Are You Next to be Sued?

If you use Limewire, Frostwire, or other file sharing software you could be sued by the Recording Industry Association of America (RIAA) or the Motion Picture Association of America (MPAA). Did you know that over three short years, between 2003 and 2006, the RIAA sued over 20,000 music fans for thousands of dollars per person for file sharing? Here's some tips to make sure you avoid law enforcement and are not then next person sued:

1) Normally, people are sued only for sharing music, not for just downloading it.  Make sure you keep copyrighted material out of your shared folder or disable the sharing feature of your P2P application.

2) Avoid publicly accessible file sharing networks, such as those at colleges.  Sometimes, these networks will report you making your chance of getting sued significantly greater.

3) To be safe, you could always just avoid downloading any copyrighted material.

If you have received notice or your ISP address has already been sued visit the Electronic Frontier Foundation's website at www.eff.org for help and additional information.

Epsilon Data Breach: Expect a Surge in Spear Phishing Attacks

Epsilon, the world’s largest permission-based email marketing company, reported an unauthorized entry to its email database on March 30. The company, which sends more than 40 billion emails a year, has assured its clients that the hacked information is limited to names and email addresses. Epsilon has warned customers not to respond to fraudulent emails asking for account information. The hackers did not get any information regarding Social Security or credit card numbers. Financial institutions affected include Barclays Bank, Capital One Financial Corp., Citigroup, JPMorgan Chase and U.S. Bancorp. The parent companies of Best Buy, Ethan Allen furniture stores, the Kroger grocery chain, the Home Shopping Network and Walgreens drugstores issued similar warnings, as did the Hilton and Marriott hotel chains.
Phishing' scams are the number one concern from this breach. Hackers could send fake emails pretending to be your bank, pharmacy, hotel or other business that were customers of Epsilon. The email will look real and will be convincing as attackers have the customer's name and the company information that they did business with. The email could ask unsuspecting users to click on a link which can ask for credit card numbers, run malware, install spyware or carry out other attacks.
Epsilon posted a press release two days later after the breach happened on March 30. The breach is currently under the investigation of the U.S. Secret Service, which asks all Epsilon customers who are suspicious about any fraudulent emails to report to phishing-report@us.cert.gov.
http://www.dailyrosetta.com/epsilon-data-breach-under-investigation/12190.html

Going Dark

Earlier, I blogged about law enforcement's efforts to implement an ISP data retention mandate to improve their ability to investigate and prosecute crimes. This blog is about a similar law enforcement effort to improve their ability to actively intercept wire and electronic communications. During testimony to the Congressional Subcommittee on Crime, Terrorism and Homeland Security, Valerie Caproni, FBI General Counsel, described the difficulties that law enforcement faces in establishing surveillance after receiving court authorization. Often the provider does not have sufficient technical resources to accomplish the surveillance. This capability gap is referred to as "going dark." Complex environments with multiple layers between end-user and primary provider using multiple technologies make the task of surveillance much more complicated than in the past. Not surprisingly, additional funding and bureaucracy is being proposed to help address the issue. The 2012 federal budget requests $15 million to establish a Domestic Communications Assistance Center (DCAC) to advance solutions to the "going dark" issue. The DCAC will "leverage the research and development efforts of federal, state and local law enforcement with respect to electronic surveillance capabilities, facilitate the sharing of technology between agencies, and advance initiatives to implement solutions..." Even in these tough financial times, it's not the money that makes people uneasy, it is the potential for abuse. Wouldn't it be great if $15 million could fix that? http://1.usa.gov/h7yB3w

Cloud Computing & Jurisdiction

I’d like to write about something that I briefly mentioned during our presentation but, due to time constraints, was unable to get into too much detail about: jurisdiction.  As I stated in our presentation, jurisdiction refers to the power of a law enforcement agency or court to investigate or hear a case.  This can be from either geographic location or subject matter.  Unfortunately for law enforcement, the Internet doesn’t have a specific geographic location, or a specific subject matter.  Now another complicating factor has entered the mix: cloud computing.

Cloud computing is, basically, computer software and services available over the Internet.  A “cloud” can allow people or companies to access software online instead of having the software on each computer or device.  This can save a lot of money and effort.  However, when it comes to law enforcement, a problem arises.  In civil cases, a defendant may be required to produce documents under its “custody and control.”  But in a “cloud,” who maintains custody and control of documents?  The company can certainly claim that the documents are no longer in their custody or control, as they are stored on the servers of another company.  Would that company then need to be included in the lawsuit in order to gain access to the original documents?

Then there’s the issue of geographic jurisdiction.  Some countries have very strict privacy laws, such that releasing banking documents can be punishable as a criminal act.  Could a company escape criminal or civil liability in the U.S. by simply using a cloud-computing provider located in one such country?  Cloud computing is a relatively new technological innovation, so it’s not yet in wide use.  But more and more countries are realizing the money-saving capabilities of the cloud.  Whether or not the cloud will make it easier for unscrupulous companies to take advantage of the gray areas in the law has yet to be seen.

Youtube: Law Enforcements New Best Friend

Who needs to go looking for evidence these days when you can just find it on YouTube?

Today, many youth boast about crimes they have committed via YouTube. Hopefully they will think twice after this story:

Four teen boys from Scottsdale, Arizona posted a video of their gang vandalizing property with the title boasting, ""Hey, this is basicly (sic) just a video of us breaking stuff." The video displayed these boys smashing their skate boards into vending machines and looting all of the candy out of them.Another shot showed one of these hooligans smashing into a front windshield of a car and finishing it off with his foot.

About a month after the video was posted on YouTube; the children were detained by local authorities who identified their faces from the video. Now they are facing charges in Maricopa County Juvenile Court for robbery and criminal damage.

So who's laughing now boys?

http://www.azcentral.com/news/articles/0321sr-vandals0322ON.html

Why do people commit cyber crimes?

Computer crime comes in many different varieties. As new computer technologies are made available, there is sure to be someone lurking in the cyber-shadows who are ready to exploit, test or take advantage of security holes that may exist. Computer crime has become the most widespread criminal activity in the world. But what motivates someone to attempt or commit computer crimes?
1. Easy of Anonymity. It is much easier to get away with criminal activity in a cyber world than in the real world. There is a strong sense of anonymity than can draw otherwise respectable citizens to abandon their ethics in pursuit personal gain.
2. Inadequate Legal Jurisdiction. Computer networks literally span the entire globe. This makes it virtually impossible for any government to enact or enforce laws when computer criminals are set up in foreign countries.
3. New Technology. Many computer criminals use their computers merely as a logical extension of “traditional” crimes that can take advantage of computer technology to help facilitate or carry out crime. For example, automated software can be programmed to steal credit-card numbers, personal-identification information and even cell-phone codes.
4. Holding a Grudge. Malicious computer codes like worms and viruses are often spread by someone who is seeking to cause harm to an individual or company-possibly over losing a job, perceived unethical business conduct or maybe even jealousy or envy. Such parties intend to destroy or cripple their targets for the personal satisfaction of seeing them suffer the effects.
5. Thrill of the Game. For many computer criminals, the excitement and challenge of exploiting a computer system can be too great to resist.
6. Opportunistic crime. Individuals who spend a significant amount of time on their computer have many opportunities to commit crimes. These people may have never known that these criminal prospects exist before, but, by spending increased amount of time on the Internet, have come to see a whole variety of opportunities laid out in front of them.
What do you think? Would you like to add something to this list?

Read more: Why Do People Commit Computer Crimes? eHow.com http://www.ehow.com/about_4709031_do-people-commit-computer-crimes.html#ixzz1GWkxpSR3

Permission to Hack: Finding Out the Hard Way

When someone gives you the password to their e-mail account and you access that account, are you aware that you are committing a crime. Even if given permission it is still illegal, and Leon Walker found this out the hard way.

Leon Walker (AP Photo)(CBS/WWJ/AP) Leon Walker, a Michigan man facing felony charges for allegedly hacking into his estranged wife's computer to access her e-mails, has had his trial postponed to give his lawyers more time to prepare their case.
Walker, of Rochester Hills, is accused under a state hacking law of reading then-wife Clara Walker's e-mail on a laptop in their home in 2009.
The trial was originally slated to begin this month. Instead, it was rescheduled for April 11, in Oakland County Circuit Court in Pontiac.

Walker, an information technology worker, faces up to five years in prison for violating an Internet computer misuse law which was designed to protect the stealing of trade secrets and identities.

Clara Walker, 35, filed the complaint against her husband last year, after she learned he had hacked into her email account and read emails which exposed an affair she was having with her second husband. He had been arrested on charges of beating her in front of a child she had with her first husband.

Walker claims his now ex-wife had told him the password, and that he originally went into her account to confirm that she was taking their 3-year-old daughter on liaisons with the second husband.

Walker also presented the emails to the first husband because he was allegedly concerned for the child's safety. The first husband then filed for custody of the child and attached the emails to the court filing, reports Arizona Central.

Walker's lawyer Leon Weiss is using the additional time to review police records from the sheriff's office involving spouses and ex-spouses reporting that their e-mails had been read; however, he could not find a single prosecution, says Arizona Central.

Prosecutor Paul Walton said Walker's actions merited the felony charge and that he used the information to "humiliate her."
Leon and Clara Walker divorced in December 2010.

http://www.cbsnews.com/8301-504083_162_20030408-504083.html

So before you try to use someone else's e-mails against them you better think twice, because you could be on your way to becoming a convicted hacker.