Crime that behaves like a company

Discussions of cyber security usually begin with the defender's systems, passwords and training. In a Wealth Office X conversation with Michael Macfarlane, David Ferbrache OBE, Managing Director of Beyond Blue, and Lord Bernard Hogan-Howe, former Commissioner of the Metropolitan Police in London, spent much of their time on the other side of the transaction. Their account of how attackers think offers a clear picture of why family offices have become attractive to them.

Ferbrache's starting point is that most of the threat is transnational organised crime, driven by money and profit, and that it operates like any other commercial enterprise.

It's ultimately their businesses. They're entrepreneurial, they're looking for returns on investment.

— David Ferbrache OBE, Wealth Office

Like any business, these groups follow the opportunity. Ferbrache describes how their targeting has changed. They once went after big organisations, including financial services firms. Those became hard targets as they got good at security, so the criminals turned to supply chains, service providers and smaller firms. Family offices, in his description, fit an awkward category. In one sense they are small businesses. In terms of assets under management, and in terms of what could be exploited, they are not.

Scanning, landing and triage

The process Ferbrache describes resembles prospecting more than a targeted raid. Much activity is still indiscriminate, scanned at scale and looking for vulnerabilities. He can imagine a family office being compromised almost by accident. What follows is a form of triage. The intruder asks where they have landed, what data is there, and what could be done with the family's reputation, its trusted contacts and its members. Very quickly, he says, that can lead to the conclusion that a target is worth the effort.

The tactics have shifted to match. Criminal groups once concentrated on ransomware, encrypting data and demanding payment from organisations without good backups. Increasingly, Ferbrache says, they collect samples of data, work out where they are and decide how best to apply extortion and blackmail. He describes a further trend of attempts to blackmail key executives and family members directly. He also reports that the time between initial compromise and the attack itself is dropping.

Artificial intelligence improves the economics of this model. In Ferbrache's account it helps criminals scan large numbers of systems quickly and carry out thorough background research, producing well-crafted phishing lures and, at times, simulated video and audio. By implication, research that once took real effort now costs less, and more targets become worth examining.

Assets that fit in a pocket

Some assets are especially attractive because they are portable and hard to recover. Macfarlane recounts a client who believed he had lost a drive holding something in the order of US$50 million to US$60 million in cryptocurrency while flying between countries. The family office went into overdrive without knowing where to begin. The drive turned up in an inside pocket of a suit hanging in a wardrobe, but Macfarlane's point was the panic, and the absence of any plan.

Hogan-Howe describes a case in which a party was asked to prove that its cryptocurrency existed by bringing it on a disc to a meeting. It was left on the table, taken with a version of the three shells trick, and the money was moved very quickly afterwards. He also explains the practical difficulty of holding such assets securely.

It's very hard for somebody to remember a 16 digit code, so they're going to record it somewhere. Where they record it, they're vulnerable.

— Lord Bernard Hogan-Howe, Wealth Office

Holding several accounts multiplies the problem. The blockchain, he notes, leaves an indelible record of where the assets went. What is harder is stopping them moving or getting them back. It is not impossible, he says, and there are routes to do it, but it is not an easy task for anyone.

For all the technology, Hogan-Howe insists that digital crime always has a human element. There is a motivation behind every attack, whether to steal or to damage, and usually a finger on the button.

Information as raw material

The criminal business model also treats information as a commodity to be gathered and assembled. Ferbrache says he routinely sees cases in which nothing was hacked at all. Information was simply observed and put together, a practice he calls pattern of life analysis. State actors do this thoroughly, mapping where people are, whom they associate with and when. The results allow phishing to be tailored to someone's interests, frauds to be timed for when an executive is travelling or out of touch, and in the most extreme cases reveal where a person will be physically present. Hogan-Howe adds that software can now identify where an image was taken, and that cyber risk crosses into physical risk, recalling past cases in which children were kidnapped for money.

Macfarlane adds a use for stolen information that sits outside conventional crime. In his reputation work he increasingly sees families facing litigation he regards as unfounded, sometimes close to vexatious, where the aim is to use reputational damage to force a settlement. In cyber, he suggests, other parties may want access to information that supports that kind of pressure.

Hogan-Howe frames risk as a function of two things, the likelihood of an event and how terrible the outcome would be, even if it is infrequent. The criminal's calculation runs the other way, weighing effort against expected return. Seen together, the two calculations explain much of the guests' advice. Ferbrache's emphasis on identifying a family's crown jewels and its worst-case scenarios is, in effect, looking at the office as an intruder would after landing. Hogan-Howe's preference for assuming that an attack will get through follows from the same logic. An enterprise that scans at scale and triages what it finds will, sooner or later, find something. Read this way, the guests' advice concerns how much an intruder can gain on landing and how ready the family is for the day it happens.