Identity theft is among the most reputationally and financially damaging of all technology crimes. However, global understanding of identity theft is hampered by a lack of empirical research and a complex threat landscape. This paper reports on a four-stage project to improve identity theft outcomes for current and future victims, sponsored by a research grant from the Australian Communications Consumer Action Network (ACCAN). We first analysed 4,000 Australian cases of identity theft in order to understand the processes behind identity theft attacks, victim reporting trends, and opportunities for improving victim and investigation outcomes. Two opportunities for intervention were identified. The first related to understanding long-term victim recovery, and the informational and support mechanisms that improved victim welfare. The second related to developing improved data and threat sharing between telecommunications carriers and banks. From this analysis, we designed and implemented two interventions to improve identity theft outcomes: one at the individual level to improve identity theft recovery, and the second at the organizational level to promote threat sharing. This paper reports on the initial outcomes of implementing these interventions.

Victim-enabled identity theft is a crime in which an individual victim is deceived into providing their personally identifying information (PII) to a criminal to facilitate its theft and/or misuse. In this paper we analyse a particular victim- enabled tax-related identity theft scheme recently reported in Australia, which has also been reported, in a slightly different guise, in the US. We find that this scheme, and others like it, are best understood when studied from both the perpetrator's and the victim's points of view. The criminal perspective and business practices have been captured and analysed in the Identity Threat Assessment and Prediction (ITAP) model developed by the Center for Identity at The University of Texas (UT CID). The victim perspective has been captured from multiple victim case files captured by IDCARE. The research findings support the view that combining perspectives enhances the analytical value of a threat assessment and prediction model. The multi-actor nature of victim-enabled identity theft complements the methodological approach adopted in the paper, and provides new insights on a growing form of identity theft that can inform future prevention and detection response strategies.

Purpose The purpose of this paper is to examine why mainstream information security awareness techniques have failed to evolve at the same rate as automated technical security controls and to suggest improvements based on psychology and safety science. Design/methodology/approach The concepts of bounded rationality, mental models and the extended parallel processing model are examined in an information security context. Findings There is a lack of formal methodologies in information security awareness for systematically identifying audience communication requirements. Problems with human behaviour in an information security context are assumed to be caused by a lack of facts available to the audience. Awareness, therefore, is largely treated as the broadcast of facts to an audience in the hope that behaviour improves. There is a tendency for technical experts in the field of information security to tell people what they think they ought to know (and may in fact already know). This “technocratic” view of risk communication is fundamentally flawed and has been strongly criticised by experts in safety risk communications as ineffective and inefficient. Practical implications The paper shows how the approach to information security awareness can be improved using knowledge from the safety field. Originality/value The paper demonstrates how advanced concepts from safety science can be used to improve information security risk communications.

Purpose The purpose of this paper is to examine the practical issues, techniques and learning points associated with information security awareness and organizational change programmes. Design/methodology/approach The paper is based on the findings and conclusions of research, observations and projects carried out in large organizations over the last two decades. It highlights failings and critical success factors in contemporary approaches to transform organizational culture. It draws on theory and research from the industrial safety field, and discusses its relevance in the information security field. Findings The paper identifies the primary reasons why many contemporary enterprise security awareness programmes are ineffective. It discusses the nature of the problem and solution space, identifying the practical issues and opportunities, and gives recommendations on how future programmes can be improved. Research limitations/implications The paper identifies gaps in current research, including the need to confirm whether or not certain findings about incidents in safety field might be applicable to security incidents. It calls for a new approach to information security management that incorporates theory and techniques drawn from psychology and marketing. Practical implications The paper is intended to educate students and researchers working in the information security field on issues and techniques associated with information security awareness and organizational change programmes. It also provides practical advice for business organizations on how to design and implement such programmes. Originality/value The paper takes a fresh approach to the subject, examining the relevance of theory and techniques adapted from other fields and drawing new conclusions about the requirements and approach for effective information security awareness and organizational change programmes.

This article describes an approach to program optimization based on transformations, where temporal logic is used to specify side conditions, and strategies are created which expand the repertoire of transformations and provide a suitable level of abstraction. We demonstrate the power of this approach by developing a set of optimizations using our transformation language and showing how the transformations can be converted into a form which makes it easier to apply them, while maintaining trust in the resulting optimizing steps. The approach is illustrated through a transformational case study where we apply several optimizations to a small program.

Many classical compiler optimizations can be elegantly expressed using rewrite rules of form: I ⇒ I ′ if φ , where I , I ′ are intermediate language instructions and φ is a property expressed in a temporal logic suitable for describing program data flow. Its reading: If the current program π contains an instruction of form I at some control point p , and if flow condition φ is satisfied at p , then replace I by I ′.The purpose of this paper is to show how such transformations may be proven correct. Our methodology is illustrated by three familiar optimizations, dead code elimination, constant folding and code motion. The meaning of correctness is that for any program π, if Rewrite (π, π′, p , I ⇒ I ′ if φ) then [[π]] = [[π′]], i.e. π and π′ have exactly the same semantics.