Corporate hacks go unreported

The reporting of hacking attacks must become the norm if cyber crime is to be tackled, according to a US Department of Justice computer crime boss.

David Green, principal deputy chief of the Department's computer crime division, warned that not enough companies are coming forward and admitting to being hacked.

"We still find that companies which wouldn't hesitate to report it if their corporate headquarters was broken into, consider that there is a shame factor with computer break-ins; as if they are at fault. So they don't want to report it," he explained.

Speaking to delegates at the Microsoft Government Leaders' Conference in Seattle, Green said: "Part of the problem is that it is a self-perpetuating cycle: law enforcement [agencies] don't find out about attacks and when they do [it's too late] and they can't trace it back.

"We have to make the reporting of these attacks the norm. We need corporate co-operation to report these sorts of vulnerabilities to law enforcement [agencies] in order that they are able to deal with it."

Many companies are reluctant to report crime for fear of damage to their reputation, said Howard Schmidt, vice chairman of President George Bush's critical infrastructure protection board.

He is championing an exemption to the US Freedom of Information Act so that companies which report hacking attacks could be allowed to remain anonymous.

"The private sector wants to be able to report attacks without the fear that it will affect their stock price or ability to innovate," he said.

But Detlef Eckert, head of analysis and policy planning at the European Commission's Information Society Directorate, said that any reporting structure will fail without industry support.

"In Europe we don't have enough information about the problems for industry. One of our targets is to improve that with a set of trusted relationships between the member states and the private sector," he explained.

"There needs to be a trusted network in which the private sector gets a say. It can't just be a government sponsored thing. It must be a public and private partnership, not just about law enforcement."