News from Prague, just weeks ahead of the Payment Card Industry (PCI) meetings there, reveals new levels of sophistication in ATM fraud. The Prague Monitor reports a foreign gang is thought to be behind the attacks.

The principle by which the gang withdraws money from the accounts resembles a mobile telephone – the gang is capable of producing a copy of the card within minutes after the user inserted it and entered his PIN.

They then can withdraw the money in other countries, for instance, in Bulgaria, Poland or Slovakia.

There are two key attributes to the attack. The first is that the attackers are following the same customer behavior as the banks. They are only attacking on Saturday nights at locations highly likely to see cash withdrawals because of security marketing.

“So far, they have selected exclusively ATMs placed near the banks – either inside of them or directly outside. These ATMs seem more reliable and safe to users because most of them are monitored by cameras,” [police officer Michal] Ihnat said.

They seem safe, but in fact they are lying in wait. An obvious countermeasure here is for customers to alter their behavior and remove cash during the daytime on a weekday. Alternatively the banks could shutdown ATMs at high-risk times. This goes to a simple common sense principle — the higher the convenience of an ATM the lower the ability to protect it.

The second attribute is a wireless and hit-and-run, allowing attackers to keep on the move. The attackers do not return to the ATM to collect data as their compromise is able to broadcast the cardholder information. A detective defense against this could be wireless monitoring to detect when an ATM is compromised, although picking out rogue signals has several problems. Downtown Prague is littered with frequently changing wireless signals and the attackers could easily encrypt and obfuscate their traffic. Another more practical solution would be to keep ATMs within a cage that blocked wireless communication. This cage is more complicated than it sounds, as signals can easily leak, but it would defeat the attack most directly. It also would be an expensive change to the open-air ATM systems.

This is an attack on authentication, which Bruce Schneier likes to discuss. Bruce’s theory of securing the transaction instead of the authentication brings forward another solution: send out-of-band confirmations for ATM withdrawals. A cell-phone call or text to confirm a the amount would defeat these attackers. Again, however, it would be complicated to implement and place a significant obstacle to convenience.

A well-written Op-Ed in the NYTimes asks tough questions of security management in America:

In 2006, Nikki White died at age 32. “Nikki didn’t die from lupus,” her doctor, Amylyn Crawford, told Mr. Reid. “Nikki died from complications of the failing American health care system.”

“She fell through the cracks,” Nikki’s mother, Gail Deal, told me grimly. “When you bury a child, it’s the worst thing in the world. You never recover.”

We now have a chance to reform this cruel and capricious system. If we let that chance slip away, there will be another Nikki dying every half-hour.

That’s how often someone dies in America because of a lack of insurance, according to a study by a branch of the National Academy of Sciences. Over a year, that amounts to 18,000 American deaths.

After Al Qaeda killed nearly 3,000 Americans, eight years ago on Friday, we went to war and spent hundreds of billions of dollars ensuring that this would not happen again. Yet every two months, that many people die because of our failure to provide universal insurance — and yet many members of Congress want us to do nothing?

The difference in risk calculations has a lot to do with how we respond to things we perceive as under our control. In other words we fear most those things that we think will threaten our control, such as terrorism. Health issues, on the other hand, often are thought of in controlled terms and choices that we will be able to make — things to be treated or avoided through detection and prevention.

Will you get lupus? Check the data, consult with a professional…
Will you be a victim of a terrorist attack? Your imagination is the limit.

This is compounded by the timing of terrorism versus a disease. Nikki White died many years after first diagnosis. Her story is tragic and sad but it also gives a slightly different worry to most people than the sudden impact of something like a bomb in a crowded building. Fear of sudden death or harm is likely to be treated as a high priority compared with disease and health issues that manifest over time.

Another factor is due to communication and imagery. Burning buildings were broadcast across all media and Al Qaeda quickly became a name recognized in most households. However it is extremely rare to find a single compelling image in American news that can convey something like the 18,000 deaths mentioned above from lack of insurance.

Thus, it seems to me the story does an excellent job of conveying a lack of control, urgency, and shocking imagery of health care issues in America. Unfortunately I suspect the writing still pales in comparison to the hype and fear of terrorism. That is my guess why many members of Congress who would spend billions on a vague threat of terrorism now fail to support health-care reform that could save more lives.