Blog
What goes boom on the street: The gassing of ATMs!
I am extremely fearful that the greatly dumbed-down 'blow up the ATM' model will appeal to many a would-be bad guy once the old 'steal the ATM card' method no longer works.
April 28, 2015 by Richard Buckle — Founder and CEO, Pyalla Technologies, LLC
Recently, lightning struck a storage tank holding flammable material from a shale fracking operation, and the explosion lit up the sky for miles around. Firefighters resorted to letting the material burn off and for two days a distinct plume of smoke could be seen by everyone living along Colorado's front ranges between Fort Collins and Boulder.
Fireworks like this are an ever-present threat when flammable fluids and gasses are involved; the bigger question for me is why haven't we seen more of them. Industry precautions seem to be preventing such occurrences as the business of fracking has boomed across northern Colorado and regions further north.
It seems that Mother Nature is not alone when it comes to lighting up the evening sky. According to a Jan. 27, article from Bloomberg, aptly titled "BOOM":
No American ATM has ever been robbed with explosive gas. The same was true in Britain — until 2013. Now there have been more than 90.
The scoop here is that thieves are simply bringing with them "crowbars, power tools, coils of flexible tubing, and two large tanks of explosive gas," and boom! The cash is theirs!
In preparation for an upcoming post to this blog I revisited notes I made at the recent BAI Payments Connect conference in Phoenix. When the topic of EMV came up during an interview with Dena Hamilton of BAE Systems, she asked, "Where does the $3 billion in fraud 'migrate to,' as we believe fraud will not be fully eliminated with EMV? Where are the bad guys going to focus next?"
Hamilton said she believed that application fraud would fill the gap in part, if not completely (look for more on this in an upcoming post). However, as I read the Bloomberg article, I came across a couple of interesting observations:
Bank security experts think the first ATM gas attack may have been in Italy in 2001. Early statistics are shaky, but by 2005 there were almost 200 across the continent, according to EAST, or the European ATM Security Team. (Their figures include physical explosives, but gas dominates.) In 2013 there was a 31 percent increase from the year before, to 696 attacks in eight countries. Gas bomb gangs have struck in Australia (2008), Brazil (2010), and Chile (2014), but they're primarily a European phenomenon. The Dutch term for the method is plofkraak, which translates roughly to thud burglary.
Then came the more important wakeup call:
As far as anyone knows, there has never been a gas attack on an American ATM. The leading theory points to the country's primitive ATM cards. Along with Mongolia, Papua New Guinea, and not many other countries, the U.S. doesn't require its plastic to contain an encryption chip, so stealing cards remains an effective, nonviolent way to get at the cash in an ATM. Encryption chip requirements are coming to the U.S. later this year, though. And given the gas raid's many advantages, it may be only a matter of time until the back of an American ATM comes rocketing off.
Yes, blame it on EMV and the possible unintended consequences that may follow. As much as I agree with Hamilton that the bad guys will look elsewhere for their next $3 billion, and that identity theft, cyberfraud and tinkering with applications are all likely scenarios, that's making the big assumption that the bad guys will get a lot smarter.
I am extremely fearful that the greatly dumbed-down "blow up the ATM with gas" model will appeal to many a would-be bad guy once the old "steal the ATM card" method no longer works.
Sad to say, where there is an opportunity a market will develop, and this is true with exploding ATMs. According to the Bloomberg article:
The rise in gas attacks has created a market opportunity for the companies that construct ATM components. Several manufacturers now make various anti-gas attack modules: Some absorb shock waves, some detect gas and render it harmless, and some emit sound, fog, or dye to discourage thieves in the act.
So perhaps it will be a moot point for FIs here in America; should gas attacks catch on, gas will be rendered harmless and the bad guys will be made to look foolish.
But the story really doesn't end on this note. Our ever-constant need to access cash anytime, anywhere, will see the ATM business thrive even as placement and manner of access, taps new heights.
An April 6 article, "IdeaBank 'Uberizes' the ATM" reported on a Polish FI's new cash delivery service for small businesses. IdeaBank has outfitted automobiles with built-in depositories and ATMs that can be summoned via smartphone.
For starters, this just has to appeal to Americans who can already order up just about anything delivered right to their door. But will ATMs someday "hide in plain sight," where no manner of attack, gas or otherwise, can generate gains attractive to the bad guys?
Is the time ripe for even greater innovation than we have seen in the past? And will the ATM morph even as the bad guys throw everything at them?
With that, life might return to normal with the only boom to be heard the occasional exhaust backfire from an old car!
About Richard Buckle
Richard Buckle is the founder and CEO of Pyalla Technologies, LLC. He has enjoyed a long association with the Information Technology (IT) industry as a user, vendor, and more recently, as an industry commentator, thought leader, columnist and blogger. Richard participates in the HPE VIP Community where he is part of their influencer team.
