Is Fake News Illegal?

Malaika G. Naidu

Fake News. Sensationalism. Misreporting.
In the last couple of years, the digital world has witnessed a growing trend in the amount of false information that is published. While the digital world has made the dissemination of news easier and quicker, the concept of fake news is older than the internet. Such news was born in the print medium at the turn of the 20th century and was called yellow journalism. A type of yellow journalism is tabloid journalism. However, while yellow journalism aims at propagating false information, tabloid journalism sensationalizes of rumours that may or may not be true.

False Information and It’s Purpose

False Information is any information that is not factually accurate or verified. In politics and current affairs, this is called fake news. Much like wartime propaganda, the purpose of false information is to misinform, deceive or incite the audience. Such news is usually fabricated to influence people’s views, push political agenda and cause hysteria or confusion. And so, false information tends to spike during election times, political turmoil, civil unrest or, as we’re seeing today, during global crises like pandemics.

Spread of False Information

Media houses are required to abide by a strict code of conduct that regulates the information that they put into the public domain. This prevents them from misreporting. However, with the internet and exponential rise of social media, information can now be published and shared with few to no regulations and editorial standards. A substantial percentage of people online depend on social media sites and digital networks for their news. This is particularly worrisome because many don’t even try to verify the information that they consume. It does not help that it is rather difficult to verify all the information that we get today. Social media is a big catalyst in this dissemination of false information.

Economics of False Information

It’s not just that ‘some people like to watch the world burn’; there is actually a robust business model around false information. There is a clear economic gain for those who indulge in this business. Content creators and hosts generate substantial advertising revenue, more so when a piece goes viral. Add to this the algorithms that social media uses to ensure that you only view information that aligns with your preexisting views, ensuring more clicks. This is terrible because we remain isolated from other views that, if made available, may give us a more holistic approach to information.

How Do We Curb False Information?

Here’s another interesting fact. Apart from the super-profitable false information business, there is also the business of fact-checking now! Many large media houses have launched businesses for fact-checking.
However, you can do your part. Here’s how.

1. Verify the source

If it’s a website, look at the URL and whether the website is secure. Often, false information websites will have odd URLs and small spelling or grammar errors in the name. Don’t download apps without checking their reviews. For social media handles, verify their bios and scroll through the comments to gauge the general sentiment.

2. Look Beyond the Headline

Clickbait or attractive headlines are big in hooking viewers. Read the whole article instead of just the headline. Also, false information headlines are usually loud, with many punctuations and capital letters.

3. Cross Verify

Do a quick Google search. In today’s hyper-connected world, it is unlikely that only one source is reporting a matter. Easiest way to verify the credibility of a news piece is to see who all are reporting it.

4. Fact Check

Often old photos, videos and quotes are reused or published without context. Again, a quick Google search should solve this problem.

5. Check Your Bias

We are naturally inclined to accept information if it confirms our own biases. Ideally, when reading news reports, it is best to consume differing views and commentaries.

6. Is it a Joke?

Parody accounts and satire do not fall under false information. They are created to entertain or inform using exaggeration and humour. Before calling a source false, check if they are a parody account. Nothing wrong there, just don’t quote its content as news to someone else!

Is It Illegal?

Now that’s the crore rupee question! Fake news in itself is not illegal. Yes, if the content being published amounts to slander or libel, then that’s a different matter. But sharing false information on the internet is not strictly against the law. There are some countries like Singapore, Germany, France, and Malaysia, et al, who have thought of enacting laws against fake news. However, it’s not easy. If taken too far, these laws could hamper the basic right of freedom of speech and expression. Also, it is difficult to prove wrongdoing with false information. The impact and extent of damage is dependent entirely on how the audience responds to the false information.

CoViD-19 and Fake News

The novel corona virus pandemic, now called CoViD-19 has spiked false information the world over. From misreported numbers by governments and medical associations to false methods to prevent and cure the disease, the internet is flooded with false news and information. The best course of action is to look only towards experts such as the World Health Organization. Tune in to news channels to get your latest information and don’t believe everything you read on social media.

Don’t get caught up in the sensationalism online. False information, especially in such situations, can make the difference between life and death.

Let’s work together. Stay home and stay safe.

Advantages of Password Vaults

Malaika G. Naidu

Passwords. The basis of cyber safety. From entertainment to e-commerce, all our activity online is secured through combinations of letters, numbers and special characters that we put together. Hopefully, at random but mostly in predictable sequences.

What started off with ‘alphabets and numbers, at least 6 characters long’, has become ‘alpha-numeric with special characters, at least 8 characters long’. Some apps/websites take it even further and force you to use a character only twice in a password. E.g. – AsianLaws! would be invalid, but AsianL@ws! would be allowed. Most banks even require you to change your password every 6 months. Password requirements are becoming increasingly more demanding, and rightly so.

So, how do we remember so many password combinations and still use unique passwords for every app/website/device? Do we give in to “sign in through Google/Facebook” or do we take our security a little more seriously?

Up until now, we’ve suggested using logic to remember your passwords.
Example: @ + Name of Website + Number of Letters + Dog’s Name
Facebook: @Facebook8Scooby ; Instagram: @Instagram9Scooby

The truth is that these passwords work only for websites and apps that require low security. After all, it is quite easy to reverse engineer the logic if one password is revealed. And most of us tend to keep the logic simple. Giants like Google, Facebook and even the FBI have been taken down, so our passwords with minimum security don’t stand too high a chance.

So, what’s the point?

The aim is to avoid having the most easily hackable password. If a hacker is specifically after your password, your chances of being safe are dependent solely on the skill level of the hacker. There is no 100% air-tight security. However, such cases are few and far in between. Most hack attacks are blanket attacks done on many accounts simultaneously, with the hope that some will crack. And therefore, as we said earlier, the aim is to avoid having the most easily hackable password. Reduce your vulnerability and reduce the likelihood of your account getting compromised.

What does that mean?

Make your passwords difficult to crack to the best of your abilities. And when that falls short, turn to a password manager or a password vault!

Yes, you read that right. A password manager stores your passwords in a vault controlled by a master password and automatically enters the required password into a browser/app on your request. Now, the thought that all passwords be saved in one location seems the opposite of secure. That is true if you were to save all your password in an excel sheet or a Google document. Using a password manager is more advisable than the alternative of reusing passwords. However, password vaults, especially the paid ones available today on the App Store or Play Store have excellent security protocols. While these managers allow you to set your own passwords, ideally you should let the program choose the password for a website/app. These programs come up with passwords that are completely random, such as uaF@7TaW.!vuJw. Without any logic or phrases, these passwords are near impossible to crack.

For additional security, you should also use two-factor authentication when auto-filling passwords. Of course, the master password you pick for the password manager must be ironclad. You will have to pick something that is complicated and not predictable.

Yes, there’s an inherent risk in trusting a password vault with all your online safety. However, that’s essentially how the whole online ecosystem works. Our browsers are constantly tracking our data in exchange for access to the internet. Your phone is continuously tracking your usage patterns in order to better your user experience. Similarly, the chances of getting hacked when using a password vault are far fewer than trying to randomise passwords yourself across the many, many accounts we maintain.

Get Cracking and Protect Your Passwords!

Some good password vaults are 1Password, Dashlane, KeePass, LastPass and RoboForm. If you use Chrome on your PC and an Android phone, Google Password Manager is also recommended. Paid apps usually come with better security protocols and stronger defense algorithms. However, it’s a small price to pay in exchange for having to remember many passwords across platforms!

Some key points to remember for passwords are:

  • Alpha-numeric with special characters (obviously!)
  • Do not use personal information like birthdays
  • Use words from different languages
  • Avoid standard symbols such as ! @ &
  • Size matters; longer passwords are tougher to crack

Do you have any suggestions for passwords?

If you want to know more about password vaults, let us know and we'll do another blog. In the meantime, check out the certificate and diploma courses on our website to up your skills!

Safety on Social Media Platforms

Malaika Naidu

The most valuable resource today is not oil, water or fresh air – it’s data! An article in The Economist recently outlined just how valuable this resource is to organisations the world over. It’s alarming how data mining can influence people and hence dictate real events. Now answer this, where can one find unlimited, often unprotected, data?

Yes, Social Media.

What started off as platforms to engage with friends and peers has fast turned into a gateway for all sorts of transactions. Given that social media platforms are not strictly bound by age, almost everyone has an account on at least one such platform - Facebook, Twitter, Instagram, and LinkedIn being the Big Four.

Some still use it for mere entertainment, like a quick scroll through while you wait for your food at a café. But with the sheer reach of these platforms, many now use them as tools to increase or represent their businesses, thereby adding a whole new dimension to the user data now available through these websites/apps.

If you willingly share any valuable data about yourself or those in your life, then you have to be ready for those waiting to misuse it. Internet crime is seeing a marked shift from basic email-related crimes to social media crimes. These include identity theft, photo morphing, romance scams and of course, cyberbullying and cyber stalking! 

Cyberbullying and cyberstalking are becoming serious safety issues. The anonymity of the internet allows people to easily get away with saying or doing things that they probably won’t dare to do in real life. People go out of their way to create fake profiles solely for such purposes. This is why it’s important to connect and interact only with individuals you already know in real life or through trusted connections. However, your vulnerability on social media is not just in your hands.

Let’s assume you take all the required precautions to ensure that you don’t put any personal data on your Instagram account. You only upload photos of your photography. But then a friend of yours puts a photo of you and in the description mentions personal information about you – your birthday, your pet’s name or your parents’ names. Maybe even tags the location to your house. Now, all your effort to keep your personal data offline is slowly getting negated.

Some might ask, how bad can the damage from social media be? Do these crimes even require as much attention as say bank frauds?

Well, a recent report, called Social Media Platforms and the Cybercrime Economy, stated that cybercriminals are earning at least $3.25 billion per year from social media-enabled cybercrime, with the breakdown of earnings being close to:

  • Illegal pharmaceutical sales (i.e. prescription drugs) – $1.9 bn
  • Stolen data sales – $630 m
  • Financial fraud – $290 m
  • Crypto-mining malware – $250 m
  • Romance/dating fraud – $138 m

The crux of the issue is the ease with which cybercriminals can access data of millions of users, globally. We’ve said it often and we continue to stress on it – just as the internet has made our lives easier, faster and more convenient, so has it helped the criminals too! In fact, research states that one out of five large organisations is now potentially infected with malware distributed via social media. Nearly 40% of malware infections are linked to malvertising, add to that 30% that comes from malicious plug-ins and apps.

Yet, don’t worry. As always, you just need to do the basics and you will considerably reduce your vulnerability.

  • Keep your passwords long with mixed characters; change them regularly
  • Approach the internet with distrust – what you see online is rarely a representation of reality
  • If you can’t say it in front of your grandmother, don’t say it on social media
  • Always log out from others’ devices. Ideally, log out from your own phone/laptop too!
  • Regularly update your settings for privacy and content sharing
  • Just because you have connections, doesn’t mean you must accept the friend request
  • Use two-factor authentication!
  • Avoid sharing personal information that can be used against you

And please, if you do witness a cybercrime, report it! If someone you know is posting content that is against the platform’s policies, report! Internet safety is a community effort.

Do you have some safety practices that you would like to share?

Introduction to ASCL Courses

Malaika Naidu
Asian School of Cyber Laws Blog Background
Introduction to ASCL courses

Asian School of Cyber Laws is an organisation that strives to make education easily accessible and efficiently delivered. Our journey began in 1999, even before the Information Technology Act (2000) came into effect. Bringing together the fields of Information Technology and Law, our courses are carefully crafted to serve members of the legal fraternity as well as individuals from other fields such as business, banking, law enforcement, CA, CS, engineering, marketing and more. Over the last 20 years, we’ve shared our knowledge with over 75,000 students.

In a world where almost all our interactions are digital, and online safety is non-negotiable, people still tend to share ATM pins with others, write down passwords, and leave themselves logged in on computers that are not theirs. Some even continue to use QWERTY as a password!

ASCL has been ceaselessly working towards remedying this and strives to make cyber education as simple to comprehend as 2+2=4.

All our courses are for a duration of 6-months with digital course material and online examinations. Here’s a brief overview:

Diploma in Cyber Law (DCL)
An introduction to the field of cyber law, DCL covers the basics that everyone must know about the laws that govern cyber space. The course will help you navigate real situations like leaked photos, credit card fraud, hacked emails or social media accounts, and other such real cyber issues. The syllabus covers the fundamentals of cyber law with actual case examples.

Cyber Crime Prosecution and Defence (CCPD)
CCPD will help you navigate the judicial and investigative framework under the Information Technology Act, 2000. This tailor-made course for lawyers and law enforcement officers, covers relevant entities, terms and concepts with cyber-crime case laws and global cyber-crime law all from the perspective of presenting cases in prosecution or defence. An expert level course that requires participants to have at least completed their graduation, it’s also available to law students who have completed 3 years of the integrated 5-year LLb program.

Digital Evidence Specialist (DES)
Digital evidence is becoming increasingly relevant in conventional and unconventional crimes such as murder, adultery, data theft, matrimony scams, cyber stalking, online banking fraud and many more. This is only natural given we use the internet for everything from communication to buying groceries! This course covers the various types of digital evidence and standard operating procedures using case files. It emphasises on the collection and the subsequent production of such evidence in a court of law. Participants need to complete their under-grad to apply for DES. It’s also available to law students who have completed 3 years of the integrated 5 year LLb program.

Internet Investigation Specialist (IIS)
With the rapid growth in cyber-crimes, internet investigators are a growing breed. This course starts from the basics of the internet and the World Wide Web, followed by tools, tips and tricks to conduct digital investigation. From emails to screenshots, browser history to social media activity, including cloud safety and bitcoins – IIS will help you achieve Sherlock’s level of attention to detail and crime solving ability!

There you have it. To start your journey in the cyber world with ASCL, click here! The best part is – we’re constantly looking at feedback to develop fresh courses that could fill gaps in the current system. Soon, we will be offering state of the art courses in Intellectual Property Law too. Stay tuned for more updates!

The 9 sides of cyber security

Endpoint security — Network Security — Application Security — Incident Response — Regulatory Compliance — Data Protection — Training — Testing — Contingency Planning

9 Sides of Cyber Security

1. End-point security

Endpoint security requires that each computing device on the network comply with certain standards before network access is granted.

Endpoints include laptops, desktops computers, smart phones, and other communication devices, tablets, specialized equipment such as bar code readers, point of sale (POS) terminals etc.

End-point security encompasses:

  1. Host-based firewalls, intrusion detection systems, and intrusion prevention systems
  2. Host-based anti-virus systems, anti-malware systems, anti-spyware systems, anti-rootkit systems, anti-phishing systems, pop-up blockers, spam detection systems, unified threat management systems
  3. SSL Virtual Private Networks
  4. Host Patch and Vulnerability Management
  5. Memory protection programs
  6. Control over memory devices, Bluetooth Security
  7. Password Management
  8. Security for Full Virtualization Technologies
  9. Media Sanitization
  10. Securing Radio Frequency Identification (RFID) Systems

2. Network Security

Network security relates to the cyber security aspects of computer networks and network-accessible resources.

Network Security encompasses:

  1. Secure authentication and identification of network users, hosts, applications, services and resources
  2. Network-based firewalls, intrusion detection systems, and intrusion prevention systems
  3. Network-based anti-virus systems, anti-malware systems, anti-spyware systems, anti-rootkit systems, unified threat management systems
  4. Network Patch and Vulnerability Management
  5. Virtual Private Networks
  6. Securing Wireless Networks
  7. Computer Security Log Management
  8. Enterprise Telework and Remote Access Security
  9. Securing WiMAX Wireless Communications
  10. Network Monitoring
  11. Network Policy Management

3. Application Security

Application security relates to the cyber security aspects of applications and the underlying systems.

Application attacks include:

  1. Input Validation attacks such as buffer overflow, cross-site scripting, SQL injection, canonicalization
  2. Authentication attacks such as network eavesdropping, brute force attacks, dictionary attacks, cookie replay, credential theft
  3. Authorization attacks such as elevation of privilege, the disclosure of confidential data, data tampering, luring attacks
  4. Configuration management attacks such as unauthorized access to administration interfaces / configuration stores, retrieval of clear text configuration data, lack of individual accountability, over-privileged process & service accounts
  5. Sensitive information attacks such as access to sensitive data in storage, network eavesdropping,
  6. Session management attacks such as session hijacking, session replay, man in the middle,
  7. Cryptography attacks due to poor key generation or key management and weak or custom encryption,
  8. Parameter manipulation attacks e.g. query string manipulation, form field / cookie / HTTP header manipulation,
  9. Exception management attacks such as denial of service,
  10. Auditing and logging attacks

4. Cyber Incident Response

Incident Response relates to the plans, policies, and procedures for handling cyber security incidents.

Broadly speaking, Cyber Incident Response covers:

  1. Organizing an Incident Response Capability
  2. Preparing for and preventing Incidents
  3. Detection and analysis of Incidents
  4. Containment, Eradication, and Recovery
  5. Post Incident Activity

Specifically, Cyber Incident Response encompasses:

  1. Forensic Imaging & Cloning
  2. Recovering Digital Evidence in Computer Devices
  3. Mathematical Authentication of Digital Evidence
  4. Analysing Data from Data Files, Operating Systems, Network Traffic, Applications, and Multiple Sources
  5. Analyzing Active Data, Latent Data, and Archival Data
  6. Wireless, Network, Database and Password forensics
  7. Social media forensics
  8. Malware, Memory and Browser forensics
  9. Cell Phone Forensics
  10. Web and Email investigation
  11. Analysing Server Logs

5. Regulatory Compliance

Regulatory Compliance relates to measures undertaken to ensure compliance with applicable laws and mandatory cyber security standards.

Failure to meet regulatory compliance requirements can result in civil and criminal action and even imprisonment for organization heads.

Usage of consolidated and harmonized compliance controls ensures regulatory compliance without unnecessary duplication of effort and activity.

One such control system is the “Effective Compliance and Ethics Program” contained in Chapter 8B2.1 of the Federal Sentencing Guidelines Manual issued by the United States Sentencing Commission.

Another control is the “AS 3806- 2006” issued by Standards Australia. This provides guidance on:

  1. The principles of effective management of an organization’s compliance with its legal obligations, as well as any other relevant obligations such as industry and organizational standards
  2. The principles of good governance and accepted community and ethical norms.

6. Data Protection

Data Protection relates to the cyber security aspects of protecting the confidentiality, integrity, and availability of data.

From a Data Protection perspective, data can be classified into 3 types — data at rest, data in motion and data under use.

Critical and confidential data includes source code, product design documents, process documentation, internal price lists, financial documents, strategic planning documents, due diligence research for mergers and acquisitions, employee information, customer data such as credit card numbers, medical records, financial statements etc.

Data Loss Prevention solutions:

  1. Identify confidential data
  2. Track that data as it moves through and out of enterprise
  3. Prevent unauthorized disclosure of data by creating and enforcing disclosure policies

Various encryption technologies such as symmetric encryption, public key encryption, and full disk encryption can be used for data protection.

A data protection policy involves:

  1. Instituting good security and privacy policies for collecting, using and storing sensitive information
  2. Using strong encryption for data storage.
  3. Limiting access to sensitive data.
  4. Safely purging old or outdated sensitive information.

7. Cyber Security Training

Cyber Security Training is a formal process for educating personnel about cyber security and building relevant skills and competencies.

Cyber Security Training ensures that relevant personnel understand their cyber security responsibilities. This enables them to properly use and protect the information and resources entrusted to them.

Effective cyber security training must include:

  1. Real-world training on systems that emulate the live environment,
  2. Continual training capability for routine training,
  3. Timely exposure to new threat scenarios,
  4. Exposure to updated scenarios reflecting the current threat environment,
  5. Coverage of basic day-to-day practices required by the users

8. Cyber Security Testing

Cyber Security Testing is the process of ascertaining how effectively the entity meets specific cyber security objectives.

Cyber Security Testing encompasses:

  1. Review Techniques, which include Documentation Review, Log Review, Ruleset Review, System Configuration Review, Network Sniffing, and File Integrity Checking
  2. Target Identification and Analysis Techniques, which include Network Discovery, Network Port and Service Identification, Vulnerability Scanning, Active & Passive Wireless Scanning, Wireless Device Location Tracking, and Bluetooth Scanning
  3. Target Vulnerability Validation Techniques which include Password Cracking, Penetration Testing, Penetration Testing and Social Engineering
  4. Security Assessment Planning which includes Developing a Security Assessment Policy, Prioritizing and Scheduling Assessments, Selecting and Customizing Techniques, Assessment Logistics, Assessor Selection and Skills, Location Selection, Technical Tools and Resources Selection, Assessment Plan Development and Legal Considerations
  5. Security Assessment Execution which includes Coordination, Assessing, Analysis, Data Handling, Data Collection, Data Storage, Data Transmission and Data Destruction
  6. Post Testing Activities which includes Mitigation Recommendations, Reporting and Remediation/Mitigation

9. Contingency Planning

Contingency planning revolves around preparing for unexpected and potentially unfavorable events that are likely to have an adverse impact.

Types of Contingency Plans are:

  1. Business Continuity Plan
  2. Continuity of Operations Plan
  3. Crisis Communications Plan
  4. Critical Infrastructure Protection Plan
  5. Cyber Incident Response Plan
  6. Disaster Recovery Plan
  7. Information System Contingency Plan
  8. Occupant Emergency Plan

Stages in the Information System Contingency Planning Process are:

  1. Developing the Contingency Planning Policy Statement
  2. Conducting the Business Impact Analysis
  3. Identifying Preventive Controls
  4. Creating Contingency Strategies
  5. Plan Testing, Training, and Exercises
  6. Plan Maintenance

22 Essential Skills for a Cyber Crime Investigator

22 Skills of a Cyber Crime Investigator

We live in a world where everything seems to be getting hacked — Airplanes, ATM machines, Baby monitors, Biometric devices, Bitcoin wallets, Cars, CCTV cameras, Drones, Gaming consoles, Health trackers, Medical devices, Power plants, Self-aiming rifles, Ships, Smart-watches, Smartphones & more.

The increasing global cost of cybercrime ($100 billion+ a year) has led to a massive surge in the demand for cybercrime investigators. This article explores the 22 skills every cybercrime investigator must have.

Skill 1: Web Technologies

Considering the magnitude and impact of web attacks, it is necessary for a cyber crime investigator to understand some of the technologies that run the Internet and the World Wide Web.

This includes practical activities including hosting a domain, creating SFTP users, setting up custom MX records, setting up, configuring & administering private email accounts, databases, and Virtual Private Servers, configuring SSL for secure websites and deploying cloud infrastructure. The investigator must also understand installing, configuring & deploying content management systems and e-commerce platforms.

Skill 2: Web Hacking

Since a majority of cyber crime cases involve web-hacking or web-attacks, it is essential for cyber crime investigators to have a strong knowledge of the techniques of web hacking such as Footprinting, Bypassing Authorization Schema, SQL injection, Cross Site Scripting (XSS), Broken Authentication, Session Hijacking, Unvalidated Redirects & Forwards, and Cross-Site Request Forgery (CSRF).

Skill 3: Suspect interviewing

Effective suspect interviewing is an essential skill for cybercrime investigators. The investigator must understand the difference between an interrogation and an interview and how to prepare for and conduct a suspect interview. The investigator must be able to detect deception, document an interview and get an admission from a suspect. An investigator must also know how to conduct an inquiry in an organization.

Skill 4: Documentation

Even the best investigation is worthless if it is not supported by accurate and relevant documentation and that’s why a thorough understanding of documentation is essential for a cybercrime investigator.

Skill 5: Law

Every step of an investigation must be in compliance with the law and that’s why a thorough understanding of the applicable law is essential for a cyber crime investigator.

Skill 6: Phishing tools, techniques, and counter-measures

Phishing is one of the most popular techniques among hackers and financial cyber criminals. This makes it important for a cyber crime investigator to understand phishing tools, techniques, and counter-measures.

Skill 7: Virtual Payment Systems

Virtual Payment Systems have taken the global money markets by storm. A cyber crime investigator must have a strong understanding of how these systems work.

Skill 8: Financial instruments and concepts

Financial crimes are some of the most interesting cases that cyber crime investigators are called upon to solve. These include including advance-fee scam, bank frauds & carding, charge back fraud, check washing, check fraud, credit card fraud, identity theft, insider trading, insurance fraud, mortgage fraud, ponzi schemes, securities fraud, skimming, wireless identity theft and more.

Skill 9: Forensic accounting

Forensic Accountants are called upon in cases involving economic damages calculations, bankruptcy, securities fraud, tax fraud, money laundering, business valuation, and e-discovery. It is important for a cyber crime investigator to have a basic understanding of forensic accounting.

Skill 10: Fraud Investigation

Many times a cyber crime investigator is called upon to handle fraud investigations. An investigator must understand Fraud (its extent, patterns and causes), Fraud Risk Assessment & Management, Fraud Prevention, Detection & Reporting.

Skill 11: Bitcoin & other crypto-currencies

Bitcoin is, without doubt, the most famous crypto-currency. It gained a lot of notoriety during the crackdown on Silk Road, an underground online marketplace trading in drugs, stolen financial information, weapons & more.

Considering the use of bitcoin (and other cryptocurrencies) by criminals, a strong understanding of bitcoin forensics is essential for cyber crime investigators.

Skill 12: Malware incident prevention & incident response

Considering the impact of malware, it is essential for a cyber crime investigator to have a strong understanding of malware incident prevention and malware incident response.

Skill 13: Dark Web

The World Wide Web that the vast majority of netizens use is also referred to as the clearnet — since it primarily is unencrypted in nature. Then there is the deep web — the part of the clearnet, which is not indexed by search engines. Deep web includes data stored in password-protected pages and databases. The darkweb is a small part of the deepweb. The deepweb consists of darknets including peer-to-peer networks, Freenet, I2P, and Tor. The Tor darkweb is also called onionland, since its top level domain suffix is .onion and it uses the traffic anonymization technique of onion routing.

Considering the popularity of the darkweb amongst the organized criminals groups, a cyber crime investigator must have a thorough working knowledge of the dark web.

Skill 14: Email investigation

Despite the popularity of instant messengers (such as Whatsapp) and social media, email remains one of the most popular methods of online communication in the world. This makes it essential for a cyber crime investigator to have a strong knowledge of email tracking & tracing.

Skill 15: Log analysis

In a large number of cyber crime cases, the investigation begins with an analysis of server logs. It is essential for a cyber crime investigator to have a sound working knowledge of server log analysis.

Skill 16: Browser forensics

In many cases of cyber crime, valuable evidence can be obtained from web browsers. This makes it important for a cyber crime investigator to have a strong practical knowledge of browser forensics.

These evidence points include history, bookmarks, credit card information & contact information stored in autofill, saved passwords, files in the download location. Browser forensics also involves analysis of cloud printers and other connected devices, extensions, cookies and site data, location settings and exceptions, media settings (like camera and microphone permissions) & exceptions, unsandboxed plug-in access & exceptions, automatic downloads and exceptions and more.

Skill 17: Social Media Forensics

It’s probably not incorrect to say that almost every Internet user is part of at least one social media platform. This makes social media forensics an essential skill for a cyber crime investigator.

Skill 18: Google Ecosystem & its Forensics

Google isn’t just a search engine anymore. The Google ecosystem is all around us — Gmail, YouTube, Google groups, Google sites, Google plus, Google keep and so much more. This makes Google forensics a must-have skill for cyber crime investigators.

Skill 19: Forensic technologies

It is essential for a cyber crime investigator to have a strong working knowledge of forensic technologies, cyber forensic concepts and ISO/IEC 27037 — the most important global standard for identification, collection, acquisition and preservation of potential digital evidence.

Skill 20: Cyber security

A basic working knowledge of cyber security is essential for everyone and more so for cyber crime investigators. Aspects of information security include Application Security, Cloud Computing Security, Computer Security, Cyber Security Standards, Data Security, Database Security, Information Security, Internet Security, Mobile Security, and Network Security.

Skill 21: Cryptography & Steganography

Many people use cryptography and steganography. And these include criminals and terrorists. Hence a working knowledge of these is useful for cyber crime investigators.

Skill 22: Password recovery & forensics

In many cases it is found that potential evidence is locked up in password protected files. This makes it essential for cyber crime investigators to have a strong practical knowledge of password recovery & forensics.

Cyber Education- the Road Less Known

Cyber Education - the road less known

I’m not a techie, nor a lawyer and yet here I am in a field that takes on both these mammoths. I’ve been here a long time; India’s had her cyber law in place since the year 2000. So, it’s deeply disappointing to see the confusion in students and professionals alike about the various aspects of a cyber education.

Yes, I said cyber education and not just an IT education. So, I’m not only talking about the technology in cyberspace. I’m referring to the other side of the spectrum.

9 out of 10 people today have faced some type of cybercrime. And yet, almost 7 out of those 9 will not know what to do about it.

I thought about cybercrime, you know, as a non-techie and a non-lawyer, and decided to break it down to its foundation stones.

Here, let’s create our first bifurcation. Cybercrime may be divided into 2 parts — Pre-crime and Post-crime

Pre-crime

This is where your crime hasn’t happened yet. So, you are basically hoping for the best and preparing for the worst. This can also be divided further into:

1. Cyber security

In layman’s terms, every step that you take to ensure that your computer hardware, computer software, networks, accounts etc. remain safe from any breach, aka cybercrime, is cyber security. Simple, isn’t it? Well, simple is where this article stays. You want a connoisseur’s break up of the cyber security menu, see: The 9 sides of cyber security

2. Cyber Insurance

The obvious next step in pre-crime schedule. What you may not be able to secure ought to be insured.

Post-crime

This is where your cybercrime worst has happened. Now, hopefully, you aren’t affected too badly. But even if you are, there are divisions to this part that can help you.

1. Cyber Law

This is the law that governs cyberspace and as often as not has jurisdiction beyond your country. So, where do you report a cybercrime. Cyber law tells you the where, how and whom to approach. It also tells you the punishments for various cybercrimes. You know, in case you may be committing one?

2. Cyber Investigation

Here’s where the sleuths step in. Professionals here need to have that investigative streak and need to be armed with the latest tools and techniques of cyber investigation. This is where you get answers to how the cybercrime was committed and with any luck, may just get the criminal. And again, if you want the real dirt on what all an investigator needs to know, see — 25 Skills Essential for a Cyber Crime Investigator

So, you’re a student or professional who has a thought that they want a piece of the humongous cybercrime pie. This article may just have helped you understand where you want to be.

Just be prepared to keep learning to stay abreast in this ever-evolving super-exciting space.

What is cyber law and why do we need it?

What is cyber law and why do we need it?

What is Cyber Law?

In order to arrive at an acceptable definition of the term Cyber Law, we must first understand the meaning of the term law. Simply put, law encompasses the rules of conduct:

  1. that have been approved by the government, and
  2. which are in force over a certain territory, and
  3. which must be obeyed by all persons on that territory. Violation of these rules will lead to government action such as imprisonment or fine or an order to pay compensation.

The term cyber or cyberspace has today come to signify everything related to computers, the Internet, websites, data, emails, networks, software, data storage devices (such as hard disks, USB disks etc) and even Airplanes, ATM machines, Baby monitors, Biometric devices, Bitcoin wallets, Cars, CCTV cameras, Drones, Gaming consoles, Health trackers, Medical devices, Power plants, Self-aiming rifles, Ships, Smart-watches, Smartphones & more.

Thus a simplified definition of cyber law is that it is the “law governing cyber space”.

The issues addressed by cyber law include cyber crime, electronic commerce

1. Cyber crime

An interesting definition of cyber crime was provided in the “Computer Crime: Criminal Justice Resource Manual” published in 1989. According to this manual, cyber crime covered the following:

  1. computer crime i.e. any violation of specific laws that relate to computer crime,
  2. computer related crime i.e. violations of criminal law that involve a knowledge of computer technology for their perpetration, investigation, or prosecution,
  3. computer abuse i.e. intentional acts that may or may not be specifically prohibited by criminal statutes. Any intentional act involving knowledge of computer use or technology is computer abuse if one or more perpetrators made or could have made gain and / or one or more victims suffered or could have suffered loss.

2. Electronic commerce

The term electronic commerce or E-commerce is used to refer to electronic data used in commercial transactions. Electronic commerce laws usually address issues of data authentication by electronic and/or digital signatures.

3. Intellectual Property in as much as it applies to cyberspace

This encompasses:

  1. copyright law in relation to computer software, computer source code, websites, cell phone content etc;
  2. software and source code licenses;
  3. trademark law with relation to domain names, meta tags, mirroring, framing, linking etc.;
  4. semiconductor law which relates to the protection of semiconductor integrated circuits design and layouts;
  5. patent law in relation to computer hardware and software.

4. Data protection & privacy

Data protection and privacy laws address legal issues arising in the collecting, storing and transmitting sensitive personal data by data controllers such as banks, hospitals, email service providers etc.

The Need for Cyber Law

The first question that a student of cyber law will ask is whether there is a need for a separate field of law to cover cyberspace. Isn’t conventional law adequate to cover cyberspace?

Let us consider cases where so-called conventional crimes are carried out using computers or the Internet as a tool. Consider cases of spread of pornographic material, criminal threats delivered via email, websites that defame someone or spread racial hatred etc. In all these cases, the computer is merely incidental to the crime. Distributing pamphlets promoting racial enmity is in essence similar to putting up a website promoting such ill feelings.

Of course, it can be argued that when technology is used to commit such crimes, the effect and spread of the crime increases enormously. Printing and distributing pamphlets even in one locality is a time consuming and expensive task while putting up a globally accessible website is very easy.

In such cases, it can be argued that conventional law can handle cyber cases. The Government can simply impose a stricter liability (by way of imprisonment and fines) if the crime is committed using certain specified technologies. A simplified example would be stating that spreading pornography by electronic means should be punished more severely than spreading pornography by conventional means[1].

As long as we are dealing with such issues, conventional law would be adequate. The challenges emerge when we deal with more complex issues such as ‘theft’ of data. Under conventional law, theft relates to “movable property being taken out of the possession of someone”.

The General Clauses Act defines movable property as “property of every description, except immovable property”. The same law defines immovable property as “land, benefits to arise out of land, and things attached to the earth, or permanently fastened to anything attached to the earth”. Using these definitions, we can say that the computer is movable property.

Let us examine how such a law would apply to a scenario where data is ‘stolen’. Consider my personal computer on which I have stored some information. Let us presume that some unauthorized person picks up my computer and takes it away without my permission. Has he committed theft? The elements to consider are whether some movable property has been taken out of the possession of someone. The computer is movable property and I am the legal owner entitled to possess it. The thief has dishonestly taken this movable property out of my possession. It is theft.

Now consider that some unauthorized person simply copies the data from my computer onto his pen drive. Would this be theft? Presuming that the intangible data is movable property, the concept of theft would still not apply as the possession of the data has not been taken from me. I still have the ‘original’ data on the computer under my control. The ‘thief’ simply has a ‘copy’ of that data. In the digital world, the copy and the original are indistinguishable in almost every case.

Consider another illustration on the issue of ‘possession’ of data. I use the email account rohasnagpal@gmail.com for personal communication. Naturally, a lot of emails, images, documents etc are sent and received by me using this account. The first question is, who ‘possesses’ this email account? Is it me because I have the username and password needed to ‘login’ and view the emails? Or it is Google Inc because the emails are stored on their computers?

Another question would arise if some unauthorized person obtains my password. Can it be said that now that person is also in possession of my emails because he has the password to ‘login’ and view the emails?

Another legal challenge emerges because of the ‘mobility’ of data. Let us consider an example of international trade in the conventional world. Sameer purchases steel from a factory in China uses the steel to manufacture nails in a factory in India and then sells the nails to a trader in the USA. The various Governments can easily regulate and impose taxes at various stages of this business process.

Now consider that Sameer has shifted to an ‘online’ business. He sits in his house in Pune (India) and uses his computer to create pirated versions of expensive software. He then sells this pirated software through a website (hosted on a server located in Russia). People from all over the world can visit Sameer’s website and purchase the pirated software. Sameer collects the money using a PayPal account that is linked to his bank account in a tax haven country like the Cayman Islands.

It would be extremely difficult for any Government to trace Sameer’s activities.

It is for these and other complexities that conventional law is unfit to handle issues relating to cyberspace. This brings in the need for a separate branch of law to tackle cyberspace.

Master the art of Cyber Crime Investigation with the CCI+ course

Cyber Crime Investigators play a crucial role in eCommerce companies, audit firms, banks, IT companies, Government, police, enforcement & military agencies agencies and manufacturing companies.

We live in a world where everything seems to be getting hacked - not just laptops, smartphones & websites but also cars, aeroplanes, ships, drones, self aiming rifles, ships, CCTV cameras, medical devices, bitcoin wallets, smart-watches and more...

The ASCL Certified Cyber Crime Investigator + course prepares you to handle cases involving digital evidence and cyber trails.

Cyber Crime Investigators are an integral part of:

  • Information Security teams,
  • Incident Response teams,
  • Fraud Control teams.

These teams are crucial in eCommerce companies, audit firms, banks, IT companies, Government agencies and manufacturers.

Cyber Crime Investigators are also required by police, enforcement and military agencies.

Cyber Crime costs the world more than Rs. 57,000,000,000,000 every year. Companies and Governments need skilled cyber crime investigators to contain this US $ 114 billion annual cost.

The 25 skills every cyber crime investigator must have

  1. Basic Web Programming skills.
  2. Working knowledge of Web Technologies.
  3. Strong working knowledge of Web Hacking.
  4. Effective suspect interviewing skills.
  5. Thorough understanding of documentation.
  6. Sound knowledge of the relevant law.
  7. Practical knowledge of phishing tools, techniques and counter-measures.
  8. Strong knowledge of the working of Virtual Payment Systems.
  9. Understanding of financial instruments and concepts.
  10. Basic understanding of forensic accounting.
  11. Practical knowledge of Fraud Investigation.
  12. Practical knowledge of investigating Bitcoin & other crypto-currencies.
  13. Strong understanding of malware incident prevention & incident response
  14. Thorough practical knowledge of the Dark Web.
  15. Strong practical knowledge of email investigation.
  16. Thorough practical knowledge of Server Log analysis.
  17. Strong practical knowledge of browser forensics
  18. Thorough understanding of Social Media Forensics.
  19. Thorough understanding of the Google Ecosystem & its Forensics.
  20. Strong working knowledge of forensic technologies.
  21. Understanding of the ISO/IEC 27037 standard.
  22. Basic working knowledge of cyber security.
  23. Working knowledge Cryptography & Steganography.
  24. Strong practical knowledge of password recovery & forensics.
  25. Updated knowledge of the latest cyber attacks around the world.

As per Ministry of Human Resources Development estimates - India needs 2.5 lakh cyber experts and professionals to effectively tackle cyber crimes. (Source: Times of India Feb 10, 2011).

Course History

This course was launched in February 2002. In the last 13 years it has been completed by 1000s of participants including:

  • Police Officers,
  • Lawyers & law students,
  • IT professionals & Engineering students,
  • Chartered accountants & CA students,
  • Company Secretaries & CS students,
  • Tax & other Government officials,
  • Military personnel,
  • Management Professionals,
  • Commerce Graduates and students.

The ASCL Certified Cyber Crime Investigator + course was launched in February 2002. In the last 13 years it has been completed by 1000s of participants.

Course Syllabus

This course has 24 modules:

  1. Cyber Crime - Global Scenario
  2. Web Technologies
  3. Web Programming
  4. Web Hacking & Investigation
  5. Suspect Interviewing
  6. Documentation & Legal Issues
  7. Phishing
  8. Virtual Payment Systems
  9. Investigating Financial Crimes
  10. Forensic Accounting
  11. Fraud Investigation
  12. Bitcoin Forensics
  13. Malware
  14. Dark Web
  15. Email Investigation
  16. Investigating Server Logs
  17. Browser Forensics
  18. Social media forensics
  19. Google ecosystem & forensics
  20. Forensic Technologies
  21. Cyber Security Fundamentals
  22. Cryptography & Steganography
  23. Password Forensics
  24. Real World Case Studies

 

India's most popular cyber law course completes 11 years and 20,000 students

India's first and most popular Diploma in Cyber Law course has completed 11 years.

The course was launched in 2004 and has been completed by more than 20,000 participants including

  • Judges,
  • Police Officers,
  • Lawyers & law students,
  • IT professionals & Engineering students,
  • Chartered accountants & CA students,
  • Company Secretaries & CS students,
  • Tax & other Government officials,
  • Military personnel,
  • Management Professionals,
  • Commerce Graduates and
  • Students.

This course is conducted by Asian School of Cyber Laws jointly with The Government Law College, Mumbai (GLC). Founded in 1855, GLC is the oldest law school in Asia dating even prior to the University of Mumbai.

The course is conducted in:

  • distance mode (next batch begin January 2016) and
  • classroom mode (next batch begins July 2016).

With a very low fee (Rs 4,500 for distance mode), the course offers tremendous value for money.

Course Syllabus:

  1. Fundamentals of Cyber Law
  2. E-commerce-Legal issues
  3. Intellectual Property Issues & Cyber space - Indian Perspective
  4. Cyber crime and Digital Evidence - Indian Perspective