|
The bright-blue starry sky depicted on an Australian web page for Fortuna Alliance offers an enticing proposition: “Make your income soar like the space shuttle.” But a click of the mouse is enough to bring World Wide Web surfers down to earth. A web press release by Fortuna acknowledges that its US home page was shut down by the US Federal Trade Commission in May, after the company had been accused of running an illegal pyramid scheme. Operating for just six months out of a small town in the US Northwest, Fortuna, the FTC alleges, bilked tens of thousands of investors in dozens of countries out of an estimated $9 million. By value, it is the biggest Internet fraud to date. The Fortuna case has opened the FTC’s eyes to the vast potential for Internet crime and has taught it something about the complications of international law enforcement that can be involved. “The Internet makes it possible to perpetrate such a crime anywhere,” says Charles Harwood, FTC regional director in charge of the case. After receiving warnings from authorities in Australia, Canada and from the local police before being shut down, Fortuna’s operators disappeared offshore, as did most of the money they had collected. Communicating via web pages still going strong from an Australian server, its operators have denied the allegations. Undaunted, they continue to offer new schemes. They’ve also started an on-line defence fund and have vowed to fight the FTC, which has obtained an injunction to freeze assets in the US and in Antigua, where more than $5 million had been directed from the company’s US bank. An FTC civil suit seeks to return the money to investors, but it may be too late. The FTC isn’t sure what kind of extradition treaties (if any) exist with Belize, the Central American country where the Fortuna leaders are living and are rumoured to have purchased a skin-diving resort. And Antiguan bank-secrecy laws make it impossible to know how much money is still there, and not already in another offshore haven. “It’s hard to get effective relief,” sighs Harwood. Nonetheless, he believes the success of the FTC in pursuing Fortuna is critical to the development of financial services on the Internet. “We’d like to avoid having the Internet viewed in the same light as 900 telephone numbers,” he says, referring to the pay-for-porn numbers that proliferate in the US. The borderless nature of the Internet is one of the characteristics that makes it so susceptible to crime. But that isn’t the only headache for regulators and law-enforcement agencies everywhere as they struggle to get a handle on the World Wide Web before a calamity undermines confidence in this major technological development. For the things that make the Internet attractive to legitimate business are as readily available to criminals. “The Internet is cheap, it’s easy and it’s fast,” says John Stark, special counsel for Internet projects at the US Securities & Exchange Commission. Many government officials acknowledge being in the dark, only admitting to a suspicion that the Internet is likely to challenge their traditional methods and legal frameworks. “We haven’t got a clue what to do,” says one high-ranking law enforcement official. Virtual instruments The US still dominates Internet activity, and as a result, most regulatory action has occurred there. In addition to the FTC action against Fortuna, the SEC has shut down six Internet-based scams. In one case, the SEC says, about $3.5 million was raised by two men offering “prime bank” securities instruments that don’t even exist. Another involved a company called Pleasure Time, Inc that attracted $2 million selling unregistered securities offering huge profits to be made from a telephone lottery. The SEC and the National Association of Securities Dealers (NASD), which regulates the over-the-counter market, are now investigating market manipulation involving the bulletin board services and Internet chat rooms that have been instrumental in many small stocks’ rise during the past year’s frenzy. The SEC is also deliberating whether proposed Internet stock exchanges will fall under its regulatory jurisdiction, just as other regulators are eyeing proposed commodities and currency exchanges. A further layer of complexity and opportunity for electronic crime springs from the development of Internet-based payment systems. None of the Internet crimes thus far investigated has involved exchanges of money via cyberspace. However, once secure methods of transferring money are widely accepted which could be much sooner than many observers predict a whole host of other issues will arise, from monetary control and federal insurance to tax avoidance, counterfeiting and money-laundering. Directed by the Group of 10 industrial countries, the Bank for International Settlements in Basle is beginning to analyze the subject. So far European and US regulators have taken diametrically opposed positions. The Europeans, as outlined in a recent report from the European Monetary Institute (the institution developing the European central bank), are proposing that regulated banks should be the only entities authorized to conduct financial business over the Internet or through prepaid smart cards, which contain a microchip that stores value and are planning to use the Internet for their transactions. The EMI proposal has been adopted as policy by the German finance ministry. Beyond national control So far, most US regulators and law enforcement officials have concluded that such tight regulation is unnecessary and perhaps not even practicable. “What the Germans are doing is probably irrelevant,” says Stanley Morris, director of the Financial Crimes Enforcement Network (FinCEN), a division of the US Treasury that administers the US money-laundering statute. “They can order that,” Morris says, but any German citizen “can do his banking [online] in Antigua, thank you very much.” Few in the field expected the explosive growth in web usage that has already occurred. In the US, where Internet penetration has gone furthest, some 37 million people are estimated to have access to the World Wide Web, according to Nielson Media Research, a consumer survey organization. The SEC reports that online investment services have about 800,000 to 900,000 accounts; 20% of discount broker Charles Schwab’s accounts are online. Global Internet usage is expected to grow from 100 million to 500 million users by 2000. “Developments are taking place very rapidly,” says Martin Hollobone, an executive dealing with enforcement and legal issues at the UK’s Securities & Investments Board (SIB). He is also involved with the International Organization of Securities Commissions (Iosco) groups that are tackling some of the secondary-market and enforcement questions the Internet poses. Hollobone says that a year ago finance on the Internet was not a significant issue for UK regulators because they saw use of the Internet as a little eccentric. But now major UK retail banks such as Barclays are “close to doing money transactions” on the Internet. “Once you start seeing financial transactions taking place, linked with its international nature, the prospect of people’s money disappearing into cyberspace becomes a significant concern.” Hollobone believes regulators will get more concerned than they already are once big institutions start doing transactions over the Internet. One regulator who is trying to get on top of the issue is Mary Schapiro, president of the US National Association of Securities Dealers’ (NASD) new regulatory unit. Schapiro began looking into potential Internet fraud when she was chairman of the US Commodities and Futures Trading Commission a year ago. Shapiro is convinced more enforcement and regulation has to be undertaken and has pushed the NASD to the forefront. The NASD suspended trading in one OTC stock, Comparator, earlier this year when it noted that dramatic price and volume activity was preceded by a flurry of Internet advocacy and discussion of the stock. Similar activity occurred in half a dozen other stocks still under investigation. Even so, Shapiro says: “It’s impracticable that regulators are in a position to be monitoring or surveilling the entire Internet or to bring enough meaningful cases to make a difference.” Like her counterparts at the SEC and elsewhere, she believes education of Internet users is crucial. “The Internet is a terrific tool for getting information but users need to understand that people can be sharing information for wholly their own purposes … It can be a very cost-effective way to disseminate fraudulent information.” “You don’t know the credibility of the source,” adds the SEC’s Stark. “You might have an idea who the person is, but you don’t know if it’s a short seller, a promoter, a broker or an analyst. He might not be disinterested and you have no way of knowing other than from his own disclosure.” Insiders could be touting stocks they want to dump, says Schapiro, noting that the anonymity of the web means that potential investors have no way of verifying the quality of the advice given by many online stock promoters, or even if they are who they claim to be. Even if an individual knows who the user is, cautions Stark: “You can’t be sure when reading the posting that it isn’t someone who used a package sniffer, or a stolen user name.” If an individual is using an alias, NASD doesn’t have authority to find out who is behind the activity. Such cases would be turned over to the SEC, whose powers to subpoena could extract information from Internet access suppliers such as America Online or CompuServe. Since the NASD is a self-regulatory body that covers brokerage firms and their employees, Schapiro is trying to get the firms to agree to mail a new NASD brochure to all their accounts with warnings about the Internet. “We’re trying to walk people through in a catchy way to the possibilities and pitfalls of using the Internet as an investment tool.” Ten brokerage firms have already signed up for this initiative. The warning is also now being displayed on the American Association of Individual Investors’ web site, and on the Motley Fool, a popular stock investment service provided by America Online, which is reputed to have a great influence on OTC stocks. Motley Fool clearly wants to keep its reputation clean. “Everyone will see the warning as soon as they sign on,” Shapiro says. The SEC’s home page on the web, set up this summer, links users to a detailed educational page entitled “Investment fraud and abuse travel to cyberspace”. It cautions investors to be on the alert for offers peppered with such words as “guarantee”, “high return”, or “risk-free”. And it suggests: “Watch out for offshore scams and investment opportunities in other countries. When you send your money abroad, and something goes wrong, it’s more difficult to find out what happened and to locate your money.” A web site run by a group of US agencies, called the National Fraud Center, has links to home pages for other US government agencies such as the Federal Bureau of Investigation (FBI) and the FTC, and international ones run by Argentina’s justice ministry, the Australian attorney general’s office, Canada’s justice department and the Royal Canadian Mounted Police, and the justice ministries in Peru, Singapore and Sweden. In the UK, the SIB hopes to have a web page by the year-end. The Internet has become a high priority for the SEC’s enforcement unit, which has a team stalking the Internet to sniff out fraud. Like any other user, the agency is tapping into the benefits of fast and cheap technology. Its home page also enables prospective investors to email it tips about potential frauds. “The response has been unbelievable,” says Stark, who notes that after being online for only a month and a half, the SEC was receiving 30 to 40 complaints a day via its new web site. He has also been impressed by the “detail and sophistication” of the messages. “People start their own investigations. If they have received a spam (the Internet equivalent of a cold call), they will do an analysis of the header to figure out where it came from. Some complaints even list the securities violations and do a legal analysis.” The self-policing seems to be part of what Stark calls the “culture of benevolence on the net”. Web surfers and users of email-based news groups are accustomed to posting questions about virtually everything from aardvarks to zymurgy and getting responses from knowledgeable and friendly sources. And although such a culture of cooperation may have induced a naive trust in the accuracy of information among some users, it can also prompt positive attempts to stamp out misuse from those who feel the Internet is being used nefariously. International cooperation As well as promoting education of Internet users and seeking their assistance in tracking down and limiting cyberfraud, regulators are trying to foster international cooperation. Securities fraudsters already work cross-border, but the Internet makes that easier. Internet criminals can disguise who and where they are and may also be able to exploit nuances regulators haven’t even considered. “Jurisdiction is a big issue,” says the SIB’s Hollobone. Iosco has just set up two working groups, one on secondary markets and another on enforcement and the exchange of information. But as the SEC’s international chief Paul Leder notes: “It’s hard to reach an international consensus until you see where people want to be domestically.” As far as the SEC is concerned, undecided questions include whether Internet exchanges should be regulated, and whether brokers and issuers trading on the Internet should be registered with the SEC. Hollobone says the SIB already has memoranda of understanding with, for example, the SEC, to try to coordinate action. “We’re working on ensuring that they work as well on the problems raised by the Internet as they do in other areas.” He says the SIB is “trying to ensure that people using the Internet do not take advantage of any potential loopholes in our regulations.” Because the UK’s Financial Services Act was not worded with the Internet in mind, he explains, there is inevitably some opportunity for “people to carry on unauthorized activities on the Internet and not get caught.” The SEC, he notes, has already issued interpretative releases about the application of its rules and regulations. The UK’s approach is to make sure electronic information follows the same rules as printed matter. A number of Internet exchanges are being developed, including currency-trading services offered by London’s Currency Management Corp, and 1st Money Garden in New York. Whether or not these are ultimately regulated, Hollobone believes they will not succeed unless there is a minimum of certainty in a number of areas. “Someone could try and do it without the necessary clearing facilities, but people dealing with them will want certainty of execution in their contracts. They will want to be certain of the legal standing, they’ll want to know the jurisdiction in which it is operating, the insolvency legislation it falls under and what legal redress exists.” Essentially, he continues, investors will want to know: “What happens if a counterparty goes down? Who settles the contract? Whose bankruptcy laws apply? Can you protect them?” A perception that electronic money transactions are secure is the first and critical step to unlocking the potential of the Internet for a broader range of financial transactions. But it also opens the way to much more crime. Industry lawyers and even some government officials point out that there are good reasons why powerful encryption systems have been developed relatively slowly. Above all it’s because such systems not only keep information secure from hackers but can also prevent detection of fraud by law enforcement departments. In the US, such agencies as the FBI and the Justice Department have been so worried about terrorists and participants in organized crime using the web to communicate internationally undetected that they’ve declined to give approval to export licences for strong encryption software. “The government has purposely slowed down [encryption software] development,” says Internet law specialist Charles Merrill of McCarter and English, a New Jersey law firm. Legislation introduced in Congress to force the government to get rid of these exports controls has prompted the US administration to propose some relaxation, but industry attorneys say it hasn’t gone far enough. For example, Netscape has received permission for 128-bit encryption to be included in the next version of its popular web-browser software, though weaker versions will be distributed outside the US. By contrast, Russian encryption software uses 280 bits. The more bits, the more difficult it is for both hackers and government officials to penetrate an encoded communication. Today many online financial services rely on a direct modem link between a user and, say, a bank. Internet transactions, by contrast, are on an open system. Because it is difficult to make this secure, most Internet financial business today is solicitation, information and advertising. “People aren’t using the Internet to transfer money unless they’re nuts,” says Merrill. Encryption in such software as Netscape, he says, “is not really secure from the standpoint of telling who can log in.” Without such security, he asserts, it’s impossible to make binding legal contracts, the key to the expansion of Internet financial business. What has been lacking, Merrill explains, has been the ability to authenticate the user’s identity via an impenetrable digital signature. Recently, though, Visa announced an alliance with VeriSign, a software company that has developed such signatures, and MasterCard has agreed a similar deal with another software provider. The paradox of security Digital signature technology is being tested in various smart-card systems, the UK’s Mondex, Cybercash in the US and DigiCash in the Netherlands. All such cards move money from a bank account to a card that can then be used in place of cash. But the confidentiality required throws up what the money-laundering cops at FinCEN call the “paradox of security”. Once the money leaves the banking system it has to become anonymous in order to be secure enough for transmission over the Internet. “Any highly efficient anonymous payment system operating outside of the banks is going to be attractive to organized crime,” says FinCEN’s Morris. To combat money-laundering, for example, the US government has required banks to file reports and maintain paper trails. This and the “know your customer” rule that banks are now supposed to follow could become meaningless even if such transactions were done through them. And encoded communication on the Internet could render traditional phone-tapping techniques redundant. FinCEN is just one of the US treasury agencies that has been reviewing the topic over the past year. That’s because treasury secretary Robert Rubin has singled out the Internet as an area of top concern, and recently announced the formation of a task force to look at the issues raised by electronic money. Various bank regulators will be involved in the effort, which will address the extent to which currency regulations and laws cover electronic money, and try to propose “innovative and non-regulatory” methods of plugging any loopholes. Morris has concluded that government is ill-equipped to deal with this fast-developing technology, which can lead to software packages changing every three months. So FinCEN is trying to work with the industry. “We know you’re not going to tell us all your trade secrets,” Morris has told encryption experts. But to avoid the government coming in with draconian measures after major investments have been made, he suggested instead, “Tell us where you’re headed and let us examine the ways in which the good guys win and the bad guys don’t.” Besides the opportunities encryption offers for money laundering, central bankers have identified other concerns about money swirling through the Internet unregulated, notably the fact that electronic transactions broaden the definition of money. “It is not really a complete flight of fancy to foresee central bank money becoming insignificant in the domestic economy,” says Jerry Jordan, president and chief executive officer of the Federal Reserve Bank of Cleveland, Ohio. “In time the public may find commercially provided electronic money attractive as a replacement for currency.” Creating another form of money call it M8, some joke would complicate monetary policy for central bankers and mean a loss of some of the income that derives from issuing currency. In a speech to a congressional committee last year, former Federal Reserve vice-chairman Alan Blinder raised some relevant questions. “Whose monetary liability is the particular form of electronic money? If an issuer were to become bankrupt or insolvent, what would be the status of the claim represented by a balance on a card or other device? In such a situation, when and how would funds be made available to the holder? Who is responsibility for the clearing and settlement mechanism?” In addition to these structural issues, such unresolved questions as counterfeiting, liability and theft led to the European proposals to restrict the issue of prepaid cards or the offering of financial services via the Internet to regulated banks. A spokesman for the German Finance Ministry says that “immense damage could result if the legislative bodies were to delay until large-scale abuse of electronic funds held in computer networks had occurred”. For instance, she says that “the falsification of electronic units of payment cannot be demonstrated by virtue of physical notes and coins and there are no restrictions on dissemination throughout computer networks. Legislative action must be taken without delay.” Such a heavy-handed approach is not to Americans’ liking. The FBI may be concerned about encryption but technological innovation has been a powerful motor of US development. And the Internet has largely been developed in the US, where market innovation generally takes precedence over regulation. The US Federal Reserve Board has so far adopted a wait-and-see attitude. Blinder’s speech last year concluded that “the uncertainties regarding the future of ‘electronic money’ are so overwhelming that we mainly suggest patience and study rather than regulatory restrictions”. This summer, board member Edward Kelley put it more bluntly in a speech to the Digital Commerce Conference in Washington: “The Federal Reserve has not subscribed to the European view that only banks should issue prepaid cards, or by extension other stored-value payments products.” Currently under legislative debate is whether such cybercash would be subject to regulations currently in place that limit the liability of credit card holders for fraud. Quick, efficient and global One reason the US regulators are reluctant to take the European approach is because they fear that the Internet is such a jurisdictional tangle that current legal and regulatory mechanisms will not be able to cope. The growth and success of largely self-regulated international financial markets makes many theoreticians wary of advocating the regulation of another global medium. Some, like Villanova University law professor Hank Perritt, who is also an attorney for Netscape, argue that the World Wide Web is bringing average consumers the type of quick, efficient and global transactions already available in the wholesale international capital markets. Federal Reserve Bank of Cleveland economist Ed Stephens argues: “If there’s another way to do it and it’s cheaper, that’s the way things are going to go. You can’t expect the supervisory process to be monitoring the whole world to make sure everything going right.” Some US regulators expect and hope that many Internet schemes will seek the seal of approval that regulation offers, without it being mandatory. A case in point is Security First Network Bank, which claims to be the first US federally regulated bank on the Internet. SFNB sought Fed approval to go online and Federal Deposit Insurance Corporation insurance for deposits, meeting all the necessary capital and reserve requirements to do so. After reviewing SFNB’s encryption software, which it hopes to market to other financial institutions, the Fed cautioned that the security measures the bank had developed did not provide “absolute protection”. But, it added, “the nature of these risks is not different from those to which more traditional banking operations are exposed in other forms.” Consumers apparently agree. SFNB previously a sleepy savings and loan based in Pineville, Kentucky, and part of the Cardinal Bankshares Holding Group until it was spun off in an IPO this spring went online last fall. By the end of March it had garnered $6.2 million in deposits over the Internet. In the US at least, where the federal courts recently ruled that Internet communication was protected by the First Amendment’s guarantee of free speech, Big Brother-type fears of interference in the right to communicate have taken precedence over pre-emptive regulation. For the stronger encryption software the financial world is clamouring for can indeed work both ways. “The same technology that [allows] you to operate in total secrecy also permits the government to collect every bit of information about you,” says FinCEN’s Morris. “We could mandate that a record be kept of every transaction, and that it be downloaded every week.” But, he says, “we’re not going to do that.” On the other hand, he says, the US Treasury, whose Comptroller of the Currency regulates banks with the Fed, doesn’t want to see “infinite amounts of money outside the financial institutions”. What is needed is a whole new way of looking at the Internet, argues David Johnson, who heads Counsel Connect, a group of lawyers who focus on Internet-related issues. “Current legal structures are tied very closely to geographic territorial jurisdictions, but now we have a phenomenon that isn’t tied to that. We have to look at the possibility of creating a new kind of legal order that more closely fits to the new environment.” Self-regulation may be the only real solution, Johnson argues. “The limitations faced by national governments … don’t mean that the net can’t or won’t develop some basic ground rules of its own. It is important for the growth of electronic commerce that there be some effective constraints on fraud. “If not, he suggests, “people just won’t go there.” That may be little consolation to the thousands who lost money on the Fortuna pyramid. The FTC’s Harwood says most of the complaints he has received from Fortuna investors were directed at the agency, which they begged to back off so that they could recoup their investments as the scheme progressed. But according to FTC economist Peter Vander Nat, who analyzed the formula being used to promise huge returns, millions of newcomers would have had to buy into Fortuna’s plan in order to pay off those who had already invested. It appears, though, that the FTC’s message has hit home. As of the end of September, Fortuna’s surviving web pages have received a little under 1,200 hits. How many of the curious have done more than read the page is not known. * |
