Identity Theft - Malaysian Concern

The Star Online, Monday June 9, 2008

Identity theft top concern among Malaysians

PETALING JAYA: Financial institutions may need to further improve their security systems to ensure that their customers’ personal data is safe, said Unisys Asia South vice-president and general manager Scott Whyman.
“Preventive measures that can be taken to combat identity theft (for example) include implementing the use of biometric data, such as fingerprint reading and iris scanning for validating online transactions,” he said.
According to him, fraudsters are always on the look out for “softer targets” — those that don’t possess tightened and up-to-date security measures.
“And everyone should also be wary of the websites they visit or the online merchants that they buy from,” Whyman said.
He said that in the past, people shied away from online transactions due to threats from viruses and hackers.
Today’s encryption technologies and other programs to safeguard online transactions have reduced such threats but Internet users should always keep their guard up.
“While many people (and organisations) are less concerned about these threats nowadays, they still need to be on the lookout (for them),” Whyman said.
He was speaking to the press after releasing the results of the latest Unisys Security Index survey.
According to the survey, 78% of Malaysians who responded said they were very or extremely concerned over identity theft.
“Though there has been a slight decrease in the overall level of concern, Malaysians are beginning to be more aware of these (online) security risks and are looking into ways to reduce them,” Whyman said.
Identity theft is one of the primary concerns across the entire Asia-Pacific region because more people are going online and are being targeted by online fraudsters looking for easy prey, said Unisys.
After identity theft, the next primary concerns among Malaysians are credit or debit card fraud (76%) and the war on terrorism (71%), in that order.
The survey polled 872 Malaysians, aged between 18 and 64 years, across Peninsula Malaysia. Updated twice a year, the survey aims to provide a snapshot of the country’s sense of security in four key areas — national, personal, financial and Internet.
Other countries are also surveyed by Unisys, including Singapore and Hong Kong.

http://star-techcentral.com/tech/story.asp?file=/2008/6/9/technology/20080609144730&sec=technology

Tutorial on PDP

In the tutorial class, Sir Sonny had give us handouts of the privacy terms of some companies' websites in Malaysia. He asked us to read the privacy terms, compare it and summarize whether or not it is aligned with the Data Protection Principles that we've learned in the lecture. we have to discuss it in a group and present it to the class. As the groups were presenting after one another, we found that most of the privacy terms made by these companies in their websites are not fully aligned with the Data Protection Principles. most of these websites states that they are free to use and process the personal data collected with any means and for any purpose. another statement made by some of the companies is that they will disclose the personal data of their customers to other companies without having to inform the data subjects!

All this while, I have never care about the privacy terms when i'm surfing a website, but after this tutorial class, i found that i am seriously aware about a website's privacy terms and i am very careful before i provide my personal data to them.

As a data subject, i really hope that the companies in Malaysia will amend and align their websites' privacy terms according to the Data Protection Principles.

Data Protection Principles (summary from PDP lecture slides)

In the lecture, Sir Sonny mentioned about the government of Malaysia is in the process of legislating the Personal Data Protection law. The scope of the law is destined for any individuals or institutions including government, businesses, and e-commerce players. It is aimed to control the collection, possession, processing and use of personal data and to protect the privacy of an individual in relation to that data.

The Data Protection Principles (as in the First Schedule of the latest PDP Bill) :

1 -- Personal data shall be collected lawfully and fairly.
2 -- Purpose of collection of personal data.
3 -- Use of personal data.
4 -- Disclosure of personal data.
5 -- Accuracy of personal data.
6 -- Duration of retention of personal data.
7 -- Access to and correction of personal data.
8 -- Security of personal data.
9 -- Information to be generally available.

TUTORIAL (take-home task)

Question :
a) Andrew is a computer science attached with Microhard Corporation in Cyberjaya as a practical trainee. One day he managed to crack the company's information system but did not do anything afterwards. The following day he also managed to intrude into Microhard Corporation's website system and then posted his picture on the front page of the website and left his mobile number below his picture, hoping that someone will call him and make friends. Subsequently his phone rang, but unfortunately it was his training manager who called and later warned him that actions will be taken. Upon investigations, it was also revealed that Andrew had previously leaked the company's system access code to his friend at University, to whom he also sent emails telling bad things about his manager. Advise Microhard Corporation on various potential liabilitites of Andrew from the above incident, with reference to various cybercrime laws applicable in Malaysia.


Answer :

a) Issue 1 :
- Andrew cracked company's information system but did not do anything afterwards.

- Cracking a computer system can be defined as hacking a computer system or legally defined as accessing a computer system without authority.

- Computer Crimes Act, Section 3(1): A person shall be guilty of an offence if (a) he causes a computer to perform any function with intent to secure access to any program or data held in any computer; (b) the access he intends to secure is unauthorized; and (c) he knows at the time when he causes the computer to perform the function that that is the case.

By virtue of this provision, the following acts are prohibited:
a. Unauthorized access to computer, computer system and computer network;
b. Recreational hacking;
c. Computer cracking to explore loopholes in the system;
d. System intrusion;
e. System and e-mail spoofing

The person guilty under this section is liable to a maximum RM 50,000.00 fine or to 5 years imprisonment or to both. [taken from the article "Computer Crimes in Malaysia" by Sonny Zulhuda]


Issue 2 :
- Andrew intrude company's website system and posted his picture and mobile number on the front page of the website.

- CCA Section 3(1):
By virtue of this provision, the following acts are prohibited:
a. Unauthorized access to computer, computer system and computer network;
d. System intrusion

Liable to a maximum RM 50,000.00 fine or to 5 years imprisonment or to both. [ "Computer Crimes in Malaysia" by Sonny Zulhuda]


- Computer Crimes Act, Section 5(1): A person shall be guilty of an offence if he does any act which he knows will cause unauthorized modification of the contents of any computer.

By virtue of this provision, the following acts are punishable offences:
a. Unauthorized alteration, amendment and modification of data;
b. System intrusion and sabotage;
c. Website defacing;
d. System and website destruction;
e. Spreading virus that will cause data alteration or system destruction

The offences under this section are punishable with a maximum RM 100,000.00 fine or to 7 years imprisonment or to both. However, if the act is done with further intention of causing injury, it can be punished up to RM 150,000.00 fine or 10 years imprisonment or both. [ "Computer Crimes in Malaysia" by Sonny Zulhuda]


Issue 3 :
- Andrew leaked company's system access code to his friend.

- Computer Crimes Act, Section 6(1): A person shall be guilty of an offence if he communicates directly or indirectly a number, code, password or other means of access to a computer to any person other than a person to whom he is duly authorized to communicate.

- This type of offence is punishable by a maximum RM 25,000.00 fine or a 3 years imprisonment or both. [ "Computer Crimes in Malaysia" by Sonny Zulhuda]


Issue 4 :
- Andrew sent emails to his friend telling bad things about his manager.

- Communication and Multimedia Act, Section 211(1) stipulates that no content applications service provider, or other person using a content application service, shall provide content which is indecent, obscene, false, menacing, or offensive in character with intent to annoy, abuse, threaten or harass any person.

By virtue of this provision, among other things, the Internet application and service providers as well as end users are prohibited from providing and distributing offensive contents through the computer system. This includes prohibition of offensive emails and offensive web pages from being published. It also makes the following actions as offences:
a. Online harassment through email or websites or other Internet content;
b. Hatred and abusive content;
c. False rumor spreading;
d. Indecent and/or obscene materials;
e. Threat Email

- The punishment for such an offence is a fine at maximum RM 50,000.00 or imprisonment of maximum one year or both. The provision also prescribes additional fines or jail term if the offence is continuing. [ "Computer Crimes in Malaysia" by Sonny Zulhuda]

Protecting Your Password (Summary from lecture slides)

these are the steps should be taken to protect our password from being stolen :

1 -- Do not share your password!

2 -- Do not write down password in an insecure place or easily accessible.

3 -- Do not keep your password unchanged if you've already tell it to other people.

4 -- Change your password every now and then.

5 -- Do not let your friends, colleagues, or anybody to borrow your password.

6 -- Do not neglect your password unsafely.

7 -- Do not let your friends or colleagues to "shoulder surfing" with you!

Privacy

"The right to be let alone is indeed the beginning of all freedom."

Justice William O. Douglas

i agree with this statement made by Justice William O. Douglas. privacy is the main key point of freedom. if there is no privacy, how could people have their freedom?

Murder Charge Amended

Murder charge amended to causing death
KUALA LUMPUR: Two brothers and a cousin, who were initially charged with murdering a couple on Aifilfitri last year, have been spared the gallows when the High Court here today amended the charge.
Judicial Commissioner Azman Abdullah, in amending the charge at the end of the prosecution case, ruled that the case fell under Exception 5 of Section 300 of the Penal Code. The exception states that "culpable homicide is not murder when the person whose death is cause, being above the age 18 years, suffers death, or takes the risk of death with his own consent.'' However, the three relatives still maintained their not guilty plea and were ordered to enter their defence, which hearing would begin on Dec 30. In the dock are Muhammad Ilyas Abdul Razak, 25, his brother, Muhammad Fauzi, 23, and their cousin, Muhammad Nizam Mohd Ibrahim, 21, who are jointly charged with causing the death of Mohd Ibrahim Kader Mydin, 48, and Rosina SM Mydin Pillay, 42, at house No 5-7C, Blok A, Flat Seri Sarawak, Jalan Kenanga here between noon and 8pm on Oct 1, 2008.
They are charged under Section 304(a) of the Penal Code which carries a jail sentence of up to 20 years.
In his judgment, Azman said although there was no evidence that the three relatives had beaten the couple to death, a witness had testified that Muhammad Fauzi and Muhammad Nizam did that to others on Muhammad Ilyas'' orders. "The court rules that the prosecution has succeeded in establishing a prima facie case under Section 304(a) of the Penal Code," he added. Earlier, Azman said that from witnesses' testimonies, it showed that the three accused and their families believed that the ceremony held on Hari Raya could heal a person from illnesses and also bring back the dead to life. He said the willingness of the family to undergo the healing ceremony proved their belief in the ritual, including on the parents allowing their son to beat them. "A testimony by a witness who heard a ceramah by Muhammad Ilyas showed that the two families (Muhammad Ilyas and Muhammad Nizam's families) had high regard for Muhammad Ilyas' spiritual capabilities," he added. Meanwhile, defence counsel Supramaniam Kasia Pillay, who represented the three accused, said none of the witnesses in the hosue where the incident took place was able to tell how the couple died and who caused their death. He also said that a psychiatric report also confirmed that Muhammad Ilyas had mental problems and that Muhammad Fauzi and Muhammad Nizam were only following Muhammad Ilyas' order. Deputy public prosecutor Anselm Charles Fernandis submitted that the accused murdered the couple to convince other relatives that they could bring the dead back to life. -- BERNAMA

source :
http://m.nst.com.my/Current_News/NST/articles/20091123205218/mobile/index.pda

this is an article reporting about two brothers and a cousin who were charged with murdering a couple last year had been spared from the punishment as the High Court here amended the charge today. the Judicial Commissioner, Azman Abdullah ruled that the case were fall under Exception 5 of Section 300 of the Penal Code where it is stated that "culpable homicide is not murder when the person whose death is cause, being above the age 18 years, suffers death, or takes the risk of death with his own consent." in this case which mentioned in this article, the reason why the three relatives were not charged under murdering is because the couple themselves were willingly to be beaten by the three as a practice in a ceremony of Hari Raya.

reading this article, I remembered the topic that we've learned in the Legal Framework class, where Sir Sonny said that there is three degrees of murder charge.

1st degree : murder
2nd degree : culpable homicide
3rd degree : accidently murder

this case fell into the second degree where the three relatives were charged culpable homiside. this article has improved my understanding about the murder charge that I've learned in class.