Thursday, April 9, 2015

Cyber Crime & Fraud In Canada

In this post, I'm going to get something off my chest that has been a long time brewing... in fact, it's been brewing for years.  The subject is about Canada and cyber-crime and fraud prevention where computers and law-enforcement collide.

If you don't know already, I work in IT.  I'm a programmer by trade (for the past 7 years I've concentrated on iOS, but there's 20+ years of Windows developer mileage under this bridge before that).  My code runs in everything from ship inspection systems to SuperMax prisons to the Special Organised Crime Agency (now the NCA) and national banks.  I am JCP certified and I'm found in NATO handbooks H4 & H8.  In short, I'm a registered "good guy" with a vested interest in doing the right thing and maintaining my reputation as trustworthy.

So, onto the story....

In Canada, just as anywhere else, there's two sides to cyber-crime and fraud; There's those with the intent to prevent it and those with the intent to commit it.  Just like in most other civilised places, the legal system tries to protect people from computer related crime - in Canada we have the "Criminal Code Section 342.1" which tries to draw a box around what you're allowed to do and not allowed to do.  So far, everything seems cut and dried and nobody should be surprised by what I've said.

When it comes to fraud prevention, various layers of government and law enforcement inform the public that they are here to help, and the legal framework/laws and public education programs would lead you to believe that you are very well protected in Canada.  The reality is this apparent protection is a double-edged sword that is often as likely to prolong your exposure to fraud as it is to protect you from it.

I'm no expert in the world of cyber-crime/fraud, but I understand way more than the average person - and in the UK and the USA, experience has shown that when I try to help an organisation with a problem, people listen to me... except in Canada.  I've had conversations with Andrews Air Force base about the finer technical points of Air Force One, discussed iPhone-based Missile Impact mapping technologies with Fort Bliss by the White Sands Missile Range and everyone knows I'm a good guy who is on the same side as them.... then I get on the phone to Bell Canada one day to report to Sheilagh Malloy (their privacy bod) that one of Bell Canada's customers has been breached and needs rescuing from a very real chance of identity theft, and demonstrating this to Ms Malloy resulted in the aforementioned section 342.1 rules being read back to me and telling me to never go into Bell's systems again.  

That experience was several years ago.  Amongst the many things I learned in that conversation, I saw what I thought was a blind spot for customer safety and data.  I followed that hunch and a year later, I started a disagreement with Bell Canada about runaway customer data involving my own records that I was now looking into.  

Structuring my argument according to what I'd thought I'd learned in the previous conversation, the disagreement was "resolved" in a stale-mate with Ms Malloy so she'd think that she won her side of the argument about Bell's privacy policy because she didn't have to back down.  Because I'd pushed her into a stalemate position where I remained "dissatisfied" she had no choice but to gave me the escalation path necessary to go to the Privacy Commission of Canada, and this gave me the "green light" to go after Bell Canada's third party link with Yellow Pages Group because it involved them too.  Of course, when I asked YPG if they were willing to stand shoulder-to-shoulder with Ms Malloy at Bell Canada and her position on my data, they collapsed faster than a wet noodle and undermined what Bell Canada had argued.  

Thus, I had successfully secured my own data, and confirmed what I suspected the first time round was blind spot with Bell Canada.  Of course, once you know there is a problem, it's not hard to go looking for signs of it.

Watching Bell Canada customers get compromised is fairly trivial.  In the same way you can watch looters steal televisions from a shop across the street, you just watch the information appear outside of Bell - you don't need to go into Bell Canada's systems, in the same way you don't need to go into a leaky pipe to see that it's leaking.  

You can set up Google to notify you when a breach occurs, which means you're no longer violating Canada's Criminal Code section 342.1 because you're not accessing that data - instead someone else is telling you that data is now available - and if you're not accessing/viewing/transmitting/storing it, then you're not breaking the law.  A bonus to this, is we've gotten ourselves an accidental security canary because we can infer what Bell Canada failed at, and as long as the signals keep appearing that there's a failure, you know Bell Canada hasn't got it's act together.

What I'd like to do is help the people who are almost guaranteed to become victims of identity theft, fraud, etc.  Of course, this means reporting it and when you report it, you need to provide evidence, and under the rules of section 342.1, I can't handle that data or show that it compromises a customer by accessing their details.

As you can guess, this is very frustrating.

So, what are my options?

  • I could talk to Bell, CRTC, etc, but Bell Canada would launch a law-suit against me if I then went on to prove the problem exists because it means proving you can access compromised customers in their system.
  • Let's imagine I want to talk to the Canadian Anti-Fraud Centre:
    • You go to login here (Link) on a Mac and the RCMP securekey login fails...
    • You downgrade to Windows and login, only to find the CAFC requires specific information that you can't provide.  They have no "Contact us for something else" option.
  • I can't deal with the police, as no proof of a crime has happened yet, and again showing that the crime is likely to happen would require me to step over the law and put myself in danger when showing how and where.  

What we need:
Canada needs a program where trusted individuals can demonstrate to law enforcement that there is a cyber-fraud problem and help members of the public to be alerted when it can be proven that they are at risk from fraud/identity theft/etc.  The program should span customers of banks, too, as this is another problem area.  Finally, these whistle-blowers should have immunity from section 342.1 and have no further legal ramifications for cooperating with law enforcement to help the general public become safer by the people who dropped the ball in the first place.

In short, it's my belief that we need a mechanism whereby people can be protected from criminal activity, without those trying to help law enforcement identify the problem being penalized.  Where we stand currently is the very same mechanism to stop cyber-fraud now stops anyone from proving when you are at risk of cyber-fraud.  Of course, those who disregard the law are free to do so because they're now effectively protected by this catch-22 situation.