Identification is ever more important in the online world, and identity-related crime is a growing problem related to this. This new category of crime is not restricted to high-profile instances of identity ‘theft’ or identity fraud; it is wide-ranging and complex, ranging from identity deletion to unlawful identity creation and identity ‘theft’. Commonly accepted definitions are lacking, thus blurring available statistics, and policies to combat this new crime are piecemeal at best. In order to assess the real nature and magnitude of identity-related crime, and to be able to discuss how it can be combated, identity-related crime should be understood in all its aspects. As a first key step, this article introduces a typology of identity-related crime, consisting of conceptual, technical, and legal categories. The conceptual categories are unlawful forms of identity deletion, identity restoration, and identity change; the latter category is subdivided in unlawful forms of identity takeover (‘identity theft’), identity delegation, identity exchange, and identity creation. The technical categories consist of 17 points of attack on identification. The legal categories distinguishes between identity-specific legal provisions, such as the US crime of identity theft, and identity-neutral legal provisions mainly used in Europe, subdivided in criminal, civil, and administrative provisions. This typology can be used as a comprehensive framework for future research, countermeasures, and policies related to identity-related crime.

On September 11, 2001, thousands of businesses located in or around the World Trade Center found themselves in the midst of a catastrophe. There was massive loss of life, facilities and equipment were ruined, transportation routes were gridlocked, communication channels were overwhelmed, and airspace was sanitized. Yet many of the affected businesses were able to resume operations on September 12. How was this possible? Careful planning.

Contingency planners and disaster recovery experts may disagree on some details, but all would agree that every business and organization should have a disaster recovery plan. These plans will vary widely based upon the scope and scale of the organization, but all should identify possible scenarios that could interrupt their operations and then devise strategies to overcome these interruptions. The most common scenarios are forces of nature such as earthquakes, hurricanes, tornados, landslides, wildfires, flooding, blizzards, ice storms, volcanoes and tidal waves. Man-made disasters should also be addressed; e.g., arson, prolonged power loss, burglary, vandalism, computer attacks, espionage, bomb threats, terrorist attacks, chemical spills, transportation interruptions, etc.

A basic assumption of disaster recovery is that the primary site of organizational operations will be either non-existent, unsuitable for occupancy, or inaccessible. This necessitates the creation of a temporary location to continue the activity of the organization. In order to accomplish this objective, information and other critical resources must be transferred from the primary location to a secondary location. From a records management standpoint, this requires organization of information assets in such a way that critical active records, as well as vital records, such as corporate charters, are both complete and portable (e.g., via dispersion).

The first step in protecting critical information assets is to identify them—in advance. This calls for an information and records inventory. A records manager should interview employees from all departments, including legal counsel and external accounting partners, in order to gain a complete picture of company information assets that would be essential in maintaining a viable organization. These records receive the label vital records. Vital records are frequently protected by redundancy. That is, a copy of each vital record is created and then be sent for storage in a facility physically separated from the primary operations unit of the company. While many organizations who operate in multiple facilities or geographically disparate locations may rely on unaffected company locations for other disaster recovery strategies, the preservation of vital records is frequently outsourced to a third party commercial information management company in order to insulate that information from internal attacks by disgruntled employees.

The need for this third-party involvement is clearly demonstrated in the following excerpt from an article in Network World magazine. “Tim Lloyd of Wilmington, Delaware, was found guilty last spring of planting a software time bomb in a centralized file server at Omega Engineering’s Bridgeport, New Jersey, manufacturing plant. The malicious software code destroyed the programs that ran the company’s manufacturing machines, costing Omega more than $10 million in losses, $2 million in reprogramming costs, and eventually leading to 80 layoffs…The case stems from a July 31, 1996, incident at Omega, a Stamford, Connecticut, manufacturer of customized high-tech measurement and instrumentation devices. On that morning, the central file server crashed on boot up, deleting and purging all programs on it. After months of data recovery efforts, the programs are considered a complete loss.”

Here is a further illustration from the Computer Security Institute, “Companies reporting computer crime for 1997 have reported the following: virus infection - 65%; laptop theft - 57%; abusive use of the Internet - 31%; unauthorized computer use - 16%; telecommunications fraud - 16%; information theft - 14%; financial fraud - 12%; sabotage - 11%; network break-in - 8%.” The Harris Corporation reports that “60% of computer abuse is caused by insiders. 85% of computer break-ins occur internally. Insiders still remain as the most serious threat to intellectual property.”

Redundant copies may take the form of paper records, microforms, computer data tapes, or combinations of all those media types and others as well. The location of these materials, along with an inventory of the redundant copies should be communicated in the disaster recovery plan, along with contact information for the commercial information management company. Access to this information is shielded by a restrictive authorization list, which is a select group of employees authorized to order the retrieval of information. When contemplating a scenario such as September 11, where there was massive loss of life, it would be prudent to include the name of a non-company employee (such as legal counsel or external company accountant) on the authorization list in order to insure that there will be a surviving person authorized to order retrieval of vital information, even in the case of an incident leading to significant casualties. It is also a prudent step to include a copy of the organization’s disaster recovery plan at a distant offsite location.