, has published its “2010 Identity Fraud Survey Report” showing that instances of identity fraud continue to rise, driven by new accounts fraud (using someone else’s identity information, or the identity of a fictitious person, to open a new account in the name of that person), although the costs to each affected consumer have decreased. Robert Vamosi et al., Javelin Strategy & Research, 2010 Identity Fraud Survey Report: Identity Fraud Continues to Rise  –​ New Accounts Fraud Drives Increase; Consumer Costs at an All –​ Time Low (Feb. 2010), available at https://​www.javelinstrategy. com/​research/​brochures/​Brochure-​170. 2 UK Identity Crime Statistics: In the United Kingdom, it has been estimated that over 100,000 people per year are affected by identity crime, costing the UK economy nearly £1.7 billion annually. Is Identity Fraud Serious?, cifas, http://​www.cifas.org.uk/​is_​identity_​fraud_​serious (last visited Oct. 30, 2012). In 2009, 2010, and 2011, over 100, 000 cases of confirmed fraud per year were recorded by members of the U.K’s Credit Fraud Avoidance System. Id. Australian Identity Crime Statistics: “Identity crime has been extensively reported as the fastest growing crime type globally, costing the Australian economy somewhere between $ 1.6B and $3B per annum. Queensland Police Identity Crime Symposium, Policing with Intelligence, http://​policingwithintelligence.blogspot.com/​2009/​08/​queensland-​police-​ identity-​crime.html (last visited Oct. 30. 2012). And, 20% of Australians have experienced identity crime. 20% of Australians Have Experienced Identity Crime, Veda (Oct. 1, 2009), http://​www.veda.com.au/​news-​and-​media/​article.dot?id=506838. Canadian Identity Crime Statistics: According to the results of a survey, “6.5% of Canadian adults, or almost 1.7 million people, were the victim of some kind of identity fraud in the 2008. These victims spent over 20 million hours and more than $150 million to resolve problems associated with these frauds.” Susan Sproule & Norm Archer, Measuring Identity Theft in Canada: 2008 Consumer Survey, McMaster eBusiness Research Center, http://​www.business. mcmaster.ca/​IDTDefinition/​WP23%20exec%20summ.htm (last visited Mar. 24, 2010) (discussing the results of a 2008 survey of Canadian consumers conducted by the McMaster eBusiness Research Centre (MeRC) on behalf of the Ontario Research Network on Electronic Commerce (ornec)). The Canadian Council of Better Business Bureaus estimates that identity theft costs the Canadian economy approximately $2.5 billion per year. Chapter 3: e-​Readiness, Canadian e-​Business Initiative, Industry Canada (Sept. 2004), http://​www.ic.gc.ca/​ eic/​site/​ecic-​ceac.nsf/​eng/​gv00503.html. 3 According to National District Attorneys Association (ndaa), “imprecise and varying definitions of identity crime” are a key challenge faced by ndaa members when trying to prosecute

© Koninklijke Brill NV, Leiden, 2020 | DOI:10.1163/9789004395978_002

2 chapter 1 crime, and no legal framework placing the crime into a coherent and effective grouping of criminal sanctions.4 Because so little is understood about identity crime, most of the world’s nations do not have laws specifically addressing identity crime, despite the fact that the crime is committed in almost every country. Only the United States and Canada have statues directly addressing identity crime, under the rubrics “identity theft” and, in Canada, “identity fraud.”5 However, even with these laws in place, the number of victims of identity crime is steadily increasing in those countries.6 Official codifications of U.S. law include identity crime within the broad category of crimes involving “fraud and false statements.”7 Similarly, in Canada, identity crime laws are categorized under “fraudulent transactions relating to contracts and trade.”8 However, these identity-​crime-​specific statutes specify criminal acts that were never considered when the generic fraud laws were adopted, such as producing an identification or authentication feature without

4

5 6

7 8

identity crime cases. Overview, IDSafety, http://​www.theiacp.org/​investigateid/​preparing-​ for-​successful-​prosecution/​ (last visited Oct. 30, 2012). A U.N. Commission on Crime Prevention and Criminal Justice draft report provided a long list of conclusions and recommendations based on its work. They essentially consisted of the following: Further work is needed in gathering, analyzing and disseminating information about fraud and identity-related crime. While, in the case of economic fraud, most states have clear legislative definitions and offenses, these are not detailed enough to enable research into specific types, trends and patterns involving international schemes, organized crime, or how communication technologies are used in order to commit such fraud. U.N. Secretary-General, Comm’n on Crime Prevention and Criminal Justice, International Cooperation in the Prevention, Investigation, Prosecution, and Punishment of Fraud, the Criminal Misuse and Falsification of Identity and Related Crimes [Draft 1 Short Version], 10–​12, U.N. Doc. E/​CN.15/​2007/​8 (2007), available at https://​www.unodc.org/​unodc/​en/​organized-​crime/​ identity-​related-​crime.html. As for identity-related crime, much less is known, and work must be done to allow for: A standard classification framework for offenses and activities; Estimations of the costs of fraud, with input from national experts on money laundering and appropriate commercial associations; Gathering of information about identity-related crime as a distinct problem in its own right, and in the context of related criminal activities. For a detailed discussion, see Chapter 6 (“identity-related crime Legislation in the United States, Canada, Australia and the United Kingdom”) and Chapter 6, Part A (“American identity crime statutes”). A 2010 survey by Javelin Strategy & Research found that the number of identity crime victims in the United States in 2009 was 11.1 million, which was up 12 percent from 2008. Vamosi et al., supra note 1. The amount of damage done by such fraud was $54 billion, which increased 12.5 percent from 2008. Id. 18 U.S.C. ch. 47 (2006). Criminal Code, R.S.C., 1985, c. C-​46, part X (Can.).

The Problem of Identity Crime

3

­f igure 1  Chart showing the increases in, and impact of identity crimes *Past years dollars figures have been adjusted for inflation using the Consumer Price Index (CPI-U) issued by the Bureau of Labor Statists. ftp://ftp.bls.gov/pub/special.requests/cpl/cpiai.txtaccessed12/14/2009. **Based on US population estimates (age 18 and over), http://www.census.gov/ popest/estimates.php accessed January 01/11/10. ***2006, 2007, 2008, and 2009 dollar cost estimates have been smoothed using three-year averaging.

lawful authority,9 or possessing such a document or feature with knowledge that it was produced without lawful authority.10 The generic fraud statutes, on the other hand, target only some of the acts that constitute the components of identity crime,11 and may be too general to be seen as prohibiting many of the acts constituting identity crime. The most common phrase used to describe identity crime is “identity theft” and, to a lesser extent, “identity fraud.” While theft and fraud are a part of identity crime, they each only describe a part of the whole, namely, taking the identity information and using the identity information to deceive someone. However, identity crime is identity theft and identity fraud and more. In order to take effective action to end such crimes, one must view identity crime as any crime in which identity information or documents are the target of criminals, the object of criminal activity, or the tools to commit a further crime.12 “Identity

9 10 11 12

18 U.S.C. § 1028(a)(1) (2006). Id. § 1028(a)(6). These components are the basis for the Identity Crime Model and Legal Analysis found in Chapter 3. See Bert-​Jaap Koops and Ronald Leenes, ID Theft, ID Fraud and/​or ID-related Crime. Definitions Matter, Datenschutz und Datensicherheit (“Privacy & Security”) 30 (2006) 9, 553–​56.

4 chapter 1 crime” may thus be defined as knowingly acquiring, manipulating, producing, transferring, possessing, or using identity information or documents in order to commit a fraud, or to commit other unlawful activities.13 “Identity crime” includes the use of document features that serve to authenticate documents,14 and the use of specialized tools to create fraudulent identities.15 “Identity crime” is a relatively new term. The United Nations’ Commission on Crime Prevention and Criminal Justice has discussed the term “identity crime,” saying that it covers all forms of illicit conduct involving identity, including identity theft and identity fraud, and calling it a “forward-​looking usage” that most states have not yet adopted.16 Commentators have said that current nomenclature “imprecisely label[s]‌an identity crime ‘theft’ when it meets traditional requirements for, and may be more accurately described as, fraud[.] [By doing so], we undermine the definitions of both fraud and theft.”17 While the phrase “identity theft” is in common parlance, it has not been widely used in statutes, although it is now contained in the statutes of both the United States and Canada –​and each country uses the term differently from the other. 13

14

15

16 17

See Chapter 3 for detailed discussion. “Identity” is a broad term, but some U.S. statutes have narrowed it to pertain to specific personal information and documents, and the scope of this work is limited to crimes involving such information and documents. See, e.g., 18 U.S.C. § 1028(d)(7) (stating that the term “means of identification” means any name or number that may be used, alone or in conjunction with any other information, to identify a specific individual, including any (A) name, social security number, date of birth, official State or government issued driver’s license or identification number, alien registration number, government passport number, employer or taxpayer identification number; (B) unique biometric data, such as fingerprint, voice print, retina or iris image, or other unique physical representation; (C) unique electronic identification number, address, or routing code; or (D) telecommunication identifying information or access device.); Cal. Penal Code § 530.55(b) (West 2009); Criminal Code, R.S., 1985, c. C-​46, s. 402.1 (Can.). See 18 U.S.C. § 1028(d)(1) (“The term ‘authentication feature’ means any hologram, watermark, certification, symbol, code, image, sequence of numbers or letters, or other feature that either individually or in combination with another feature is used by the issuing authority on an identification document, document-making implement, or means of identification to determine if the document is counterfeit, altered, or otherwise falsified.”). See id. § 1028(d)(2) (“The term ‘document–​making implement’ means any implement, impression, template, computer file, computer disc, electronic device, or computer hardware or software that is specifically configured or primarily used for making an identification document, a false identification document, or another document-making implement.”). Criminal and Legal Affairs Subgroup, G8 Lyon-​Roma Anti-​Crime and Terrorism Group, Essential Elements of Criminal Laws to Address Identity-related Crime 3 (Feb. 2009) [hereinafter “Essential Elements”]. Michael J.  Stephan, Shane Pennington, Guha Krishnamurthi, and Jon Reidy, Identity Burglary, 13 Tex. Rev. L. & Pol. 401 (2009).

The Problem of Identity Crime

5

The divergence between the United States and Canada as to what constitutes “identity theft” is quite useful in examining the difficulties in international cooperation when countries do not even agree on what the crime should be called. In Canada, whose law became effective in early 2010, an official background document authorized by Parliament18 notes that “others” apply the term “identity theft” broadly to encompass many parts of the criminal process, including acquiring, collecting, and transferring personal information, and using the personal information to commit or attempt to commit a crime. Canada, on the other hand, uses both “identity theft” and “identity fraud” to refer to distinct aspects of identity crime. “Others,” as used in the Canadian background document, appears to refer to the United States, although “acquiring” and “collecting” are not actually covered in the U.S. statute. The main U.S. statute does not, in fact, even mention “identity theft,” other than in the title of the act that created the statute: the “Identity Theft and Assumption Deterrence Act of 1998.” A secondary U.S. statute is called “Aggravated Identity Theft,”19 but the “aggravation” is generally more akin to “fraud” than to “theft.” In the rest of the world, few places use the term “identity theft.”20 Thus, a proper name for the crimes has not yet been determined. If an international body were to adopt “identity crime” in proposing a convention (as with the Convention on Cybercrime21 standardizing use of the term “cybercrime”), nations that sign the treaty would become more likely to use the term, or perhaps obligated to do so. It is the preferable term. For the purposes of this book, the term “identity crime” is generally used instead of “identity theft” or “identity fraud.” When the term “identity theft” is used, it used in the manner advanced by the Canadian law, which applies the term to one who “knowingly obtains or possesses another person’s identity information in circumstances giving rise to a reasonable inference that the information is intended to be used to commit an indictable offence that includes fraud, deceit or falsehood as an element.”22 When “identity fraud” is used, it applies, as put forth by the Canadian statute, to one who fraudulently personates another person, living or dead, with intent to gain advantage, to 18

19 20 21 22

Nancy Holmes & Dominique Valiquet, Bill S-​4: An Act to amend the Criminal Code(identity theft and related misconduct, Document No. LS-​637E (April 14, 2009), available at http://​ www2.parl.gc.ca/​Sites/​LOP/​LegislativeSummaries/​Bills_​ls.asp?lang=E&ls=s4&source=library_​prb&Parl=40&Ses=2 (last modified June 5, 2009). 18 U.S.C. § 1028A (2006). E.g., Canada, and the Australian state of South Australia, as discussed in Chapter 4. Council of Europe, Convention on Cybercrime, opened for signature Nov. 23, 2001, E.T.S. No. 185, [hereinafter “Cybercrime Convention”], available at http://​conventions.coe.int/​ Treaty/​en/​Treaties/​Html/​185.htm. Criminal Code, R.S., 1985, c. C-​46 § 402.2(1) (Can.).

6 chapter 1 obtain property, to cause a disadvantage to the person being personated, to avoid arrest or prosecution, or to obstruct justice.23 Identity crimes are not confined within national borders. A crime seemingly committed in one locale, perhaps by a person sitting at his own computer, in actuality may occur in many different places, crossing the borders of the country where its perpetrator acted and affecting people and organizations around the globe. Keystrokes in one country may trigger a computer in a second country, a different legal jurisdiction, to misuse the identity of a person in a third country, and yet another legal jurisdiction. Worse yet, computer networks that process and store huge amounts of identity information make massive thievery and trafficking in identification information possible. Thus, according to a U.N. report, “The decrease in face-​to-​face transactions coupled with the increasing distance between crimes, criminals, and victims, often across international boundaries, has opened up new opportunities for those who engage in identity-​related crime to exploit.”24 Adding to the problem is that identity crimes fall under many different branches of law in different countries: thefts, frauds, and computer crimes, for example. A  single framework for identity crimes, including all aspects, would make the tracking of such crimes far simpler, and enable governments to aim resources at those crimes. Were they all under the same general framework worldwide, trans-​border commission of the crimes could more easily be curtailed. Identity crime increases as opportunities increase, and the greatest opportunity is provided by the ever-​expanding use of the Internet for commerce, banking, governmental functions, and personal functions –​in short, for conducting one’s life. As the Cybercrime Convention recites, “Exchange no longer occurs only between human beings, but also between human beings and computers, and between computers themselves.”25 In order to gain access to this global exchange, every person must have some sort of identity: something that will allow a distant computer, and a person accessing that computer, to ascertain that a particular person is actually that person. We are now likely to be identified not by our names or faces, but progressively from an accumulation of identity documents,26 and we are represented by a means of 23 24 25 26

Id. § 402.2(1). Essential Elements, supra note 16. Cybercrime Convention, supra note 21. An “identification document” is any type of document commonly accepted to identify an individual, or intended to be used for that purpose when completed with information concerning a particular individual. It may be one from the federal government or any other governmental body. It might come from the sponsoring entity of an event designated as a special event of national significance, a foreign government, or an international

The Problem of Identity Crime

7

identification27 that constitutes an information-​based identity. While the meaning of identity may seem simple and obvious at first glance, it is actually a complex proposition that has been discussed in depth by philosophers, psychologists, legal experts, and sociologists for years.28 The development of the Internet with its “virtual communities” and its “faceless interactions” has resulted in more attention being given to the idea of identity as an asset or a commodity that needs protection.29 As the value of identity as an asset

27



28 29

governmental or a quasi-governmental organization. Such a document may be made by, issued by, or merely under the authority of the body responsible for the identification document. 18 U.S.C. § 1028(d)(3) (2006). Id. § 1028(d)(7). “Means of identification” was not part of the original legislation, but was added later. A “means of identification” can be any name or number that, either alone or in conjunction with any other information, identifies a specific individual. Among the various means of identification contemplated by the statute are: –​ name, social security number, date of birth, government-issued driver’s license or identification number, alien registration number, government passport number, employer or taxpayer identification number; –​ unique biometric data, such as fingerprint, voice print, retina or iris image, or other unique physical representation; –​ unique electronic identification number, address, or routing code; or –​ telecommunication identifying information or access device, meaning an electronic serial number or any other number or signal that identifies a specific telecommunications instrument or account, or a specific communication transmitted from a telecommunications instrument. See discussion in Chapter 2. The United Nations’ Commission on Crime Prevention and Criminal Justice has done a considerable amount of work in recognizing the existence of identity crime, analyzing the means of identity used in member states, and analyzing current statutory regimes. In its “Study on Fraud,” the Commission provided a unique and succinct discussion of the nature of identification documents and information, and their role in criminal activities: “The ability to uniquely identify individuals is a critical element of virtually every aspect of social, political and economic activity. An identity must be created and linked to the specific entity identified. Identification information must be created, transmitted, stored and retrieved, and it is usually linked to other information about the individual it identifies, such as nationality or citizenship status, financial and banking records, criminal records and similar personal and commercial information. The fundamental role identity plays in so many different systems creates a vast range of opportunities for crime if basic identification information can be altered or falsified or if the systems for creating, altering, retrieving and verifying identity and other information can be subverted. For that reason, the criminal law and criminal justice systems of almost all states have addressed identity-related issues in some way.” U.N. Secretary-General, U.N. Commission on Crime Prevention and Criminal Justice, Results of the Second Meeting of the Intergovernmental Expert Group to Prepare a Study on Fraud and the Criminal Misuse and Falsification of Identity, U.N. Doc. E/​CN.15/​ 2007/​8/​Add.3 (Jan. 31, 2009)  [hereinafter “U.N. Commission, Second Meeting, Study

8 chapter 1 continually grows with the proliferation of online relationships and transactions, it is necessary to understand what identity means. If identity is an asset, what kind of asset is it, what is its value, and how should it be protected? Worldwide communication and commerce have become easy and quick. People enjoy and value the ease with which we can purchase goods, and share and transmit information across local and international borders. Unfortunately, such ease leads to the possibility, and reality, of international criminality, including identity crimes. Identity crime increases as advances in technology give thieves more ways to defraud victims. “These thieves may steal, alter, or hijack your identity or business to commit their long list of crimes under your name and with your money,” notes one authority.30 It is easy to access, and easy to search, information contained in computer systems. The opportunity to exchange and disseminate such information without regard to distance has enabled the mushrooming of the amount of information available and the knowledge that can be drawn from it.31 Some criminals see identity crimes as crimes of opportunity; organized crime, however, takes and uses identity information systematically, and law enforcement authorities worry that the aspects of identity crime that benefit organized crime might also be used by terrorists to finance and carry out attacks. The different laws in different jurisdictions can be exploited, in particular by vast criminal and terrorist organizations, which now have the flexibility to gather and disseminate sensitive personal data as needed from and to anyplace in the world. One can establish a “spoofed” website, for example, using it to lure personal information from everywhere, which can be built and uploaded to an Internet service provider anywhere. Thus, where a crime occurs, an occasional problem for investigating conventional crimes, is always a problem for identity crimes, in which the issues of jurisdiction are not yet resolved, and authorities have not yet learned how to coordinate among law enforcement agencies in multiple states or countries.32 Despite the identity threat, the members of the public and their representatives in government currently have no real understanding of what identity

30 31 32

on Fraud”], available http://​www.unodc.org/​documents/​organized-​crime/​E_​CN_​15_​ 2007_​8_​Add_​3.pdf. Identity Theft in Canada, Spamlaws.com, http://​www.spamlaws.com/​id-​theft-​can.html (last visited Mar. 24, 2010). Cybercrime Convention, supra note 21, at Introduction, ¶ 4. Report on Identity Theft, Public Safety Canada, http://​www.publicsafety.gc.ca/​prg/​le/​ bs/​report-​eng.aspx (last modified Nov. 28, 2011).

The Problem of Identity Crime

9

crimes are and how much damage they do.33 Without such understanding, government officials are unable to create a legal framework to prevent, prosecute, and minimize the impact of identity crimes. Governments, individuals, and businesses have long underestimated the scope of identity crimes, including the financial and nonfinancial losses incurred by its victims. Many crimes that should be considered identity crimes are not so considered, because there is no real understanding of what an identity crime is. For example, the acquisition of identity information, which may be a low-​tech operation such as photocopying customers’ credit card information, or scavenging through trash bins for discarded bank statements, is prosecuted and treated like an ordinary theft or, if the information is gathered from discarded material, not prosecuted at all.34 In most countries, identity-​related fraud is not separated from ordinary fraud, and is prosecuted under the fraud statutes.35 This book aims to provide answers to the quandaries posed by identity crime. The crux of the book is the Identity Crime Model.36 The Model provides a framework for understanding why instances of identity crime continue their increase even in countries with identity-​crime-​specific laws. In recognition of this inexorable increase, the book posits some reasons: First, the extant laws do not completely cover the crime. Second, even if those laws did cover the crime, the laws must be enacted internationally, and be accompanied by a commitment for cross-​border cooperation in enforcing the laws.37 Third, 33 An oecd Scoping Paper concluded with a list of “Issues for Consideration” that member-​ states of the oecd should take into account in their efforts to combat identity crimes. One of the suggestions was to develop a common definition of identity crime and its elements. Organisation for Economic Co-​o peration and Development (oecd), Scoping Paper on Online Identity Theft (Ministerial Background Report DSTI/​ CP(2007)3/​FINAL, declassified 2008)  [hereinafter “oecd Report”], available at http://​ www.oecd.org/​sti/​40644196.pdf. 34 See discussion in Chapter 6. 35 Id. 36 Chapter 3. 37 A group of scholars at the Hoover Institution of Stanford University noted, in 2000, that “efforts to prevent or deter [cybercrime] have been largely unsuccessful, with increasingly damaging consequences. Information necessary to combat attacks has not been timely shared. Investigations have been slow and difficult to coordinate. Some attacks are from States that lack adequate laws governing deliberate destructive conduct. Such international cooperation as occurs is voluntary and inadequate. Some significant enhancement of defensive capabilities seems essential. Cybercrime is quintessentially transnational, and will often involve jurisdictional assertions of multiple States. Agreements on jurisdiction and enforcement must be developed to avoid conflicting claims.” Abraham D. Sofaer et al., A Proposal for an International Convention on Cyber Crime and Terrorism, iws –​ The Information Warfare Site, (Aug. 2000)  http://​www.iwar.org.uk/​law/​resources/​ cybercrime/​stanford/​cisac-​draft.htm [hereinafter “iws Proposal”].

10 chapter 1 even if a strong transnational system is in place, individuals, companies, and governments must adopt rigorous strategies to prevent the crimes, and those strategies must be based on an approach specific to identity crimes. The importance of international unity in identity crime laws cannot be overemphasized. The international community has previously tackled a similar global problem in the Council of Europe’s 2001 Convention on Cybercrime,38 which has been signed not just by European countries, but also by the United States, Canada, South Africa, and Japan, and ratified by the United States and most European countries.39 In its Introduction to the Convention, the framers emphasized that “[s]‌olutions to the problems posed [by cybercrime] must be addressed by international law, necessitating the adoption of adequate international legal instruments.”40 The same is true for identity crime. This book is intended to guide the international legal community in determining the right laws, and the right enforcement methods, to control the threats posed by ­identity crime. Many countries use their fraud, theft, and larceny statutes to prosecute identity crimes41 but, as the United States and Canada found out, fraud laws are inadequate to combat the crisis.42 Governments, policymakers, businesses, and law enforcement must embrace a different way of thinking to understand and deal with identity crime. The notion that identity crime is different from fraud or theft or larceny is a new concept; only within the last 10 years has identity crime truly been recognized as a distinct area of law by international organizations.43 However, fraud, theft, and larceny, while they might be charged and successfully prosecuted in an identity crime context, they are not crimes that are contoured to the elements of identity crime. Will a jury always agree that it is “theft” to electronically invade a computer storing information in order to access personal information? Will a judge recognize the taking of 38 39 40 41 42 43

Cybercrime Convention, supra note 21. The convention came into force on Jan. 7, 2004, when there were 5 ratifications, which had to include at least 3 member states of the Council of Europe. See signatory list, referenced below. Convention on Cybercrime Signatories as of Mar. 30, 2010, Council of Europe, http://​ conventions.coe.int/​Treaty/​Commun/​ChercheSig.asp?NT=185&CM=8&DF=&CL=ENG (last visited Mar. 30, 2010). Cybercrime Convention, supra note 21, at Introduction, ¶ 6. Countries without identity crime laws, but that prosecute based on other sorts of laws, are discussed in Chapter 6. See, e.g., discussions of the laws of U.K. See Chapter 6. See, e.g., oecd Report, supra note 33; U.N. Commission, Second Meeting, Study on Fraud, supra note 29; European Union Fraud Prevention Expert Group, Report on Identity Theft/​ Fraud (Oct. 22, 2007), available at http://​ec.europa.eu/​internal_​market/​fpeg/​docs/​id-​ theft-​report_​en.pdf).

The Problem of Identity Crime

11

credit card information by a waiter, for the purpose of selling that information, as “larceny”? Will a prosecutor need to make compromises in order to convince a fact finder that creating a new identity and using it to gain phone service is a serious form of fraud? While the penal provisions attached to fraud, theft, or larceny are instructive as to proper penalties for identity criminals, identity crimes must gain recognition as a stand-​alone offenses in order to successfully prosecute and punish them. Recognition for the uniqueness of identity crime must be global in order to successfully prosecute such crime. A universal template for the criminalization of identity-​related offenses is needed so that investigations and prosecution of crimes can be coordinated among far-​flung enforcement bureaus. Statistics on worldwide identity crime will only become meaningful when the parameters of the crime are clearly drawn and recognized by a substantial number of jurisdictions. International enforcement agencies with a common purpose cannot work effectively when the type of evidence needed to provide proof of a crime differs from one place to another, when the crime was committed in all of those places. An international convention, one specifically aimed at identity crimes, would be an effective way to deal with a borderless crime such as this. It can be modeled on the Council of Europe’s Convention on Cybercrime. The rationale for an international convention rather than mere national laws is much the same as the rationale for the Convention on Cybercrime:44 1. Identity crimes are transnational, and require a transnational response. 2. Identity criminals exploit weaknesses in the laws and enforcement practices of states, exposing all other states to dangers that are beyond their capacity unilaterally or bilaterally to respond. 3. The speed and technical complexity of identity crimes using the Internet require prearranged, agreed procedures for cooperation in investigating and responding to them. 4. A multilateral convention will ensure that all parties to the treaty: i) adopt laws making identity offenses criminal; ii) enforce those laws or extradite criminals for prosecution by other states; iii) cooperate in investigating criminal activities and in providing usable evidence for prosecutions; and iv) participate in formulating and agree to adopt and implement standards and practices that enhance safety and security. 44

iws Proposal, supra note 37.

12 chapter 1 5.

An international agency created pursuant to the Convention will provide a forum for international discussion, ongoing response to technological developments, and technical assistance to developing states.45 Identity impacts many parts of a person’s life, including work, social relationships, and family connections. Identity affects people’s mobility, how they buy and sell merchandise, whether they have access to the rights and privileges of citizenship, whether they are entitled to vote, whether they have access to health care, and whether the health information stored by providers reflects their personal medical history. With so much riding on identity and identification, there is a need for reliable and effective proof that individuals really are who they say they are, and that they have the credentials required to take specific actions. For example, a person needs a valid driver’s license to drive a car or the right diploma to prove the academic competency to assume a position of responsibility. The information included in a license, diploma, or some other document certifying a particular individual must include a means of ensuring its relevance and accuracy. It needs to be managed and controlled by organizations, institutions, and individuals themselves because access to the information or disclosure of it has a huge impact on individuals and their relationship with organizations, businesses, governments, and the public. Because identity is so valuable, and the means of identification can be so detached from the individuals who own them, identification and the documents and data that represent identification are an irresistible target for criminals. Although identity itself has no market value, its value in obtaining money, goods, services, and status is unlimited.46 Identity crimes are attractive to criminals not just for the value of an identity, but also because identity information is so accessible. It is not like ordinary thievery, which targets objects like automobiles and wallets. Identity theft is committed everywhere:  homes, businesses, schools, playgrounds, and often, in the garbage cans and dumpsters outside these locations. Because digital data is everywhere, and devices storing and transmitting such data are in most homes and businesses, identity thieves need not ever come anywhere near the persons from whom they are stealing. Every day, people use their credit cards to buy food or gas, give personal information to their employers, and submit data to all levels of government. Each transaction creates an opportunity for identity criminals to obtain identity information and use it, with the victim not realizing his identity is stolen until days, weeks, months, or years later.

45 46

Id. (adapted to a discussion of identity crimes). As to the types of gains resulting from identity crimes, see Chapter 3.

The Problem of Identity Crime

13

Economies are fragile things. Unless we carefully guard the foundations of our most vibrant financial systems, which are built on easy access to funds and ample lines of credit, much of the world’s resources will flow to those who cheat the system at the expense of honest governments, businesses, and consumers. The reality and potential of identity crimes is a threat to our ability to maintain a system of free trade and international commerce unimpeded by the manipulations of cheats and thieves who look for weak spots and strike without mercy. Our systems for welfare, social security, and immigration, which must work properly if the borders of countries are to be respected and the public fisc protected, need methods to ensure that the persons trying to take advantage of governmental benefits and protections are, in fact, for people entitled to do so. Employers and unions must be able to verify that the people who they hire or enroll are entitled to the benefits of employment and the protections of organized labor. An attribute of identity crime that makes it hard to conquer is that it is particularly difficult to investigate and gather sufficient evidence for an indictment. Criminal investigators first must face the challenge of complexity.47 What kind of complexity? 1. An investigation requires the participation of a multitude of different businesses, such as financial institutions, credit card companies, debt collectors, and medical records companies, in each of which investigators may have difficulty establishing contacts.48 2. A single crime may occur in many jurisdictions, which often have imprecise and varying definitions of identity crime if they have any definition at all.49 Evidence that may fit the crime in one place may be a mismatch for the criminal elements required in another place. 3. Evidence often is not something tangible, like a fingerprint or an incriminating document; rather it exists in the virtual world, and can be erased or overwritten if the investigator does not act quickly. Gathering evidence requires specialized knowledge, and that knowledge must be updated constantly to keep abreast of the criminals. Prosecutors must find a way

47

48 49

For a thorough discussion of the challenges facing prosecutors, see International Association of Chiefs of Police, Identity Crime Toolkit for Investigators, To Identity Thieves, Everyone is Just a Number 11 (nd.) [hereinafter “iacp Toolkit”], available at http://​www.theiacp.org/​investigateid/​pdf/​binder-​resources/​ identity-​crime-​toolkit.pdf. Id. at 38. Id.

14 chapter 1 for judges and juries to understand exactly what the perpetrator did and how that is a crime, despite the lack of tangible evidence.50 4. Identity crime is not a single crime. Rather, it unfolds in stages, from obtaining or creating a usable identity, and then using that identity to commit further crimes, while concealing the true identity of the criminal.51 A person’s victimization from identity crimes may be ongoing and repetitive. One criminal may acquire card information (perhaps by larceny), use it to commit credit fraud (larceny and fraud), gain employment (fraud; offenses against employment laws), get a driver’s license (fraud on the dmv; traffic law violations for driving without a valid license), and commit a money laundering offense, then sell the identity information to someone else who continues to use it until something or someone puts a stop to it. The complexity of identity crime, as discussed above, and the difficulties in prosecuting such crimes are issues that can be mitigated in the long run by changes in the law and in the methods of enforcement. In the absence of effective laws and enforcement, it is necessary to engage in prevention methods. Methods include the use of strong user authentication in computer systems, the development of business policies to address identity theft, content and identification management, gathering and sharing relevant information among stakeholders, consumer education, the creation of partnerships between public and private entities, and international cooperation in both policy and actions.52 The practitioners of criminology have put forth numerous crime prevention models and approaches, but few are well-​suited to identity-​related crimes.53 There is no specific framework for developing a methodological approach to preventing, and reducing the impact of, identity-​related crimes. Additionally, numerous recommendations for prevention have been made by governments, non-​profit and for-​profit organizations, ngo s, and law enforcement authorities, but these recommendations have been based on prevention approaches that do not address the unique elements of identity crimes. The approach that 50 51 52 53

Id. at 40. Id. See Chapter 7 (“Recommendation for Identity Crime Prevention and Impact Minimization”). Approaches such as the “victim-​centric prevention approach” and “crime prevention through environmental design.” See, e.g., Peter R.  Ibarra & Edna Erez, Victim-​centric Diversion? The Electronic Monitoring of Domestic Violence Cases, in 23 Behav. Sci. & L. 259 (2005); International cpted Association, http://​www.cpted.net (last visited Mar. 30, 2010).

The Problem of Identity Crime

15

is put forth in this book is specifically tailored to identity crimes, as opposed to one adaptable to a wide range of crimes. Thus, it should prove more useful in preventing such crimes than generic solutions. A comprehensive book on identity crime is desperately needed. To date, a rather meager body of literature deals with the topic. On a popular level, one will find articles in magazines, newspapers, and on the internet that do little more than offer brief checklists of how to avoid having one’s identity compromised. These pieces are not to be criticized, but they are simply not crafted to deal with the scope and seriousness of identity crime that our current situation demands. At a slightly higher level of sophistication one will find articles appearing in various commercial and banking journals; many of these treatments are quite useful since it is often businesses and banks that are most heavily impacted by identity crime, yet still these articles do not begin to tackle comprehensively the task of effectively confronting identity crime as one of this age’s most serious problems. Moreover, there are books that have been written on identity crime, but none of them address identity crime comprehensively or from the perspective of a legal and legislative analysis; in most cases these books deal with the severity of identity crime and its impact on the average ­citizen.54 For legal analysis, one can turn to law journals55 and a few legal 54

55

See, e.g., Jim Stickley, The Truth about Identity Theft (2008); John R. Vacca, Identity Theft (2003); Amanda Welsh, The Identity Theft Protection Guide (2004); Bob Sullivan, Your Evil Twin:  Behind the Identity Theft Epidemic (2004); Daniel J.  Solove, The Digital Person:  Technology and Privacy in the Information Age (2004); Kristin M.  Finklea, Identity Theft: Trends and Issues (2010). See, e.g., Brandon McKelvey, Financial Institution’s Duty of Confidentiality to Keep Customer’s Personal Information Secure from the Threat of Identity Theft, 34 U.C. Davis L.  Rev. 1077 (2001); Edward J. Janger and Paul M. Schwartz, The Gramm-​Leach-​Bliley Act, Information Privacy, and the Limits of Default Rules, 86 Minn. L.  Rev. 1219 (2002); Erin M. Shoudt, Identity Theft: Victims “Cry Out” for Reform, 52 AM. U. L. Rev. 339 (2002); Lynn M.  LoPucki, Human Identification Theory and the Identity Theft Problem, 80 Tex. L.  Rev. 89 (2001); James P. Nehf, Recognizing the Societal Value in Information Privacy, 78 Wash. L. Rev. 1 (2003); Anthony E. White, The Recognition of a Negligence Cause of Action for Victims of Identity Theft: Someone Stole My Identity, Now Who Is Going to Pay for It?, 88 Marq. L. Rev. 847 (2005); Jeff Sovern, The Jewel of Their Souls: Preventing Identity Theft Through Loss Allocation Rules, 64 U. Pitt. L. Rev. 343 (2003); Daniel J. Solove and Chris Jay Hoofnagle, A Model Regime of Privacy Protection, Ill. L.  Rev. 1 (2006); Daivd Narkiewicz; Identity Theft:  A Rapidly Growing Technology Problem, 26 Penn. Lawyer 58 (May/​June 2004); Catherine Pastrikos, Identity Theft Statutes:  Which Will Protect Americans the Most?, 67 Alb. L. Rev. 1137 (2004); Erin Leigh Sylester, Identity Theft: Are the Elderly Targeted?, 3 Conn. Pub. Interest L.J. 371 (Spring 2004); Holly K. Towle, Identity Theft: Myths, Methods, and New Law, 30 Rutgers Computer and Tech. L.J.

16 chapter 1 treatises,56 but none of this material is comprehensive. These treatments typically highlight one or two specially-​focused issues within the larger body of issues related to identity crime, and few of them even attempt to deal with identity crime across interstate or international borders. In any case, the reader should know that virtually all of the available literature (popular, commercial, legislative, legal) has been consulted and is cited throughout this book. Thus this book avails itself of the considerably thoughtful and valuable material already available, but goes much further in addressing virtually every aspect of identity crime and how better to confront it legally in all political jurisdictions, including the international community. In other words, this book is the first comprehensive treatment of all aspects of identity crime. It is a legal analysis, suggesting that the national and international communities need to get a grasp on this rapidly growing cancer called identity crime, but also suggesting that radical surgery is needed rather than a steady application of band aids to fix the problem. The book consists of ten chapters including the introduction and the conclusion. Chapter 2 addresses the meaning of “identity” and attempts to make suggestions concerning the need for legislatures everywhere, indeed the international community at large, to begin to universalize such basic matters as defining identity, not to mention making more uniform the array of laws that seek to reduce and eliminate identity crimes.

56

237 (2004); Erin Suzanne Dais, A World Wide Problem on the World Wide Web: International Responses to Transnational Identity Theft via the Internet, 12 Wash. U. J.L. & Pol’y 201 (2003); Chris B. Petrie, Identity (Theft) Crisis! 26 Wyo. Lawyer 22 (October 2003); Sean B.  Hoar, Identity Theft:  The Crime of the New Millennium, 80 Or. L.  Rev. 1423 (Winter 2002); Raymond G. Mullady, Jr. and Scott D. Hansen, Identity Theft Litigation: A Roadmap for Defense and Protection, 2008 Utah L.  Rev. 1, No. 2 (2008); Nicole A.  Ozer, Rights “Chipped” Away: RFID and Identification Documents, 2008 Stan. Tech. L. Rev. 1 (2008); Rachel Hirsch, Identity Theft Continues to Top FTC’s List of Consumer Complaints, Nat’l L.  Rev. (March 28, 2012); Daniel J.  Solove, The New Vulnerability:  Data Security and Personal Information, 9 (gwu Law School Public Law Research, Paper No. 102, 2008); Vincent R. Johnson, Cybersecurity, Identity Theft, and the Limits of Tort Liability, 57 S.C. L. Rev. 255 (2005); Paul M. Schwartz & Daniel Solove, The PII Problem: Privacy and a New Concept of Personally Identifiable Information, 86 N.Y.U. L. Rev. 1814 (2011). See, e.g., Perspectives on Identity Theft, 23 Crime Prevention Studies (Graeme R. Newman & Megan M. McNally eds. 2009), (presenting a collection of scholarly articles on identity crime that explores the seriousness of identity crime and the need for legislative initiatives to deal with it); See also Reba A. Best, Identity Theft: A Legal Research Guide (2004) (presenting a very useful bibliography of early literature on identity crime).

The Problem of Identity Crime

17

Chapter 3 presents the Identity Crime Model, a framework for understanding identity crimes. The chapter assists the reader in evaluating and developing legal instruments for prevention, recovery, and prosecution, and in developing an overall prevention strategy. Chapter 3 develops a definition of identity crime that includes the five critical components of the crime, namely acquisition, production, transferring, possession, and use, which are discussed in detail. Techniques and strategies for acquiring personal information and documents are covered, including the acquisition of physical items57 and data theft techniques that rely on computer technology, such as phishing, botnets, smishing, vishing, pharming, spyware, malware, web Trojans, keyloggers and screenloggers, system reconfiguration attacks, hacking and cracking, online searching and search hacking, wardriving, and identity theft via social networks. Chapter 3 also provides a comparison of identity-​related frauds with generic fraud, revealing the unique features of the former. Different types of identity-​ related frauds are discussed in detail including identity-​related frauds involving: credit cards and payments; banks; trade; loans; real estate and mortgages; employment; criminal evasion; telephones and other utilities; taxes; social security numbers and cards; passports and visas; driver licenses; medical services; credentials; insurance; investments; tenancy; bankruptcy; postal services; email and the Internet. Chapter 3 goes on to discuss situations in which identity information and documents are used for committing other crimes, such as terrorism, money laundering, illegal immigration, drug trafficking, and organized crime. Chapter 4 provides threat analysis, and introduces the Identity Crime Risk Assessment Model, spelling out the identity crime threat agents that directly or indirectly increase or decrease the likelihood