Centry Quick Check Program for Corporate Due Diligence

New technology has revolutionized corporate investigations and changed the way we go about them. There’s greater efficiency, new insights, and broader reach. However, the downside is that this technology can lull both investigators and clients into a false sense of security.

Computers can provide us with information, but people are still better at evaluating data within context, such as identifying how useful the information is and what it is relevant to. In short, technology can’t yet replicate human analysis – and yet we continue to see a growing dependence upon it for exactly that.

The Value of Professional Investigators in Corporate Due Diligence

In countries where there are robust public records, this dependence on automated scanning and investigative tech is particularly evident. Although investors and corporations still recognize the value of actual investigators in challenging regions across the globe where the public records may not be so accessible or accurate, when it comes to investing in due diligence insidethe US and Canada for example, companies are increasingly drawn by the promise of these low-level automated scans.

However, it’s important to consider that these types of surface level scans will not and cannot encompass a breadth of understanding of an investigated subject. Software driven data harvests conducted without the analytical power of the human mind could expose businesses to risks they may be unaware of, including things like reputational risk, fraud, money laundering, and more.

Most of these automated scans lack coverage on the target in media, whether that’s on social platforms or journalistic content. This surface level research cannot hope to provide a clear and accurate picture of a subject, and it certainly would not appease judicial officials if something were to go wrong.

For example, single-location local records checks cannot account for whether a person has moved cities. It would also not pick up any information about whether or not the subject faced allegations of criminal activity, which is something that can be identified through doing a media assessment. Furthermore, media research can also illustrate any extreme political views or subjects that an investor or company might not want to be associated with.

The professional experience of a professional who has done hundreds, if not thousands of due diligence investigations is something that is highly valuable. They are more likely to be able to provide context around findings that may initially seem adverse, such as whether or not a particular practice is typical for a particular industry or they might pick up contextual clues that could uncover a previously overlooked detail.

Companies seeking to save a dime by purchasing an automated scan with no human inference could be unknowingly setting themselves up for a huge risk in the future.

Our Answer: Investigator Driven Quick Checks for Individuals and Companies

Propelled by increased regulatory concerns among corporate entities and a more competitive environment amid the offers of automated checks, Centry Global has formulated an answer to the question of how to marry meaningful analysis to efficiency in due diligence investigations with our Quick Check (QC) program.

What to Expect from a Centry QC

The QC program combines an identity review, sanctions screening, compliance check, and media research into a single, well-organized background check package on either individuals or companies with a turnaround time of 5-7 business days.

Quick Check of a Company

• Identity Review
  • Key financial figures
  • Risk Level
  • Beneficial Owners and Senior Management
• Compliance Review
  • Sanctions and Watchlists Screening
• Social/Adverse Media Review
• Analysis and/or Recommendations

Quick Check of an Individual

• Identity Review
  • Shareholdings and Directorships
• Compliance Review
  • Sanctions and Watchlists Screening
  • Politically Exposed Persons Screening
  • Litigations Check
• Social/Adverse Media Review
• Analysis and/or Recommendations

For more information on these Quick Checks, please feel free to contact us at info@centry.global or on our LinkedIn, Facebook and Twitter pages!

Tactical Catfishing

Most of us think of ‘catfishing’ in the context of someone using a fake profile, usually on some dating app, to trick unsuspecting people. Maybe they do it for manipulation and blackmailing purposes, or to scam people out of money.

Now, however, a social engineering drill conducted by the NATO Strategic Communications Centre of Exellence (NATO StratCom COE) has shown us that these catfishing tactics can be used on soldiers to glean sensitive information about things like battalion locations, troop movements, and other personal intel.

The operation used the catfishing technique to set up fake social media pages and accounts on Facebook and Instagram with the intent of fooling military personnel. This clandestine operation, designed to take place over the course of a month, was arranged by a “red team” based out of NATO’s StratCom Center of Excellence in Latvia.

The falsified Facebook pages were designed to look like pages that service members use to connect with each other – one seemed to be geared toward a large scale military exercise in Europe and a number of the group members were accounts that appeared to be real service members.

The truth was, however, these were fake accounts created by StratCom researchers to test how deeply they could influence the soldiers’ real world actions through social engineering. Using Facebook advertising to recruit members to these pages, the research group was able to permeate the ranks of NATO soldiers, using fake profiles to befriend and manipulate the soldiers into providing sensitive information about military operations and their personal lives.

The point of the exercise was to answer three questions:

1. What kind of information can be found out about a military exercise just from open source data?
2. What can be found out about the soldiers just from open source data?
3. Can any of this data be used to influence the soldiers against their given orders?

Open source data relates to any information that can be found in public avenues such as social media platforms, dating profiles, public government data and more.

The researchers found that you can, indeed, find out a lot of information from open source data – and yes, the information can be used to influence members of the armed forces. The experiment emphasizes just how much personal information is ‘open season’ online, especially as our lives are increasingly impacted by our digital footprints.

Perhaps even more troubling is the fact that even those of us who are the best positioned to resist such tactics still managed to fall for them, illustrating just how easy it is for the average person with no experience with digital privacy.

Many of the details about how exactly the operation was conducted remain classified, such as precisely where it took place and who was impacted. The research group that ran the drill did so with the approval of the military, but obviously service members were not aware of what was happening.

The researchers obtained a wide range of  information from the soldiers, including things like the locations of battalions, troop movements, photographs of equipment, personal contact information, and even sensitive details about personal lives that could be used for blackmail – such as the presence of married individuals on dating sites.

Instagram in particular was found to be useful for identifying personal information related to the soldiers, while Facebook’s suggested friends feature was key in recruiting members to the fake pages.

Representatives of the NATO StratCom COE stated that the decision to launch the exercise was made in the wake of the Cambridge Analytica scandal and Mark Zuckerberg’s appearance before U.S. Congress last year.

A quote from the report says:

“Overall, we identified a significant number of people taking part in the exercise and managed to identify all members of certain units, pinpoint the exact locations of several battalions, gain knowledge of troop movements to and from exercises, and discover the dates of active phases of the exercises.

“The level of personal information we found was very detailed and enabled us to instill undesirable behaviour during the exercise.”

Military personnel are often the target of scams like catfishing. Recently, a massive blackmailing scheme that affected more than 440 service members was uncovered in South Carolina, where a group of inmates had allegedly used fake personas on online dating services to manipulate the service members. This just goes to show that it’s not just finances at risk through catfishing, but security overall.

Facebook has taken a decidedly firm stance against the proliferation of fake pages and accounts designed to manipulate the public. The company prohibits what it calls “coordinated inauthentic behavior”, and has bolstered its safety and security team over the past year in an effort to combat phishing and other types of social scams.

But after the success of StratCom’s endeavor, it seems that Facebook’s efforts to crack down on this aren’t completely successful. Of the fake pages created, one was shut down within hours, while the others took weeks to be addressed after being reported. Some of the fake profiles still remain.

One thing to keep in mind is just how small-scale this experiment was in relation to the massive yield of information. Three fake pages and five profiles were all it took to identify more than 150 soldiers and obtain all of that sensitive information. This is tiny in comparison to the coordinated efforts of bad actors that utilize hundreds of accounts, profiles, and pages. One can imagine just how much data could be obtained through those schemes.

As a result of the study, the researchers suggested some changes Facebook could make to help prevent malign operations of a similar nature. For example, if the company established tighter controls over the Suggested Friends tool, it would not be quite as easy to identify members of a given group.

Digital privacy is especially important – the picture we present of ourselves across different social media platforms can help people build a clear idea of who we are, which could, consequently, be used against us in terms of manipulation tactics and social engineering.

The use of social media to gather mission sensitive information is going to be a significant challenge for the foreseeable future. The researchers suggest that we ought to put more pressure on social media to address vulnerabilities like these that could be used in broad strokes against national security or individuals directly.

Centry Global has a service for identity verification of online profiles. If you suspect you may be at risk for being manipulated, contact us at www.datecheckonline.com!

This article was written by Kristina Weber, Content Manager of Centry Global. For more content like this, be sure to follow us on Twitter @CentryGlobal and subscribe to Centry Blog for bi-weekly updates.

At the Cost of Life: The Counterfeit Pharmaceuticals Industry

Out of all the fraudulent goods that circulate the world amongst their legitimate counterparts, the counterfeit pharmaceuticals market is one of the largest sectors. Counterfeit pharmaceuticals is a booming business, with multiple sources pointing between an estimated $200-$300 billion dollar revenue. Worse, the stakes behind counterfeiting pharmaceuticals are higher than fake handbags – people around the world depend on medication for their livelihood.

The World Health Organization has a broad definition of what constitutes a counterfeit drug – any drug that has been deliberately or fraudulently mislabeled with respect to identity or source. The term ‘counterfeit pharmaceuticals’ is an umbrella that encompasses everything from changing things like date of expiration on packaging to altering the raw materials to removing the active ingredients from the medication.

Counterfeit medications make up roughly 10% of pharmaceuticals on a global scale, but it’s important to note that this isn’t an even spread throughout each country in the world. Developing countries face fraudulent pharmaceuticals on a wider scale than you might find in first world countries that have more regulations.

But even in those areas there are plenty of opportunities for criminals to take advantage of the system. Counterfeit pharma is an attractive industry to criminals – especially those with organized crime connections – as it can generate enough revenue to rival trafficking things like heroin. This is because they can charge near market prices for big ticket medicines like cancer treatments and insulin, which makes it easier to mass produce knockoffs for a substantial profit.

All drugs must undergo clinical trials to test their efficiency, quality, and potential side effects before they can be marketed to the public. These measures function as a safety valve to protect consumers. However, these regulations are not observed by the manufacturers of counterfeit products. Instead, they use substandard products, leave out active ingredients, or otherwise tamper with the components. The end result can range from ineffective treatment to severe health problems or death.

The way pharmaceuticals move through the supply chain can leave them vulnerable. There’s typically three major phases of it – manufacturing, distributing, and retailers.

Usually the chemical compounds that compose the active ingredients of a drug are manufactured in places like China or India due to the relatively low cost of raw materials in those regions. Indeed, India itself is home to more than fifteen thousand illicit drug factories, which are estimated to supply approximately 75% of the world’s counterfeit drugs. Continuing the manufacturing process, those chemical compounds are made into their respective forms – whether that’s capsules, injections, creams, etc. – either in the country of origin or in USA/Europe.

The drugs are then shipped in large quantities to packing facilities, where they are prepared for the distribution phase. This part is particularly vulnerable, as this is an area where criminals can deposit convincing fakes to be combined with the legitimate drugs.   

That said, counterfeiting can occur outside the distribution chain as well because of internet and mail order markets, street vendors, etc. This is especially common in areas where medicine can be hard to acquire – counterfeit pharmaceuticals are a big problem in the developing world. Some pharmacists in these developing regions are compelled to buy from the cheapest – but not necessarily the safest – suppliers in order to compete with the street market.

Things such as lotions, creams, and oils are often counterfeited as they are relatively easy to make and then sold by illegitimate suppliers. Production of these goods is generally less regulated than pills or injections because knockoff ointments are most likely going to be less potentially damaging than their oral counterparts. That said, there were a significant portion of counterfeit injectables found amongst the legitimate pharmaceutical supply chain, which tend to cost more and can have deadly effects. Overall, though, anything that is profitable is at risk to be counterfeited – things that range from treatments for AIDS to Cancer to Diabetes to antibiotics and more. Theoretically, every patient is at risk – thus counterfeit pharmaceuticals are a problem that should concern everyone.

The human toll is enormous, as a study by the World Health Organization calculated that up to 72,000 deaths from childhood pneumonia could have been attributed to the use of antibiotics that had reduced activity, and that number climbs to 169,000 if the drugs had no active ingredients at all. These low quality drugs also add to the danger of antibiotic resistance, which threatens to undermine the power of these life-saving medicines in the future.

Three international security organizations including Interpol, the Institute of Security Studies, and the Global Initiative against Transnational Organized Crime have called for an overhaul of the regulatory, enforcement, and education systems for medical supply chains in Africa specifically. This is in order to reduce the spread of counterfeit pharmaceuticals across the continent. The three organizations commissioned a study called “The rise of counterfeit pharmaceuticals in Africa” under a bigger project funded by the European Union that is dedicated to Enhancing Africa’s Response to Transnational Organized Crime (ENACT). Findings from the study suggested that counterfeit pharmaceuticals accounted for nearly 30% of drugs on the market in Africa.

In order to address the proliferation of fraudulent pharmaceuticals, anti-counterfeiting measures have been rising up around the world. For example the U.S. Drug Supply Chain Security Act requires pharmaceutical companies to add serial numbers to all packages over the next few years, which should help in tracking the movement of the medications through the supply chain. Several non-profits have been founded to combat the issue as well.  Overall, however, finding a solution to this issue is going to be something that requires sustained commitment not only on a national level but on an international plane between health organizations, law enforcement, healthcare stakeholders, and the pharmaceutical industry as a whole.

This article was written by Kristina Weber of Centry Global. For more content like this, subscribe to our blog for bi-weekly articles related to the security industry and follow us on Twitter with our new handle @CentryGlobal!

Security Predictions for 2019

The predictions for 2018 that we shared last year seemed to land on the points of data protection and cyber security, while it strayed from others – most notably on the front of cryptocurrencies. BitCoin was a hot topic in 2017, surging to values that had people everywhere kicking themselves for not investing sooner. What unfolded after was an epidemic of articles predicting a global acceptance of cryptocurrencies. That balloon popped when the cryptocurrency market crashed in early 2018, and it seems that many have quietly reneged their cryptocurrency hype since.

Continuing the tradition, here are a few insights into the forecast for 2019:

Supply Chain Attacks. While these threats can occur in every sector of the economy as it pertains to supply chains, the industries that most commonly experience these attacks include pharmaceuticals, biotechnology, hospitality, entertainment, and media. Manufacturing operations are attractive targets to adversaries, due in part to having such a broad potential surface of attack. With increasing reliance on the supply chain, there is a wealth of information that could be obtained if organizations have not taken appropriate steps to secure themselves. For more information on cyber security in the supply chain, read our article here.

Further development of consumer privacy laws. Last year we saw the launch of the European Union’s GDPR, which marked the first big regulatory move toward protecting consumer information. Soon after, California passed a bill (Consumer Privacy Act of 2018) that seems to be the state’s version of GDPR – it is slated to go into effect at the end of 2019. A draft for a federal privacy bill for the United States may arrive early in 2019 after concerns over a number of privacy breaches.

Continuing adoption of artificial intelligence across wider society. From Alexa to politics, AI will continue to spread across industries and uses. Chinese companies have announced intentions to develop AI processing chips to avoid reliance on US-manufactured Intel and Nvidia. There is rising concern that AI technology could be increasingly used by authoritarian regimes for the purpose of restricting personal freedoms. As AI continues to spread its proverbial wings, we could see a move toward “transparent AI”, that is, an effort to gain consumer trust in the use of AI by being clear in how it uses human data and why. Of course there is always the worry that the rise of AI will create a jobless future for people, however Gartner suggests the opposite, that artificial intelligence will create more jobs than it will eliminate.

Big data breaches will push companies to tighten login security. We might see a concerted effort of the security industry to replace username/passwords altogether, pushing toward an alternative solution as an industry standard. Biometrics – for example facial recognition or fingerprint logins – are certainly on the rise.

Digital skimming will become more prevalent. The trick of card skimming has moved to the digital world, where attackers are going after websites that process payments. The growth of online shopping has made checkout pages attractive targets. British Airways and Ticketmaster were two high profile cases of this. The British Airways case was particularly alarming, as airlines in general have access to a wide breadth of information ranging from birthdates, passport details, payment information and more. Although the airline was able to confirm that no travel data was stolen in the attack, it nonetheless remains as a cautionary tale.

This article was written by Kristina Weber. For more content like this, be sure to subscribe to Centry Blog for bi-weekly articles related to the security industry. Follow us on Twitter @CentryLTD and @CentryCyber!