Protect Your Identity!

Yes, it could happen to anyone. identity theft has become a major concern among Malaysians and other countries as well. tp prevent this, it is good to have some knowledge on how our identity can be stolen. our personal data are stolen through spam emails, virus attacks, and phishings. thus, we are advised not to reply to those spam emails and provide our personal data to unknown resources.

Identity Theft - Malaysian Concern

The Star Online, Monday June 9, 2008

Identity theft top concern among Malaysians

PETALING JAYA: Financial institutions may need to further improve their security systems to ensure that their customers’ personal data is safe, said Unisys Asia South vice-president and general manager Scott Whyman.
“Preventive measures that can be taken to combat identity theft (for example) include implementing the use of biometric data, such as fingerprint reading and iris scanning for validating online transactions,” he said.
According to him, fraudsters are always on the look out for “softer targets” — those that don’t possess tightened and up-to-date security measures.
“And everyone should also be wary of the websites they visit or the online merchants that they buy from,” Whyman said.
He said that in the past, people shied away from online transactions due to threats from viruses and hackers.
Today’s encryption technologies and other programs to safeguard online transactions have reduced such threats but Internet users should always keep their guard up.
“While many people (and organisations) are less concerned about these threats nowadays, they still need to be on the lookout (for them),” Whyman said.
He was speaking to the press after releasing the results of the latest Unisys Security Index survey.
According to the survey, 78% of Malaysians who responded said they were very or extremely concerned over identity theft.
“Though there has been a slight decrease in the overall level of concern, Malaysians are beginning to be more aware of these (online) security risks and are looking into ways to reduce them,” Whyman said.
Identity theft is one of the primary concerns across the entire Asia-Pacific region because more people are going online and are being targeted by online fraudsters looking for easy prey, said Unisys.
After identity theft, the next primary concerns among Malaysians are credit or debit card fraud (76%) and the war on terrorism (71%), in that order.
The survey polled 872 Malaysians, aged between 18 and 64 years, across Peninsula Malaysia. Updated twice a year, the survey aims to provide a snapshot of the country’s sense of security in four key areas — national, personal, financial and Internet.
Other countries are also surveyed by Unisys, including Singapore and Hong Kong.

http://star-techcentral.com/tech/story.asp?file=/2008/6/9/technology/20080609144730&sec=technology

Tutorial on PDP

In the tutorial class, Sir Sonny had give us handouts of the privacy terms of some companies' websites in Malaysia. He asked us to read the privacy terms, compare it and summarize whether or not it is aligned with the Data Protection Principles that we've learned in the lecture. we have to discuss it in a group and present it to the class. As the groups were presenting after one another, we found that most of the privacy terms made by these companies in their websites are not fully aligned with the Data Protection Principles. most of these websites states that they are free to use and process the personal data collected with any means and for any purpose. another statement made by some of the companies is that they will disclose the personal data of their customers to other companies without having to inform the data subjects!

All this while, I have never care about the privacy terms when i'm surfing a website, but after this tutorial class, i found that i am seriously aware about a website's privacy terms and i am very careful before i provide my personal data to them.

As a data subject, i really hope that the companies in Malaysia will amend and align their websites' privacy terms according to the Data Protection Principles.

Data Protection Principles (summary from PDP lecture slides)

In the lecture, Sir Sonny mentioned about the government of Malaysia is in the process of legislating the Personal Data Protection law. The scope of the law is destined for any individuals or institutions including government, businesses, and e-commerce players. It is aimed to control the collection, possession, processing and use of personal data and to protect the privacy of an individual in relation to that data.

The Data Protection Principles (as in the First Schedule of the latest PDP Bill) :

1 -- Personal data shall be collected lawfully and fairly.
2 -- Purpose of collection of personal data.
3 -- Use of personal data.
4 -- Disclosure of personal data.
5 -- Accuracy of personal data.
6 -- Duration of retention of personal data.
7 -- Access to and correction of personal data.
8 -- Security of personal data.
9 -- Information to be generally available.

TUTORIAL (take-home task)

Question :
a) Andrew is a computer science attached with Microhard Corporation in Cyberjaya as a practical trainee. One day he managed to crack the company's information system but did not do anything afterwards. The following day he also managed to intrude into Microhard Corporation's website system and then posted his picture on the front page of the website and left his mobile number below his picture, hoping that someone will call him and make friends. Subsequently his phone rang, but unfortunately it was his training manager who called and later warned him that actions will be taken. Upon investigations, it was also revealed that Andrew had previously leaked the company's system access code to his friend at University, to whom he also sent emails telling bad things about his manager. Advise Microhard Corporation on various potential liabilitites of Andrew from the above incident, with reference to various cybercrime laws applicable in Malaysia.


Answer :

a) Issue 1 :
- Andrew cracked company's information system but did not do anything afterwards.

- Cracking a computer system can be defined as hacking a computer system or legally defined as accessing a computer system without authority.

- Computer Crimes Act, Section 3(1): A person shall be guilty of an offence if (a) he causes a computer to perform any function with intent to secure access to any program or data held in any computer; (b) the access he intends to secure is unauthorized; and (c) he knows at the time when he causes the computer to perform the function that that is the case.

By virtue of this provision, the following acts are prohibited:
a. Unauthorized access to computer, computer system and computer network;
b. Recreational hacking;
c. Computer cracking to explore loopholes in the system;
d. System intrusion;
e. System and e-mail spoofing

The person guilty under this section is liable to a maximum RM 50,000.00 fine or to 5 years imprisonment or to both. [taken from the article "Computer Crimes in Malaysia" by Sonny Zulhuda]


Issue 2 :
- Andrew intrude company's website system and posted his picture and mobile number on the front page of the website.

- CCA Section 3(1):
By virtue of this provision, the following acts are prohibited:
a. Unauthorized access to computer, computer system and computer network;
d. System intrusion

Liable to a maximum RM 50,000.00 fine or to 5 years imprisonment or to both. [ "Computer Crimes in Malaysia" by Sonny Zulhuda]


- Computer Crimes Act, Section 5(1): A person shall be guilty of an offence if he does any act which he knows will cause unauthorized modification of the contents of any computer.

By virtue of this provision, the following acts are punishable offences:
a. Unauthorized alteration, amendment and modification of data;
b. System intrusion and sabotage;
c. Website defacing;
d. System and website destruction;
e. Spreading virus that will cause data alteration or system destruction

The offences under this section are punishable with a maximum RM 100,000.00 fine or to 7 years imprisonment or to both. However, if the act is done with further intention of causing injury, it can be punished up to RM 150,000.00 fine or 10 years imprisonment or both. [ "Computer Crimes in Malaysia" by Sonny Zulhuda]


Issue 3 :
- Andrew leaked company's system access code to his friend.

- Computer Crimes Act, Section 6(1): A person shall be guilty of an offence if he communicates directly or indirectly a number, code, password or other means of access to a computer to any person other than a person to whom he is duly authorized to communicate.

- This type of offence is punishable by a maximum RM 25,000.00 fine or a 3 years imprisonment or both. [ "Computer Crimes in Malaysia" by Sonny Zulhuda]


Issue 4 :
- Andrew sent emails to his friend telling bad things about his manager.

- Communication and Multimedia Act, Section 211(1) stipulates that no content applications service provider, or other person using a content application service, shall provide content which is indecent, obscene, false, menacing, or offensive in character with intent to annoy, abuse, threaten or harass any person.

By virtue of this provision, among other things, the Internet application and service providers as well as end users are prohibited from providing and distributing offensive contents through the computer system. This includes prohibition of offensive emails and offensive web pages from being published. It also makes the following actions as offences:
a. Online harassment through email or websites or other Internet content;
b. Hatred and abusive content;
c. False rumor spreading;
d. Indecent and/or obscene materials;
e. Threat Email

- The punishment for such an offence is a fine at maximum RM 50,000.00 or imprisonment of maximum one year or both. The provision also prescribes additional fines or jail term if the offence is continuing. [ "Computer Crimes in Malaysia" by Sonny Zulhuda]

Protecting Your Password (Summary from lecture slides)

these are the steps should be taken to protect our password from being stolen :

1 -- Do not share your password!

2 -- Do not write down password in an insecure place or easily accessible.

3 -- Do not keep your password unchanged if you've already tell it to other people.

4 -- Change your password every now and then.

5 -- Do not let your friends, colleagues, or anybody to borrow your password.

6 -- Do not neglect your password unsafely.

7 -- Do not let your friends or colleagues to "shoulder surfing" with you!

Privacy

"The right to be let alone is indeed the beginning of all freedom."

Justice William O. Douglas

i agree with this statement made by Justice William O. Douglas. privacy is the main key point of freedom. if there is no privacy, how could people have their freedom?