Domestically we need to really increase the punishments for these and other computer crimes and step up enforcement significantly.
The problem here is that the attacks are so easily perpetrated.
My approach would be:
- Reduce risks: change practices, increase system security,decrease holdings of vulnerable data.
- Increase monitoring: watch for specific patterns of behaviour.
- Increase checks and balances and procedures within and between organisations and firms: one of the simplest anti-fraud actions is to increase the number of individuals required to make a specific action. For automated data processing, that poses obvious challenges, though multiple paths and validations of requests is one option. 2FA is in one sense a form of this.
- Changes in law and regulation such that individuals are not obligated to provide or agree to collection or submission of personal information and behavioural data in order to participate in the normal everyday business of life: communications, commerce, travel, work, education, and more.
- Strict and biting consequences for firms which fail to reduce risks and protect individuals privacy and confidentiality.