# data[].attributes.headline
"Cyber Crime Isn't About Computers: It's about Behaviour" - Adam Anderson

# data[].attributes.subject
"Cyber Crime Isn't About Computers: It's about Behaviour" - Adam Anderson

# data[].attributes.body
Adam introduces a funny story regarding change of behaviour and it's connection to Cybercrime. He reminds us that everyone is a potential target of being hacked.
The reality of the capabilities of hackers is illustrated and elaborated to remind eachof us that there is no stereotype for hackers.

# data[].attributes.attachment_link.title
Cyber Crime Isn't About Computers: It's About Behavior | Adam Anderson | TEDxGreenville

# data[].attributes.headline
What is Cybercrime andHow Can You Prevent It?

# data[].attributes.subject
What is Cybercrime andHow Can You Prevent It?

# data[].attributes.body
While a bit lengthy of an article Avast has pulled together a well summarized article on the many parts of Cybercrime my favorite part is "How to recognize if you’ve been a victim of cybercrime". It's main points are bolded so allow skiming directly to what the signs are.

# data[].attributes.attachment_link.provider_name
What is Cybercrime and How Can You Prevent It?

# data[].attributes.attachment_link.readable_text
What Is Cybercrime? | Definition & Examples | Avast
Cybercriminals buy and sell malware online (generally on the dark web) while also trading in services that test how robust a virus is, business intelligence dashboards to track malware deployment, and tech support (that's right - crooks can contact a criminal helpline to troubleshoot their illegal hacking server or other malfeasance!).

The professionalization and proliferation of cybercrime adds up to countless costs in damages every year, impacting individuals, businesses, and even governments. Experts estimate that cybercrime damages will reach $6 trillion annually by 2021, making it one of the most lucrative criminal enterprises.

As the Internet of Things (IoT) evolves and smart devices become more popular, cybercriminals benefit from a much broader attack surface - increased opportunities to penetrate security measures, gain unauthorized access, and commit crimes.

As the saying goes, there's more than one way to skin a cat - and there are most certainly a variety of ways to make money as a cybercriminal.

Common examples of cybercrime

As mentioned, cybercriminals range from individuals to criminal organizations to state-sponsored actors. Just as the type of criminal varies, so do their crimes and the methods they use to break the law. From a single hacker who managed to hack into the US stock market to North Korean state-sponsored groups that propagated ransomware on a massive scale, there are a staggering amount of cybercriminals active every day. Moreover, expert skills are no longer required to become a cybercrook.

Here are some standout examples of cybercrime to watch out for.

Malware

Computer viruses are the granddaddy of cybercrime; probably the first kind of it you became aware of. Viruses infect computer systems, destroying files, messing with the overall functionality, and self-replicating to jump to other devices and systems. Viruses are actually a form of malware, which encompasses all kinds of malicious soft ware: any code or programs written and distributed to do damage, steal data, make money for their owner, and generally ruin your day. This includes ransomware, which can lock up your files until you pay a ransom to decrypt them, and adware, which spams you with ads.

Identity theft and other fraud

While identity theft is not exclusively a cybercrime, these days it's much more likely to happen through technology. In fact, identity fraud happens every two seconds in America today. If a hacker wants to commit identity theft or credit card fraud, they first need to access enough of their victim's personal data to fuel the crime. Here are several ways they can get that access:

Phishing: Cybercrooks use "bait" in the form of fraudulent messages to lure victims to fake sites where they unwittingly enter personal information like usernames, passwords, or bank details.

Pharming: Taking it one step deeper than phishing, pharming uses malware to reroute unsuspecting internet surfers to fake versions of websites, where they unknowingly enter their personal details.

Keylogging: This type of malware (or to be more specific, spyware) secretly logs everything you type, capturing your account information and other personal details.

Sniffing: If you're connected to an unsecured, unencrypted public Wi-Fi network, hackers can steal your data by "sniffing" your internet traffic with special tools (unless you have a VPN, of course).

While hackers have many ways to steal personal data, there are also some good ways you can prevent identity theft. Avoid accessing your personal accounts (especially online banking) on public Wi-Fi, and consider setting up a monitoring service to make sure your online accounts haven't been breached.

Cyberbullying

Cyberbullying refers to all kinds of online harassment, including stalking, sexual harassment, doxxing (exposing someone's personal information, like their physical address, online without their consent), and fraping (breaking into someone's social media and making fake posts on their behalf).

Cryptojacking

Cryptojacking is when hackers break into your device and use it to mine cryptocurrency without your knowledge or consent. Cryptominers do this by using JavaScript to infect your device after you visit an infected website. This can cause performance issues and high electric bills for you - and earn big profits for the cryptojackers.

Cyberextortion

Cyberextortion is just what it sounds like - a digital version of the nightmare that is extortion. One of the most common forms is ransomware, when hackers infect your computer with malware that encrypts all your files until you pay them a ransom to unlock them. Cyberextortion can also refer to blackmailing victims using their personal info, photos, and video; or threatening businesses using methods like botnet-driven DDoS attacks.

Cyberespionage

As mentioned, many cybercriminals these days are actually state-sponsored groups. Whether it's the North Koreans, the Iranians, or even the US's own NSA-affiliated Equation Group, world powers use hacker groups as one weapon in the complicated matrix of global politics. Stealing classified intelligence and using malware to attack nuclear plants are just two ways in which state-sponsored groups can do some frightening things on the world stage.

No matter the type of cybercrime, you can help protect yourself by installing a strong antivirus program like Avast Free Antivirus. Avast will block malicious links, suspicious websites, harmful downloads, and various other threats. Cybercriminals don't like to work too hard - if they can't access your machine or personal data, they're likely to move on to the next (easier) victim. So give yourself a strong layer of defense and fight back against cybercrooks.

Where does cybercrime come from?

Although the internet is only about 30 years old, experts consider an 1834 hack the first cybercrime in history. Two thieves were able to infiltrate the French Telegraph System and gain access to financial markets, committing data theft.

Other early cybercrimes, beginning in the late 1800s and first half of the 20th century, saw hackers focus on the telephone systems. Just two years after phones were invented, teenage boys broke into Alexander Graham Bell's telephone company and caused mischief by misdirecting calls. Phone hacking, or phreaking, later became popular in the 1960s to 1980s.

The year 1940 saw the first ethical hacker: French computer expert Rene Carmille hacked into the Nazi data registry to thwart their attempts to register and track Jews.

In the 1980s, the advent of email brought with it phishing scams (remember the Nigerian prince?) and malware delivered through attachments. By the 1990s, web browsers had become commonplace, along with computer viruses. The widespread adoption of social media in the 2000s only increased cybercrime, and especially data theft, due to the nature of these platforms. During the past ten years, malware infections and data theft have increased dramatically, and show no signs of slowing down anytime soon.

With the proliferation of the Internet of Things, cybercriminals have many creative new ways to attack. As more and more everyday objects - refrigerators, washing machines, heating systems, light bulbs, and more - come online, they open new vulnerabilities and opportunities to cybercrooks. Hackers have already figured out how to infiltrate a casino via its smart fish tank and deploy ransomware through a coffee maker; the full scope of cybercrime in the age of IoT is not quite known yet, but it's something we should certainly be on guard for.

As an everyday user of computers and mobile devices, how are you most likely to encounter cybercrime? It can reach you through a variety of ways, including unsafe websites, social media, holes created by exploited security vulnerabilities, weak passwords on accounts and/or smart devices, and, especially, email.

Email

Though social media may be one of the most popular ways to use the internet these days, email is still the most prevalent delivery method for cybercrime. Not only that, email fraud is the second-costliest cybercrime, according to the FBI. Email fraud encompasses phishing attempts, malware in the form of sketchy attachments or links, as well as some forms of digital extortion, ransomware, and exploit kits.

The dark web

The deep web refers to all parts of the internet (sites, e-shops, forums, etc.) that are not accessible by a regular search engine like Google or Bing. A subset of the deep web is the dark web, or darknet, which requires a special browser, such as Tor, to access it. Although the dark web is not itself illegal, the anonymity it affords makes it a hotbed for criminal activity.

On the dark web, cybercriminals can exchange the most dangerous and odious commodities our society has to offer: malware, drugs, weapons, child pornography, and even contract killing. The dark web is also where information, like stolen passwords or credit card numbers, gets bought and sold. That's why if you're a victim of a data breach, it can sometimes take a few days (or even longer) until someone purchases the stolen data and tries to access your account.

Who's most at risk?

As mentioned, cybercriminals can target individuals, businesses, and governments. And at the risk of sounding alarmist, none of those groups are any more or less safe from threats than the others. Cyber fraudsters are pretty indiscriminate when it comes to choosing their victims. Luckily, we have some proven strategies for preventing cybercrime, which we'll share with you a bit later in this article. (Spoiler alert: the best line of defense is making sure you're using good antivirus software.)

The impact of cybercrime

The impacts of cybercrime can be devastating due to the high risk of data loss and financial impact.

For individuals

Data breaches, identity theft, problems with devices: cybercrime can have a big impact on individuals. You might find yourself dealing with suspicious charges on your credit card as a result of identity theft, a ransomware attack demanding hundreds or thousands in blackmail to release your files, or expensive fees in data or electricity from cryptojacking or botnets. The costs can be worse than monetary when cyberbullying, including sexual harassment, is plaguing you.

For businesses & governments

Businesses as well as healthcare organizations and governments can also suffer from sensitive data loss, huge financial burdens, and brand damage. The average ransomware attack against small and medium businesses in 2019 demanded $5,900 to unblock their files or systems. Far worse, the downtime during these attacks cost the affected businesses $141,000 on average. That's to say nothing of ransomware attacks on governments, such as the one that caused Jackson County, Georgia to pay $400,000 to restore their IT systems and infrastructure.

Data breaches can also have huge impacts on companies and their customers, such as the monumental Equifax hack, the Yahoo! breach, or the many Facebook leaks.

What's the punishment for committing a cybercrime?

Each state in the US has slightly different laws surrounding cybercrime. The punishments depend on the severity of the crime and the amount of damage done, of course. Cybercrimes are usually classified as some type of felony, and the justice system is generally harsh on those who can be found and charged. Unfortunately, the most successful hackers are those who never get caught.

Another issue is the fast pace of technological innovation. In many cases, our laws are not current enough to adequately address all the possible forms of cybercrime. It might take a newer, younger wave of lawmakers to properly take on the challenges of today's digital and criminal landscape.

How to recognize if you've been a victim of cybercrime

While it can sometimes be hard to recognize if you've been the victim of a cybercrime, some crimes do leave clear signs:

Malware infection: Your machine might start running slowly and sending you various error messages.

Phishing or pharming attack: You'll find suspicious charges on your credit card or other compromised accounts.

Keylogger: You may see strange icons or your messages might start adding duplicate text.

Botnet: If your computer becomes involved in a botnet, it may be hard to recognize at all.

Crytojacking: You'll see increased electric bills.

Broadly speaking, sudden decreases in performance or strange behavior from your PC, tablet, or mobile indicates that you may have been the target of a cybercrime.

If you think you've been a victim, you should definitely take the time to report cybercrime. If you're in the US, the government has some resources that can help you: they suggest contacting the Internet Crime Complaint Center, the Federal Trade Commission, or the Department of Justice, depending on the nature of the crime. If your identity was stolen, you should especially make sure to report the identity theft, including using the resources on IdentityTheft.gov.

If you're outside the US, look for similar organizations in your country to report cybercrime.

Is it possible to stop cybercriminals?

Cybercrooks and thieves can be very hard to catch or stop, making broad solutions to cybercrime elusive. For specific instances of cyberfraud, we generally rely on the police, national security departments, and commercial cybersecurity firms to fight the bad guys.

For the average computer user, it's quite hard to go up against a cybercrook. The best approach is to follow some common best practices. If you can block cybercriminals from getting access to your devices, you'll block them from making money off of you - which is, after all, their primary motivation. And how can you do that?

How to prevent cybercrime

The best way to protect yourself against cybercrime is to exercise sensible digital habits. Here are some common-sense browsing habits that will help you defend yourself daily:

Be wary of emails with sketchy links or attachments you didn't expect.

Don't download anything from unknown sources.

Check to make sure you're on a legitimate website before entering any personal info.

Always apply software updates immediately (they fix security vulnerabilities).

Don't use unencrypted public Wi-Fi (in coffee shops, airports, etc.) without a VPN.

Use strong, unique passwords - don't reuse the same password across multiple accounts.

Use two-factor authentication whenever possible.

Boost your router security to protect your home network.

Protect against malware: a cybercriminal's most powerful weapon

In addition to the common-sense tips mentioned above, the strongest line of defense against cybercrime is using a robust antivirus program. Most cybercrime uses some form of malware or another, which can infect your computer, pilfer through your personal data in search of info for identity theft, and lock up your files and demand money for their release. Avast Free Antivirus will block malware before it has a chance to get on your machine, acting as an invisible barrier between you and cybercriminals.
}, deleted_at=1604666496867, id=post_body, label=Blog Content, name=post_body, type=rich_text}}-->

Cybercrime refers to any illegal activity carried out using computers or the internet. Cybercriminals - ranging from rogue individuals to organized crime groups to state-sponsored factions - use techniques like phishing, social engineering, and all kinds of malware as part of their cyber attacks. Find out how cybercrime works and how to protect yourself with free comprehensive security software.

What is cybercrime?

When you hear the word "cybercriminal" or "hacker," what image comes to mind? Is it a sketchy guy, perhaps wearing a dark hoodie, camped out in a dank basement somewhere, typing away furiously? While that image is in the public consciousness thanks to movies and TV, the real picture of a cybercriminal is much different: cybercrime is incredibly organized and professionalized.

This article contains:

Cybercriminals buy and sell malware online (generally on the dark web) while also trading in services that test how robust a virus is, business intelligence dashboards to track malware deployment, and tech support (that's right - crooks can contact a criminal helpline to troubleshoot their illegal hacking server or other malfeasance!).

The professionalization and proliferation of cybercrime adds up to countless costs in damages every year, impacting individuals, businesses, and even governments. Experts estimate that cybercrime damages will reach $6 trillion annually by 2021, making it one of the most lucrative criminal enterprises.

Latest cybersecurity news - October 2022

As the Internet of Things (IoT) evolves and smart devices become more popular, cybercriminals benefit from a much broader attack surface - increased opportunities to penetrate security measures, gain unauthorized access, and commit crimes.

As the saying goes, there's more than one way to skin a cat - and there are most certainly a variety of ways to make money as a cybercriminal.

Common examples of cybercrime

As mentioned, cybercriminals range from individuals to criminal organizations to state-sponsored actors. Just as the type of criminal varies, so do their crimes and the methods they use to break the law.

From a single hacker who managed to hack into the US stock market to North Korean state-sponsored groups that propagated ransomware on a massive scale, there are a staggering amount of cybercriminals active every day. Moreover, expert skills are no longer required to become a cybercrook.

Here are some standout examples of cybercrime to watch out for.

Malware

Computer viruses are the granddaddy of cybercrime; probably the first kind of it you became aware of. Viruses infect computer systems, destroying files, messing with the overall functionality, and self-replicating to jump to other devices and systems.

Viruses are actually a form of malware, which encompasses all kinds of malicious soft ware: any code or programs written and distributed to do damage, steal data, make money for their owner, and generally ruin your day. This includes ransomware, which can lock up your files until you pay a ransom to decrypt them, and adware, which spams you with ads.

Identity theft and other fraud

While identity theft is not exclusively a cybercrime, these days it's much more likely to happen through technology. In fact, identity fraud happens every two seconds in America today. If a hacker wants to commit identity theft or credit card fraud, they first need to access enough of their victim's personal data to fuel the crime. Here are several ways they can get that access:

Phishing: Cybercrooks use "bait" in the form of fraudulent messages to lure victims to fake sites where they unwittingly enter personal information like usernames, passwords, or bank details.

Pharming: Taking it one step deeper than phishing, pharming uses malware to reroute unsuspecting internet surfers to fake versions of websites, where they unknowingly enter their personal details.

Keylogging: This type of malware (or to be more specific, spyware) secretly logs everything you type, capturing your account information and other personal details.

Sniffing: If you're connected to an unsecured, unencrypted public Wi-Fi network, hackers can steal your data by "sniffing" your internet traffic with special tools (unless you have a VPN, of course).

While hackers have many ways to steal personal data, there are also some good ways you can prevent identity theft. Avoid accessing your personal accounts (especially online banking) on public Wi-Fi, and consider setting up a monitoring service to make sure your online accounts haven't been breached.

Cyberbullying

Cyberbullying refers to all kinds of online harassment, including stalking, sexual harassment, doxxing (exposing someone's personal information, like their physical address, online without their consent), and fraping (breaking into someone's social media and making fake posts on their behalf).

Cryptojacking

Cryptojacking is when hackers break into your device and use it to mine cryptocurrency without your knowledge or consent. Cryptominers do this by using JavaScript to infect your device after you visit an infected website. This can cause performance issues and high electric bills for you - and earn big profits for the cryptojackers.

Cyberextortion

Cyberextortion is just what it sounds like - a digital version of the nightmare that is extortion. One of the most common forms is ransomware, when hackers infect your computer with malware that encrypts all your files until you pay them a ransom to unlock them. Cyberextortion can also refer to blackmailing victims using their personal info, photos, and video; or threatening businesses using methods like botnet-driven DDoS attacks.

Cyberespionage

As mentioned, many cybercriminals these days are actually state-sponsored groups. Whether it's the North Koreans, the Iranians, or even the US's own NSA-affiliated Equation Group, world powers use hacker groups as one weapon in the complicated matrix of global politics. Stealing classified intelligence and using malware to attack nuclear plants are just two ways in which state-sponsored groups can do some frightening things on the world stage.

No matter the type of cybercrime, you can protect yourself by installing a strong security program like Avast One. Avast One will block viruses, malicious links, suspicious websites, harmful downloads, and various other threats. If cybercriminals can't easily access your machine or personal data, they're likely to move on to the next victim.

Give yourself a strong layer of defense, fight back against cybercrooks, and defend against viruses, malware, and other online threats.

Where does cybercrime come from?

Although the internet is only about 30 years old, experts consider an 1834 hack the first cybercrime in history. Two thieves were able to infiltrate the French Telegraph System and gain access to financial markets, committing data theft.

Other early cybercrimes, beginning in the late 1800s and first half of the 20th century, saw hackers focus on the telephone systems. Just two years after phones were invented, teenage boys broke into Alexander Graham Bell's telephone company and caused mischief by misdirecting calls. Phone hacking, or phreaking, later became popular in the 1960s to 1980s.

The year 1940 saw the first ethical hacker: French computer expert Rene Carmille hacked into the Nazi data registry to thwart their attempts to register and track Jews.

In the 1980s, the advent of email brought with it phishing scams (remember the Nigerian prince?) and malware delivered through attachments. By the 1990s, web browsers had become commonplace, along with computer viruses.

The widespread adoption of social media in the 2000s only increased cybercrime, and especially data theft, due to the nature of these platforms. During the past ten years, malware infections and data theft have increased dramatically, and show no signs of slowing down anytime soon.

With the proliferation of the Internet of Things, cybercriminals have many creative new ways to attack. As more and more everyday objects - refrigerators, washing machines, heating systems, light bulbs, and more - come online, they open new vulnerabilities and opportunities to cybercrooks.

Hackers have already figured out how to infiltrate a casino via its smart fish tank and deploy ransomware through a coffee maker; the full scope of cybercrime in the age of IoT is not quite known yet, but it's something we should certainly be on guard for.

As an everyday user of computers and mobile devices, how are you most likely to encounter cybercrime? It can reach you through a variety of ways, including unsafe websites, social media, holes created by exploited security vulnerabilities, weak passwords on accounts and/or smart devices, and, especially, email.

Email

Though social media may be one of the most popular ways to use the internet these days, email is still the most prevalent delivery method for cybercrime. Not only that, email fraud is the second-costliest cybercrime, according to the FBI. Email fraud encompasses phishing attempts, malware in the form of sketchy attachments or links, as well as some forms of digital extortion, ransomware, and exploit kits.

The dark web

The deep web refers to all parts of the internet (sites, e-shops, forums, etc.) that are not accessible by a regular search engine like Google or Bing. A subset of the deep web is the dark web, or darknet, which requires a special browser, such as Tor, to access it. Although the dark web is not itself illegal, the anonymity it affords makes it a hotbed for criminal activity.

On the dark web, cybercriminals can exchange the most dangerous and odious commodities our society has to offer: malware, drugs, weapons, child pornography, and even contract killing. The dark web is also where information, like stolen passwords or credit card numbers, gets bought and sold. That's why if you're a victim of a data breach, it can sometimes take a few days (or even longer) until someone purchases the stolen data and tries to access your account.

Who's most at risk?

As mentioned, cybercriminals can target individuals, businesses, and governments. And at the risk of sounding alarmist, none of those groups are any more or less safe from threats than the others. Cyber fraudsters are pretty indiscriminate when it comes to choosing their victims.

Luckily, we have some proven strategies for preventing cybercrime, which we'll share with you a bit later in this article. (Spoiler alert: the best line of defense is making sure you're using good antivirus software.)

The impact of cybercrime

The impacts of cybercrime can be devastating due to the high risk of data loss and financial impact.

For individuals

Data breaches, identity theft, problems with devices: cybercrime can have a big impact on individuals. You might find yourself dealing with suspicious charges on your credit card as a result of identity theft, a ransomware attack demanding hundreds or thousands in blackmail to release your files, or expensive fees in data or electricity from cryptojacking or botnets. The costs can be worse than monetary when cyberbullying, including sexual harassment, is plaguing you.

For businesses & governments

Businesses as well as healthcare organizations and governments can also suffer from sensitive data loss, huge financial burdens, and brand damage. The average ransomware attack against small and medium businesses in 2019 demanded $5,900 to unblock their files or systems. Far worse, the downtime during these attacks cost the affected businesses $141,000 on average. That's to say nothing of ransomware attacks on governments, such as the one that caused Jackson County, Georgia to pay $400,000 to restore their IT systems and infrastructure.

Data breaches can also have huge impacts on companies and their customers, such as the monumental Equifax hack, the Yahoo! breach, or the many Facebook leaks.

What's the punishment for committing a cybercrime?

Each state in the US has slightly different laws surrounding cybercrime. The punishments depend on the severity of the crime and the amount of damage done, of course. Cybercrimes are usually classified as some type of felony, and the justice system is generally harsh on those who can be found and charged. Unfortunately, the most successful hackers are those who never get caught.

Another issue is the fast pace of technological innovation. In many cases, our laws are not current enough to adequately address all the possible forms of cybercrime. It might take a newer, younger wave of lawmakers to properly take on the challenges of today's digital and criminal landscape.

How to recognize if you've been a victim of cybercrime

While it can sometimes be hard to recognize if you've been the victim of a cybercrime, some crimes do leave clear signs:

Malware infection: Your machine might start running slowly and sending you various error messages. Your antivirus software may also detect a malware infection.

Phishing or pharming attack: You'll find suspicious charges on your credit card or other compromised accounts.

Keylogger: You may see strange icons or your messages might start adding duplicate text.

Botnet: If your computer becomes involved in a botnet, it may be hard to recognize at all.

Crytojacking: You'll see increased electric bills.

Broadly speaking, sudden decreases in performance or strange behavior from your PC, tablet, or mobile indicates that you may have been the target of a cybercrime. You can also use an identity monitoring tool like Avast BreachGuard, which checks for data breaches and hacks, and informs you if your personal information is at risk.

If you think you've been a victim, you should definitely take the time to report cybercrime. If you're in the US, the government has some resources that can help you: they suggest contacting the Internet Crime Complaint Center, the Federal Trade Commission, or the Department of Justice, depending on the nature of the crime. If your identity was stolen, you should especially make sure to report the identity theft, including using the resources on IdentityTheft.gov.

If you're outside the US, look for similar organizations in your country to report cybercrime.

Is it possible to stop cybercriminals?

Cybercrooks and thieves can be very hard to catch or stop, making broad solutions to cybercrime elusive. For specific instances of cyberfraud, we generally rely on the police, national security departments, and commercial cybersecurity firms to fight the bad guys.

For the average computer user, it's quite hard to go up against a cybercrook. The best approach is to follow some common best practices. If you can block cybercriminals from getting access to your devices, you'll block them from making money off of you - which is, after all, their primary motivation. And how can you do that?

How to prevent cybercrime

The best way to protect yourself against cybercrime is to exercise sensible digital habits. Here are some common-sense browsing habits that will help you defend yourself daily:

Protect against malware: a cybercriminal's most powerful weapon

In addition to the common-sense tips mentioned above, the strongest line of defense against cybercrime is using a robust antivirus program. Most cybercrime uses some form of malware or another, which can infect your computer, pilfer through your personal data in search of info for identity theft, and lock up your files and demand money for their release.

Avast One will block viruses and malware before they can get on your machine, acting as an invisible barrier between you and cybercriminals. And it'll automatically detect and remove any viruses or other malware currently on your devices - while also protecting you against phishing and other threats.

You might also like...

Get powerful security and privacy protections for your Android with Avast One

Get powerful security and privacy protections for your iPhone with Avast One

# data[].attributes.attachment_link.title
What is Cybercrime and How Can You Prevent It?

# data[].attributes.attachment_link.description
What Is Cybercrime? | Definition & Examples | Avast Cybercriminals buy and sell malware online (generally on the dark web) while also trading in services that test how robust a virus is, business intelligence dashboards to track malware deployment, and tech support (that's right - crooks can contact a criminal helpline to troubleshoot their illegal hacking server or other malfeasance!).

# data[].attributes.headline
IT World Canada: "Understanding Canadian Cybersecurity Laws: Measuring up — Outlining existing federal cybersecurity legislation in Canada, the UK, Australia, and the US (Article 8)"

# data[].attributes.subject
IT World Canada: "Understanding Canadian Cybersecurity Laws: Measuring up — Outlining existing federal cybersecurity legislation in Canada, the UK, Australia, and the US (Article 8)"

# data[].attributes.body
IT World Canada's podcast has kept me up to date on the lastest security issues, advice, and breaches. This article sums up and explains the various part regarding the field of CyberCrime in a very aproachable way.

# data[].attributes.attachment_link.provider_name
IT World Canada - Information Technology news on products, services and issues for CIOs, IT managers and network admins

# data[].attributes.attachment_link.readable_text
One year ago, with the dawn of a new decade ahead of us - the 2020s - many of us looked back at the end of 2019 and start of 2020 as a turning point; an opportunity for a fresh start. At that point in time, we had no idea of the dramatic social, educational, and occupational changes that this year would have in store for us all. While the new decade has not yet been the vibrant beacon of social and technological advancement that we may have hoped for, our global entry into 2020 has undoubtedly been a rollercoaster. From widespread mandatory isolation, necessarily remote workspaces and increased civilian interaction with public health authorities, to the necessarily rapid introduction of digital communication technologies to populations who had previously been able to avoid developing a dependance on digital technology as a primary form of social interaction. All of these factors, and more, have contributed to the massive inundation of public reliance on digital communication technology and its corresponding infrastructure in Canada.

Much of this increase in technological reliance has long been foreseen; anticipated by researchers, academics, and the especially tech-savvy folks among us. What was not anticipated, however, was the sudden increase in the speed at which we have all had to adapt to these new realities. This past year in particular, has necessitated a review and revitalization of our existing Canadian privacy, data protection, cybersecurity, and cybercrime laws in keeping with the ongoing effort to expand, revise, or otherwise rewrite the relevant legislation to accommodate for our rapidly-evolving global, national, and localized cybersecurity concerns.

In case you missed it

This past year, in the era of the global COVID-19 pandemic, has helped to effectively highlight many of the legislative gaps and other areas in need of improvement within our current national legislative scheme. One possible explanation for this gap is the reality that the speed of technological development increased far too quickly, when compared with the adaption of our federal legislation, to allow for the construction of adequately-tailored legal accommodations. Posited from an adjusted position, another explanation of the same result is that the legislation did not adapt quickly enough to keep up with the inevitable (and arguably foreseeable) advances in data technology and digital communication that we have seen and continue to see.

Fortunately, we are not alone. Indeed, many other countries are experiencing the same push to revise and re-evaluate legislative structures which had, until very recently, been adequately effective at regulating privacy relations and general data protection. In this article, we will outline the relevant national privacy and cybersecurity-related laws currently in effect in the United Kingdom, Australia, and the United States, as fellow common law countries.
Common law countries
Countries that follow the common law legal system, including Canada, the United Kingdom, Australia, and the United States are considered to be "common law countries". The basis for common law legal system relies upon a body of customary law; the body of unwritten laws based on legal precedents established by the courts in previous judicial decisions.

In addition to being common law countries, Canada, the United Kingdom, Australia, and the United States each have specific statutory provisions which apply to identity theft and fraud, copyright infringement, patents and intellectual property, commercial electronic messages, and general criminal provisions. We can start by reviewing the current laws in Canada before outing the laws in effect in the United Kingdom, Australia, and the United States, respectively.
Review of Current Cybersecurity Laws in Canada
Regulating governmental relationships
Access to Information Act (RSC 1985, c A-1)
Regulating businesses, organizations, and commercial enterprises
Personal Information Protection and Electronic Documents Act Canada's Anti-Spam Legislation (SC 2010, c 23) (SC 2000, c 5)
The commercial marketplace, including private businesses, corporations, and organizations, must abide by the provisions established in the Personal Information Protection and Electronic Documents Act and by the rules regulating the use of commercial electronic messages in Canada's Anti-Spam Legislation.
Criminal Code, RSC (1985) c C-46
Canada's Anti-Spam Legislation (CASL) , is the federal law that addresses spam and other electronic threats. It established the rules for sending commercial electronic messages and the installation of computer programs. As defined in , "spam" refers to unwanted or unsolicited commercial electronic messages received over the internet. As defined, a "commercial electronic message" is an electronically received message that encourages participation in a commercial activity, such as an email that contains a coupon or tells customers about a promotion or sale.
Protecting Canadians from Online Crime Act ( SC 2014, c 31) The Common Law and Civil Tort Law
aims to protect consumers and businesses from the misuse of digital technology, including spamming and other nonconsensual activities. It applies to all electronic messages sent by businesses and organizations in connection with a "commercial activity" - that is, electronic messages sent in hopes of encouraging engagement from the consumer, with the ultimate purpose being to make a profit. The key distinguishing feature of this legislation is the requirement that Canadian (and global) organizations that send commercial electronic messages within, from, or to Canada must receive express consent from recipients prior to sending those messages.

Regulating interpersonal relationships and criminal activities

Cyber/computer-supported activities can be thought of as traditional crimes which are committed through a cyber medium. For example, child trafficking is a criminal offence regardless of the medium over which the exchange is made or the forum used for the transaction. If a child trafficking offence is committed through the use of DarkNets, encrypted or anonymous networks, or otherwise supported by cyber technology, then the crime is a cyber-supported crime.

Jones v. Tsige involved a bank employee who accessed and reviewed another employee's personal bank accounts on 174 occasions over a four-year period. When the victim became aware of this, she sued the defendant. The victim claimed that by improperly accessing and reviewing her bank accounts the defendant committed the tort of invasion of privacy. In response, the defendant argued that Ontario does not recognize the invasion of privacy as a tort.

Following a thorough review of the case law and previous legal commentary related to the "invasion of privacy" tort, Ontario Court of Appeal Justice Sharpe concluded that "Ontario has already accepted the existence of a tort claim for appropriation of personality and, at the very least, remains open to the proposition that a tort action will lie for an intrusion upon seclusion."

"...the tort includes physical intrusions into private places as well as listening or looking, with or without mechanical aids, into the plaintiff's private affairs. Of particular relevance to this appeal, is the observation that other non-physical forms of investigation or examination into private concerns may be actionable. These include opening private and personal mail or examining a private bank account."

- ONCA Justice Sharpe

And just like that, the common law tort of "intrusion upon seclusion" was born.
General Data Protection Regulations (GDPR) and Data Protection Act 2018
Cybersecurity laws in the United Kingdom
Network and Information Security Regulations 2018
Regulating government, businesses, and organizations
Computer Misuse Act 1990
Government, businesses, and organizations in the United Kingdom are subject to the General Data Protection Regulation (GDPR), the Data Protection Act 2018, and the NIS Regulations. When the Brexit transition period concludes on December 31, 2020, the United Kingdom will have its own UK General Data Protection Regulation (UK-GDPR) which will work in conjunction with the current Data Protection Act 2018.

These laws require that personal data must be securely kept and access to personal data is only permitted to third parties subject to sufficient guarantees regarding the security of the processing services.They also require the implementation of technical (e.g., firewalls, anti-virus programs, specific software, perimeter scanning tools) and organizational (e.g., policies and procedures regarding cybersecurity) protective measures to safeguard personal data and protect against unauthorized or unlawful access, use, loss, destruction and damage of any personal data. It is interesting to note that, according to these laws, enforcement action to address inadequate safeguards can be taken even in the absence of a reported cyber-attack or personal data breach.

Regulating Interpersonal Relationships and Criminal Activities

The implications of this Act are that hackers who program their computers to search through password permutations could be liable under the first section, even if all of their attempts are rejected by the target computer. As well, using another person's login credentials without proper authority to access data or a program, or to alter, delete, copy or move a program or data, or to output a program or data to a screen or printer, or to impersonate that other person using email, online chat programs, web or other services, constitute the offence.

Together, the UK's Computer Misuse Act 1990 , the NIS Regulations, the Data Protection Act (2018), and the General Data Protection Regulation (GDPR), make up the bulk of the United Kingdom's cybersecurity and data privacy protection legislative scheme.
Privacy Act 1988 (Cth)
Cybersecurity laws in Australia
Australian Privacy Principles (APPs)
In Australia, the legislative powers are divided between the national government (called the Commonwealth) and the six States (New South Wales, Queensland, South Australia, Tasmania, Victoria and Western Australia) and three Territories (Australian Capital Territory, Northern Territory, and Norfolk Island) within the greater nation.

Regulating governmental, business, and organizational relationships
Principle 1 - Open and transparent management of personal information
Other statutory provisions also affect privacy and separate privacy regimes apply to state and territory public sectors. This department assists the Attorney-General to administer the Privacy Act . The Privacy Act is supported by the Privacy Amendment (Enhancing Privacy Protection) Act 2012, and the Privacy Regulation 2013 .
Principle 2 - Anonymity and pseudonymity
The Australian Privacy Principles deal with all stages of the processing of personal information. They set out the standards for the collection, use, disclosure, quality and security of personal information, and they provide obligations concerning access to, and correction of, an individual's own personal information for agencies and organizations which are subject to the Privacy Act.
Principle 3 - Collection of solicited personal information
This is overseen by the Office of the Australian Information Commissioner - the independent national regulator for privacy and freedom of information which promotes and upholds the right of individuals to access government-held information and have their personal information protected - within the Australian Government. The 13 Australian Privacy Principles are summarized on the OAIC website (www. ) as:
Principle 4 - Dealing with unsolicited personal information
This ensures that APP entities manage personal information in an open and transparent way and includes having a clearly expressed and up to date APP privacy policy.
Principle 5 - Notification of the collection of personal information
Requires APP entities to give individuals the option of not identifying themselves, or of using a pseudonym. Limited exceptions apply.
Principle 6 - Use or disclosure of personal information
Outlines when an APP entity can collect personal information that is solicited. It applies higher standards to the collection of 'sensitive' information.
Principle 7 - Direct marketing
Outlines how APP entities must deal with unsolicited personal information.
Principle 8 - Cross-border disclosure of personal information
Outlines when and in what circumstances an APP entity that collects personal information must notify an individual of certain matters.
Principle 9 - Adoption, use or disclosure of government related identifiers
Outlines the circumstances in which an APP entity may use or disclose personal information that it holds.
Principle 10 - Quality of personal information
An organization may only use or disclose personal information for direct marketing purposes if certain conditions are met.
Principle 11 - Security of personal information
Outlines the steps an APP entity must take to protect personal information before it is disclosed overseas.
Principle 12 - Access to personal information
Outlines the limited circumstances when an organization may adopt a government related identifier of an individual as its own identifier, or use or disclose a government related identifier of an individual.
Principle 13 - Correction of personal information
An APP entity must take reasonable steps to ensure the personal information it collects is accurate, up to date and complete. An entity must also take reasonable steps to ensure the personal information it uses or discloses is accurate, up to date, complete and relevant, having regard to the purpose of the use or disclosure.

An APP entity must take reasonable steps to protect personal information it holds from misuse, interference and loss, and from unauthorized access, modification or disclosure. An entity has obligations to destroy or de-identify personal information in certain circumstances.
Australian Government Agencies Privacy Code 2017
Outlines an APP entity's obligations when an individual requests to be given access to personal information held about them by the entity. This includes a requirement to provide access unless a specific exception applies.
Spam Act 2003 (Cth)
Outlines an APP entity's obligations in relation to correcting the personal information it holds about individuals.
Crimes Act 1914 (Cth)
The OAIC is responsible for investigating breaches of the APPs and credit reporting provisions. The OAIC's has the power to accept enforceable undertakings, seek civil penalties in the case of serious or repeated breaches of privacy, and conduct assessments of privacy performances for both Australian Government agencies and businesses.
Criminal Code Act 1995 (Cth)
The Australian Government Agencies Privacy Code was registered in October 2017 and went into effect on July 1, 2018. It applies to all Australian governmental agencies who are subject to the Privacy Act 1988 (except for Ministers) and sets out the specific requirements and key practical steps that must be taken in order to comply with the Australian Privacy Principles.
The Common Law and Civil Tort Law
Regulating interpersonal relationships and criminal activities

Australia's historical equivalent to the Criminal Code of Canada, the Crimes Act 1914 is one of the first recognizable compilations of federal criminal law since federation in 1901. The Crimes Act 1914 deals with the most serious criminal offences against the Commonwealth. Historically, it was the most extensive legislative instrument addressing federal criminal offences, but is now being superseded with the passing of the Criminal Code Act 1995 (Cth), which is a compilation of all the federal offences in Australia.

Apart from the criminalization of specific activities, Australian law also presents a means to legally address wrongdoing in the civil law, which relates to non-criminal law including civil wrongs, contract law, property law and other areas that concern the rights and duties of individuals amongst themselves.

As in Canadian civil tort law and, unless barred by an existing statute, individuals are entitled to sue other people, or the state, for the purpose of obtaining a civil legal remedy for a legally-recognized "tort" or wrongdoing. However, to sue someone in tort law, requires the pre-existence or creation of an applicable tort, through the common law, case law, or challenge in a court. At the time of writing, there is currently no federal or state legislation articulating a specific cause of action for breach of privacy in Australia law.

Cybersecurity laws in the United States

As we have seen in Canada, in the United Kingdom, and in Australia, there is no singular federal law or federal cybersecurity regulation that governs data privacy in the United States. Rather, there are few sector-specific federal cybersecurity regulations that focus on specific industries, including healthcare, financial institutions, and commercial marketing.
Privacy Act of 1974 Federal Information Security Management Act
The Privacy Act of 1974 continues to be the foundational legislation governing federal government use of personal information, however, this does not apply to businesses or organizations outside of government. The three main sector-specific cybersecurity regulations are: the Health Insurance Portability and Accountability Act of 1996 (HIPAA) , the Gramm-Leach-Bliley Act of 1999 , and the Homeland Security Act of 2002

In essence, these regulations mandate the need for healthcare organizations, financial institutions and federal agencies to enact and enforce policies to protect their systems, ensure data privacy, and comply with all relevant privacy legislation with regard to the access to and collection, processing, use, and disclosure of personal or private information.
Health Insurance Portability and Accountability Act of 1996
Regulating the federal government and governmental agencies

Regulating sector-specific industries: healthcare

Ensuring patient and maintaining doctor-patient confidentiality can promote more effective communication between physician and patient in an effort to enhance quality of individualized health care and treatment, to improve patient autonomy, and with the goal of preventing economic harm or embarrassment to the patient.

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a US federal law that required the creation of national standards to protect sensitive patient health information from being disclosed without the patient's consent or knowledge. The US Department of Health and Human Services issued the Privacy Rule and the Security Rule to implement the requirements of the .

The Privacy Rule standards address the use and disclosure of individuals' health information (known as "protected health information") by entities subject to the Privacy Rule. These individuals and organizations are called "covered entities." The Privacy Rule also contains standards for individuals' rights to understand and control how their health information is used. A major goal of the Privacy Rule is to ensure that individuals' health information is properly protected while allowing the flow of health information needed to provide and promote high quality health care and to protect the public's health and well-being. The Privacy Rule strikes a balance that permits important uses of information while protecting the privacy of people who seek care and healing.
Gramm-Leach-Bliley Act / Financial Services Modernization Act of 1999
The Security Rule protects a subset of information covered by the Privacy Rule.

Regulating sector-specific industries: Banking and financial institutions

Financial institutions are among the most heavily regulated entities, at both the federal and state levels, and similarly are required to protect customer personal information against reasonably foreseeable threats to security.

The three major components overlaying the collection, disclosure, and protection of consumers' personal information in the include: the Financial Privacy Rule, the Safeguards Rule, and Protection from Pretexting.

The Financial Privacy Rule requires financial institutions to provide each consumer with a privacy notice at the time the consumer relationship is initially established and annually thereafter. The privacy notice must explain the information collected about the consumer, where that information is shared, how it is used, and how it is protected. The notice must identify the consumer's right to opt out of the information being shared with unaffiliated parties pursuant to the provisions set out in the Fair Credit Reporting Act .
Computer Fraud and Abuse Act (1986) The Common Law and Civil Tort Law
The Safeguards Rule requires financial institutions to develop a written information security plan that describes how the company is prepared for, and plans to continue to protect clients' nonpublic personal information. The aim of the Safeguards Rule is to force financial institutions to reexamine their relationship with personal private data and to perform a thorough risk analysis on their current safeguard processes.
Public Disclosure of Private Facts
Protection from Pretexting is to protect against personal data breaches which occur through impersonation. This is, when someone tries to gain access to personal information without the proper authority to do so. This is related to identity theft and identity fraud. Pretexting includes requesting private information while impersonating the account holder either, by phone, by postal mail, by email, or by phishing. The encourages organizations to implement adequate safeguards against pretexting, such as the implementation of multi-factor authentication.
False Light
Regulating interpersonal relationships and criminal activities
Appropriation
The United States has a few torts which developed out of the "invasion of privacy" cause of action in tort law. These include:
Intrusion of Solitude / Intrusion Upon Seclusion
The dissemination of truthful private information which a reasonable person would find objectionable.

The publication of facts which place a person in a false light, even though the facts themselves may not be defamatory.
Summary Tables
The unauthorized use of a person's name or likeness to obtain some benefits.

The intentional intrusion, physically, electronically, or otherwise, upon the private space, solitude, or seclusion of a person, or the private affairs or concerns of a person.

The civil law in the United States recognizes invasion of privacy torts as civil wrongs and allows injured parties to recover for their losses by bringing a cause of action (suing) the other party to recover damages, such as financial compensation or an injunction to legally compel the other party to immediately cease an activity.

Applicable national laws related to cybersecurity

Table 2: Which law applies where and to whom?

Conclusion

In considering the cybersecurity laws of four countries: Canada, the United Kingdom, Australia, and the United States, it is evident that they have each taken different approaches to legislate, and regulate, data privacy and cybersecurity-related concerns within their respective borders. While all four are considered to be "common law" countries, their unique national needs, historical interests, and constitutional values have contributed to the individualized evolution of their statutory law.

Statutory laws often evolve in parallel with (or in response to) social and/or technological change. With the rapid technological advancements that have inundated our nations over the past few decades - indeed since the age of industrialization - the national statutory laws have had to adjust and accommodate to remain applicable to the changing society in which we live. This exceptional period of technological growth, and our increased reliance on digital communications, has culminated in the need for each of these nations to re-evaluate their current national data privacy and cybersecurity-related statutory schemes to adequately protect the interests of the nation and the people who live and work within it.

At the time of writing, all four of these nations have, individually and collectively, been engaged in consultation processes to address their statutory provisions relating to cybersecurity, data privacy, and cybercriminal activities. Indeed, these four international allies (and New Zealand) have been collaborating, through their respective cybersecurity research centres, to create new and improved global cybersecurity standards and report on possible strategies for approaching potentially malicious cybersecurity threats. As we enter into 2021, we can anticipate (with great certainty) that the applicable data privacy, cybersecurity, and cybercriminal provisions in these countries will continue to develop, evolve, and expand over the next decade.

Would you recommend this article?

Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.Click this link to send me a note →

Jim Love, Chief Content Officer, IT World Canada

** Melissa Lukings is a senior JD student in the Faculty of Law at the University of New Brunswick (UNB) and former graduate of Memorial University of Newfoundland (MUN) holding a BA in Linguistics. She has a particular interest in cybersecurity and privacy law, criminal law, and grassroots community organizations - specifically those focusing on equality and inclusion, human rights, violence prevention, harm reduction, and / or relating to equal and equitable access to justice. **** Dr. ARASH HABIBI LASHKARI is a senior member of the IEEE and an Associate Professor in Cybersecurity at York University. Prior to this, he was an Associate Professor at the Faculty of Computer Science, University of New Brunswick (UNB), and research coordinator of the Canadian Institute for Cybersecurity (CIC). He has over 23 years of academic and industry experience. He has received 15 awards at international computer security competitions - including three gold awards - and was recognized as one of Canada's Top 150 Researchers for 2017. He also is the author of ten published books and more than 100 academic articles on a variety of cybersecurity-related topics. In 2020, he was recognized with the prestigious Teaching Innovation Award for his personally-created teaching methodology, the Think-Que-Cussion Method. He is the author of 12 published books and more than 100 academic papers on various cybersecurity-related topics. He is the founder of the Understanding Cybersecurity Series (UCS), an ongoing research and development project culminating with a varied collection of online articles and blogs, published books, open-source packages, and datasets tailored for researchers and readers at all levels. His first two books in this series are entitled "Understanding Cybersecurity Management in FinTech - Challenges, Strategies, and Trends" and "Understanding Cybersecurity Law and Digital Privacy - A Common Law Perspective," published by Springer in 2021. The first online blog series of UCS entitled "Understanding Canadian Cybersecurity Laws", was recognized with a Gold Medal at the 2020 Canadian Online Publishing Awards (COPA). His research focuses on cyber threat modeling and detection, malware analysis, big data security, internet traffic analysis, and cybersecurity dataset generation.

# data[].attributes.attachment_link.title
Understanding Canadian Cybersecurity Laws: Measuring up - Outlining existing federal cybersecurity legislation in Canada, the UK, Australia, and the US (Article 8) - IT World Canada

# data[].attributes.attachment_link.description
One year ago, with the dawn of a new decade ahead of us - the 2020s - many of us looked back at the end of 2019 and start of 2020 as a turning point; an opportunity for a fresh start.

# data[].attributes.attachment_caption
(Written by: Matthew Lapierre, posted Dec 20, 2021 )“The number of cyber actors is rising and they’re becoming a lot more sophisticated."

# data[].attributes.headline
Ottawa Citizen: "Rise in Ottawa-area cyberattacks tied to dark web and new wave of criminals"

# data[].attributes.subject
Ottawa Citizen: "Rise in Ottawa-area cyberattacks tied to dark web and new wave of criminals"

# data[].attributes.body
Protecting our personal data is becoming increasingly important as Cyberattacks or small scale hacking can lead to interception by unknown criminals. This article is a reminder that protection pactices must be two fold. As consumers using two factor aithentication should be number one and businesses need to ensure their systems are secure and resistant to bruteforce penetration hacking.

# data[].attributes.attachment_link.readable_text
"The number of cyber actors is rising and they're becoming a lot more sophisticated."

In September, on a website on a hidden part of the internet, reams of confidential data appeared.

The data looked like a list of folders and files, labelled with titles like "Client_web_backup." The files were from computer servers belonging to the Societé de Transports de L'Outaouais - the Gatineau public transport provider.

An ominous message accompanied it: "the STO suffered a breach and they refused to pay."

This newspaper has reviewed the STO data that was posted online. We have chosen not to identify the group that orchestrated the data breach, nor the site where the data has been posted, because doing so could lead others to find it and use it.

Those responsible for the data breach told this newspaper they asked the STO for $3 million U.S. as a ransom to have the data removed from the web.

The data's appearance threw the STO into chaos. "The attack was very severe," Patrick Leclerc, STO's CEO, told reporters at a media conference in September. "To put it simply, it's as if the attackers put a lock on our systems to prevent us from using them ... Following the STO's refusal to pay the demanded ransom, the cyber attackers published files on the dark web."

The scenario described by Leclerc is an increasingly common one. Cybercriminals are growing more numerous and are targeting IT systems with greater sophistication and law enforcement officers are facing increased pressure to find and arrest those responsible.

"The number of data breaches, today, it's hit its peak - not to say that it's going to go down," said Vern Crowley, a detective sergeant working on the Ontario Provincial Police's cybercrime unit.

Crowley has had a front-row seat to the rise in cybercrime over the past decade and its recent spike. He grew up with an affinity for computers, he said, and, when he joined the OPP more than 30 years ago, the force was just beginning to go digital. Crowley quickly became "one of those guys helping out around the office, helping fix and or set up some of the computer systems."

The force noticed Crowley's knack for computers and sent him to train in digital forensics at the Canadian Police College. When he returned, he worked on digital avenues investigations, spending time extracting evidence from computers and hard drives seized during investigations.

As the OPP digitized its systems, becoming increasingly reliant on computers, so, too, did the rest of the world. Corporations and governments began storing their confidential information in new ways - cloud computing became the norm in 2010 - and thieves and hackers were looking for ways to steal it.

Around 2015, Crowley and others at the OPP noticed a rise in the number of IT systems being attacked. No longer were computers simply being used to facilitate other crimes, like fraud. Now, as people, businesses and institutions were reliant on computer systems, criminals were accessing those systems, targeting them and holding them hostage.

But Crowley and his colleagues noticed that, as police officers, they didn't really have the tools or the resources to crack down on this new breed of criminal. "We didn't have the capability or the capacity at that time to lead a complex cybercrime investigation," he said. So, the OPP created its cybercrime unit, which officially began operating in 2018, and Crowley became one of its first members.

Today, Crowley and his colleagues respond to calls where technology is the target of the crime. In the early days of the cybercrime unit, those crimes, while not necessarily rare, were often the result of a small number of people worldwide who had advanced hacking abilities.

But now those skills, and the ability to access computer systems, have become readily available even to unskilled programmers.

"The number of cyber actors is rising and they're becoming a lot more sophisticated," said Sami Khoury, head of the Canadian Centre for Cyber Security (CCCS), which tracks and warns against new cyber threats in Canada. The centre was created in 2018, the same year Crowley and the OPP cybercrime unit started working. "What capabilities a few years ago we thought were in the domain of very, very few actors, now they are becoming even more prevalent," Khoury said.

A quick glimpse through ransomware sites on Tor, an internet browser that allows users to access parts of the internet that cannot be accessed through a normal browser, reveals an entire hidden marketplace. It has always been rumoured that anything can be purchased on this part of the internet, colloquially known as the "dark web." From drugs to a hitman, it's all there.

This newspaper scanned the dark web recently and found easily available ransomware-for-hire services and a wealth of data sets stolen from businesses and institutions, including the STO's data and others from Quebec, Ontario and across Canada.

A data breach happens when a hacker accesses a data network, which can be done in myriad ways - by sending phishing emails or by finding weaknesses in a company's website or mobile application, for example. Once inside, the cybercriminals steal data or make it unusable, forcing their victims to buy back access to their own information. The latter threat is called a ransomware attack.

Businesses and individuals can protect themselves, Khoury and Crowley said, by having strong passwords and by using multi-factor authentication, and, if they do become a victim of a cyberattack, they should report the incident to the OPP and to the CCCS.

It is worth being prepared, Crowley said, because "it's not a matter of if (a cyberattack will happen), it's a matter of when."

Cybercriminals "fire indiscriminately in every direction," Khoury said. "They have no scruples, they'll go wherever they can find money or wherever they think that the victim has to pay."

In addition to the STO, several healthcare institutions and municipalities in the Ottawa area have recently reported being affected by "cybersecurity incidents." The Rideau Valley Health Centre, Kemptville District Hospital and the municipality of Clarence-Rockland are among those that have been affected.

These types of incidents - which are often caused by ransomware - can paralyze a network and interrupt IT capabilities for weeks or longer. Patients began to experience issues with their bookings at Rideau Valley Health Centre in late October and one month later the health centre was still reporting issues. The Kemptville Hospital told this newspaper on Nov. 23 that the work to restore its IT systems was ongoing, "but we were able to resume most of our services in recent weeks, with the exception of some diagnostic imaging services."

And the criminals on the other end of these attacks often remain in the shadows. "Technology works for law enforcement, but it works against us," Crowley said. "Cybercriminals use technology such as Tor, cryptocurrency, to help hide from law enforcement. Unlike CSI, where it takes one hour to solve the case, unfortunately, it takes a lot longer than that."

Law enforcement officials have, however, had some success. The OPP arrested 31-year-old Matthew Philbert of Ottawa on Nov. 30 after a 22-month investigation. Investigators said Philbert, who faces three cybercrime-related charges, was prolific in his use of ransomware, targeting everyone from governments to individuals.

"This is a very ugly and invasive type of crime," Det. Insp. Matt Watson of the OPP's Criminal Investigation Branch said of Philbert's alleged actions. But, while Watson and the OPP pointed to Philbert's arrest as a victory in a recent media conference, the scale of the growing cybercrime problem loomed over their announcement.

"I have an entire cyber investigation team and they're fully employed right now," Watson told this newspaper. "I could use 10 more investigators."

# data[].attributes.attachment_link.title
Rise in Ottawa-area cyberattacks tied to dark web and new wave of criminals

# data[].attributes.attachment_link.description
"The number of cyber actors is rising and they're becoming a lot more sophisticated." In September, on a website on a hidden part of the internet, reams of confidential data appeared. The data looked like a list of folders and files, labelled with titles like "Client_web_backup."

# data[].attributes.body
The whole of Cybercrime is quite large where it overlaps with other laws depending on how technology is used. This graphic shows the many parts of Cybercrime but is divided based on the role that tech took in a case.
Understanding the scope of Cybercrime is important in self-awareness regarding online activities but also in protection from the unlawful use of technology by others.

# data[].attributes.body
If you were to check your spam mail folder, it likely has various types of phishing scams, and while email providers have improved their ability to detect them, it can always fail.
Awareness of how to spot legitimate email correspondence from businesses but also impersonation of our loved ones.

# data[].attributes.headline
Steps to take if you have been hacked...

# data[].attributes.subject
Steps to take if you have been hacked...

# data[].attributes.body
With many workplaces allowing employees to virtually access work desktop machines from home (or vice versa), the very benefits of its implementation can quickly turn it into a heavy risk. Weak security with Desktop-as-a-Service can lead to malware or interception of confidential data through a Man-in-the-Middle attack. Leaving the data owners open to possible legal action by their employers, as the owner of the data remains responsible for their own data when using such a service.

# data[].attributes.headline
Statistics Canada: "Cybercrime and Canadian Businesses, 2017"

# data[].attributes.subject
Statistics Canada: "Cybercrime and Canadian Businesses, 2017"

# data[].attributes.body
No one is immune to Cybercrime and that includes businesses of ALL sizes. This means that investing in cybersecurity measures can save both time and money in the long term.

# data[].attributes.headline
CPAC - "Canadian government has a serious problem with cyber security: Doug Black"(30 Oct 2018)

# data[].attributes.subject
CPAC - "Canadian government has a serious problem with cyber security: Doug Black"(30 Oct 2018)

# data[].attributes.body
While this video is a few years old, the number of cases continued to rise throughout the pandemic. One such Cybercrime that is reoccurring in North America is National Security Offenses, where fake news or other such digital "warfare" become tools by other countries in an effort to trigger some kind of change that is favourable to them.

# data[].attributes.attachment_link.title
Canadian government has a serious problem with cyber security: Doug Black

# data[].attributes.headline
CityNews - "Cyber security threats in Canada grow during COVID-19 pandemic"(18 Jan 2022)

# data[].attributes.subject
CityNews - "Cyber security threats in Canada grow during COVID-19 pandemic"(18 Jan 2022)

# data[].attributes.body
The exploitation of our critical infrastructures for hospitals and essential businesses throughout the country was hit hard throughout the pandemic. While we turned to technology to stay connected with our loved ones more than at any other point in history, vulnerabilities in cyber security become targets.
Cybersecurity breaches or infiltration with the goal of preventing access and holding the data ransom can cause a chain reaction of unlawful offences, especially if it is necessary to inform medical professionals in life or death situations.

# data[].attributes.attachment_link.title
Cyber security threats in Canada grow during COVID-19 pandemic

# data[].attributes.headline
Protecting Canadians from Online Crime Act (S.C. 2014, c. 31)

# data[].attributes.subject
Protecting Canadians from Online Crime Act (S.C. 2014, c. 31)

# data[].attributes.body
Specific citing and direct link to the act regarding the protection for all Canadians concerning any crime committed against them online.

# data[].attributes.attachment_link.title
Protecting Canadians from Online Crime Act