Management Information System Management Information System Topic: Criminal Misuse of Computers

Management Management Information SystemInformation System

Topic: Criminal Misuse of Topic: Criminal Misuse of ComputersComputers

Group MembersGroup Members

Mak Wing Sze (Wayze) 28Mak Wing Sze (Wayze) 28

Tang Wing Shan (Tammy) 33Tang Wing Shan (Tammy) 33

Tse Choi Yu (Karen) 37Tse Choi Yu (Karen) 37

Young Wai Fan (Kathy) 44Young Wai Fan (Kathy) 44

IntroductionIntroduction

Computer Crime Effect All The WorldComputer Crime Effect All The World Information Technology Systems Information Technology Systems Legislation & Health & Safety RegulationsLegislation & Health & Safety Regulations Information Technology Systems SecurityInformation Technology Systems Security Care on Computer CrimeCare on Computer Crime

The Hong Kong Government gazettes for the The Hong Kong Government gazettes for the first time a Bill on Computer Crimes. first time a Bill on Computer Crimes.

The Bill introduced new types of criminal The Bill introduced new types of criminal offences concerning activities involving the offences concerning activities involving the use of computersuse of computers

The issues relating to computer fraud and The issues relating to computer fraud and computer abuse computer abuse

Constitute major threats to information Constitute major threats to information systems security were addressed by the systems security were addressed by the Bill. Bill.

The Bill has now become law in Hong The Bill has now become law in Hong Kong. Kong.

Background Background

Computer Crimes has no precise definition Computer Crimes has no precise definition

It is often used to refer to computer-related activitiesIt is often used to refer to computer-related activities

Which are either criminal in the legal sense or just Which are either criminal in the legal sense or just

antisocial where there is, strictly speaking, no breach antisocial where there is, strictly speaking, no breach of the existing of the existing Criminal LawCriminal Law

Computer CrimesComputer Crimes

Computer CrimesComputer Crimes fall into three main fall into three main categories, it include categories, it include

Computer FraudComputer FraudComputer AbuseComputer AbuseSoftware PiracySoftware Piracy

Source: :http://www.info.gov.hk/police/hkp-home/chinese/tcd/intro.htm#Hacking

Technology CrimeTechnology Crime Hacking Hacking Criminal DamageCriminal Damage

Website DefacementWebsite DefacementDenial of Service AttackDenial of Service AttackSpreading VirusSpreading Virus

Internet FraudInternet FraudInternet shopping FraudInternet shopping FraudOnline Sweepstakes, Lottery FraudOnline Sweepstakes, Lottery FraudReplication of Hong Kong Mark Six FraudReplication of Hong Kong Mark Six FraudBogus WebsitesBogus WebsitesInternet Commercial FraudInternet Commercial Fraud

Misuse of accountsMisuse of accounts Online TheftOnline Theft

Abusive Use of Password Abusive Use of Password Online Games TheftOnline Games TheftTheft of Corporate InformationTheft of Corporate InformationInternet BankingInternet Banking

Illegal Materials/WebsitesIllegal Materials/WebsitesInternet PornographyInternet PornographyInternet GamblingInternet Gambling

Offences relating to the use of Instant messaging tools Offences relating to the use of Instant messaging tools

Computer FraudComputer Fraud

It is a well understood legal conceptIt is a well understood legal concept Which invariably involves willful Which invariably involves willful

misrepresentation with intent to misrepresentation with intent to unlawfully gain or cause loss to unlawfully gain or cause loss to anotheranother

It is simply refers to fraud It is simply refers to fraud committed using a computer or in committed using a computer or in which the computer plays an which the computer plays an important roleimportant role

Computer AbuseComputer Abuse

It is refers to certain types of abusive use It is refers to certain types of abusive use wrongly of computer resources. wrongly of computer resources.

It differs from computer fraud in the It differs from computer fraud in the sense sense

That the former relates to activities That the former relates to activities Which are an end in themselves without Which are an end in themselves without

further ulterior motives while the further ulterior motives while the ultimate object of the latter is fraud in its ultimate object of the latter is fraud in its usual sense with the use of the computer usual sense with the use of the computer merely as a convenient or expedient tool merely as a convenient or expedient tool for that end.for that end.

Software PiracySoftware Piracy In In Hong Kong mainly refers to the unauthorized Hong Kong mainly refers to the unauthorized

copying and distribution of proprietary software. copying and distribution of proprietary software. This falls within the area of intellectual property law, This falls within the area of intellectual property law,

e.g. e.g. IInternet nternet SSharing. haring. Criminal law sanctions are available under this Criminal law sanctions are available under this

regime, software piracy is less commonly treated as “regime, software piracy is less commonly treated as “CComputer omputer CCrimerime""

In view of the perceived magnitude and potential In view of the perceived magnitude and potential severity of threats posed by computer crimes in a severity of threats posed by computer crimes in a highly computerized international trading and finance highly computerized international trading and finance centre like Hong Kongcentre like Hong Kong

Software PiracySoftware Piracy

TThe Hong Kong Government published its first ever he Hong Kong Government published its first ever Computer Crimes Bill Computer Crimes Bill

ThisThis proposed legislation in the area of Information proposed legislation in the area of Information Technology Law in Hong KonTechnology Law in Hong Kongg

Laws against HackingLaws against Hacking

There are two offences under the laws of There are two offences under the laws of Hong Kong aiming at "Hacking" activities:Hong Kong aiming at "Hacking" activities: Cap.106 S.27aCap.106 S.27a

Unauthorised access to computer by telecommunUnauthorised access to computer by telecommunicationication

Cap.200 S.161Cap.200 S.161Access to computer with criminal or dishonest inAccess to computer with criminal or dishonest in

tenttent Cap 200, S. 60 iv Cap 200, S. 60 iv

Criminal DamageCriminal Damage

Source: Hong Kong Police Force

TELECOMMUNICATIONS ORDINANCETELECOMMUNICATIONS ORDINANCE

SECT 27ASECT 27A

Source: http://www.hklii.org/hk/legis/ch/ord/

Unauthorized Access to Computer Unauthorized Access to Computer by Telecommunicationsby Telecommunications

1)1) Any person who, by telecommunications, knowingly causes a computer Any person who, by telecommunications, knowingly causes a computer to perform any function to obtain unauthorized access to any program or to perform any function to obtain unauthorized access to any program or data held in a computer commits an offence and is liable on conviction tdata held in a computer commits an offence and is liable on conviction to a fine of$20000. (Amended 36 of 2000 s. 28) o a fine of$20000. (Amended 36 of 2000 s. 28)

2)2) For the purposes of subsection (1) For the purposes of subsection (1) a)a) The intent of the person need not be directed at The intent of the person need not be directed at b)b) Access of any kind by a person to any program or data held in a computer is Access of any kind by a person to any program or data held in a computer is

unauthorized if he is not entitled to control access of the kind in question to tunauthorized if he is not entitled to control access of the kind in question to the program or data held in the computer and he program or data held in the computer and

3)3) Subsection (1) has effect without prejudice to any law relating to powers Subsection (1) has effect without prejudice to any law relating to powers of inspection, search or seizureof inspection, search or seizure

4)4) Notwithstanding section 26 of the Magistrates Ordinance ( Cap 227), prNotwithstanding section 26 of the Magistrates Ordinance ( Cap 227), proceedings for an offence under this section may be brought at any time oceedings for an offence under this section may be brought at any time within 3 years of the commission of the offence or within 6 months of thwithin 3 years of the commission of the offence or within 6 months of the discovery of the offence by the prosecutor, whichever period expires fie discovery of the offence by the prosecutor, whichever period expires first.(Added 23 of 1993 s. 2) rst.(Added 23 of 1993 s. 2)

CRIMES ORDINANCECRIMES ORDINANCE

SECT 60SECT 60


Destroying or Damaging PropertyDestroying or Damaging Property

1)1) A person who without lawful excuse destroys or damages any A person who without lawful excuse destroys or damages any property belonging to another intending to destroy or damage any property belonging to another intending to destroy or damage any such property or being reckless as to whether any such property such property or being reckless as to whether any such property would be destroyed or damaged shall be guilty of an offence.would be destroyed or damaged shall be guilty of an offence.

2)2) A person who without lawful excuse destroys or damages any A person who without lawful excuse destroys or damages any property, whether belonging to himself or anotherproperty, whether belonging to himself or another

a)a) Intending Intending to destroy or damage any propertyto destroy or damage any property or being reckless as to whether any or being reckless as to whether any propertyproperty would be destroyed or damaged; andwould be destroyed or damaged; and

b)b) Intending by the destruction or damage to endanger the life of another or being reckless Intending by the destruction or damage to endanger the life of another or being reckless as to whether the life of another would be thereby endangered, shall be guilty of an as to whether the life of another would be thereby endangered, shall be guilty of an offence. offence.

3)3) An offence committed under this section by destroying or damaging An offence committed under this section by destroying or damaging property by fire shall be charged as arson. (Added 48 of 1972 s. 3) property by fire shall be charged as arson. (Added 48 of 1972 s. 3) [cf. 1971 c. 48 s.1 U.K.] [cf. 1971 c. 48 s.1 U.K.]

CRIMES ORDINANCECRIMES ORDINANCE

SECT 161SECT 161


Access to Computer with Criminal Access to Computer with Criminal or Dishonest Intentor Dishonest Intent

1)1) Any person who obtains access to a computerAny person who obtains access to a computera)a) With intent to commit an offence;With intent to commit an offence;b)b) With a dishonest intent to deceive; With a dishonest intent to deceive; c)c) With a view to dishonest gain for himself or another; or With a view to dishonest gain for himself or another; or d)d) With a dishonest intent to cause loss to another, whether on the same With a dishonest intent to cause loss to another, whether on the same

occasion as he obtains such access or on any future occasion, commits an occasion as he obtains such access or on any future occasion, commits an offence and is liable on conviction upon indictment to imprisonment for 5 offence and is liable on conviction upon indictment to imprisonment for 5 years.years.

2)2) For the purposes of subsection (1) "Gain" and "Loss" are to be construed For the purposes of subsection (1) "Gain" and "Loss" are to be construed as extending not only to gain or loss in money or other property, but as as extending not only to gain or loss in money or other property, but as extending to any such gain or loss whether temporary or permanent; andextending to any such gain or loss whether temporary or permanent; and

a)a) "Gain" includes a gain by keeping what one has, as well as a gain by getting "Gain" includes a gain by keeping what one has, as well as a gain by getting what one has not; andwhat one has not; and

b)b) ““Loss" includes a loss by not getting what one might get, as well as a loss by Loss" includes a loss by not getting what one might get, as well as a loss by parting with what one has. (Added 23 of 1993 s. 5) parting with what one has. (Added 23 of 1993 s. 5)

COPYRIGHT ORDINANCECOPYRIGHT ORDINANCESpecial Law and Special Special Law and Special

CaseCase

SECT 118 SECT 118


Criminal liability for making or Criminal liability for making or dealing with infringing articles, etcdealing with infringing articles, etc

The Copyright (Suspension of The Copyright (Suspension of Amendments) Ordinance ( Cap 568) Amendments) Ordinance ( Cap 568) provides for the suspension of the provides for the suspension of the operation of certain amendments in operation of certain amendments in relation to this section effected by the relation to this section effected by the Intellectual Property (Miscellaneous Intellectual Property (Miscellaneous Amendments) Ordinance 2000 (64 of Amendments) Ordinance 2000 (64 of 2000). Offences 2000). Offences

Hong Kong Police Force Hong Kong Police Force

Crime Prevention Bureau Crime Prevention Bureau

Crime Prevention DivisionCrime Prevention Division

BT (Bit Torrent) DownloadBT (Bit Torrent) Download

Dowloading copyrighted material such as MP3 music, Dowloading copyrighted material such as MP3 music, vedios and softwarevedios and software

BT (Bit Torrent) DownloadBT (Bit Torrent) Download Multimedia entertainment found on the Internet often comes frMultimedia entertainment found on the Internet often comes fr

ee of charge, such as when watching an upcoming movie traileee of charge, such as when watching an upcoming movie trailer, listening to Internet radio, or watching the latest news. r, listening to Internet radio, or watching the latest news.

Although downloading the MP3s of an entire music album is qAlthough downloading the MP3s of an entire music album is quite easy on the Internet, it is still illegal if those music files oruite easy on the Internet, it is still illegal if those music files originate from an unauthorized source. iginate from an unauthorized source.

Source: http://cesy.qed.hkedcity.net/htmltxte/events.htm

Real Case ScenarioReal Case Scenario Pirated CDsPirated CDs

A 15 years old girl was charged by the CustomA 15 years old girl was charged by the Customs and Excise Department for selling pirated mus and Excise Department for selling pirated music CDs on the Internet...sic CDs on the Internet...

Source: http://cesy.qed.hkedcity.net/htmltxte/events.htm

HackingHacking

(Unauthorized Access, Access with (Unauthorized Access, Access with Criminal Intent)Criminal Intent)

The Intent of Such Hacking Activities VariesThe Intent of Such Hacking Activities Variesand Can Be Summarized As Follows:and Can Be Summarized As Follows:

For 'Fun' For 'Fun' Misuse of computer system to launch further cyber Misuse of computer system to launch further cyber

attacksattacks Destruction of computer file Destruction of computer file Obtaining sensitive information to commit further Obtaining sensitive information to commit further

offences offences Carrying out other illegal activitiesCarrying out other illegal activities

And MORE........And MORE........

Man arrested in Britain in Hacking Man arrested in Britain in Hacking Case Case

WASHINGTON (CNN) WASHINGTON (CNN)

The FBI and Scotland Yard announced Tuesday The FBI and Scotland Yard announced Tuesday the arrest of a 24-year old man who they say was the arrest of a 24-year old man who they say was responsible for a computer virus known as the responsible for a computer virus known as the "Leaves worm," which surfaced in early July in "Leaves worm," which surfaced in early July in home users' Windows-based computer systems.home users' Windows-based computer systems.

Source: www.cnn.com/2001/TECH/internet/ 08/14/www.cnn.com/2001/TECH/internet/ 08/14/hackinghacking.arrest/index.html.arrest/index.html

August 14, 2001August 14, 2001

Twist in eBay Hacking CaseTwist in eBay Hacking Case

SAN JOSE, Calif.--A 22-year-old former Los SAN JOSE, Calif.--A 22-year-old former Los Alamos National Laboratory worker accused of Alamos National Laboratory worker accused of breaking into the computers of eBay, Exodus breaking into the computers of eBay, Exodus Communications and several other companies Communications and several other companies successfully dismissed his lawyer on Wednesday, successfully dismissed his lawyer on Wednesday, despite a federal judge's repeated urgings that he despite a federal judge's repeated urgings that he reconsider.reconsider.

Source: http://news.zdnet.com/2100-1009_22-821413.htmlhttp://news.zdnet.com/2100-1009_22-821413.html

Internet Boasts Lead to Arrest in Internet Boasts Lead to Arrest in Computer Hacking CaseComputer Hacking Case

The 21-year-old owner of a computer The 21-year-old owner of a computer networking company has been charged with networking company has been charged with hacking into hundreds of computers and hacking into hundreds of computers and stealing credit card information. stealing credit card information.

Source: http://www.post-gazette.com/pg/04245/371481.stmhttp://www.post-gazette.com/pg/04245/371481.stm

September 01, 2004September 01, 2004

Chiding Sony, an Australian Court Says Chiding Sony, an Australian Court Says Gamers Can Hack The PlayStationGamers Can Hack The PlayStation

In a victory for gamers, the highest court in In a victory for gamers, the highest court in Australia ruled that players can legally hack Australia ruled that players can legally hack Sony’s PlayStation console so that the device can Sony’s PlayStation console so that the device can run copies of games and international versions of run copies of games and international versions of games.games.

The win is a boost for gamers who complain that The win is a boost for gamers who complain that the digital rights management of hardware and the digital rights management of hardware and software has gone too far and unfairly restricts software has gone too far and unfairly restricts the players. the players.

October 7, 2005October 7, 2005

Source: http://www.redherring.com/Article.aspx?a=13908&hed=Sony+Loses+PS+Hacking+Casehttp://www.redherring.com/Article.aspx?a=13908&hed=Sony+Loses+PS+Hacking+Case

Safety TipsSafety Tips

Install firewall & Intrusion Detection System Install firewall & Intrusion Detection System Upgrade anti-virus protection frequently, Upgrade anti-virus protection frequently, Upgrade operating systems and applications files Upgrade operating systems and applications files

frequentlyfrequently Back up critical data files regularly Back up critical data files regularly Use secure password and change regularly Use secure password and change regularly Scan all e-mail attachments for virus before opening them Scan all e-mail attachments for virus before opening them

Shred all personal documents before disposalShred all personal documents before disposal

And MORE........And MORE........

Statistics in Hong KongStatistics in Hong Kong

Technology Crime Statistics in Hong KongTechnology Crime Statistics in Hong Kong

*Others include traditional offences such as criminal intimidation, using a false instrument etc.

Source: : Hong Kong Police Force

No. of Computer Crime Cases in Hong Kong in 2004No. of Computer Crime Cases in Hong Kong in 2004

Source: : Hong Kong Police Force

Financial losses due to computer crimes inFinancial losses due to computer crimes in

Hong Kong from 2000 to 2003Hong Kong from 2000 to 2003

Source: Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT)

Internet FraudInternet Fraud

Bogus WebsitesBogus Websites

Recent Phishing AttacksRecent Phishing Attacks

A fake website which looks genuine by using similar graphics and domain name to those of the legitimate website.

In recent months, there is a significant growth in the number In recent months, there is a significant growth in the number of phishing emails and bogus websites found in Hong Kong.of phishing emails and bogus websites found in Hong Kong.

The followings pages are press releases and sample bogus wThe followings pages are press releases and sample bogus websites of recent attacksebsites of recent attacks

Suspected FraudulentSuspected Fraudulent

NWS Holdings LimitedNWS Holdings LimitedSuspected Fraudulent - 25 Nov 2005Suspected Fraudulent - 25 Nov 2005

NWS Holdings Limited Suspected Bogus Website - Main Page

Source: http://www.infosec.gov.hk

The First Digital International BankThe First Digital International BankSuspected Fraudulent – 22 Nov 2005Suspected Fraudulent – 22 Nov 2005

The First Digital International Bank Suspected Bogus Website - Main Page


International Switzerland Cooperation Bank International Switzerland Cooperation Bank Suspected Fraudulent – 4 Oct 2005Suspected Fraudulent – 4 Oct 2005

International Switzerland Cooperation Bank Suspected Bogus Website - Main Page


FraudulentFraudulent

The Industrial and Commercial Bank of China ( Asia ) Limited The Industrial and Commercial Bank of China ( Asia ) Limited Fraudulent website19 Oct 2005Fraudulent website19 Oct 2005

The Industrial and Commercial Bank of China ( Asia ) Limited Suspected Bogus Website -

Main Page

The Industrial and Commercial Bank of China ( Asia ) Limited Suspected Bogus Website -

Internet Banking


The Industrial and Commercial Bank of China Fraudulent Website The Industrial and Commercial Bank of China Fraudulent Website 13 Sep 200513 Sep 2005

The Industrial and Commercial Bank of China Suspected Bogus Website - Main Page


General ImpactsGeneral Impacts

Loss of data and information Loss of data and information Damage of IT resources Damage of IT resources Time wasting in reading, checking, verifying ( e.g. hoax) and re-seTime wasting in reading, checking, verifying ( e.g. hoax) and re-se

tting the system tting the system Wasting bandwidth Wasting bandwidth Unavailability of service Unauthorised use or misuse of computer Unavailability of service Unauthorised use or misuse of computer

systems systems Loss of customer trust Loss of customer trust Loss of public confidence Loss of public confidence Disruption of Production Disruption of Production Financial Loss Financial Loss Reputation of Companies Reputation of Companies

Safety TipsSafety Tips

Always verify the domain name displayed on your browser’s website address line, or access websites through your browser’s bookmarks.

Double click the tiny padlock or key icon shown on your browser to check the digital certificate of the website. The certificate should be issued to the genuine domain name/ organisation and have a valid date.

Source: http://www.info.gov.hk/police/hkp-home/english/tcd/hkmae.pdf

How Computer Crimes Affect How Computer Crimes Affect Hong Kong?Hong Kong?

KarenKaren

TammyTammy

WayzeWayze

KathyKathy

Q & AQ & A

The EndThe End

Thank YouThank You

Documents

Management Information System Management Information System Topic: Criminal Misuse of Computers