Category: The Authorities

March 9, 2018

UK Cyber Security Centre One Year On

In November 2016 the National Cyber Security Centre (NCSC) was created as part of GCHQ and given a mandate to pursue the radical action required to better protect the UK’s interests in cyberspace.

A key strand in this new approach is the NCSC’s Active Cyber Defence (ACD) programme, which aspires to protect the majority of people in the UK from the majority of the harm, caused by the majority of the attacks, for the majority of the time. It is intended to tackle the high-volume commodity attacks that affect people’s everyday lives, rather than the highly sophisticated and targeted attacks, which are dealt with in other ways.

One key intervention is the Takedown Service.

The Takedown Service

This service works by requesting that hosting providers remove malicious content that is pretending to be related to UK government and also certain types of malicious content hosted in the UK.

In 2017, we removed 18,067 unique phishing sites across 2,929 attack groups that pretended to be a UK government brand, wherever in the world they were hosted.
As a consequence, we have reduced the median availability of a UK government-related phishing site from 42 hours to 10 hours. That means that these sites are available for much less time to do harm to UK citizens. 65.8% of those are down in 24 hours, up from 39% before we started takedowns.
In 2017, we removed 121,479 unique phishing sites across 20,763 attack groups physically hosted in the UK, regardless of who it was pretending to be. As a consequence, we have reduced the median availability of a phishing site physically hosted in the UK from 26 hours to 3 hours, again giving them much less time to do harm. 76.8% of those were down in 24 hours, up from 47.3% before NCSC started takedowns.
In 2017, we worked with 1,719 compromised sites in the UK that were being used to host 5,111 attacks, intended to compromise the people that visited them. As a consequence, we have reduced the median availability of these compromises from 525 hours to 39 hours.
Over the year 2017, the month-by-month volume of each of these has fallen, suggesting that criminals are using the UK government brand less and hosting fewer of their malicious sites in UK infrastructure.
In 2017, we notified email providers about 3,243 Advance Fee Fraud attacks, pretending to be related to UK government.
In 2017, we stopped several thousand mail servers being used to impersonate government domains and sending malware to people, in the expectation that the government link makes them more realistic. We have also removed a number of deceptive domains that were registered with the sole intention of deceiving people.
While the volume of global phishing we can see has gone up significantly (nearly 50%) over the last 18 months, the share hosted in the UK has reduced from 5.5% to 2.9%.

That’s a great first year – keep up the good work.

Do leave a comment on this post – click on the post title then scroll down to leave your comment.

March 7, 2018

Reporting Data Breaches to the Information Commissioner

Not all organisation data breaches get reported to the Information Commissioner’s Office (ICO).

ICO do recommend that any serious breach is reported to them, but it isn’t mandatory and ‘serious breaches’ are not defined. However, the following should assist data controllers in considering whether breaches should be reported:

The potential detriment to individuals is the overriding consideration in deciding whether a breach of data security should be reported to the ICO. Detriment includes emotional distress as well as both physical and financial damage.

Ways in which detriment can occur include:

exposure to identity theft through the release of non-public identifiers, eg passport number
information about the private aspects of a person’s life becoming known to others, eg financial circumstances

The extent of detriment likely to occur is dependent on both the volume of personal data involved and the sensitivity of the data where there is significant actual or potential detriment as a result of the breach.

Where there is little risk that individuals would suffer significant detriment, for example because a stolen laptop is properly encrypted or the information that is the subject of the breach is publicly-available information, there is no need to report.

The volume of personal data lost / released / corrupted: There should be a presumption to report to the ICO where a large volume of personal data is concerned and there is a real risk of individuals suffering some harm.
The sensitivity of the data lost / released / corrupted:

How to Report a Breach

Serious breaches should be reported to the ICO using the DPA security breach helpline on 0303 123 1113 (open Monday to Friday, 9am to 5pm). Select option 3 to speak to staff that will record the breach and give you advice about what to do next or report in writing using the DPA security breach notification form, which should be sent to the email address [email protected] or by post to the office address at:- Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

When a breach is reported, the nature and seriousness of the breach and the adequacy of any remedial action taken will be assessed and a course of action determined.

ICO may:

Record the breach and take no further action, or  Investigate the circumstances of the breach and any
remedial action, which could lead to further action;
Set a requirement on the data controller to undertake a course of action to prevent further breaches;
Start formal enforcement action which could lead to a fine of up to £500,000

For further information see https://ico.org.uk

Do enter your email address and click on the subscribe button on top right to keep up to date with new posts.

February 15, 2018

Keurboom Communications Stopped

Keurboom Communications Ltd has been handed the highest ever fine of £400,000 for nuisance calling after more than 1,000 people complained about automated calls.

The calls, made during an 18 month period, including road traffic accident claims and PPI compensation. Some people received repeat calls, even on the same day and during unsociable hours. The company also hid its identity, making it harder for people to complain.

The law says that companies can only make automated marketing calls to people if they have given consent. Keurboom ignored this and called without consideration.

The government is working on a new law to allow prosecution of Directors and fine them up to £500,000. This is because some companies deliberately closed down to avoid the fines imposed on them.

Following the ICO’s investigation, Keurboom Communications Ltd has been placed in voluntary liquidation. The ICO says it is committed to recovering the fine by working with the liquidator and insolvency practitioners.

How to Block Nuisance Callers

Register with the Telephone Preference Service (TPS) then reputable companies will no longer make sales and Marketing calls to your number.
Use your phone to block repeated unwanted callers and caller ID withheld numbers. Some phones allow you to do this and some services such as BT Call Protect enable this.
Use the magic phone number when a website demands your number. (More information at https://fightback.ninja/test/a-magic-phone-number-and-call-blocking/)

If you have any experiences with scammers, spammers or time-waster do let me know, by email.

January 25, 2018

HMRC Warn of Tax Threat Calls

Scammers target vulnerable and elderly in cold call tax voucher fraud, warns HM Revenue and Customs (HMRC).

HMRC say that scammers call the victims and impersonate an HMRC member of staff.

“They tell them that they owe large amounts of tax which they can only pay off through digital vouchers and gift cards, including those used for Apple’s iTunes Store”.

Victims are then told to go to a local shop, buy these vouchers and then read out the redemption code to the scammer who has kept them on the phone the whole time.

The conmen then sell on the codes or purchase high-value products, at the victim’s expense.

HMRC said the scammers frequently use intimidation to get what they want, threatening to seize the victim’s property or involve the police.

The scammers use vouchers because they are easy to sell on and hard to trace once used.

HMRC would never request the settling of debt through any such method.

The vast majority of the victims are aged over 65 and suffered an average financial loss of £1,150 each.

As these scammers often prey on vulnerable people. HMRC urge people with elderly relatives to warn them about this scam and remind them that they should never trust anyone who phones them out of the blue and demands they pay a tax bill.

If you suspect that you or a vulnerable or elderly relative has been the victim of this scam or a similar one, you should report it immediately to Action Fraud on 0300 123 2040.

Do Share this post on social media – click on the post title then scroll down to the social media share buttons.

January 19, 2018

Western Union to Repay Scammed Money

The U.S. Department of Justice (DOJ) and the US Postal Inspection Service have been investigating Western Union who are a wire transfer company.

Western Union is often used by fraudsters as payments through Western Union cannot generally be tracked.

Western Union has admitted to aiding and abetting wire fraud and failure to maintain an effective anti-money-laundering programme and agreed to pay $586 million. That money is now being used by DOJ to give refunds to people who were tricked into using Western Union to pay scammers.

Victims of fraud who paid money to scammers via a Western Union wire transfer between 2004 and 2017 can apply for a refund .

This was thought to only apply to U.S. citizens but the US Department of Justice has recently confirmed that victims of fraud who live anywhere in the world – including the UK – can apply for a refund if they lost money transferred via Western Union between 1 January 2004 and 19 January 2017. There is a limited refund pot and there are thought to be 100,000s of victims, so they may not get all of their lost money back.

Fraudsters use a variety of methods to trick people into wiring them money – romance scams, friend in distress, fake online purchases etc.

The refund scheme covers any form of wire transfer fraud which involved making a payment via Western Union, so if you sent money to someone who wasn’t who they said they were, or you didn’t get what you were promised in return for a transfer you made, you can apply for a refund.

How To Apply For a Refund

You can apply online at www.westernunionremission.com/ or by post – the deadline is 12 February 2018.

To apply online, fill in the Western Union remission claim form. You’ll be asked for contact details, details of the payment you made to a fraudster, whether you’ve previously managed to recover some of your lost money and if so, how much. If you’ve already had some money back, you can only claim for the amount you haven’t recouped.

The form asks for a social security number – for people no in the U.S.A. put that you don’t have one as you are not a U.S. citizen.

If you have receipts or other supporting documentation such as a police report, then upload copies of these to support your claim. You can still apply if you don’t have any documentation.

Make sure you apply through the official site and don’t respond to emails from people claiming they can get your money back – these are almost certainly fraudsters. You do not have to pay anything to get your money back and you will not be called and asked for your bank account or credit card number as part of the claims process.

The process may take a year or more because of the number of claims that will have to be dealt with. The Department of Justice has already identified 500,000 potential victims in the US and many more are expected to apply from overseas.

Do Share this post on social media – click on the post title then scroll down to the social media share buttons.