Building Global Networks to Fight Global e-crime · Phishing or online fraud Hoaxes Identity theft...

Building Global Networks to Protect Children through Public-

Private Partnerships

Katharine A. BostickMicrosoft

Senior Director, Security & Internet Safety

Asia Pacific, Greater China, Japan and India

APECTEL 39

APEC-OECD joint symposium on initiatives among Member

economies promoting safer Internet environment for children

15th April 2009

1.46 Billion

• Over ½ billion in Asia

• English , Chinese, Spanish, Japanese, French, German, Arabic, Portuguese, Korean, Italian

• 5.3 billion

• Source: www.internetworldstats.com

Microsoft’s Internet Safety Enforcement Vision

A Safer and more secure internet for everyone

Build A safer and more secure online environment– Why?

Innovation & Creativity

Did you know

Shift Happens - Globalization; Information Age (created by Karl Fisch & modified by Scott McLeod

http://www.youtube.com/watch?v=ljbI-363A2Q

2008 Latest Edition - Did You Know

3.0http://www.youtube.com/watch?v=jpEnFwiqdx8

Look what’s at your fingertips

• Communicate with friends, family, colleagues

• Access to information and entertainment

• Research, learn, meet people and explore

To Children

Predators

Cyberbullies

File-sharing abuses

Invasion of privacy

Disturbing content

To Personal Safety

Spam

Phishing or online fraud

Hoaxes

Identity theft

To PC Security

Viruses

Worms

Trojan Horses

Spyware

Online gaming-Malware stealing passwords

Microsoft Security Intelligence Report V. 5

Warning: Your Computer has a virus

Scan your system

Building networks requires Global coalition and Action

Key StrategiesPublic Policy & responsible industry practices

• Council of Europe’s Cybercrime Convention;

• International Center (ICMEC) Model Legislation on Child Pornography & Child protection policies & practices

• Asia Pacific Legislative Gap Analysis

Public-private partnerships • Tools, Training & Technical Support for Enforcement

Technology solutions • Technology Coalitions/Financial Coalition• Family Safety Settings• Anti-virus, Anti-spyware, Anti-phishing• Access & Identity Management Solutions• Targeted tracking of traffic & content

Education & Awareness • Creating a culture of safety and security through engagement

with industry, business, law enforcement, and government to find solutions, mitigate risks, and promote best practices

Creating a culture of cyber safety

Policy & Practices

EnforcementPartnerships

No one alone has the solution

Industry

Academics

Governments

Law

Enforcement

Non-government

organizations

Consumers

Partner or Perish

James McCormack, Former Director

Australian High Tech Crime Centre

Digital Phishnet Conference

January 2008, Singapore

Building Successful Partnerships

Trust

Shared Purpose

CommitmentOpen

Feedback

Clear roles and responsibilities

Mutual Benefit

17

Partnerships with government & law enforcement agencies: Capacity Building

International, Regional and National Partnerships

2CENTRE (Cybercrime Centres of Excellence network for Training, Research and Education)

Virtual Global Taskforce (VGT)

Collaboration among LE from UK, US, Canada, Australia, Italy and Interpol

working together to fight child abuse online.

Microsoft founding industry partner

Australia Federal Police will lead VGT in 2009

Partnerships and Outreach:ToolsLaw Enforcement Portal

Microsoft’s law enforcement resources and information in one location

Provides forensics support

Secure site; requires invitation and EULA signature

Technical Support services:Frequently asked questions and self-help resources

Web form or e-mail request for targeted support from Microsoft specialists Targeted technical, investigative support resources

LE officials leverage Microsoft resources:Resources from Microsoft investigative teams, product groups, MS Tech Net, and Public Sector consulting division

Many new whitepapers, How-to materials, and other resources in the works

Contact: leportal@microsoft.com

18

Law Enforcement Portal (HomePage)

19

https://www.microsoftlawportal.com

Email: leportal@microsoft.com

Tools : COFEE

Computer Online Forensic Evidence Extractor (COFEE)

Design as a script based on live forensics tools that can be used by investigator with no knowledge computer forensics

Conduct live evidence extraction before system shutdown

Make use of USB as the media to carry out non-intrusive volatile evidence extraction.

Tools: Child Exploitation Tracking System (CETS)

Indonesia Fights Child Abuse with Technology

“Taking this kind of integrated approach allows each player to bring their expertise and contribution to the table, producing a more effective response to these heinous crimes.”

— Drs. R Makbul Padmanagara » Chief of Criminal Investigation Department, INP (Kabareskrim)

CETS IN INDONESIA

CETS INTERNATIONAL MEETING IN ROME, ITALY

MAY 31, 2007

Presentation by INP

Training Partnerships GlobalComputer-Facilitated Crimes Against Children

regional training sessionsLaunched in December 2003 at Interpol headquarters in Lyon, France

ICMEC has organized 36 trainings over past 5 years training 3200 law enforcement officials from 113 countries from around the globe

Europol / InterpolWorking Group on Cybercrime Training established by Europol in June 2007.

Training modules are developed with universities and made available to Interpol and all interested law enforcement authorities. Co-funded by European Commission under AGIS and now ISEC programs.

In addition, ad hoc trainings are organized on Windows mobile and Windows XP Forensics, MS Office Metadata and Hiding Techniques, Botnet Malware Detection and Analysis, Windows Vista Security Preview and Demo.

LE Tech” conferencesIntroduce Microsoft’s new products, services and program offerings that will have a bearing on cybercrime investigations over the next few years.

Expertise offered for reverse-engineering, botnets, rootkits, phishers, spammers, botnet herders, and spyware distributors and other cyberthreats

Closed conferences.

Partnerships in Asia Pacific

Law Enforcement Cybercrime & Intellectual Property Capacity Building Projects

Asia Development Bank Institute and Microsoft

Indonesia Cybercrime ProjectUnlimited Potential Partner

Anti-trafficking and Child Safety Project (CETS)

Cambodia Cybercrime and Child Safety Project

LE capacity building trainings in PRC, HK, India, Indonesia, Japan, Korea, Malaysia, Thailand, Philippines, Taiwan and Vietnam

Hands on Trainings

Public/Private Partnerships-Sharing InformationDigital Phishnet (DPN) -www.digitalphishnet.org

•National Cyber-Forensics & Training Alliance (NCFTA) www.ncfta.net

collaborative enforcement operation designed bring industry (technology, banking, financial services and online services) academics and law enforcement together to combat phishing

Financial Coalition Against Child Pornography (FCACP) www.ncmec.org

•Disrupt the economics of commercial child pornography by following the flow of fund

Guidelines for Cooperation between law enforcement and

Internet Service Providers against Cybercrime.

www.coe.int/cybercrime

Are we making progress

Success stories

“Imagine what we can accomplish if no one takes credit.”

FBI Agent at Digital Phishnet Conference, Singapore 2008 (quoting President Harry S. Truman)

Working together to ensure a safer and more secure internet community

The world is a dangerous place to live not because those who do evil but because of those who watch and let it happen.

- Albert Einstein

3 years ago

Steung Meanchey in Cambodia

Today: Our Future Leaders

Questions

Thank You!

Contact: kbostick@microsoft.com

© 2008 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.

The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market

conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation.

MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.