COMBATING CYBER CRIMINALS

Over 10 years ago, a virus named “I love you” penetrated the web networks. It allegedly affected thousands if not millions of computers worldwide. After a few days, it was determined that a Filipino computer specialist operating out of the Philippines caused it.

Many people including my barber were amazed even expressing pride that one Filipino could supposedly wreck havoc to the Worldwide Web.

I remember responding to my barber and to some of those expressing amazement that the concern should not be on the Filipino who spread the “I love you” virus but more on the fact that among all the millions of computers in the world, the U.S. Federal Bureau of Investigation (FBI) and other international experts were able to identify the very exact computer that the Filipino used to spread the virus.

I just finished attending the Cyber Security Conference held in Washington, D.C. The attendees include IT specialists and Cyber Security experts from the U.S. Government, guest governments, and private IT companies. I was one of the few credentialed members of the media permitted to cover the conference. The latter is also being held simultaneously with the Mobile Government Conference and the Cloud and Virtualization Conference.

In the conference, I had the chance to meet an expert connected with a firm that protects many of the networks of the Stock Exchanges and financial institutions in North America, Europe, and Asia from hackers and cyber criminals. In our conversation, he mentioned to me that one of their capabilities is in determining the source and identifying in “an instant” or almost real time the one overtly “hacking” or committing a cybercrime. Amazing indeed!

We exchanged business cards. I hope to know more about it later.

Lawrence C. Miller of PaloAlto Networks, network Security Company described the State of Today’s Intrusions. He says, “Today’s threats are more sophisticated and equal opportunity than ever before. All types of enterprises and information are being targeted” Many of the attacks are producing a steady stream of high profile sophisticated breaches and intrusions. He gave examples:

1.     Comodo (business partners). In March 2011, an intruder compromised a reseller’s network and stole nine digital security certificates that could then be fraudulently issued to impersonate various websites operated by Google, Microsoft, Skype and Yahoo;

2.     Sony PlayStation (credit card data). In April 2011, hackers breached the Sony PlayStation network, potentially stealing credit card and personal information (including names, birthdates, physical and e-mail addresses, pass-words, logins, handles, online IDs, purchase histories, and profile data) of more than 100 million subscribers;

3.     U.S. Senate (political hacktivism). In June 2011, LulzSec (a loosely organized hacker group) broke into the U.S. Senate website and posted a list of compromised – but not sensitive or classified – files online. Other examples of political hactivism by various hacker groups include attacks against the U.S. Public Broadcasting Service (PBS), Fox Broadcasting Company, and MasterCard, Visa, and PayPal websites in retaliation for negative coverage or adverse actions against WikiLeaks; and

4.     DigiNotar (Intellectual property). In September 2011, the same attacker that claimed responsibility for the Comodo breach took credit for a much larger compromise against Digitar that occurred during the summer of 2011. Again, a Certificate of Authority (CA) was the target and the attacker was able to generate hundreds of seemingly valid certificates for dozens of popular domains.

The above are just a few examples. According to Miller, Hackers have evolved from the prototypical “whiz kid” – sequestered in a basement, motivated by notoriety, and fueled by too much carbonated caffeine - into a bon fide cybercriminal, often motivated by significant financial gain, and sponsored by nation-states, criminal organizations, or radical groups.

Miller described that today’s hacker fits the following profile:

1.             Has far more resources available to facilitate an attack;

2.             Has greater technical depth and focus;

3.             Is well funded; and

4.             Is better organized.

I will be writing more about the Cyber Security Conference in subsequent columns. Let me spend more time digesting my notes and the materials that I have obtained at the conference.

I suspect that hackers and cyber criminals target many capitalist countries including the Philippines. A Cybercrime Prevention law was passed just recently. The problem is that Congress inserted anti-Freedom of Expression provisions like the labeling of Libel as an online crime with higher penalty as well as not providing sufficient conditions and safeguards. Meanwhile, the Supreme Court issued a TRO against its implementation for 120 days.

I wrote earlier that the Philippines participated in the development and formulation of the Convention on Cybercrime. In fact, I claimed that Congress virtually copied the provisions in the Convention on Cybercrime except the unacceptable insertions to come up with the Cybercrime Prevention Act.

My recommendation is for the PNoy Administration to sign (if not yet done) the Convention on Cybercrime and ask the Senate to ratify it immediately.

The Convention does not include Libel as a cybercrime. It provides sufficient safeguards including recognition and respect for International Human, Civil, and Political Rights laws.

Under our legal system, generally accepted principles of international agreements and customary law are part of the law of the land. (Art. II, Section 2, Constitution)

Following the doctrine enunciated In the Kuroda case, duly adopted international treaties can be invoked before and directly enforced by the courts and other tribunals and by the administrative authorities if they implicitly or explicitly establish rights and duties for private persons. “International law and treaties have the same domestic status as national legislation, and both international law and national legislation are subordinate to the Constitution.”

Furthermore, the Supreme Court has recognized the validity of "executive agreements" concluded and applied even without Senate approval. 

FILIPINOS CAN MAKE OR UNMAKE A U.S. PRESIDENT

My barber asked again what my take is re the Obama-Romney Presidential Battle.

With the help of online sources and cyber technology, this is my humble analysis. Because of the Electoral College System, we have to analyze the polls per State and correspondingly project what would be the results. Looking at the Electoral College Map projected by the conservative Rasmussen Report and the Real Clear Politics, which averages all the polls; I would say that the Electoral College Map would show the following results:

Obama: 257 Electoral Votes   Romney: 215 Electoral Votes    Swing: 66 Electoral Votes

The Swing States are:

1.         Florida:          29

2.         Ohio:              18

3.         Virginia:         13

4.         Nevada:           6

Total:                          66

To win the elections, one must have at least 270 Electoral Votes

ARITHMETIC:

ROMNEY

To win, Romney needs to obtain additional 55 Electoral Votes. To become President, he must win in Florida, Ohio, and Virginia, which would give him a total of 60 additional votes – more than enough to cover the 55 needed. He cannot afford to lose in any of these 3 States. Winning in 2 and Nevada would not be sufficient.

OBAMA

To win, Obama needs to obtain additional 13 Electoral Votes. His is an easier path than Romney’s. All he needs is to win in Virginia, Ohio, or Florida. Winning Virginia would give him a total of 270, the magic number; Ohio a total of 275; and Florida, a total of 286.

Unless one unexpectedly falters in another State and Nevada is needed to cover it, at this point based on the above scenario, the latter is not as important to Obama or Romney as the other 3 States. This explains why Obama and Romney are spending much time, money, and efforts in these States.

Filipino Americans Can Make a Difference

The Filipinos are largely concentrated in the following States: 1. California; 2. Hawaii; 3. Illinois; 4. Washington; 5. New Jersey; 6. New York;  7. Texas; 8. Nevada; 9. Florida; 10. Virginia.

While the Filipinos are not as large in Ohio, in a close race, they can still make a difference especially if they unite with the other Asians as they have done in the past.

In the first 6 States mentioned above, Filipino Republicans or Pro-Romney Filipinos cannot make a difference. These States are so overwhelmingly Pro-Obama that Filipino Republicans cannot make a dent.

In the State of Texas, it is the opposite. Filipino Democrats or Pro-Obama Filipinos cannot make a difference. Texas is overwhelmingly Pro-Romney that Filipino Democratic votes would be useless.

Virginia, Florida, Nevada and Ohio are Swing States that Filipinos can really make a difference.

Every vote counts! Let me repeat. To be President, Romney must win in Virginia, Florida AND Ohio. To be President, Obama must win in Virginia, Florida, OR Ohio.

If Filipinos register and vote in these 3 States, indeed, they can either MAKE or UNMAKE a U.S. President!

E-Gen with “E” as in Electoral Reforms

This summary is not available. Please click here to view the post.

PHILIPPINES: A FREE AND RESPONSIBLE CYBER PLAYER

Filipino Internet users have been adjudged the freest in Asia and the 6^th freest in the world, according to Freedom House, a think tank based here in Washington, D.C.  South Korea is ranked the second freest in Asia.

This was before the Cybercrime Prevention Act was enacted and became effective. It included the crime of Internet Libel and prescribed a penalty higher than what the Revised Penal Code imposes for defamatory statements.

The Philippine version of the Cyber Law was patterned after the Convention On Cybercrime adapted by the Council of Europe and other non-members that included the United States and the Philippines.

The United States has signed and ratified it while the Philippines who has signed it still needs to ratify it.

The freest in the world is Estonia and the second freest is the United States. What is common to both is the fact that Libel is not considered cybercrime in their laws. Although their laws impose civil liability for libelous statements, there has never been anybody imprisoned for Libel.

The Constitutional safeguards protecting Freedom of Expression and their respective jurisprudence, especially in the United States, overwhelmingly support the supremacy of Free Speech over Libel.

Estonia is also a signatory of the Convention On Cybercrime. It has also ratified it. In fact, it also patterned its Cybercrime Prevention Law after the Convention On Cybercrime.

Defining Internet Libel as a cybercrime would surely lower our ranking among the freest in the world. But the ranking is really less important than its effect of discouraging the free flow of ideas between and among Filipino netizens and with other Internet users of the world.

Being the freest also has some drawbacks. Estonia and United States have been victims as well as targets of cyber attacks.

In Estonia, they experienced Cyber attacks such as “hacking, defacement, spam, DDoS including botnets, incitement to hatred and violence at internet websites and chat rooms”, providing guidelines on how to attack, including lists of Estonian servers. The target websites and servers were the Office of the President, Government, Ministries, Police, Banks, Online media, Prime Minister’s Party.

Since then, Estonia developed a CyberSecurity Strategy and passed some new provisions in the Penal Code, an Electronic Communications Act, Information Society Services Act, Data Protection Act, and Public Information Act but all with safeguards recognizing International Civil and Political Rights.

According to FBI (Federal Bureau of Investigation) data cited in a U.S. Senate testimony, “annual cybercrime profits and damages have hit a trillion dollars.”

The tools that are increasingly used by hackers for these cyber crimes are called “botnets”. Symantec estimates that there are about 3.5 million to 5.4 million botnets worldwide.

Bloomberg BusinessWeek reported that companies such as Sony, Google, Lockheed Martin and two of South Korea’s largest banks have been hacked. Even the International Monetary Fund (IMF) and Citigroup announced that their computers were breached  several months ago.

In effect, the battleground against terror and crime is no longer limited to Air, Land and Sea. Cyberspace has become a place for warfare. For this reason, the U.S. Military has declared it a military domain.

China, for example, has been accused of hacking Google’s infrastructures. On the other hand, the former accused the United States of being an “information imperialist,” and of using the Internet to overthrow governments.

The Pentagon, despite budgetary problems, “requested US$3.2 billion worth of funding to be allocated to “cyber security”.  A U.S. Cyber Command has been established and in fact, has had operational capacity.  Cyber Commands are likewise being established in other countries. It was reported that India is looking to establish a “Cyber Control and Command Authority” while China has established a “Blue Army” to defend the People’s Liberation Army from attacks on its networks.

The Philippines could be a major player in the Cyber World. With the right approach and attitude, we could be another source of cyber engineers, cyber warriors, cyber technicians, and cyber security experts.

It could accelerate the country’s economic development exponentially. It could be the destination for more foreign ICT investments.

CYBERCRIME LAW: An Imperfect Copy

A planet of more than 7 billion inhabitants; more than two (2) billion personal computers, fifteen percent of which carry the Apple brand; and more than five (5) billion cell phones, smartphones and tablets, the Earth has become a world of interconnected digital natives and immigrants, communication devices, and computers through a worldwide network called the Internet.

There have been profound changes brought by the computerization, convergence, and continuing globalization of networks.

There have been concerns on “the risk that computer networks and electronic information may be used for committing criminal offenses and that evidence relating to such offenses may be stored and transferred by these networks.”  

Many countries saw the “need for cooperation between States and private industry in combating cybercrime and the need to protect legitimate interests in the use and development of information technologies.”

The same countries also believed “that an effective fight against cybercrime requires increased, rapid and well-functioning international cooperation in criminal matters.”

This is why the Council of Europe, joined by the United States and other non-Council members adopted the international agreement called CONVENTION ON CYBERCRIME (CCC).

Records show that the Philippines was a participant and, in fact, a signatory of the Convention which encourages Parties to follow a suggested format and/or provisions of a Cybercrime Prevention Law.

After a careful read of the Philippines’ Cybercrime Prevention Act of 2012, and the Convention on Cybercrime (CCC), I am not surprised that the Philippine legislators copied, almost verbatim, most of the provisions of the former from the latter.

The only problem is that some important provisions of the CCC were omitted and the Philippine legislators inserted some that have no place in the law.

The entire Chapter II dealing with all the Punishable Acts, except for the insertion of LIBEL and Sections 6 and 7, all came from CCC.

The provision on Corporate Liability is also a virtual copy of the CCC article (12).

If not because legislators are encouraged and permitted to copy the provisions of the CCC, they could have been easily accused of Plagiarism or even Copyright Infringement in some jurisdictions.

Upon learning of the legislators’ copying, my barber expressed disappointment because he thought Senator Sotto and his staff worked so hard on coming up with the legislation.

“Article 15 – Conditions and safeguards (CONVENTION ON CYBERCRIME)

1. Each Party shall ensure that the establishment, implementation and application of the powers and procedure provided for in this Section are subject to conditions and safeguards provided for under its domestic law, which shall provide for the adequate protection of human rights and liberties, including rights arising pursuant to obligations it has undertaken under 1950 Council of Europe Convention for the Protection of Human Rights and Fundamental Freedoms, the 1996 United Nations International Covenant  on Civil and Political Rights, and other applicable international human rights instruments, and which shall incorporate the principle of proportionality.
2. Such conditions and safeguards shall, as appropriate in view of the nature of the procedure or power concerned, inter alia, include judicial or other independent supervision, grounds justifying application, and limitation of the scope and duration of such power or procedure.
3. To the extent that it is consistent with the public interest, in particular the sound administration of justice, each Party shall consider the impact of the powers and procedures in this section upon the rights, responsibilities and legitimate interests of third parties.”

In its Preamble, the CCC also recognizes the applicability of international human rights treaties which “reaffirm the right of everyone to hold opinions without interference, as well as the right to freedom of expression, including the freedom to seek, receive, and import information and ideas of all kinds, regardless of frontiers, and the rights concerning the respect for privacy.”

Nowhere in the copied Philippine Cybercrime law does it reflect the said conditions and safeguards.

On the contrary, LIBEL has been added despite its absence in the CCC, and in other Cybercrime laws of foreign countries including the United States. It omitted offenses related to infringements of Intellectual Property Rights and yet it added Section 6 of the Philippine law, which states;

“All crimes defined and penalized by the Revised Penal Code, as amended, and special laws, if committed by, through and with the use of information and communications technologies shall be covered by the relevant provisions of this Act: Provided, That the penalty to be imposed shall be one (1) degree higher than that provided for by the Revised Penal Code, as amended, and special laws, as the case may be.”

A cell/smart phone use could increase a criminal’s penalty by one degree higher. In fact, Infringement of Intellectual Property rights in the Revised Penal Code such as Articles 187 and 188 (Trade Name and Trademarks) could be included if committed by, through and with the use of ICT. The most widely violated laws in the Internet are Intellectual Property Rights. By knowingly omitting it, our legislators must have unknowingly included it.

In my last week’s column on the Cybercrime law, I emphasized that the new law should be “read, interpreted, and enforced” together with Sections 1-4 of Article III of the Philippine Constitution. The said provisions deal with the Bill of Rights relating to Free Speech, Unreasonable Searches and Seizures, Privacy of Communications and Correspondence, and Equal Protection of the laws.

These are built-in constitutional safeguards that Internet users could utilize; that Judges could use for the interpretation of statutes, and that law enforcers including the Department of Justice could consider in implementing and applying the law. They are superior to any statute.

The Implementing Rules and Regulations of the law might still cure some of the defects. The Supreme Court could declare some parts of the law unconstitutional and let the rest remain valid. A bill could be introduced to amend it and invite the public including bloggers and Internet users to express their views.

The House of Representatives should probably take the initiative. After all, their version of the Cybercrime bill did not include Libel and other insertions made by the Senate.

“Who should order the search and/or seizure of one’s computer or block access to data, Judge or the Secretary of Justice?”

Cybercriminal: “Judge. It is cheaper and easier to bribe a Judge.”

Law-abiding Internet User: “Now, Justice Secretary – member of “Daang Matuwid Team. Later, after CJ Sereno's Judicial Reforms, Judge."