Not enough companies reporting cyber attacks, says FBI director

San Jose (CA) - The FBI is stepping up its efforts to fight cybercrimes. At the RSA Security Conference, agency director Robert Mueller asked the private industry to get more active in reporting attacks as there are simply too many threats and avenues of attack that the FBI can’t go alone. In exchange, the FBI promises to ensure the privacy of firms and protect critical and proprietary information.

While certain cyber crimes receive great public exposure and companies have increased their efforts in collaborating with federal agencies to identify individuals behind an attack, Mueller claims that companies are not involved at a level that is necessary to efficiently battle crime. "No person, no agency, no company, indeed no country can prevent crime and terrorism on its own," Mueller said in this speech at the conference. Most companies that experience network intrusions do not report the incidents to law enforcement out of privacy and other concerns, he said.

Companies often fear that reporting attacks to law enforcement will result in public exposure that could result in negative reporting, loss of competitive advantage and perhaps trade secrets leaking out. Mueller urged the audience of info-security professionals to share cyber crime data to enable a collaborative effort to find the sources of a particular attack. He promised that his agency will take steps to ensure their privacy : "We don’t want companies to feel victimized a second time because of our investigation."

Mueller described several cases in which law enforcement and private industry worked together to solve computer crimes. For example, he highlighted the cooperation with Microsoft to identify the hacker that released the Mytob and Zotob worms as well as the assistance of with the American Red Cross, PayPal and Mastercard to investigate 6000 Hurricane Katrina donation websites. Several of those sites were fraudulent and shutdown and "numerous" others were referred to state and local agencies for prosecution, Mueller said.

While outdated government policies were barriers for industry participation in the past, Mueller said that it is the perception of further harm caused by an investigation that keeps companies from reporting cyber attacks. If proprietary information or even trade secrets involved that barrier may get even higher, as firms feel that information may be leaked. Mueller however said that this will not happen : "We will not release proprietary information and in case of theft of trade secrets we can get protective orders."