Cyber attacks - Get used to it

It has been an interesting week in Cyber world.  Mark Zuckerberg, the CEO of Facebook has had his own personal page and pictures hacked into and released.  There are two interesting points about this.  Firstly, on the positive side, Mr Zuckerberg actually has enough confidence in his creation that he has a page.  Secondly, on the negative side, there are obviously a lot of people that don't like him.

Telstra this week faced a major problem as it was identified that parts of its database were open for all to see.  The estimate of people affected range from 100,000 to over 1 million depending on whose spin you listen to.  Telstra did the right thing and immediately shut down parts of Bigpond.  Of interest was that when I phoned Telstra to find out what was happening, the first person said that they had no idea and that it wasn't a Telstra problem. I phoned a second time.  This time I was routed to a call centre in the Phillippines.  She was far more frank and said that Telstra had been hacked, they had immediately shut down the system to protect people's data and that it could be three days before the system could be restored.

I am impressed that Telstra actually did what they did.

Vodafone on the other hand had massive outages on Friday across Melbourne.  There didn't appear to be any clear answer from the company as to why.

In the end, it raises an interesting point about hackers.  I would suggest that there are at least three types.

The first I would compare to a firebug.  They hack for the hell of it to see if they can do it.  They are not really too concerned about the consequences.

The second is the professional.  They are looking for things, people, bank accounts etc.

The third is organised crime.  They hack for a range of purposes including identity theft.

The fourth I would suggest is some Governments who actually employ people to do it.

Interesting times.

Stephen Wilcox
Australian Lawyer

Cyber Birthdays - Who gets the presents?

One of the interesting things about online activity is the inevitable question for the date you were born.  Indeed, even offline activities such as obtaining information about your utility bill, bank account or any other phone based inquiries will generally request your birthday.  This can be by voice recognition or keypad entry (two digits for the day, two digits for the month and four digits for the year).

Often, when applying for anything over the telephone, there may be a period where an automated machine reads out the terms and conditions of whatever you are applying for.  The Government legislated to protect individuals in this regard such that any term or condition that was unfair was removed.

Virtually anything you do online such as purchasing an airline ticket or joining a site (say EBay) requires you to tick a box agreeing to terms and conditions.  Does anyone read them? 

I have logged onto Facebook to try and find their terms and conditions.  This is not an easy task.  Even their own search engine does not bring up their terms and conditions as the first hyperlink as one would expect.

Even more interesting is that I have not logged onto Facebook for over a month.  I immediately received an email from Facebook stating 'Sorry that you've been having trouble logging into your Facebook account'.  This is an odd message considering that I haven't.

When setting up a Facebook account, you are required to enter your date of birth.  Indeed it is a term of use that this is up to date at all times.  Why it would change I am not sure.

Initially I assumed that the relevance of this was so that when your birthday came around each year, Facebook (which it does), sends out reminders to all of your friends that it is your birthday.  Whilst this is a charming aspect of the site, the real reason for the use of your birthday is set out in the terms and conditions.

The term states 'Your birthday allows us to do things like show you age-appropriate content and advertisements'.

Of further interest is 'Other information we receive about you'.  This includes:

'When you post things like photos or videos on Facebook, we may receive additional related data (or metadata), such as the time, date and place you took the photo or video'

This is an oxymoron.  Metadata is defined to mean 'data about data' or 'descriptive statistical information about the elements of a set of data'.  The wording 'data (or metadata)' literally means 'data (or data about data)'.  

Even weirder:

'We receive data from the computer, mobile phone or other device you use to access Facebook.  This may include your IP address, location, the type of browser you use or the pages you visit.'

Presumably this is only within the limits of the Facebook 'sphere'.  The clause then goes on (and I am not sure how the two are connected:

'For example, we may find your GPS location so we can tell if any of your friends are nearby'

I have not yet seen Facebook activate this.  Why would they want it?

In any event, your birthday is not so that Facebook can send you a present.  It is a data (or metadata) collection mechanism.

Finally, one would think that of more importance for your birthday is so that Facebook can scan and remove minors from the site.

Stephen Wilcox
Australian Lawyer

Cyber love - till death do us part

In an interesting twist to social media, it is now reported that in the United States, 20% of all divorce cases mention Facebook in the pleadings.

In a further twist, this very site is slowing down my access to place blogs.

I suppose the question is - who is looking at who?

Stephen Wilcox
Australian Lawyer

A Hairy Situation

In a Canadian case, Shonn's Makeovers & Spa, Appellant, versus the Minister of National Revenue, Respondent, a hairdresser became unstuck because of his Facebook page.  The case which was heard before His Honour Justice Boyle examined whether or not a Mr William Hall was working for the Appellant as an employee or an independent contractor.

The tests to determine this are similar to those in Australia and include intent of the parties, control over the work, ownership of tools and chance of profit/risk of loss.

Mr Hall was a colouring artist.  His Honour found that it was almost impossible for the Court to determine on the facts what his status was and further that evidence of the financial arrangements between the parties did not usefully point in either particular direction. 

Under cross examination, Mr Hall was asked why he had put on his Facebook page that he was self employed.  His response was that you didn't have to be honest on Facebook.

On further cross examination, it was put to Mr Hall that everything else on his Facebook page was true including his age, his likes and preferences, his hometown, his education and his activities and groups.  The only thing that wasn't true was his self-employment status.  Mr Hall replied that this was for privacy reasons. 

His Honour held that his credibility had been damaged by his responses.  It was not that he lied on Facebook, his Honour said that he did not believe that he was telling the truth when he said that he was lying on Facebook.

His Honour held that on the balance of probabilities that Mr Hall was not an employee of the salon.

In one of his reasons for his decision, His Honour said "Both surprisingly, and perhaps as a true sign of our times, this ends up turning on his Facebook status.  Unfortunately such is the sad state of affairs of this file ..."

Stephen Wilcox
Australian Lawyer
.
 
 
 

Cyber OCD

There is perhaps another issue regarding social networking sites.  Obsessive Compulsive Disorder.

This disorder is perhaps the worst of all.  It is horrific for the person that has it and for those people that surround them.

I first came across this disorder whilst chatting to a friend.  I was cooking a BBQ and placed my beer bottle on the wheely bin.  My friend was startled and asked me to remove it immediately.  I couldn't quite follow.  The chances of a deadly disease travelling up my beer bottle from the bin was highly unlikely.

I talked to him further.  He said that the bin was a 'dirty place'.  Eventually, I discovered that the only 'safe' place' for my friend was his bed.  The world expanded from there.

When departing for school as a child, my friend would be in agony.  Departing the bedroom was difficult.  This involved washing his hands and then using tissues to open the door to his bedroom.  If he touched the door handle, then the whole process began again.  Catching the train involved wedging himself between two poles and not touching anything. 

Everything in the outside world apart from the bed was a 'dirty space'.

Comparing this to the internet and cyber addiction is an interesting nexus.  The OCD works in reverse to the example that I have given.  A person must log on to the internet to satisfy the compulsion. 

Looking at how the brain works, there is within the frontal lobe an area that is known as the 'feel good' zone.  This is tracked from a part of the brain that runs along the top left hand side of the skull along the face.

Facebook appears to have introduced a new part of its social networking site.  I call it 'where am I". 

I have a Facebook page and a limited friend list (indeed only 21).  The average is 120.  I am now being swamped with emails from Facebook from some of the friends which state 'X is now at the Zoo' or 'Y is now at Z restaurant'. 

I have diverted all of these emails into Junk and my Internet security will eventually automatically delete them.

It is intriguing that a person would engage in this behaviour.  If one had say 1,000 friends, the barrage of emails must be extraordinary.  This development is due to the advances made in Smart Phones.

One of the questions that must be answered is whether or not the person actually knows that the phone is continually sending out messages of where they are or if they are personally entering the information.

With the development of GPS, eventually the phone will simply send out the message automatically.

If the person is entering the information (and in some cases it might be morning, noon and night), then is this a form of developing OCD?

Everyone has habits and these form a part of daily rituals.  It is only when one particular habit becomes essential that it starts to form a problem.

There are certain drugs that are used to try and block receptors in the brain such that the habit does not satisfy the 'feel good' part of the brain and therefore it becomes useless.

One such drug is Anafranil.  From the drug company's website, this drug is used for a variety of purposes, one of which is OCD and phobias in adults.  Strangely, there is a warning that grapefruit, grapefruit juice or cranberry juice can interfere with the drug's capability. 

Perhaps part of the internet is a form of OCD after all. 

Finally, as an example of my own personal experience with gaming, there was developed in the late 80's a game called Super Mario Brothers.  This game was the first of its type in that it could remember and hold your position wherever you were.  The game had 8 stages and was complicated.

I was studying law at the time and also addicted to this game.  It came to the morning of my Tax exam.  The exam was at 2pm.  Rather than study, I played the game as I was within hours of beating the whole thing.

I finally did at 11:20am.  As soon as I won, I realised that I could never play a game like that again.

Stephen Wilcox
Australian Lawyer

Cyber Insanity - One Solution

The internet has a number of games.  Some of these games are highly addictive.

Other parts of the internet are addictive.

One of the objects of this blog is to identify the legal issues surrounding social networking but also to look at the practical realities.

Parents are faced with a real problem.

There is one game that is so addictive that it now has warnings on its label.  I cannot mention the name of the game for defamation reasons.

However, there is hope.

One of my clients is a leading expert in I.T.  I have spent some hours with him discussing how to resolve the problem of adolescent internet addiction.

There are a variety of solutions.  However, an effective solution is set out below.

Every computer in the common age that has any sort of network connectivity, whether it be on an internal home network that does not have access to the internet and computers that are configured for internet access will be assigned an IP address. Normally the IP address is assigned by a modem/router provided by the internet service provider.

All computers with an IP address then communicate with other computers and the internet using specific ports assigned by the IP address. For example, when you use Internet Explorer to visit the Sydney Morning Herald website, your IP address will communicate with that web site using port 80, which is the standard port used to communicate via unsecured HTTP. When you visit the ANZ website and make a “secure” transaction, your IP address would not only use port 80 to load the web page using HTTP, but also use port 8080 as that is the “secure” HTTP port.

All applications use various ports to communicate and there are tens of thousands of ports available that applications use, however they are assigned ports so that they can be controlled and monitored on networks. 

It is possible to “rate shape” ports on specific IP addresses using the modem/router. Rate shaping allows you to assign a finite variable as to “how fast” and “priority” on the network so that you can effectively make the network traffic that travels (or uses) certain ports so slow, that although it will work, it will become tedious and unusable. Given the changes are made on the network infrastructure they can not be overridden from the client laptop or computer.

This is not a simple task as to implement this in a transparent manner. My I.T. expert would need:

·         Access to the router/ADSL modem at the premises

·         Activation of logging on the modem to determine what applications are being used, as per IP address and port number along with an analysis of this data

·         Advice as to what the make/model of the modem/router is (as it may need to be replaced as to allow rate shaping)

·         Additional configuration of the modem so that static IP addresses are assigned to any devices that need to be rate shaped

·         Training for the parents so that they can initiate the “slow down” on demand from their computer or their phone

As configuration can be made to “slow down” specific ports, like the ones games use, this will still allow general access to the internet to be at “full speed” referencing the above where HTTP traffic uses port 80, there would be no modification as to how that specific port works, so only games or applications that are deemed to be appropriate for “rate shaping” would be modified so anything deemed appropriate would still operate at “full speed” which is convenient.

Corporates use rate shaping for sites like Facebook and other network intensive (costly) non-critical applications like internet radio streaming over the internet. In the case of internet radio streaming, you need a large amount of bandwidth so that the music streams properly and doesn’t pause or break up. Initiating rate shaping makes it so slow it is unusable so the users do not bother with it. To ban it outright just causes angst.

With respect to costs, there are three phases.

1    Analysis and recommendation 

        

      Purchase of new network hardware if required.

3.      

            Implementation and training.

This is not a cheap process.  On average, the cost is about $2,000 plus GST depending on the complexity of the systems involved.  As parents, you have full rights to implement the process without the child/children even knowing.


For more information, you can contact me via my Website - stephen-wilcox.com or email direct at australianlawyer@bigpond.com


Stephen Wilcox
Australian Lawyer

Cyber dinner for two

Last night I witnessed an amazing event.  I was dining at a restaurant.  There were two males having dinner together.  During the whole course of their dinner, both parties literally were texting on their mobile telephones.  They did not speak to each other. 

They paid the bill and left.

Stephen Wilcox
Australian Lawyer

Cyber Law - Is the Cat chasing its tail

It was reported in one of today's papers that an Austrian student had requested Facebook to provide him with all personal data collected from three years of using the site.  It was further reported that Facebook provided the student with 1,222 pages of data.

Some of the comments in relation to the article were quite interesting.  One of the more interesting comments was 'Facebook is like a pub.  You don't like what you see, go to another pub.  Nobody's twisting your arm'.

Of course, Facebook is not like a pub and if it is to be compared to a pub, then there are no other pubs in town with a virtual and real monopoly on social networking.  I am not sure of any pub that could handle 800 million patrons let alone get approval to do it from Liquor Licensing.

Consumer harvesting was the mantra and is often an allegation that is raised against Facebook.  The term 'harvesting' is quite unappealing. 

There appears to be two distinct groups that are divided on Facebook.  Those that love it and those that hate it.  Various generations also have different views.  It is common that elderly people don't like it, don't understand it and therefore form a view that there must be something wrong with it.

There are of course many other forms of social or business activity on the Internet.  LinkedIn is a good example.  I am a member of both Facebook and LinkedIn.  Neither of which I find particularly useful.

The Lord Mayor of Sydney issued a statement (presumably short) on Twitter in relation to the Police behaviour relating to removal of the anti-capitalism demonstration in Sydney.  I suppose one of the questions is why?  Was it that important that her views had to be immediately sent to all and sundry to state her position?

The Family Court recently approved service of proceedings by email.

The Government continually amends its Privacy Laws for the protection of the individual.  These laws in fact can sometimes be quite frustrating as one has to answer endless questions to get answers from communication providers, banks, utility providers etc.

In the end, computers, the internet and its associated programs are critical for modern society.  The Australian Stock Exchange went offline today for four hours.  Traders who were interviewed complained that they couldn't close trades, open trades or effectively do anything.

Stephen Wilcox
Australian Lawyer

Cyber Crime - Identity Fraud

A survey to gauge how well people protect their identity has been launched by the federal Minister for Home Affairs and Justice, Brendan O'Connor. It coincides with National Identity Fraud Awareness Week (October 17-23). The survey is on the Australian Federal Police website and allows members of the public to test how vulnerable they are to identity crime and to take remedial measures if needed.

http://www.afp.gov.au/what-we-do/campaigns/national-identity-fraud-awareness-week.aspx

Stephen Wilcox
Australian Lawyer

Cyber Law - I'm the oldest, therefore I have the right

As this blog develops, it is interesting to take a snapshot of what is actually happening.  Virtually every person I meet who has a child tells me that their child is obsessed with the internet, they can't get them off it and the whole thing is out of control.  I'm not even asking the question.  It is simply stated out of some sort of desperation for someone/anyone to do something.

Today was a visit to the fruit and vegetable shop.  Generally, people are busy at the time of day post work and don't engage in much conversation.  However, this afternoon, one woman in the middle of the shop said in exasperation 'I just can't get them off the damn computers'.

This then caused some interest in the shop and general discussion.  Two of the owners, a woman and a man discussed their children.  The woman who initially raised the issue then said 'I should never have bought another laptop'.  The fruiterer replied 'that was fatal'.  The conversation continued.  The male owner of the shop said that his two sons continually fought over the computer to the extent that the eldest child said the classic maxim 'I am the eldest and I have the right'.  The original woman then said 'I don't even know what they are doing - playing some game with people in New Zealand.  I don't think it's porn however'.

Of course, at law, children have very limited rights.  Their parents do.  These rights vary in certain circumstances such as when a child is at school.  There are also legal obligations imposed on parents in relation to children.  The maxim 'I am the eldest' holds no ground at law when it comes to accessing the internet.

So what is the solution?  It is tempting to set up a Facebook page entitled 'How do I stop my child using the internet'.  It would be interesting to see how quickly Facebook would shut it down.

The film that was released last year about the creation of Facebook was an interesting piece.  It was almost a marketing piece for the organisation itself.  At the time, Facebook was being heavily criticised for privacy issues.  Even more peculiar was that Justin Timberlake played a role.  He actually bought out MySpace from News Corporation.  I personally found all of the characters repulsive.

The difficulty facing parents is that one the one hand, their children need access to the internet more and more.  School projects are submitted online.  A lot of eduction is online.  As a child, it is very easy to manipulate a parent and say 'I'm doing my homework'.

In the end, perhaps the internet is simply just like television.  Parenting in the seventies and eighties had to face this problem.  I recall my own cousin broke her ankle leaving a moving motor vehicle as her parents were driving into the garage just so she could watch a television program.

There is of course the ultimate solution - pull the plug.

Stephen Wilcox
Australian Lawyer

Cyber Grooming - Are You Safe?

The internet has many benefits - social, business, banking.  The power of search engines such as Google enable rapid access to even basic information such as phone numbers and postcodes.  Smart phones provide instant access to books and music.

In Australia, Telstra has released the 4G Network.  Its wireless speed capabilities almost match cable with enormous and ever increasing download capacities.

The types of facilities that the internet provide include blogs (such as this one), Twitter, social networking sites, chat rooms, e-mail, online gaming, instant messaging, Skype and its competitors.

The Courts and the legal system are in many ways on the back foot when it comes to dealing with new developments.

Two years is a long time in technology.  However, it is often worthwhile looking back in history to learn for the future.

On of the early social networking sites known as MySpace was a direct competitor to Facebook.  In 2007, MySpace had an estimated 180 million members.  A number of Attorney Generals in the United State requested information from MySpace to provide information on how many registered sex offenders were using its site.  After some initial legal battles, MySpace removed 7,000 names of registered sex offenders from its site.  A small percentage at 0.015%.

By 2009, this figure increased to 90,000 registered sex offenders that were removed from MySpace.  MySpace was almost at its peak of membership and by 2011, membership has fallen to 60 million users.

Facebook on the other hand now has more than 800million 'active' users according to its own website.  Of those users, 50% log on every day and the average user has 130 'online' friends.

In 2009, Facebook removed about 5,500 sex offenders from its site.

In Facebook's Statement of Rights and Responsibilities (26 April, 2011 revision), Part 4 deals with 'Registration and Account Security'.  It provides interesting reading.  Extracting a number of clauses:

1. You will not provide any false personal information on Facebook;

5. You will not use Facebook if you are under the age of 13;

6. You will not use Facebook if you are a convicted sex offender;

7. You will keep your contact information accurate and up-to-date.

Facebook describes these commitments as partly for the purpose of maintaining the security of your account.

Facebook is a free service.  There is no consideration (ie money) paid to use it and therefore, one would assume that the 'Commitments' are not binding. It would seem that the only recourse that Facebook would have for a breach of one of these Commitments is to remove the user.

Cyber Love - Till Money do us part

Section 81 of The Crimes Act 1958.

Section 81 of the Crimes Act 1958 creates the offence of obtaining property by deception.  It states;

 

81     Obtaining property by deception

                (1)  A person who by any deception dishonestly obtains property belonging to another, with the intention of permanently depriving the other of it, is guilty of an indictable offence and liable to level 5 imprisonment (10 years maximum).

                (2)  For purposes of this section a person is to be treated as obtaining property if he obtains ownership, possession or control of it, and obtain includes obtaining for another or enabling another to obtain or to retain.

                (3)  Subsections (12) and (13) of section 73 shall apply for purposes of this section, with the necessary adaptation of the reference to appropriating, as it applies for purposes of section 72.

                (4)  For the purposes of this section, deception—

                         (a)  means any deception (whether deliberate or reckless) by words or conduct as to fact or as to law, including a deception as to the present intentions of the person using the deception or any other person; and

                         (b)  includes an act or thing done or omitted to be done with the intention of causing—

                                  (i)  a computer system; or

                                 (ii)  a machine that is designed to operate by means of payment or identification—

to make a response that the person doing or omitting to do the act or thing is not authorised to cause the computer system or machine to make.

When investigating and potentially prosecuting a charge under this section of the Crimes Act, investigators and prosecutors need to be mindful of the essential elements of the offence which need to be proven.  These are well set out in “Bourke’s Criminal Law – Victoria” 2010, Lexis Nexis Butterworths, at P. 289-94 and are as follows;

1.      That the accused engaged in a deception

2.      That the accused did so dishonestly

3.      As a result of the deception the accused

a.      Obtained ownership, possession or control of property; or

b.      Obtained for another, or enabled another to obtain or to retain, the ownership, possession or control of property;

4.      That the property in question belonged to a third party;

5.      That the accused intended to deprive the third party of that property.

The first element of this charge is that there must be a deception.  This deception can be by words or by conduct and it can be either deliberate or reckless, but there must be a causal connection between the deception and the obtaining.  As cited in Director of Public Prosecutions v Ray [1974] AC 370, 

“The deception must have the effect of inducing the victim to part with his property or to do or refrain from doing something as a result which the accused obtains property for himself or for another”

While there are numerous other authorities which all support this contention of a causal connection required between the deception and the obtaining, the authorities also state that even where a victim suspects or even believes that they are being swindled at the time they part with money as a result of a deception does not mean that the obtaining has not resulted from the deception as per R v Miller (1992) 95 Cr App R 421.

Cyber addiction - the new crack?

The purpose of this Blog is to follow the development of Social Networking Law in Australia.

Earlier in the year, St Kilda Football Club successfully served a Federal Court document on a minor via a social networking site.

The Police are also using Facebook to serve Intervention Orders and other documents.

Recently, the Chief Justice of the Victorian Supreme Court announced that she was considering setting up a Twitter account in response to a State Government survey regarding sentencing which found that many members of the public considered that Judges were out of touch.

In the next review of the American Diagnostic and Statistical Manual of Mental Disorders, there is consideration as to whether Cyber Addiction will be officially included.

Stephen Wilcox