How reliable is AI in criminal evidence

A good article about how an AI system produces evidence used by police.  But humans changed the output of the AI algorithm, calling the evidence into question.

Vice Article about gunshot detection

APT10 hacking attack from China

An interesting report from PwC regarding a computer hacker from China:

Cloud Hopper Report

Revenge Porn

A story in the NY Times about a revenge porn civil case, and whether the decision by prosecutors to drop a corresponding criminal case will have any impact on the civil case.

"In recent years, federal prosecutors in Los Angeles have earned a reputation for being particularly aggressive in pursuing cases against both former boyfriends and hackers selling unauthorized sexually explicit videos to websites. One notable case was the successful prosecution of Hunter Moore, who ran a now-defunct website that specialized in posting revenge porn videos that were stolen from people’s computers and posted without their permission.

The decision to drop the charges against Mr. Elam may illustrate the difficulties in pursuing such cases because they require a jury not to hold the victim partly responsible for creating the sexually explicit images in the first place and either sharing them with a former partner or storing them on a cellphone."

See NY Times

Cravath Hacked

A large NY law firm was hacked.

Articles at: www.nytimes.com/2016/03/31/business/dealbook/cravath-law-firm-discloses-a-data-attack.html, and www.wsj.com/articles/hackers-breach-cravath-swaine-other-big-law-firms-1459293504.

Consequential Loss After Hacking Decision from the USA

An interesting decision from the United States (11th Circuit appeals court) in Silvertop Systems -- decision here.

There is an interesting discussion of consequential loss, that starts at the heading "LMT's Counterclaim for Breach of Contract"

Facts were these:

·         Supplier (Silverpop) provided an email marketing service.  Customers loaded up email addresses and Supplier would send out mass emails in a form specified by the customer to addresses on the list.

·         Hackers got into the Supplier’s system and got access to several customer’s marketing lists, including LMT’s list.

·         The contract between Silverpop and LMT had a confidentiality clause (obligation to protect the list against unauthorised disclosure to third parties) and an exclusion of consequential loss.

·         Amongst the claims and counterclaims, was a claim from LMT that Silverpop had breached the confidentiality obligation and that the damage suffered by LMT was the sale value of the marketing list, which they said was now worthless.

This is what the court decided – assuming it was correct that the value of the marketing list was now zero, that was a consequential loss.  The court discussed the difference between general damages and consequential damages (which is remarkably similar to the old English decision of Hadley v Baxendale).  The direct loss which would have been recoverable by LMT if there had been a breach of the confidentiality obligation was the loss of the value of the service (but that is not what LMT claimed).

Employees Violating Computer Misuse Policy

In July, the Fourth Circuit weighed in on the scope of the Computer Fraud and Abuse Act (CFAA) in WEC Carolina Energy Solutions, LLC v. Miller and found that the CFAA is not broad enough to impose liability on an employee who has lawful access to his employer's electronic information but later misuses that information - such as by stealing the employer's electronic trade secrets. In taking this narrow approach to the CFAA and siding with the Second and Ninth Circuits, the Fourth Circuit has widened the circuit split over whether the CFAA applies to disloyal employees who violate the computer use policies of their employer. In this Legal Alert, Audra Dial and John Moye discuss the Fourth Circuit's recent ruling and its impact for employers drafting computer use policies as well as companies pursuing trade secret claims through the CFAA.

See kilpatrickstockton.com

New Cyber Data Laws

See Cyber Data Law story.

"NEW laws will allow authorities to collect and monitor Australians' internet records, including their web-browsing history, social media activity and emails. But the laws, which will specifically target suspected cyber criminals, do not go as far as separate proposed laws designed to retain every Australian internet user's internet history for two years in the name of national security. Under the laws passed yesterday, Australian state and federal police will have the power to compel telcos and internet service providers to retain the internet records of people suspected of cyber-based crimes, including fraud and child pornography. Only those records made after the request will be retained, but law enforcement agencies will be prevented from seeing the information until they have secured a warrant."

Copyright & Theft

"THE Justice Department is building its case against Megaupload, the hugely popular file-sharing site that was indicted earlier this year on multiple counts of copyright infringement and related crimes. The company’s servers have been shut down, its assets seized and top employees arrested. And, as is usual in such cases, prosecutors and their allies in the music and movie industries have sought to invoke the language of “theft” and “stealing” to frame the prosecutions and, presumably, obtain the moral high ground. ...


The problem is that most people simply don’t buy the claim that illegally downloading a song or video from the Internet really is like stealing a car. According to a range of empirical studies, including one conducted by me and my social psychologist collaborator, Matthew Kugler, lay observers draw a sharp moral distinction between file sharing and genuine theft, even when the value of the property is the same."


See NY Times opinion article from U.S. law school professor.

Class 4 - Spam, crime and phishing

Next week we will be looking at spam, crime and phishing.

Please look at the relevant chapters of the textbook (chapter 11 and part of chapter 3) as well as the following materials.


Spam

Australian law - Spam Act 2003 (Cth)
US law - CAN-SPAM Act
EU directive - Directive on privacy and electronic communications (Article 13)
Australian Communications and Media Authority (ACMA)
Internet industry Spam Code of Practice

How effective are these laws?

Crime
Australian law - Criminal Code 1995 (Cth), Criminal Code 1899 (Qld)
Scale of cybercrime - Symantec report
Australian Federal Police
Lulzsec
Cost - here and here

Is cybercrime underreported? Australian Institute of Criminology

Phishing
Australian government - Scamwatch
Anti Phishing Working Group
Domain-based Message Authentication, Reporting & Conformance

What is the best way to respond to phishing - raising awareness, enacting legislation or cutting off scam emails before they arrive?

Kim Dotcom Interview

The first interview with Mr Dotcom after his arrest is here:

Campbell Live

Interview with Kim Dotcom Lawyer

Here is an interview from NZ TV with Mr Kim Dotcom's U.S. lawyer.  Can the operator of a file storage system be criminally liable for copyright infringement of its users?  Or is there more to this case than this?

Rogue Websites

On May 12, 2011, U.S. Senate Judiciary Committee Chairman Patrick Leahy (D-VT), Senator Orrin Hatch (R-UT), and Judiciary Committee Ranking Member Chuck Grassley (R-IA) sponsored S. 968, the Preventing Real Online Threats to Economic Creativity and Theft of Intellectual Property Act (PROTECT IP Act), a bill to deter, prevent and root out websites that profit from trafficking in stolen content.

See MPAA's view and Global Intellectual Property Center

See also FightOnlineTheft

Poker Play

"IN ANOTHER era, Daniel Tzvetkoff would have been whacked - shot or garroted, buried in a shallow grave or sent to sleep with the fishes. The world's two biggest online gambling companies, Full Tilt Poker and PokerStars, which want the $US100 million they believe the former Gold Coast high-flyer took from them, don't work that way.

They send their lawyers. Or they just wait. But Tzvetkoff, incredibly, has used his position from inside a US jail to, first, free himself, and then go on the offensive against the very people who are chasing him.

The Queensland internet entrepreneur, 28, was mysteriously bailed from a US federal prison last August. He has rolled to save his neck.

US federal prosecutors are using Tzvetkoff's unique inside knowledge of how big online gambling companies shift money out of the US in exchange for a sweet deal."

See Courier Mail front page story

"ASSOCIATES of former internet high-flyer Daniel Tzvetkoff have been charged after a flurry of arrests in the US over illegal online gaming following his release last year from a New York prison.

US judges have sealed the files on Mr Tzvetkoff's criminal case, after he was secretly released from prison -- without a bail hearing -- on charges he was involved in a $500 million money-laundering scheme for illegal online poker sites.

Secrecy now surrounds the former Gold Coast-based entrepreneur's movements, with prosecutors refusing to disclose if they are going ahead with the charges that carry a 24-year jail term."

The Australian

The owners of three of the largest Internet poker companies operating in the United States were accused Friday of tricking regulators and banks into processing billions of dollars of illegal Internet gambling proceeds.

Eleven people including the owners of Full Tilt Poker, Absolute Poker and PokerStars were charged with violating anti-Internet gambling laws, according to charges filed by federal prosecutors in Manhattan.

Prosecutors also filed a civil money laundering complaint seeking to recover at least $3 billion from the companies, which are all based overseas, court documents said.

In addition, according to the government statement, restraining orders were issued against more than 75 bank accounts used by the poker companies and their payment processors. And the Internet domain names of the companies were also seized.

NY Times

TripAdvisor and Crime

"To our travel community: This past weekend we discovered that an unauthorized third party had stolen part of TripAdvisor's member email list. We've confirmed the source of the vulnerability and shut it down. We're taking this incident very seriously and are actively pursuing the matter with law enforcement. How will this affect you? In many cases, it won't. Only a portion of all member email addresses were taken, and all member passwords remain secure. You may receive some unsolicited emails (spam) as a result of this incident. The reason we are going directly to you with this news is that we think it's the right thing to do. As a TripAdvisor member, I would want to know. Unfortunately, this sort of data theft is becoming more common across many industries, and we take it extremely seriously. I'd also like to reassure you that TripAdvisor does not collect members' credit card or financial information, and we never sell or rent our member list. We will continue to take all appropriate measures to keep your personal information secure at TripAdvisor. I sincerely apologize for this incident and appreciate your membership in our travel community. Steve Kaufer
Co-founder and CEO More information"

Avatars

From The Australian:

Is putting real-life law into an avatar's hands viable?

http://www.theaustralian.com.au/australian-it/is-putting-real-life-law-into-an-avatars-hands-viable/story-e6frgakx-1225835812440

Net Fraud

Net fraud accused back online

From: The Courier-Mail

February 21, 2010

A TEENAGE Brisbane student accused of using the internet to defraud Queensland's biggest bank of $2 million has today had his ban on using the internet lifted.

Brisbane Magistrate Noel Nunan this morning varied bail conditions for Philip Heggie, 18, so he could use the internet to continue his university studies.

Heggie, a University of Queensland business student, made a brief appearance in the Brisbane Magistrate's Court to answer charges of fraud, attempted fraud and uttering a forged document.

Click here to read the full article on the website

--- A class member asks the following regarding the above story:

Given the level of sophistication required to perpetrate these alleged activities, has the Court (in its most recent decision concerning bail conditions) paid sufficient heed to the possibility of the accused undertaking similar acts? How meaningful are either of the different sets of bail conditions prescribed by the court, given that cyber crimes can be undertaken anonymously?

Cyber-criminals gettting smarter

According to a report by Symantec, cyber-criminals are focusing less on destroying data and increasingly on attacks designed to silently steal data for profit without doing noticeable damage that would alert a user to its presence.

Read a summary of the report here. And this is how The Australian reported the story.