Cyber Extortion Research Articles

Analysing the Investigation and Prosecution of Cryptocurrency Crime as Provided for by the South African Cybercrimes Bill

Abstract The purpose of this article is to determine the effectiveness of the Cybercrimes Bill of 2018 in investigating and prosecuting cryptocurrency crime. The method used to determine this enquiry is based on the analysis of certain criminal, procedural, and investigatory support provisions of the bill, accompanied by recommendations where necessary. An analysis of the Cybercrimes Bill of 2018 in its entirety falls outside the scope of this article. The significance of this enquiry rests on the increasing use of cryptocurrencies in criminal activity (including money laundering, investment scams, fraud, hacking, and cyber extortion). The investigation and prosecution of such criminal activity may be exacerbated by the unique characteristics inherent in a cryptocurrency; a cryptocurrency is an unregulated, online, encrypted (and thus pseudonymous) ‘currency’ denominated in its own units of value. Cryptocurrencies are thus an international online ‘currency’ with multijurisdictional presence. Any criminal activity associated with its use will therefore invariably possess a cyber-element. Such criminal activity will thus need to be addressed from a legal basis that caters for the criminal and procedural processes necessary in the investigation and subsequent prosecution of such crime.

Cyber operational risk scenarios for insurance companies

Abstract Cyber Operational Risk: Cyber risk is routinely cited as one of the most important sources of operational risks facing organisations today, in various publications and surveys. Further, in recent years, cyber risk has entered the public conscience through highly publicised events involving affected UK organisations such as TalkTalk, Morrisons and the NHS. Regulators and legislators are increasing their focus on this topic, with General Data Protection Regulation (“GDPR”) a notable example of this. Risk actuaries and other risk management professionals at insurance companies therefore need to have a robust assessment of the potential losses stemming from cyber risk that their organisations may face. They should be able to do this as part of an overall risk management framework and be able to demonstrate this to stakeholders such as regulators and shareholders. Given that cyber risks are still very much new territory for insurers and there is no commonly accepted practice, this paper describes a proposed framework in which to perform such an assessment. As part of this, we leverage two existing frameworks – the Chief Risk Officer (“CRO”) Forum cyber incident taxonomy, and the National Institute of Standards and Technology (“NIST”) framework – to describe the taxonomy of a cyber incident, and the relevant cyber security and risk mitigation items for the incident in question, respectively.Summary of Results: Three detailed scenarios have been investigated by the working party: ∙ Employee leaks data at a general (non-life) insurer: Internal attack through social engineering, causing large compensation costs and regulatory fines, driving a 1 in 200 loss of £210.5m (c. 2% of annual revenue). ∙ Cyber extortion at a life insurer: External attack through social engineering, causing large business interruption and reputational damage, driving a 1 in 200 loss of £179.5m (c. 6% of annual revenue). ∙ Motor insurer telematics device hack: External attack through software vulnerabilities, causing large remediation / device replacement costs, driving a 1 in 200 loss of £70.0m (c. 18% of annual revenue). Limitations: The following sets out key limitations of the work set out in this paper: ∙ While the presented scenarios are deemed material at this point in time, the threat landscape moves fast and could render specific narratives and calibrations obsolete within a short-time frame. ∙ There is a lack of historical data to base certain scenarios on and therefore a high level of subjectivity is used to calibrate them. ∙ No attempt has been made to make an allowance for seasonality of renewals (a cyber event coinciding with peak renewal season could exacerbate cost impacts) ∙ No consideration has been given to the impact of the event on the share price of the company. ∙ Correlation with other risk types has not been explicitly considered. Conclusions: Cyber risk is a very real threat and should not be ignored or treated lightly in operational risk frameworks, as it has the potential to threaten the ongoing viability of an organisation. Risk managers and capital actuaries should be aware of the various sources of cyber risk and the potential impacts to ensure that the business is sufficiently prepared for such an event. When it comes to quantifying the impact of cyber risk on the operations of an insurer there are significant challenges. Not least that the threat landscape is ever changing and there is a lack of historical experience to base assumptions off. Given this uncertainty, this paper sets out a framework upon which readers can bring consistency to the way scenarios are developed over time. It provides a common taxonomy to ensure that key aspects of cyber risk are considered and sets out examples of how to implement the framework. It is critical that insurers endeavour to understand cyber risk better and look to refine assumptions over time as new information is received. In addition to ensuring that sufficient capital is being held for key operational risks, the investment in understanding cyber risk now will help to educate senior management and could have benefits through influencing internal cyber security capabilities.

Preventive measures against computer related crimes

Cybercrime is a combination of information, financial and personal security threats. The purpose of this research is to target statistical data to allocate the most effective preventive measures against cybercrime that would contribute to the combat at the level of potential (or real) cyber victims and cyber criminals. Brining the so-called Cyberethics into the life of people will be preventive against cybercrimes, as it will add to their culture of cyberspace through educational and popular science projects (such-like program that was put into action in Nigeria stroke positively). With the rapid spread of cybercrime, preventive measures geared towards individuals such as anti-criminalization, anti-bullying and anti-phishing propaganda, the practice of shaping negative attitude towards crimes, and discovery of responsibility for committing cybercrimes gain in importance. Society improvement as a counter-move to cut out criminal factors provoking a positive or neutral attitude to cybercrimes should be geared towards better living, as the higher is the standard the lower is the level of cybercrime. Taking individualized preventing measures to people prone to commit cybercrimes will prevent against such even before they take place (with cyber extortion and ransomware threats, such actions gain in relevance). For the fight against cybercrime, special programs are to level down victimization in the field of cybersecurity by fostering a shielding attitude in persons who can become victims. The path of designing such programs will lead to a drop cybercrime activity. Specific public authorities and non-governmental organizations should take part in the preventive process. All-encompassing preventive measures against cybercrime approaching individual at the international level will allow designing specific pilot programs for individualized prevention

Cyber Harassment Trends Analysis: a Malaysia Case Study

Each year, Malaysia Computer Emergency and Response Team (MyCERT) handles more than a hundred incidents of individuals and organizations being harassed online. A common platform for the harassment activities to take place is via social networks. This case study will illustrate and uncover several prevalent threats that targets social networking users in Malaysia. This includes discussion on online fake profiles, executing cyber extortion and cyber harassment based on the incidents received by MyCERT from year 2014 until June of 2017. Perpetrator’s modus operandi and statistics analysis is highlighted in this paper. Countermeasures to cyber harassment is proposed as a preventive measure to limit the risks and impacts of potential cyber harassment threats.

The impact of cybercrime on businesses: a novel conceptual framework and its application to Belgium

Despite growing indications and fears about the impact of cybercrime, only few academic studies have so far been published on the topic to complement those published by consultancy firms, cybersecurity companies and private institutes. The review of all these studies shows that there is no consensus on how to define and measure cybercrime or its impact. Against this background, this article pursues two aims: 1) to develop a thorough conceptual framework to define and operationalize cybercrime affecting businesses as well as its impact, harms, and costs; and 2) to test this conceptual framework with a survey of businesses based in Belgium, which was administered in summer 2016 and elicited 310 valid responses. Consisting of five types, our conceptualization of cybercrime is, unlike others, technology-neutral and fully compatible with the legislation. Drawing on Greenfield and Paoli’s Harm Assessment Framework (The British Journal of Criminology, 53, 864–885, 2013), we understand impact as the overall harm of cybercrime, that is, the “sum” of the harms to material support, or costs, and the harms to other interest dimensions i.e., functional (or operational) integrity, reputation and privacy. Whereas we ask respondents to provide a monetary estimate of the costs, respondents are invited to rate the severity of the harms on the basis of an ordinal scale. We claim that this “double track” gives a fuller, more valid assessment of cybercrime impact. Whereas most affected businesses do not report major costs or harm, 15% to 20% of them rate the harms to their internal operational activities as serious or more, with cyber extortion regarded as most harmful.

INCREASING CYBER CRIME AGAINST WOMEN IN INDIA: A CRITICAL STUDY

The arrival of the digital age and the development of internet networks gave rise to a new aspect of human experience that is referred to as cyber space. In other words, it is an addition to the world that exists within an individual's mind. While there are millions of individuals who use the internet daily to make their lives better, there are also those who use the internet for anti-social objectives and commit crimes such as cyber bullying, cyber harassment, cyber stalking, online child grooming, cyber extortion, voyeurism, sextortion/revenge-pornography and other similar activities. These people use the internet in the same way. Given the proliferation of the Internet, this has recently become a new type of abusive weapon specially targeted towards women in India. Hence, the goal of this article is to combine the digital and physical worlds, which are often seen as opposites, into a useful discussion and present the situation of cyber violence against women in India.

Cyber Extortion, Ransomware and the South African Cybercrimes and Cybersecurity Bill

Cyber Extortion, Ransomware and the South African Cybercrimes and Cybersecurity Bill

Условно-цифровое вымогательство, или кибершантаж

The article provides the author´s opinion on conditional-digital extortion, the author analises criminal law and criminology issues of understanding cyber blackmail. The article provides a forecast on the transformation of the cyber extortion into serious criminal problem. Internet extortion is viewed as a form of a theft and from the position of profit motivated violate crime against property. The article provides a conclusion that conditional-digital extortion from the criminal law point of view is a property crime, from the criminological point of view is a violate crime and a coercion to act, from the victimological point of view is a criminal behaviour. The victim of the behavior does not obey the offender´s demands and the offender uses the force. Modern internet extortion demonstrates two tendencies: a trend to establish lawfull appearance of the act and a hyperlatency.
 

Cyber extortion — The corporate response

Cyber extortion — The corporate response