Gift of Fire (5th Ed.) Ch 5 - Crime & Security - PDF

Gift of Fire, A: Social, Legal, and Ethical Issues for Computing Technology Fifth Edition Chapter 5 Crime and Security Copyright © 2018, 2013, 2008 Pearson Education, Inc. All R...

Gift of Fire, A: Social, Legal, and Ethical Issues for Computing Technology Fifth Edition Chapter 5 Crime and Security Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved What We Will Cover Hacking Identity Theft and Credit Card Fraud Whose Laws Rule the Web Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Hacking (1 of 17) Intentional, unauthorized access to computer systems The term has changed over time Phase 1: The joy of programming – Early 1960s to 1970s – It was a positive term – A “hacker” was a creative programmer who wrote elegant or clever code – A “hack” was an especially clever piece of code Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Hacking (2 of 17) Phase 2: 1970s to mid 1990s – Hacking took on negative connotations – Breaking into computers for which the hacker does not have authorized access – Still primarily individuals – Includes the spreading of computer worms and viruses and ‘phone phreaking’ – Companies began using hackers to analyze and improve security Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Hacking (3 of 17) Phase 3: The growth of the Web and mobile devices – Beginning in mid 1990s – The growth of the Web changed hacking; viruses and worms could be spread rapidly – Political hacking (Hacktivism) surfaced – Denial-of-service (DoS) attacks used to shut down Web sites – Large scale theft of personal and financial information Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Hacking (4 of 17) Is “harmless hacking” harmless? Responding to nonmalicious or prank hacking uses resources. Hackers could accidentally do significant damage. Almost all hacking is a form of trespass. Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Hacking (5 of 17) Hacktivism, or Political Hacking Use of hacking to promote a political cause Disagreement about whether it is a form of civil disobedience and how (whether) it should be punished Some use the appearance of hacktivism to hide other criminal activities How do you determine whether something is hacktivism or simple vandalism? Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Hacking (6 of 17) Hackers as Security Researchers “White hat hackers” use their skills to demonstrate system vulnerabilities and improve security Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Hacking (7 of 17) Hacking as Foreign Policy Hacking by governments has increased Pentagon has announced it would consider and treat some cyber attacks as acts of war, and the U.S. might respond with military force. How can we make critical systems safer from attacks? Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Hacking (8 of 17) Stuxnet An extremely sophisticated worm Targets a particular type of control system Beginning in 2008, damaged equipment in a uranium enrichment plant in Iran Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Hacking (9 of 17) Security Hacking is a problem, but so is poor security. Variety of factors contribute to security weaknesses: – History of the Internet and the Web – Inherent complexity of computer systems – Speed at which new applications develop – Economic and business factors – Human nature Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Hacking (10 of 17) Security Internet started with open access as a means of sharing information for research. Attitudes about security were slow to catch up with the risks. Firewalls are used to monitor and filter out communication from untrusted sites or that fit a profile of suspicious activity. Security is often playing catch-up to hackers as new vulnerabilities are discovered and exploited. Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Hacking (11 of 17) Responsibility for Security Developers have a responsibility to develop with security as a goal. Businesses have a responsibility to use security tools and monitor their systems to prevent attacks from succeeding. Home users have a responsibility to ask questions and educate themselves on the tools to maintain security (personal firewalls, anti-virus and anti-spyware). Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Hacking (12 of 17) Discussion Questions Is hacking that does no direct damage a victimless crime? Do you think hiring former hackers to enhance security is a good idea or a bad idea? Why? Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Hacking (13 of 17) The Law: Catching and Punishing Hackers 1984 Congress passed the Computer Fraud and Abuse Act (CFAA) – Covers government computers, financial and medical systems, and activities that involve computers in more than one state, including computers connected to the Internet – Under CFAA, it is illegal to access a computer without authorization – The USA PATRIOT Act expanded the definition of loss to include the cost of responding to an attack, assessing damage and restoring systems Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Hacking (14 of 17) The Law: Catching and Punishing Hackers Catching hackers – Law enforcement agents read hacker newsletters and participate in chat rooms undercover – They can often track a handle by looking through newsgroup or other archives – Security professionals set up ‘honey pots’ which are Web sites that attract hackers, to record and study – Computer forensics specialists can retrieve evidence from computers, even if the user has deleted files and erased the disks – Investigators trace viruses and hacking attacks by using ISP records and router logs Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Hacking (15 of 17) The Law: Catching and Punishing Hackers Penalties for young hackers – Many young hackers have matured and gone on to productive and responsible careers – Temptation to over or under punish – Sentencing depends on intent and damage done – Most young hackers receive probation, community service, and/or fines – Not until 2000 did a young hacker receive time in juvenile detention Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Hacking (16 of 17) The Law: Catching and Punishing Hackers Criminalize virus writing and hacker tools? Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Hacking (17 of 17) The Law: Catching and Punishing Hackers Expansion of the Computer Fraud and Abuse Act – The CFAA predates social networks, smartphones, and sophisticated invisible information gathering. – Some prosecutors use the CFAA to bring charges against people or businesses that do unauthorized data collection. – Is violating terms of agreement a form of hacking? Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Small Business Insecurity (1 of 2) Have you heard of the small business Fazio Mechanical? – Specializes in supermarket refrigeration systems – Small business (less than 200) employees in southwest Pennsylvania Target Security Breach (Fall 2013) – Data on 40 million credit cards stolen – Over 70 million customer records stolen – Started with phishing email sent to Fazio Mechanical Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Small Business Insecurity (2 of 2) Small businesses – can’t afford a security staff – are gateways to larger systems – often go out of business after a breach Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Security Security breaches occur: – Poorly written software – Poorly configured networks and applications For Security Researchers and Cybersecurity Professionals – Whistleblowing versus Responsible Disclosure Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Identity Theft and Credit Card Fraud (1 of 5) Stealing Identities Identity Theft –various crimes in which criminals use the identity of an unknowing, innocent person – Use credit/debit card numbers, personal information, and social security numbers – 18-29 year-olds are the most common victims because they use the Web most and are unaware of risks – E-commerce has made it easier to steal and use card numbers without having the physical card Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Identity Theft and Credit Card Fraud (2 of 5) Stealing Identities Techniques used to steal personal and financial information – Requests for personal and financial information disguised as legitimate business communication ▪ Phishing – e-mail ▪ Smishing – text messaging ▪ Vishing – voice phishing – Pharming – false Web sites that fish for personal and financial information by planting false URLs in Domain Name Servers – Online resumés and job hunting sites may reveal SSNs, work history, birth dates and other information that can be used in identity theft Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Identity Theft and Credit Card Fraud (3 of 5) Responses to Identity Theft Authentication of email and Web sites Use of encryption to securely store data, so it is useless if stolen Authenticating customers to prevent use of stolen numbers, may trade convenience for security In the event information is stolen, a fraud alert can flag your credit report; some businesses will cover the cost of a credit report if your information has been stolen Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Identity Theft and Credit Card Fraud (4 of 5) Responses to Identity Theft Authenticating customers and preventing use of stolen numbers – Activation for new credit cards – Retailers do not print the full card number and expiration date on receipts – Software detects unusual spending activities and will prompt retailers to ask for identifying information – Services, like PayPal, act as third party allowing a customer to make a purchase without revealing their credit card information to a stranger Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Identity Theft and Credit Card Fraud (5 of 5) Biometrics Biological characteristics unique to an individual No external item (card, keys, etc.) to be stolen Used in areas where security needs to be high, such as identifying airport personnel Biometrics can be fooled, but more difficult to do so, especially as more sophisticated systems are developed Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Whose Laws Rule the Web (1 of 8) When Digital Actions Cross Borders Laws vary from country to country. Corporations that do business in multiple countries must comply with the laws of all the countries involved. Someone whose actions are legal in their own country may face prosecution in another country where their actions are illegal. Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Whose Laws Rule the Web (2 of 8) Yahoo and French censorship Display and sale of Nazi memorabilia illegal in France and Germany Yahoo was sued in French court because French citizens could view Nazi memorabilia offered on Yahoo’s U.S.-based auction sites Legal issue is whether the French law should apply to Yahoo auction sites on Yahoo’s computers located outside of France. Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Whose Laws Rule the Web (3 of 8) Applying U.S. copyright law to foreign companies Russian company sold a computer program that circumvents controls embedded in electronic books to prevent copyright infringement. Program was legal in Russia, but illegal in U.S. Program’s author, Dmitry Sklyarov, arrested when arrived in U.S. to present a talk on the weaknesses in control software used in ebooks. After protests in U.S. and other countries, he was allowed to return to Russia. Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Whose Laws Rule the Web (4 of 8) Arresting executives of online gambling and payment companies An executive of a British online gambling site was arrested as he transferred planes in Dallas. (Online sports betting is not illegal in Britain.) Unlawful Internet Gambling Enforcement Act prohibits credit card and online-payment companies from processing transactions between bettors and gambling sites. Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Whose Laws Rule the Web (5 of 8) Libel, Speech and Commercial Law Even if something is illegal in both countries, the exact law and associated penalties may vary. In cases of libel, the burden of proof differs in different countries. Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Whose Laws Rule the Web (6 of 8) Libel, Speech and Commercial Law Libel tourism – Traveling to places with strict libel laws in order to sue – Speech Act of 2010 makes foreign libel judgments unenforceable in the U.S. if they would violate the First Amendment. – Foreign governments can still seize assets Where a trial is held is important not just for differences in the law, but also the costs associated with travel between the countries; cases can take some time to come to trial and may require numerous trips. Freedom of speech suffers if businesses follow laws of the most restrictive countries. Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Whose Laws Rule the Web (7 of 8) Libel, Speech and Commercial Law Some countries have strict regulations on commercial speech and advertising. Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Whose Laws Rule the Web (8 of 8) Discussion Questions What suggestions do you have for resolving the issues created by differences in laws between different countries? What do you think would work, and what do you think would not? Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Culture, Law, and Ethics Respecting cultural differences is not the same as respecting laws Where a large majority of people in a country support prohibitions on certain content, is it ethically proper to abandon the basic human rights of free expression and freedom of religion for minorities? Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Potential Solutions (1 of 2) International agreements Countries of the World Trade Organization (WTO) agree not to prevent their citizens from buying certain services from other countries if those services are legal in their own. The WTO agreement does not help when a product, service, or information is legal in one country and not another. Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Potential Solutions (2 of 2) Alternative principles Responsibility-to-prevent-access – Publishers must prevent material or services from being accessed in countries where they are illegal. Authority-to-prevent entry – Government of Country A can act within Country A to try to block the entrance of material that is illegal there, but may not apply its laws to the people who create and publish the material, or provide a service, in Country B if it is legal there. Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved Copyright This work is protected by United States copyright laws and is provided solely for the use of instructors in teaching their courses and assessing student learning. Dissemination or sale of any part of this work (including on the World Wide Web) will destroy the integrity of the work and is not permitted. The work and materials from it should never be made available to students except by instructors using the accompanying text in their classes. All recipients of this work are expected to abide by these restrictions and to honor the intended pedagogical purposes and the needs of other instructors who rely on these materials. Copyright © 2018, 2013, 2008 Pearson Education, Inc. All Rights Reserved