Phishing for Jurisdiction

Tim has a post and won­ders why the crim­in­als are so blatant when it should be easy to track them down. 

I think the answer is simple — nobody feels that they’re responsible. 

We live in Canada, the phish­ing attempt was about a US com­pany, and the phish­ing script is run­ning on a Thai web site. That’s a min­im­um of three police forces that would need to agree a) that it’s a prob­lem, b) that it’s a prob­lem they should do some­thing about, c) that it’s a prob­lem they can do some­thing about and d) that it’s a prob­lem they should work togeth­er to solve. Point a) sounds trivi­al, but depends on the pre­cise laws in three coun­tries (as an inter­est­ing aside, in the dim recesses of my memory I remem­ber read­ing some­where that for some years it was not illeg­al to coun­ter­feit cur­ren­cies in Aus­tralia as long as you did­n’t coun­ter­feit the Aus­trali­an cur­rency). Point b) depends on wheth­er the vari­ous police forces think it’s a worse prob­lem than many oth­ers they have to solve. And I would think that rip­ping rich-world people off for some money is way below people traf­fick­ing (to give just one example) in terms of inter­na­tion­al police priorities.

Of course, the Thai gov­ern­ment could decide that such phish­ing attempts occur­ring on Thai web sites were dis­turb­ing poten­tial investors in Thai­l­and and do some­thing about it on their own, much as I gath­er the Nigeri­an gov­ern­ment is tak­ing steps to clean up the Nigeri­an spam prob­lem. That does assume the prob­lem is per­ceived as being big enough to be worth solv­ing. In this case, you nev­er know. thaiedresearch.org is registered to the “Office of the Edu­ca­tion Coun­cil” which sounds at least semi-offi­cial; do they know about the phish­ing script? If they know, do they care?