COMBATING CYBER CRIMINALS

Over 10 years ago, a virus named “I love you” penetrated the web networks. It allegedly affected thousands if not millions of computers worldwide. After a few days, it was determined that a Filipino computer specialist operating out of the Philippines caused it.

Many people including my barber were amazed even expressing pride that one Filipino could supposedly wreck havoc to the Worldwide Web.

I remember responding to my barber and to some of those expressing amazement that the concern should not be on the Filipino who spread the “I love you” virus but more on the fact that among all the millions of computers in the world, the U.S. Federal Bureau of Investigation (FBI) and other international experts were able to identify the very exact computer that the Filipino used to spread the virus.

I just finished attending the Cyber Security Conference held in Washington, D.C. The attendees include IT specialists and Cyber Security experts from the U.S. Government, guest governments, and private IT companies. I was one of the few credentialed members of the media permitted to cover the conference. The latter is also being held simultaneously with the Mobile Government Conference and the Cloud and Virtualization Conference.

In the conference, I had the chance to meet an expert connected with a firm that protects many of the networks of the Stock Exchanges and financial institutions in North America, Europe, and Asia from hackers and cyber criminals. In our conversation, he mentioned to me that one of their capabilities is in determining the source and identifying in “an instant” or almost real time the one overtly “hacking” or committing a cybercrime. Amazing indeed!

We exchanged business cards. I hope to know more about it later.

Lawrence C. Miller of PaloAlto Networks, network Security Company described the State of Today’s Intrusions. He says, “Today’s threats are more sophisticated and equal opportunity than ever before. All types of enterprises and information are being targeted” Many of the attacks are producing a steady stream of high profile sophisticated breaches and intrusions. He gave examples:

1.     Comodo (business partners). In March 2011, an intruder compromised a reseller’s network and stole nine digital security certificates that could then be fraudulently issued to impersonate various websites operated by Google, Microsoft, Skype and Yahoo;

2.     Sony PlayStation (credit card data). In April 2011, hackers breached the Sony PlayStation network, potentially stealing credit card and personal information (including names, birthdates, physical and e-mail addresses, pass-words, logins, handles, online IDs, purchase histories, and profile data) of more than 100 million subscribers;

3.     U.S. Senate (political hacktivism). In June 2011, LulzSec (a loosely organized hacker group) broke into the U.S. Senate website and posted a list of compromised – but not sensitive or classified – files online. Other examples of political hactivism by various hacker groups include attacks against the U.S. Public Broadcasting Service (PBS), Fox Broadcasting Company, and MasterCard, Visa, and PayPal websites in retaliation for negative coverage or adverse actions against WikiLeaks; and

4.     DigiNotar (Intellectual property). In September 2011, the same attacker that claimed responsibility for the Comodo breach took credit for a much larger compromise against Digitar that occurred during the summer of 2011. Again, a Certificate of Authority (CA) was the target and the attacker was able to generate hundreds of seemingly valid certificates for dozens of popular domains.

The above are just a few examples. According to Miller, Hackers have evolved from the prototypical “whiz kid” – sequestered in a basement, motivated by notoriety, and fueled by too much carbonated caffeine - into a bon fide cybercriminal, often motivated by significant financial gain, and sponsored by nation-states, criminal organizations, or radical groups.

Miller described that today’s hacker fits the following profile:

1.             Has far more resources available to facilitate an attack;

2.             Has greater technical depth and focus;

3.             Is well funded; and

4.             Is better organized.

I will be writing more about the Cyber Security Conference in subsequent columns. Let me spend more time digesting my notes and the materials that I have obtained at the conference.

I suspect that hackers and cyber criminals target many capitalist countries including the Philippines. A Cybercrime Prevention law was passed just recently. The problem is that Congress inserted anti-Freedom of Expression provisions like the labeling of Libel as an online crime with higher penalty as well as not providing sufficient conditions and safeguards. Meanwhile, the Supreme Court issued a TRO against its implementation for 120 days.

I wrote earlier that the Philippines participated in the development and formulation of the Convention on Cybercrime. In fact, I claimed that Congress virtually copied the provisions in the Convention on Cybercrime except the unacceptable insertions to come up with the Cybercrime Prevention Act.

My recommendation is for the PNoy Administration to sign (if not yet done) the Convention on Cybercrime and ask the Senate to ratify it immediately.

The Convention does not include Libel as a cybercrime. It provides sufficient safeguards including recognition and respect for International Human, Civil, and Political Rights laws.

Under our legal system, generally accepted principles of international agreements and customary law are part of the law of the land. (Art. II, Section 2, Constitution)

Following the doctrine enunciated In the Kuroda case, duly adopted international treaties can be invoked before and directly enforced by the courts and other tribunals and by the administrative authorities if they implicitly or explicitly establish rights and duties for private persons. “International law and treaties have the same domestic status as national legislation, and both international law and national legislation are subordinate to the Constitution.”

Furthermore, the Supreme Court has recognized the validity of "executive agreements" concluded and applied even without Senate approval.