Anyway

Tim has a post and won­ders why the crim­in­als are so blatant when it should be easy to track them down.

I think the answer is simple — nobody feels that they’re responsible.

We live in Canada, the phish­ing attempt was about a US com­pany, and the phish­ing script is run­ning on a Thai web site. That’s a min­imum of three police forces that would need to agree a) that it’s a prob­lem, b) that it’s a prob­lem they should do some­thing about, c) that it’s a prob­lem they can do some­thing about and d) that it’s a prob­lem they should work together to solve. Point a) sounds trivial, but depends on the pre­cise laws in three coun­tries (as an inter­est­ing aside, in the dim recesses of my memory I remem­ber read­ing some­where that for some years it was not illegal to coun­ter­feit cur­ren­cies in Aus­tralia as long as you didn’t coun­ter­feit the Aus­tralian cur­rency). Point b) depends on whether the vari­ous police forces think it’s a worse prob­lem than many oth­ers they have to solve. And I would think that rip­ping rich-world people off for some money is way below people traf­fick­ing (to give just one example) in terms of inter­na­tional police priorities.

Of course, the Thai gov­ern­ment could decide that such phish­ing attempts occur­ring on Thai web sites were dis­turb­ing poten­tial investors in Thai­l­and and do some­thing about it on their own, much as I gather the Nigerian gov­ern­ment is tak­ing steps to clean up the Nigerian spam prob­lem. That does assume the prob­lem is per­ceived as being big enough to be worth solv­ing. In this case, you never know. thaiedresearch.org is registered to the “Office of the Edu­ca­tion Coun­cil” which sounds at least semi-official; do they know about the phish­ing script? If they know, do they care?