Peter A Clarke

The Health Sector in every jurisdiction is a high priority area of interest for hackers. Hospitals, health centres and other facilities in the sector are notorious for both troves of personal information and very poor privacy practices. Given the nature of the information is highly sensitive there is often the imperative to respond to demands by hackers. That is why it is not surprising that the the European Union Agency for Cyber Security found that ransomware accounts for 54% per of threats to the health sector.

The press release Read the rest of this entry »

Another week, another scandal involving the AFL. This time it is not the fault of the organisation. The ABC reports in AFL investigates distribution of explicit images of past and present players online that explicit images of more than 45 players and former players have been circulated. The AFL is investigating according to its statement AFL investigating, police aware after nude photos of ‘more than 45 players’ leaked. In addition the Victoria police and the e Safety Commissioner have been notified. The role the AFL can play is constrained by its limited powers. Through technical experts it may, but not certainly, find the source of the photos and possibly where the the photos were sent. If AFL employees or members of AFL clubs were involved it has disciplinary powers. But beyond that its powers are limited. It can’t arrest anyone, it can’t enter premises with a warrant to search premises and any interview with someone has to be voluntary. The police have traditionally had a monopoly on those powers. A number of the regulators in this area have been given some coercive powers. The E Safety Commissioner has a page on its website devoted to Image based abuse.

This type of problem is not new. As the Conversation in In the 19th century, a man was busted for pasting photos of women’s heads on naked bodies … sound familiar? highlights creating false images to titillate or humiliate has only been limited by the technology and the imagination of users. Modern technology, especially the use of deep fake websites, has Read the rest of this entry »

The Australian Cyber Security Co ordinator, Darren Goldie, has confirmed in a statement that the HWL Ebsworth data breach has resulted in personal information and government information being posted on the dark web. This is confirmation of what has been known for some little time. It is covered in the Australian article HWL ­Ebsworth hack: ‘Sensitive personal and government information’ published on dark web, Darren Goldie reveals. It is also covered by Cyber Security Connect with New national cyber security coordinator releases statement on HWL Ebsworth hack.

The information provided by the cyber tsar provides little that is not known by those following this story. Given Black Cat has only published 1.4 terrabytes of the 4 terrabytes of data stolen there will be more uncomfortable moments for HWL Ebsworth in the coming weeks and months, 

To put matters into a broader context itgovernance has reported that in June 2023 there were 79 reported data breaches worldwide involving 14,353,113 records. It provided a brief summary of data breaches stating:

Number of data breaches in June 2023: 79

Breached records in June 2023: 14,353,113

Number of data breaches in 2023: 607

Number of breached records in 2023: 466,078,044

Biggest data breach of 2023 so far: Twitter (220 million breached records)

Biggest data breach in the UK: JD Sports (10 million breached records)

Most breached sectors: Healthcare (175), education (106), public (72)

The number of records compromised in the HWL Ebsworth data breach is shrouded in secrecy.  An injunction will do that.  The three known biggest data breaches, in terms of records compromised, in June 2023 were:

•  Oregon and Louisiana departments of motor vehicles which involved a compromise of  all Louisianans with a state-issued driver’s license, ID or car registration. The Oregon Department of Motor Vehicles estimates that data of 3.5 million driver’s license and identity card were  compromised. 
• Genworth Financial which was affected by the MOVEit breach, with at least 2.5 million records exposed in the attack.  Also compromised was California Public Employees’ Retirement System with  769,000 of its members affected.
• Wilton Reassurance was also affected by the MOVEit breach which compromised records of 1,482,490 of its members.  

Read the rest of this entry »

The protection of children’s privacy has been a focus of enforcement action in the United States. For good reason. There is a real problem with some companies collecting and using personal information of minors.

The Department of Justice and the Federal Trade Commission have entered into orders with Edmodo whereby Edmodo consented to a permanent injunction to prevent future violations of children’s privacy. In Edmodo’s case the claim was that it collected the personal information of children under 13 without any notice to the children’s parents or obtaining parental authorization. It used this personal information to enable third-parties to display targeted advertising to student users.

The press release provides:

The Department of Justice, together with the Federal Trade Commission (FTC), today announced that Edmodo, LLC (Edmodo) has agreed to a permanent injunction and a $6 million civil penalty in connection with its online educational platform, as part of a settlement to resolve alleged violations of the Children’s Online Privacy Protection Act (COPPA), the Children’s Online Privacy Protection Rule (COPPA Rule), and the Federal Trade Commission Act. The civil penalty is suspended due to Edmodo’s inability to pay.

The Edmodo educational platform, sold to schools throughout the United States, enabled teachers to interface with students, including children under 13 years old, to host virtual class spaces, conduct discussions, share materials, make assignments, and provide quizzes and grades, among other things. In a complaint filed in the U.S. District Court for the Northern District of California, the government alleges that, until approximately September 2022, Edmodo collected the personal information of children under 13, including their names, email addresses, phone numbers, device information, and IP addresses. Edmodo allegedly collected such information without providing notice to the children’s parents or obtaining parental authorization to collect such personal information, as required by the COPPA Rule, and used this personal information to enable third-parties to display targeted advertising to student users between 2018 and September 2022.

The complaint further asserts that Edmodo was retaining this personal information indefinitely. As of March 2020, Edmodo retained the personal information associated with approximately 36 million student accounts, of which only one million were actively using the platform. This indefinite retention violated COPPA’s requirement that an operator not retain personal information of children for longer than “reasonably necessary to fulfill the purpose for which [the information] was collected.”  Read the rest of this entry »

Even users of porn deserve their privacy. Especially users of porn. That doesn’t seem to be a viewpoints shared by Pornhub. It has been illegally collecting masses of its users data. There is an excellent story in Wired with Pornhub Is Being Accused of Illegal Data Collection. It has also been picked yp by Mashable with Pornhub accused of abusing user data, cybernews with Pornhub accused of illegal data collection in Europe and VPN Overview with Pornhub’s Data Practices Violate EU Privacy Laws: Complaint.

There are serious complaints; about inadequate consents, opaque about how it shares the data it collects and arbitrarily assigns its users sexual prferences without their consent. 

This is not the first time that Pornhub has failed to protect its users privacy. The Canadian House of Commons’ Standing Committee on Access to Information, Privacy and Ethics published a report in June 2021 titled Ensuring the Protection of Privacy and Reputation on Platforms such as Pornhub in June 2021.

The Wired article Read the rest of this entry »

Along with the Federal Government the New South Wales Parliament has commenced an inquiry into Artificial Intelligence.

The terms of reference Read the rest of this entry »

Another report stating what has long been understood by those involved with cyber security and privacy law; cybercrime is a chronic problem that is getting worse. The Report covers a broader range of cyber crimes including on line abuse and harassment, which was 27% of the reported cyber crimes in in the survey.The Report by the Australian Institute of Criminology makes for sobering reading. It is a comprehensive report, at 113 pages.

The harms from cyber crime are significant.  That makes it all the more concerning that there is such poor education on how to recognise some forms of cyber crime, such as ransomware and fraud and cyber scams.  The loss to business from data breaches puts into sharp relief the need for individuals and businesses to maintain proper cyber defences.  The lax state of affairs is as much due to poor regulation and enforcement as it is on poor education.

The Abstract provides:

This is the first report in the Cybercrime in Australia series, which aims to provide a clearer picture of the extent of cybercrime victimisation, help-seeking and harms among Australian computer users. It is based on a survey of 13,887 computer users conducted in early 2023. In the 12 months prior to the survey, 27 percent of respondents had been a victim of online abuse and harassment, 22 percent had been a victim of malware, 20 percent had been a victim of identity crime and misuse, and eight percent had been a victim of fraud and scams. Overall, 47 percent of respondents experienced at least one cybercrime in the 12 months prior to the survey—and nearly half of all victims reported experiencing more than one type of cybercrime. Thirty-four percent of respondents had experienced a data breach. Cybercrime victimisation was not evenly distributed, with certain sections of the community more likely to have been a victim, and certain online activities associated with a higher likelihood of victimisation.

Most cybercrime victimisation went unreported to police or to ReportCyber, meaning official statistics significantly underestimate the size of the problem. Satisfaction with the outcomes of these reports was mixed, and relatively few reports resulted in an offender being apprehended. Rates of help-seeking varied and were influenced by the perceived seriousness of cybercrime and knowledge of how and where to report it.

The financial losses experienced by victims were wide ranging. Some victims reported losing large sums of money, but most victims reported relatively small financial losses. This report measures, for the first time, the harms experienced by individual victims and small businesses that extend beyond these financial costs. Twenty-five percent of respondents were negatively impacted by cybercrime in the 12 months prior to the survey, while 22 percent of respondents who owned or operated a small to medium business said their business was negatively impacted by cybercrime.

The Scope of the report was described in these Read the rest of this entry »

The Singapore Cyber Security Agency has released its Cyber Landscape Report. The results are hardly surprising.  Phishing and ransomware are chronic problems.  They are growing in both volume and intensity.

The reports findings provides:

Key Malicious Cyber Activities in 2022

1. 1. Phishing. There were around 8,500 phishing attempts reported to the Singapore Cyber Emergency Response Team (SingCERT) in 2022, more than double the 3,100 cases handled in 2021. More than 50 per cent of reported cases involved URLs ending with “.xyz” – a popular top-level domain (TLD)¹ among threat actors given its low cost and limited restrictions on usage. The average length of reported phishing links decreased by almost half, suggesting that threat actors are using URL shortener services more frequently to mask their malicious intent and track the click-through rate of their phishing campaigns. The most commonly-spoofed were Banking and Financial Services, Government and Logistics. More than 80 per cent of reported phishing sites masqueraded as entities within the Banking and Financial Services sector. They are often targets of phishing attacks as they are trusted institutions which hold sensitive and valuable information such as personal details and login credentials. Overall, the increase in reported phishing attempts mirrored global trends, with multiple cybersecurity vendors observing that phishing activities grew substantially in 2022. In all, SingCERT facilitated the takedown of 2,918 malicious phishing sites in 2022.
   2. Ransomware incidents. Ransomware remains a major issue both in Singapore and globally, with cybersecurity vendors reporting a 13 per cent increase in ransomware incidents worldwide in 2022. In Singapore, the number of reported ransomware cases saw a slight decrease with 132 cases reported to CSA in 2022, compared to the 137 cases reported in 2021. The cases affected mostly Small-and-Medium Enterprises (SMEs) from sectors such as manufacturing and retail, as they may hold valuable data as well as Intellectual Property (IP), which cybercriminals often seek to extort and monetise for financial gain. Many of such firms also lack dedicated resources to counter cyber threats.
   3. Infected Infrastructure². In 2022, CSA observed 81,500 infected systems in Singapore, a decrease of 13 per cent from 94,000 in 2021. Despite a sharp growth of infected infrastructure observed worldwide, Singapore’s global share of infected infrastructure fell from 0.84 per cent in 2021 to 0.34 per cent in 2022. While this decrease in infected infrastructure in Singapore points to an improvement in cyber hygiene levels, the absolute number of infected systems in Singapore remains high. The top three malware infections on locally-hosted C&C servers were Colbalt Strike, Emotet and Guloader, while Gamarue, Nymaim and Mirai were the top three malware found on locally-hosted botnet drones, accounting for nearly 80% of Singapore IP addresses infected by malware in 2022. 
   4. Website Defacements. 340 ‘.sg’ websites were defaced in 2022, a decrease of 19 per cent from 419 in 2021. Most victims were SMEs. The downward trend could be attributed to hacktivist activities moving to other platforms with potentially wider reach, such as social media. In general, a downward trend in global website defacements was observed – with the exception of Ukraine and Russia, which have seen hacktivist activities spike amidst the ongoing conflict, including the defacement of more than 70 Ukrainian government websites just before hostilities broke out.

Read the rest of this entry »

In the 1980s it was fashionable in the The Federal Government to create tsars. The term signified that they were doing something important and had enhanced powers. There were drug tsars and education tsars. The terminology was a bit unfortunate. Tsars historically had a habit of coming unstuck in horrible ways. Nothing like that happened in America but not much was done either. Australia is not nearly so grandiose. In Australia the tradition is to appoint directors or co ordinator. In that tradition the Government has announced the appointment of Air Marshal Darren Goldie AM CSC as the innuagural National Cyber Security Coordinator. The position is administrative. It is probably a good idea however the real need for improvement in cyber security is at the ground level with organisations and agencies applying fit for purpose programs, keeping them up to date and training staff to avoid making mistakes that lead to a data breach. Not nearly enough of that is being done.

The consequences of a major data breach are rarely minor or quickly resolved. The cost of remediation is almost always significant. Litigation is a common offshoot. Medibank is facing a significant class action suit. Finally there are usually more than one regulator which can take action. In this case the Australian Prudential Authority has taken action against APRA forcing Medibank to increase its capital adequacy requirement to $250 million.