We’ve all heard the horror stories about personal information, such as credit card details, falling into the wrong hands and, thankfully, in many cases the banking system limits the damage but it’s a growing problem.

Now Symantec have issued the results of some research which shows that this information may be sold on the black market for as little as a few pence as cyber criminals use generous retail promotions like bulk buying and “try before you buy” to sell consumer information and credit card details to other criminals. According to the Internet Security Threat Report 2009 e-mail addresses and accounts are traded among criminals from as little as five pence to as much as £60, with a full identity going for around £45. I don’t know about you but I find those figures to be alarmingly low – until I read on and discover that, according to Symantec, more than 10 million stolen identities are traded each year on the black market.

The online black market is booming compared to real-world criminal activity. It is more profitable, harder to prosecute and provides anonymity. Whereas on the streets of London Metropolitan Police figures indicate that a crime is committed every 37 seconds, an identity is stolen online every three seconds.

So how does this happen? Well, much of the information is harvested using malware on our PCs with many victims unaware that their computer is a “zombie” acting as part of the botnets that are the main source of online fraud, spam and other scams on the Internet today. In addition, we are putting increasing volumes of personal information onto the web through social networking. Meanwhile, action against criminals is hampered by the fact that national laws typically lag behind technological advances and the fact that the Internet is a global network and so requires co-operation from multiple law enforcement agencies.

So, what can we do about it? Well, much of the information in this blog post comes from Symantec/Norton and it’s no surprise that they would like us to buy the latest version of their security suite but, even if you use another reputable company’s security products, it’s worth checking out the advice on their Every Click Matters site including a victim assessment tool that helps you assess your risk (and black market worth) and 10 simple steps we can all take to stay safe. Maybe you, as a reader of this blog, know what to do – put it may be worth highlighting the advice to less-technical friends and family.

We’ve all heard of employers Googling prospective (and current) employees to check out their history/online status and there’s the recent story that went viral about someone who forgot she’d added her Manager on Facebook before bitching about her job (needless to say she didn’t have a job when he read what she had to say). Then there’s the story of the Australian call centre worker who was too drunk to work and pulled a sickie… only to be busted on Facebook.

Maybe these things sound like something that happens to someone else – none of us would be that stupid, would we?

Actually, it can happens to the best of us, although maybe not in quite an extreme manner. I’ve become a bit of a Twitter evangelist at work (David Cameron might say that makes me something else…) and, after one of my colleagues suggested that my new manager check out my feed as an example of effective technical knowledge sharing, I hastily checked for any potential lapses of judgment. I did actually remove an update that was probably OK, but I didn’t want to chance it.

Generally I’m pretty careful about what I say online. I never name my family members or give out my address, family photos are only available to a select group of people, I don’t often mention the name of the town where I live (although this blog is geotagged) and I am very careful to avoid mixing the details of my day job too closely with this website (technical knowledge sharing is fine… company, partner and customer details are not).

It seems that there is a generation of Internet users who are a little more blasé though and Symantec are advising consumers against the dangers of sharing their personal information on the ‘net, referring to a “digital tattoo” (described as “the amount of personal information which can be easily found through search engines by a potential or current employer, friends or acquaintances, or anyone else who has malicious intent”).

The digital tattoo term seems particularly apt because there is a misconception that, once deleted, information is removed from the ‘net but that is rarely the case. Just like a physical (skin) tattoo, removing a digital tattoo can be extremely difficult with the effects including hindered job prospects and identity theft. Symantec’s survey revealed that 31% of under-25s would like to erase some of their personal information online. Nearly two-thirds have uploaded personal photographs and private details such as postcodes (79%) and phone numbers (48%) but, worryingly, one-in-ten under-25s have put their bank details online (not including online purchases) and one-in-20 have even noted their passport number!

Of course, there are positive sides to social networking – I personally have benefited from an improved relationship with several technology vendors as a result of this blog/my Twitter feed and it’s also helped me to expand my professional network (backed up with sites like LinkedIn and, to a lesser extent, Facebook). What seems clear is that there is a balance to be struck and today’s young people have clearly not been sufficiently educated about the dangers of life in an online society.