Web2& Social networking: helping police?

OK, I can't find the post about it; so here we are. "City Council Tells 'Dumbest Criminal' To Stop Posting So Much Evidence To YouTube" - Leeds city council seems to be also dumb? http://www.techdirt.com/articles/20080521/1350411194.shtml (22 May 2008) http://www.dailymail.co.uk/news/article-1020951/Britains-dumbest-criminal-banned-boasting-offences-internet.html?ITO=1490

But a more direct move from a social networking site is not funny at all: people have been banned because of their age (over 36) for fear of porn and sex abuse. Apart from the ridicule of the situation (how on earth all over 36 can be suspected?), it is a pretty dangerous move: it's called private justice for fear of prosecution. "Social Networking Site Bans Anyone Over Age 36 To (Sorta) Deal With Sex Offender Law" http://www.techdirt.com/articles/20080522/2356201207.shtml (23 May 2008)

Hate crime and terrorism

The new trend, at least in the US, is to tackle hate crime via terrorism, by redifining some discourses as terrorist, instead of hate. The assimilation is dangerous for what is terrorism one day can become legal the next, and what is labelled terrorism does not necessarily promote hatred although it often does so. "Senator Lieberman Tries Hunting Down Terrorist Videos On YouTube" http://www.techdirt.com/articles/20080519/1810061172.shtml (20 May 2008)

Fraud: new trend or beyond credit card data

See "Forget Credit Cards, Scammers Now Want Your VoIP Accounts?" (15 May 2008) http://www.techdirt.com/articles/20080514/1756561118.shtml

although the old way remains profitable "Stark warning as UK faces cybercrime boom" http://news.zdnet.co.uk/security/0,1000000189,39431415,00.htm?r=1 (9 june 2008)

Investigation and security

Not sure I agree entirely with the comments below. That police forces have USB keys to enter Microsof products' security features does not necessarily mean that criminals will jump on the loopholes. To take an analogy, for police officers to wiretap never meant that criminals had eavedropped more... A shield can always become a sword in the wrong hands, but it does not mean it should not exist.http://www.techdirt.com/articles/20080429/095514977.shtml (29 April 2008)

Cybercrime and the EU

The COuncil of Europe created the Convention of Cybercrime. Time for the EU, despite the drawback about the treaty of Lisbon, to look at cybercrime a bit more seriously than it has done so up to now.
A study is expected: http://www.crime-research.org/news/02.05.2008/3344/ (2 May 2008)

and the Commission recently took a Framework Decision about cyber attacks in order to clarify legal issues to facilitate responses to crime http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=COM:2008:0448:FIN:EN:PDF (14 July 2008)

Cyber-Investigations and human rights

To monitor the internet to detect (and deter?) crime seems a good idea at first sight. Yet objections are many:

• practical objection: is it realistic to consider being able to control the internet? It's like wanting to monitor the mail correspondance of users throughout the world. Can we imagine the FBI or Europol controlling data held by post offices? Inachievable and therefore a pretence. I don't see how the physical world of letters could be much different from the cyberworld.
• second practical objection: how on earth can you succesfully detect crime when faced with a mass of information? the old fashioned way of doing detective work (on the web understandibly) is a much more efficient than trying to cast a net so vast it would take centuries to find the problematic fish.
• theoritical objection: again, parallels with the so-called physical world enlighten thoughts. Data "held" by post offices are private even when their contents are terrorist or criminal; why should data on the web not considered as private and thus submitted to the same regulations as for obtaining private correspondance? Where are the human rights?

And yet the FBI seriously considers asking the ISPs retention of data http://www.techdirt.com/articles/20080423/184451932.shtml (23rd April 2008)

as well as Russia's authorities who would even go further by blocking traffic like China does http://www.techdirt.com/articles/20080423/185834933.shtml (24th April 2008)

Similar problem with the 9th U.S. Circuit Court of Appeals (so federal law) agreed to let searches of laptop with no specific purposes that looking in the hard drive. Why should we set up conditions for the search of a house, but not the search of a computer when nowadays the computer is like a portable home with sometimes all the documents one needs? Where are the human rights of the accused here? Gone with the wind of fear of crime...

"Is This The Best Homeland Security Can Do In Defending Laptop Searches At The Border?" (TechDirt, 10 July 2008)

http://www.techdirt.com/articles/20080422/235343924.shtml (23rd April 2008) with an update for the Electronic Frontier Foundation asks for Congress to intervene http://www.eff.org/press/archives/2008/05/01 (1 May 2008)

Social networking, privacy and investigations

For once, I can stop criticising social networking. Manchester Police force uses Facebook in an innovative way, to promote communication and gather information about crime; http://www.facebook.com/apps/application.php?id=9878600737&ref=s
I wonder how effective it is and if privacy, which is the biggest problem on social networking, can be maintained. I would be curious to see the results of any study made on this matter.
http://www.techdirt.com/articles/20080418/164250892.shtml (21st April 2008)

As an illustration of privacy issues, see this acknowledgment by Facebook that spammers' attacks increased, notably because the users' contact details such as e-mail adresses are available even if the users have not opted for such "transparency". "Facebook admits to increased attacks by spammers" http://news.zdnet.co.uk/security/0,1000000189,39397448,00.htm (22 April 2008)

And this is without counting on the fact that users often do not realise Facebook is about publicity not keeping details private. See this story about a US military who published photographs of his base!! http://www.techdirt.com/articles/20080423/183304931.shtml (23rd April 2008) or those Oxford students the University disciplined after scrolling Facebook postings http://www.techdirt.com/articles/20080504/2148451026.shtml (6 May 2008)

So it's not surprising that the University of Wales launches academic studies of the social networking phenomenon in relation to cyber security http://www.crime-research.org/news/09.05.2008/3355/ (9 May 2008)

Yet the reaction from N-Y to punish those incriminating themselves on YouTube (I agree, it's not social networking in the proper sense- but its audience makes it similar to social networking) is quite surprising . How can such crime deter people to put videos of illegal activities? What is the purpose of such potential legislation? "New York Wants To Punish Criminals For Incriminating Selves On YouTube" (13 May 2008)http://www.techdirt.com/articles/20080512/1802591092.shtml

Botnets - DDOS

on the phenomenon of botnets, describing its key feature (the difficulty to track down who did what and with or without a criminal intention), see FBI cyber division's sparse comments http://www.crime-research.org/news/16.04.2008/3312/ (16 April 2008)

Cyberterrorism - Definition

An interesting comment about cyberterrorism by the Estonian defense ministry official Christian-Marc Liflander. For him, the last year attack on Estonia belongs to the realm of cyberterrorism; but as pointed out by Stephen Cummings, director of the British government's Centre for the Protection of National Infrastructure, this is far from certain. I would agree: not sure the evidence points out towards terrorism; to threaten governmental institutions does not by itself constitute terrorism - there must be an additional element, that of inspiring terror to the civil population. Although attacking official institutions is often linked to this purpose, the two can be separated. Finally, Mr Liflander partly contradicts himself as he said that little evidence can be gathered about where the attacks came from; so if no evidence of who did it, how can there be evidence of a purpose to terrorise?

http://www.crime-research.org/news/17.04.2008/3316/ (16 April 2008)

compare with the FBI assertion that the internet is used by terrorists groups to communicate, which seems to suggest that it is rarely used to attack institutions: http://www.crime-research.org/news/16.04.2008/3312/ (16 April 2008)


Related to terrorism is the question of national security. The US, or at least some US MPs, seem to have a broad vision of security and include governmental websites. Timothee Lee, from Techdirt, disagrees on the basis that those websites are not linked with the military's protocols on the net. Well, I would argue that it depends of what those websites are supposed to do. If they are the main portal to a wide range of services less and less available in the "physical" world, they may be considered as primary and integrated part of the life of a nation. The building of a city hall or city council where Government offers a range of services could be classified as national security; why not the websites? Maybe the question is linked with what we mean by national security: military or beyond?
Keeping Defense.gov Up Isn't A National Security Issue http://www.techdirt.com/articles/20080518/1934151159.shtml (21 May 2008)

Tangible/intangible? digital goods' nature at stake

Given that the debate in criminal law always turns towards the tangible/intangible nature of what is stolen, deceived..., this proposal from a Californian politician is quite interesting, although at first sight it does not concern criminal law, but simply tax law.

"California Lawmaker Wants To Change Law To Tax iTunes; Pretending Infinite Goods Are Tangible" (9 April 2008) http://www.techdirt.com/articles/20080408/152311789.shtml

Fraud and crime - statistics

As noted in David Wall's new book on Cybercrime - The transformation of crime in the information age -, statistics about e-crime are scarce; so it is interesting to have those of the joint research of the FBI and the NWCCC, in the 2007 Internet Crime Report. Fraud, not surprisingly, is the trendy crime (= big money for small efforts to make. See http://www.crime-research.org/news/07.04.2008/3294/ : “A cyber criminal is only looking for a less than 1% return on all the e-mails he sends out, because he can still make money hand over fist,” said Hambrick, FBI -); but surprise, surprise, the UK is on top of the list as a harbour/haven for criminals.

"UK nears US in cyber-crime, ahead of Nigeria, Romania" (10 April 2008)
http://www.crime-research.org/news/10.04.2008/3303/
"UK a hotbed of cybercriminal activity" (9 April 2008)
http://news.zdnet.co.uk/security/0,1000000189,39382596,00.htm

Will that make the Government think a bit more about establishing a specific task force? or at least give money to tackle more efficiently the problem? Or at least the police? See this article about what seems to be the US:
"Cyber crime: Police not taking it seriously" (8 April 2008)
http://www.crime-research.org/news/08.04.2008/3299/

For more statistics: "Cybercrime Losses Decline for Third Consecutive Year " (31 March 2008) http://www.crime-research.org/news/31.03.2008/3282/

Cyberattacks - prevention by Governments

Four interesting articles about preventing cyberattacks. The first is about creating a real-scale cyberattack to see how the different targets would react and their level of vulnerability.
"International cyberattack drill tests nations' responses " (10 April 2008) http://news.zdnet.co.uk/security/0,1000000189,39383325,00.htm

The second is about the response to an attack, i.e. an early-warning system, a bit like for tsunamis in the pacific?
"US plans cyberattack early-warning system" (video- 10 April 2008) http://news.zdnet.co.uk/security/0,1000000189,39383335,00.htm

With the European COmmission (EU) urging Europe to strengthen its cyber defences "Commission eyes common cyber defences " (9 April 2008) http://www.euractiv.com/en/infosociety/commission-eyes-common-cyber-defences/article-171476

and finally NATO! "NATO agrees common approach to cyber defence" (4 April 2008) http://www.euractiv.com/en/infosociety/nato-agrees-common-approach-cyber-defence/article-171377
"Nato creates cyber-defence command" (9 April 2008)http://news.zdnet.co.uk/security/0,1000000189,39382597,00.htm, with the irony of creating a centre in Estonia! http://www.crime-research.org/news/16.05.2008/3368/ (16 May 2008)

ISPs' criminal liability - YouTube and MySpace

Facts: an internet version of "happy slapping" which has nothing of happy but the name, for it is simply to beat someone up and diffuse the filming by phone or by the internet, here it was via YouTube. Can't see how one can legally argue criminal liability of YouTube: the company obviously did not know about the action before it was committed and can't in any way shape or form "aid, abet, advice..." to committing assault. Hopefully people seem to see sense.
The only liability could be if YouTube did not remove the video once informed of it...

"Video of teen beating raises questions" (11 April 2008)
http://news.yahoo.com/s/ap/20080411/ap_on_hi_te/teen_beating_ethics;_ylt=Aq3pQbSMs7fYFJrAKoBqUvch2.cA

Sentencing/ preventive measures

Rare are the decisions on sentencing and preventive measures. Yet for cybercrime, knowing which sanction is most appropriate is crucial. Ban of computer use may seem obvious, but apart from the question of being feasible, lies the issue of the extent of the ban. The following US example is quite enlightening and maybe the judge could have done with a bit of common sense. Cybercrime may be different (although that is still argued) but it does not mean it should escape logical reasoning. In an alleged $90000 (about £45 000) in tax fraud in New-York, a woman was banned from using computers. A bit too broad a preventive measure; it's like banning somebody to travel around the world for having trespassed in a park...

http://www.upi.com/NewsTrack/Top_News/2008/04/09/fraud_suspect_banned_from_computers/1256/
http://www.techdirt.com/articles/20080410/010534808.shtml (11 April 2008)

and the NY Times http://www.nytimes.com/2008/04/10/nyregion/10indict.html (10 April 2008)

ISPs as enforcers of the law

Nothing new really, but more obvious now. Section 230 (c)(2) CDA (the other part of section 230 is the infamous "child porn provision") allows for ISPs to filter contentious contents. Spam being illegal, ISPs are allowed to filter content, i.e. here e-mails and block the account holder. Law enforced by private companies which are probably quite happy about it because spam is a hindrance to their services. Decision of 10 April 2008 (Northern District Court of Illinois)
http://www.spamsuite.com.nyud.net/index.php?q=node/387
the PDF version (and full decision) is available on http://www.circleid.com/pdf/come360-counterclaim.pdf

From "Court Tells Spammer That It's Not Illegal For An ISP To Filter Its Emails" (11 April 2008) http://www.techdirt.com/articles/20080411/150256827.shtml

Sexual assault and ISPs' liability

Would be funny if not sad and serious. MySpace was sued by daughter and mum as being liable for sexual assault. Hard to see how in this case, for the daughter actually lied about her age and engage into correspondence with a much older man. This in criminal law terms translates itself in error on fact, which means that even the author of the assault may not be considered as having mens rea to commit the actus reus.
"Mother And Daughter Still Blame MySpace For Not Protecting Her From Sexual Assault" (1 April 2008) http://www.techdirt.com/articles/20080331/172442708.shtml

Since then it has been dropped "MySpace Still Not Liable For Sexual Assault Between Two MySpace Users" http://www.techdirt.com/articles/20080517/1524041148.shtml (19 May 2008)

Censorship and China (once more)

Again a week with China and the Olympics. Can't avoid the subject.
This one is interesting: the Olympic Committee has asked China to lift its Firewall. Put aside (momentarily) the cynism of the request, I love what the request stands for: the fact that China could well acknowledge it has a firewall, which it never did up to now (even denied it if I remember well).
Going to the request itself, well, two interpretations which actually can be found in the comments attached to the post on TechDirt: the request does not engage much more the Committee nor China, for what matters is.... making money. Better to lift the veil temporarily to get the maximum profits both for the West ... and for China! Or else the Committee would have a change of heart? well in that case, why not ask for lifting of censorship indefinitely, not simply while the games are there? Plus, is the COmmittee really serious about human rights when it has allowed games in a country not only reknown for its continuous violations of basic human rights but also for its constant refusal to improve (see Tibet as the latest example...) and make the slightest concession
"IOC: No Chinese Internet Filters During Olympics; All Other Times It's Fine" (1 April 2008)http://www.techdirt.com/articles/20080401/105659717.shtml

Similar issue with iTunes http://www.techdirt.com/articles/20080825/2219562089.shtml (26 August2008)

ID fraud under the flashlights

It seems to be the week of ID fraud. A documentary on the BBC yesterday 3 April 2008 pointing out the work of the City of London's Economic Crime Unit and of the anti-virus firm Sophos demonstrating how easy it is to install trojans and the like on anyone computers...
The documentary should undoubtedly raise awareness about ID fraud online and how to protect oneself efficiently
http://www.bbc.co.uk/bbcone/listings/programme.shtml?day=today&service_id=4223&filename=20080403/20080403_2100_4223_10817_60

http://www.sophos.com/security/blog/2008/04/1255.html

One thing that always buggers me is the fact that details of the civil registry and electoral rolls are freely available (date of birth...). At a time when ID fraud is thriving and difficult to detect before it is too late, I can't understand why these personal information databases remain accessible to anyone.

Lastly, it is astonishing to realise that some do not see the threat caused by ID fraud and do not want to criminalise the use of stolen personal information! "ICO urges gov't to retain data-theft laws" (2 April 2008) http://news.zdnet.co.uk/security/0,1000000189,39378353,00.htm

Danger of terrorism...

The US Defense is publicly annoucing it takes cybercrime seriously whether as a direct consequence of cyberterrorism or just simple cyberattacks. Nothing new, but ironically the internet was created by the US military... who now needs to train its own service member about security issues
"US reveals plans to hit back at cyber threats " (2 April 2008) http://news.zdnet.co.uk/security/0,1000000189,39378374,00.htm

"Army Sets Up Phishing Scam To See How Gullible Service Members Are" (3 April 2008) http://www.techdirt.com/articles/20080402/194347734.shtml


and businesses also take the threat seriously "Accenture and Sun aim to widen security scope" (2 April 2008) http://news.zdnet.co.uk/security/0,1000000189,39378365,00.htm

ISPs, prosecution and human rights

It seems that Yahoo! wishes to "clean up" its act: it offered $1m to study the link between the internet and international values, meaning human rights. After having contributed to giving in a chinese dissident, is Yahoo! willing to repent? The gesture could go into two different directions: a pure PR exercise destined to exorcise the bad name but with no real consequences and change of policy; or a strength to behave more responsibility and more in accordance with what the US and the West are supposed to embody, i.e. human rights. Where the wind will blow will undoubtedly depend on the quality of the research done, i.e. the methodology used and the people employed to do the work, as well as the lessons that will be learnt. There is no time frame given in the article, so we may well have to wait a while, forever? Because to declare there are "grey areas" which render doing business difficult international is an euphemism for not having the courage to stand by one's opinions and values and let greed take over. Yes fighting for freedom does not bring any penny in difficult situations, but that's the short term view is it?
"Yahoo CEO: Business overseas fraught with 'grey areas' " (4 April 2008)
http://news.zdnet.co.uk/internet/0,1000000097,39379891,00.htm