Thursday 26 November 2009

More than 4,000 cybercrime cases reported in two years

http://thestar.com.my/news/story.asp?file=/2009/1/17/nation/20090117161235&sec=nation

JOHOR BARU: More than 4,000 cyber complaints, mostly concerning cyber crimes have been lodged with Cybersecurity Malaysia in the past two years.

Its chief executive officer Lieutenant-Colonel Husin Jazri said that the complaints, mostly consisted of hack threats, fraud, denial of services and other computer problems such files lost or corrupted by viruses.

"We have received about 2,000 complaints in 2007.

"Last year, a total of 2,123 cases were lodged with us," he told pressmen after the presentation of five computers to a school in the Kampung Simpang Arang Orang Asli settlement.

Science, Technology and Innovation secretary-general Datuk Abdul Hanan Alang Endut presented the computers on Saturday.

Lt-Col Husin explained that the agency's services catered for individuals, as well as companies, who faced computer related problems.

"Our consultation services are free but we will charge any work that needs to be done such as repairs.

"The charges varies on a case by case basis," he said adding that the agency rarely charged students or those from the lower-income group.

He said that the agency's 150-strong staff was dedicated to solving computer problems as they aimed to serve the needs of the public.

"We have an emergency response team that caters to the complaints.

"Among our other services are digital forensics, security assurance, security management and best practices," he said.

He added that the agency's main objective is to be a one-stop coordination centre for all national cyber security initiatives.

"Among the initiatives are reducing vulnerability of ICT systems and networks and nurture a culture of cyber security among users and critical sectors," he said.

Lt-Col Husin said the public could contact the agency at 03-89926888, fax at 03-89453205 or email at info [at]cybersecurity.my.

"People can also contact our hotline at CYBER999 to report any problems.

"Our office in Seri Kembangan is open from Monday to Friday," he said.

He said that the agency was also working closely with enforcement agencies such as the police in solving and curving cybercrimes in the country.

Wednesday 25 November 2009

Questions cloud cyber crime cases

http://news.bbc.co.uk/2/hi/technology/3202116.stm

The acquittal of a teenager accused of carrying out a high-profile hack attack has cast doubts over future computer crime prosecutions, say experts.

Aaron Caffrey
Aaron Caffrey walked free from court after being acquitted
Aaron Caffrey, 19, was accused of crashing systems at the port of Houston in Texas by hacking into its computer systems.

But a jury cleared him after believing his defence that hackers had broken into his computer and used it to launch the attack.

"This verdict sets a potentially dangerous precedent with regard to hacking cases," said Cable & Wireless security expert Richard Starnes.

"A potential outcome is that defendants, charged with such an offence in the future, could attempt to compromise their own system, in order to employ a similar defence in the event they are caught."

Elite member

Mr Caffrey had faced one charge at Southwark Crown Court of unauthorised modification of computer material.

Clearly the authorities are facing a fundamental problem when attempting to prosecute suspected computer criminals
Graham Cluley, Sophos
He was accused of launching an attack on 20 September 2001 on one of the US's biggest ports, bombarding its computer system with thousands of electronic messages.

It froze the port's web service, which contained vital data for shipping, mooring companies and support firms responsible for helping ships navigate in and out of the harbour.

Mr Caffrey admitted being a member of a group called Allied Haxor Elite and hacking into computers for friends to test their security.

But he insisted he was not responsible for the attack on the port of Houston.

Both the defence and prosecution acknowledged that the attack had come from Mr Caffrey's computer.

The case hinged on whether the jury believed the defendant's argument that his computer had been taken over by a hacker using a Trojan horse program.

A forensic examination of Mr Caffrey's PC had found no trace of a hidden program with the instructions for the attack.

Trojan defence

The verdict shows that the prosecution case failed to convince the jury that the teenage was responsible for the attack.

"Clearly the authorities are facing a fundamental problem when attempting to prosecute suspected computer criminals," said Graham Cluley, senior technology consultant at the security firm, Sophos.

"The Caffrey case suggests that even if no evidence of a computer break-in is unearthed on a suspect's PC, they might still be able to successfully claim that they were not responsible for what their computer does, or what is found on its hard drive."

The Trojan defence has been successfully used in the UK courts before.

In July, a man was cleared of possessing child porn when a number of Trojan horses were discovered on his computer.

Experts say the Caffrey case could prompt a review by police of how to present evidence before a jury in computer crime cases.

Monday 23 November 2009

Cyber Crime

Cyber Crime means any illegal act that involve a computer, its systems, or its applications. It is any intentional act associated in any way with computers where a victim suffered or could have suffered a loss, and a perpetrator made or could have made a gain. It also means any illegal act for which knowledge of computer technology is essential for either its pepetration, investigation or prosecution.

Cyber crime committed on the internet. Everything from electronic hacking to denial of service attacks that cause electronic commerce sites to lose money. The crime that usually related with technology, computers and the internet. It happen when people using a computer and the internet to steal a person's identity.

According to latest survey, computer crimes are committed by students, members of organise crime, disenchanted employees and ect.

There is few famous international cyber criminal in the history who are Jeffrey Parson, Adrian Lamo, Kevin Mitnick, Ventimiglia and others. To control or prevent more cyber crime happen, there are some international law on computer crimes been formulated. For example, European Convention on Cybercrime, Computer Misuse Act (UK), Computer Fraud and Abuse Act (US), Computer Misuse Act (Singapore), and Information Technology Act 2000 (India).

Malaysia also have own legal framework. Computer crimes in Malaysia are mainly provided in the Computer Crimes Act 1997. Besides that, there is other laws would cover the remedies, which are Copyright Act, Communication and Multimedia Act, Penal Code and Internal Security Act.

Friday 20 November 2009

Data Protection and Privacy Issues in China

http://www.hg.org/article.asp?id=5340

Privacy rights have been available to Chinese citizens under the Constitution and other legal regulations since the 1980's. However, due to the size and strength of government, as well as a general reluctance in the past to litigate, the laws have not been tested to a great extent. The legislature is in the process of developing broader privacy rights under a Civil Code.
Privacy rights have been available to Chinese citizens under the Constitution and other legal regulations since the 1980's. However, due to the size and strength of government, as well as a general reluctance in the past to litigate, the laws have not been tested to a great extent. The legislature is in the process of developing broader privacy rights under a Civil Code. These new rights have the potential to shift privacy power towards the citizens for the first time since the founding of the Communist Party of China.

Constitution

The personal dignity of citizens of the People's Republic of China is recognized and protected under Article 38 of the Constitution. Further, the freedom and privacy of correspondence of citizens of the People's Republic of China are protected; however Article 40 provides some significant limitations to such rights – where state secrets or a criminal investigation is involved, police and other authorities can intercept communications as necessary. The expansive concept of “state secret” gives the government supreme power in reviewing and monitoring of communications as necessary.

Civil Law

The General Civil Law Rule of China recognizes the right to identity and the right to protection of reputation. The People’s Supreme Court has not treated privacy as a separate right until now either - it treats a claim to privacy violation akin to that of violation of one’s reputation under its relevant judicial interpretations. This means that under current law, an action for privacy violation can be considered by a court only if the plaintiff’s reputation has also been violated or affected. The limitations imposed by such a view are obvious.

Network Privacy in China

E-commerce and general online activity has been developing rapidly in China. China is estimated to now have the largest number of regular Internet users in the world, with the figure estimated at being over 300 million as of 1 June 2008. Unfortunately, given the relatively lengthy time it takes to enact national laws in China, the legislation has not kept up to date with these developments.

Although China lacks major privacy and data protection laws as discussed above, some regulations are in place in relation to network information. The Regulation on Management of the Administration of Internet Electronic Messaging Services issued by Ministry of Information Industry on 8 October 2000 is worth looking at. Article 12 states that Electronic Messaging Service providers shall maintain the confidentiality of personal information concerning online subscribers and may not disclose the same to third parties without the subscribers' consent.

This provision alone has led many Chinese website operators to post privacy policies on their sites, similar to those appearing on sites managed in the US, Australia, Europe and Hong Kong, where more developed data protection and privacy rules are in place. However, compliance with these policies is largely determined by the website operators themselves, as the regulatory requirements and enforcement of them, are weak.

Likely Future Developments

Comprehensive legal protection for the privacy of citizens has become a major focus of the Chinese legislature, given the rapid development of Internet, the ease of the dispersion of large amounts of data and other issues.

At present, China is drafting a new Civil Code; the privacy issues are introduced as follows in the latest draft of this regulation: “Natural persons enjoy privacy; privacy is constituted by personal data, personal activities and personal space; collection, saving and publication of personal data, shall be consented to by the data-subject in all cases”.

It is hoped that guidelines will be developed around the new Code, similar to those that are seen operating in Hong Kong under its Data Protection Ordinance.

ABOUT THE AUTHOR: Yu Du and Matthew Murphy
The MMLC Group is a unique combination of leading Chinese and English speaking international and local lawyers, trademark agents, patent attorneys, scientists, engineers, accountants and business consultants, working together to deliver powerful and results-driven legal and business services for many of the world's leading companies, institutions and government groups.

Thursday 19 November 2009

U.S. and EU Agree on Data Protection Principles

http://www.dhs.gov/journal/leadership/2009/11/us-and-eu-agree-on-data-protection.html

US and EU Flags
This week the United States and European Union achieved a major milestone in data protection and data sharing. The U.S. – EU Justice and Home Affairs Ministerial completed a set of common principles that unite our approaches to protecting personal data when exchanging information for law enforcement and security purposes.

The Departments of Homeland Security, Justice and State have worked with experts from the EU Presidency and Commission for the past three years to develop these principles. Leadership on both sides of the Atlantic share a deeply rooted commitment to the protection of personal data and privacy when it comes to information sharing. This practical approach will enable Europe and the United States to remain global leaders in privacy protection as we work to protect our citizens from common threats to our security.

The next step is negotiating a binding international EU-U.S. agreement based on these common principles to facilitate further cooperation while ensuring the availability of full protection for our citizens. The Department of Homeland Security looks forward to being a part of those efforts in the months ahead.

Mary Ellen Callahan
Chief Privacy Officer
U.S. Department of Homeland Security

Tuesday 17 November 2009

Privacy and Data Protection

What is privacy rights? It is state of being alone and not watched or disturbed. and als the state of freedom from interference or public attention.

There are 3 component in privacy:
i. Secrecy, information known about individual.
- data privacy such as salary, telephone number and ect.
ii. Anonymity, attention paid to an individual
- don't distract people attention
iii. Solitude, physical access to an individual
- include physical privacy or body privacy.

There's no privacy law in Malaysia but defamation case under criminal law. The discussion on the right to privacy in the wake of IT and multimedia envirnment lead to the question of personal data collection. The advanacement of such technology enables he instusion of privacy of a person wihout any necessary physical action. This area of privacy is called as "information privacy"

The most famous cybercrime that happen in cyberspace is "phising". Some computer expert try to use fake website to obtain other people's account. Those experts steal the people and create a new personal account to do illegal transaction with other people over the cyberspace.

The protection of informational privacy issues arises in ICT advancement, where one's right personal data and information is gradually thereatened. Many jurisdiction are trying to formulate appropriate regulatory framework to control this issues.

On the other hand, United States and European Community has different attitude when handle this issues. US has not traditional jurisdictions with regard to protection of personal data privacy. EU has been the mot active jurisdictions on this subject. Legislations in US are not comprehensive and more sporadic, they have minimum government intervention and weaker enforcement compare to EU which with more comprehensive legislation, deep involvement of government and with strong enforcement aspect.

By date, Malaysia government is in the process of legislating the law on Personal Data Protection. The law is meant for any individuals ad institutions including government, businesses, and e-commerce player. The main data protection principles include:

1. The personal data shall be collected fairly and lawfully
2. Purpose of collection of personal data
3. Use of personal data
4. Disclosure of personal data
5. Accuracy of personal data
6. Duration of retention of personal data
7. Access to and correction of personal data
8. Security of personal data
9. Information to be generally available

Sunday 15 November 2009

Appellate Civil Case Summaries May 2009, as seen in the July/August 2009 issue of Res Gestae

http://blog.boselaw.com/blog/contract-law-cases

In May, the Indiana Supreme Court issued six civil opinions and granted transfer in two civil appeals. The Indiana Court of Appeals issued twenty-three published civil opinions, seven of which are briefly summarized in this column. The full text of each decision is available via Casemaker at www.inbar.org.

INDIANA SUPREME COURT

Dispute between Internet marketing firm and company for website design is not for "goods and services" pursuant to Indiana's Article 2 of the Uniform Commercial Code and, under the facts of this case, the company could not sustain conversion claim for website's removal

The Indiana Supreme Court tackled numerous issues of first impression to resolve a dispute between a company and an Internet marketing firm that created and hosted the company's website. Conwell v. Gray Loon Outdoor Mktg. Group, Inc., 906 N.E.2d 805 (Ind. 2009). Although the parties fulfilled their obligations under their written agreement, the company later refused to pay for hosting fees and additional changes it requested to the website. The marketing firm sued the company for payment, and the company counterclaimed that the marketing firm committed conversion by taking down the original website for which the company had already paid.

The Supreme Court first addressed whether Article 2 of Indiana's Uniform Commercial Code ("U.C.C.") or common law principles of contract law governed the parties' transaction. By applying the "predominant thrust" test to determine whether the transaction involved the transfer of goods or the performance of service, the Court held that "[a] website created under arrangements calling for the designer to fashion, program, and host its operations on the designer's server is neither tangible nor moveable in the conventional sense." Id. at 812. Because agreement of the parties "contemplated a custom design for a single customer and an ongoing hosting relationship[,]" the U.C.C. did not apply. Id.

The Court examined the marketing firm's claim for payment under common law principles and determined that although the website modifications were not contemplated by the parties' original agreement, the company requested the changes without inquiring into the amount the changes would cost. The marketing firm's invoice was the only evidence submitted to the trial court regarding the reasonableness of the charges, and there was evidence that a representative of the company accepted the price after receiving the invoice. Because there was no evidence that the marketing firm "participated in an unconscionable effort to 'strong arm' [the company] into paying an unreasonable fee," the Court affirmed the trial court's decision to enforce the parties' agreement, even though the marketing firm had not provided a cost estimate. Id. at 813.

Turning to the company's counterclaim that the marketing firm committed conversion by taking down the website for which the company paid, the Court analyzed how copyright law affected the legal status of the website. For the company's counterclaim to succeed, the website either had to be a "work made for hire" where the company was the original owner or the marketing firm had to have transferred ownership of the website to the company. The Court determined that the website was not a work made for hire because the marketing firm was an independent contractor, not the company's employee. The Court also concluded that language in the marketing firm's proposal that the company inherently owned the product was insufficient to transfer ownership of the website from the marketing firm to the company. The marketing firm did, however, have a nonexclusive license because the "parties intended to transfer a copyright, but failed to do so in writing." Id. at 816. Because a nonexclusive license is not an ownership interest under copyright law, however, the marketing firm did not commit conversion by removing the website, and the company's counterclaim failed.

Concurring in result, Justice Boehm wrote separately to explain that, in his view, a website is "property" for the purposes of tortious or criminal conversion. Id. at 817. Although the company was a licensee that could not sustain a conversion claim, Justice Boehm emphasized that licensees are not without remedy. In this case, the marketing firm arguably "created the problem that the licensed code no longer existed" and "had no right to seize both phases [of the website design] as collateral for its unpaid work on the second phase." Id. 818-19. Although the company's damages were "a matter of speculation on this record," Justice Boehm noted that the company could have asserted breach of license as either an affirmative defense or set-off. Because it did not, he concurred with the majority's result.


Evidence of discounted payments healthcare providers accept from insurance carriers on behalf of injured plaintiffs can be introduced into evidence to determine the reasonable value of the services to the extent it can be done without referencing insurance

The Indiana Supreme Court confronted "the question of how to determine the reasonable value of medical services when an injured plaintiff's medical treatment is paid from a collateral source at a discounted rate." Stanley v. Walker, 906 N.E.2d 852, 855 (Ind. 2009). In an opinion authored by Justice Sullivan, the Court held that evidence of a healthcare provider's acceptance of a reduced amount of compensation for services provided to a plaintiff may be introduced to help a jury determine the reasonable value of the services "[t]o the extent the discounted amounts may be introduced without referencing insurance." Id. at 853. The Court analyzed Indiana Rule of Evidence 413 and the "complexities of health care pricing structures[, which] make it difficult to determine whether the amount paid, the amount billed, or an amount in between represents the reasonable value of medical services." Id. at 857. Ultimately, the Court held that Indiana's collateral source statute does not bar evidence of discounted payments accepted by healthcare providers to determine the reasonable value of services. "Given the current state of the health care pricing system where . . . authorities suggest that a medical provider's billed charges do not equate to cost, the jury may well need the amount of the payments, amounts billed by medical providers, and other relevant and admissible evidence to be able to determine the amount of reasonable medical expenses." Id. at 858.


Justice Dickson authored a dissenting opinion, joined by Justice Rucker, arguing that the majority's rule "contravenes the express requirements of the collateral source statute." Id. at 860 (citing Ind. Code § 34-44-1-2). The dissent also disagreed that the collateral source statute abrogated the common law collateral source rule because "the statute's precise language appears to create a limited exception to the common law rule, which is otherwise left intact." Id. at 862. "Under today's new rule, the existence and extent of any improvement to the accuracy of verdicts seems overwhelmed by the significant probability of incompleteness, confusion, and resulting unfairness, all further compounded by detrimental effects on the fairness and efficient administration of justice." Id. at 865.


Justice Boehm, joined by Chief Justice Shepard, wrote separately to respond to points made by the dissent and emphasized that "we hold today only that the discounted price actually paid for medical services is admissible evidence as to the reasonable value of those services. We do not hold that it is conclusive." Id. at 859.


Although claim against mother's estate was timely, daughter failed to rebut presumption that services rendered to her incapacitated mother were gratuitous because no evidence that daughter had an express or implied contract with mother's guardian

The Indiana Supreme Court unanimously reversed the trial court's denial of an estate's motion for summary judgment on a daughter's claim against her mother's estate for reimbursement for various expenses and personal services that the daughter rendered to her mother while the mother was subject to a guardianship. Estate of Prickett v. Womersley, 905 N.E.2d 1008 (Ind. 2009). First, the Court addressed the Estate's argument that the daughter's reimbursement claim was time-barred because she had not filed her claim in the guardianship proceeding. Interpreting the Guardianship Code, the Court held that Indiana Code § 29-3-10-1(d) does not require a claim to be filed against the guardianship estate and "in the absence of legislative direction mandating a guardian's approval, we are apprehensive of the administrative and other practical consequences of ordering a guardian's review of all claims filed in a probate estate that accrue during a decedent's guardianship." Id. at 1012. Therefore, the daughter's claim for reimbursement was not time-barred because she was not required to pursue it in the guardianship proceeding and she properly filed it against her mother's estate.


The Court reaffirmed the rebuttable presumption that services rendered by a family member are gratuitous. Although the daughter designated evidence that her mother signed a statement in front of two witnesses that she wanted her estate to compensate her daughter for her services, the Court held that the mother could not enter into a contract at the time she executed the statement and, consequently, "when the provider is a family member the implied contract must exist between that person and the incapacitated person's guardian." Id. at 1013. Because the daughter failed to produce evidence that she had an express or implied contract with her mother's guardian, she failed to rebut the presumption that her services were gratuitous as a matter of law.


An insurance company's policy was consistent with Indiana's uninsured motorist statute and insureds were not entitled to uninsured motorist benefits for the death of their unmarried adult son because they did not suffer bodily injury

The Indiana Supreme Court unanimously held that named insureds who brought an action against their automobile insurer to recover uninsured motorist benefits for the death of their unmarried adult son were not persons "legally entitled to recover damages" for their son's death. Bush v. State Farm Mut. Auto. Ins. Co., 905 N.E.2d 1003, 1008 (Ind. 2009). For purposes of its uninsured motorist coverage, the parents' insurance policy defined "insured" to include the named insureds and their relatives, which were defined as related persons primarily residing with the named insureds. Because their adult son no longer lived with his parents, he was not an insured under his parents' policy.


The insured parents argued that they were entitled to uninsured motorist benefits because their policy was inconsistent with Indiana's uninsured motorist statute-Indiana Code § 27-7-5-2-and, thus, unenforceable. The Court disagreed and emphasized that "the statute itself makes clear that it contemplates uninsured motorist coverage only for the 'insured's' bodily injury." Id. at 1005. The insurance company's policy was "consistent with the uninsured motorist statute by requiring that the insured sustain bodily injury to trigger uninsured motorist coverage." Id. Reaffirming a previous holding, the Court held that the definition of bodily injury includes emotional distress "only if it arises from a bodily touching." Id. (citing State Farm Mut. Auto. Ins. Co. v. Jakupko, 881 N.E.2d 654 (Ind. 2008)). "Indiana's uninsured motorist statute requires coverage only for bodily injuries sustained by an insured." Bush, 905 N.E.2d at 1007-08. Because the parents did not suffer bodily injury, they did not have uninsured motorist coverage for their adult son's death.


For purposes of the Family and Medical Leave Act, the 1250-hour requirement applies to an employee's overall service, not service in any particular position, and a trial court's exercise of equitable jurisdiction to award an employee front pay had to be discounted to reflect present day value

The Indiana Supreme Court addressed issues of first impression surrounding a full-time teacher, part-time football coach's claims against his school corporation employer under the Family and Medical Leave Act ("FMLA"). Gary Cmty. School Corp. v. Powell, 906 N.E.2d 823 (Ind. 2009). Although the school reinstated the employee to his full-time teaching position after his medical leave, it did not reinstate him to his head coaching position. Additionally, the school rejected him as head football coach in subsequent years, which the teacher argued was retaliatory conduct for comments he made to a local newspaper regarding the school's failure to restore him to his coaching position following his medical leave.


The Court held as an issue of first impression that "an employee filling multiple positions with the same employer is eligible for FMLA leave as to all positions if that employee has completed 1,250 total hours of service to that employer in the twelve months preceding the request for leave." Id. at 828. As the Court noted, "the test for [FMLA] eligibility is phrased in terms of 'hours of service' to an 'employer,' not service in any particular position." Id. Therefore, because the 1,250-hour requirement applies to an employee's overall service, the school corporation was required to reinstate the employee to both the full-time teaching position and the part-time coaching position. Additionally, the Court concluded that the employee presented sufficient evidence to support the jury's conclusion that the school corporation retaliated against him for voicing his complaints to a local newspaper, which were not permissible grounds for retaliation under FMLA.


The school corporation presented numerous arguments challenging the trial court's award of damages. As an issue of first impression, the Court concluded that although the trial court did not abuse its discretion by exercising equity jurisdiction and awarding front pay, "front pay should be discounted to present value. Without discounting, [the employee] would receive a windfall in the form of the use of the money years before it would have been earned." Id. at 834. The Court remanded the action to the trial court to discount the front pay award to present day value, but otherwise affirmed the trial court in all respects.


Employees' damages award for backpay after employer's violation of Indiana Civil Rights Act should not have been reduced by amount of unemployment benefits received

Two employees filed a complaint with the Michigan City Human Rights Commission ("Commission"), alleging that their employer violated the Indiana Civil Rights Act when it discriminated against them on the basis of race and terminated them for timecard fraud. Filter Specialists, Inc. v. Brooks, 906 N.E.2d 835 (Ind. 2009). The Commission concluded that race was the motivating factor behind the firings and awarded the employees damages for backpay and fringe benefits. The Indiana Supreme Court concluded that the employees proved their claim even though they did not introduce evidence of the ordinance establishing the Commission because the ordinance "has no bearing on whether [the employer] discharged [the employees] on the basis of race in violation of the Indiana Civil Rights Act." Id. at 845. Additionally, the employees presented substantial evidence to support the Commission's conclusion that they had suffered unlawful discrimination, even though there was "no smoking gun" regarding the employer's mental processes. Id. at 848.


Regarding damages, the Court agreed with a majority of federal circuit courts that "unemployment benefits should not be deducted from backpay awards in discrimination cases." Id. at 849. Consequently, the trial court erred by ordering the case remanded to the Commission because "the damages awarded to [the employees] should not have been affected by their receipt of unemployment compensation." Id. at 850.

INDIANA COURT OF APPEALS

> Father had independent cause of action against Indiana Patient's Compensation Fund for negligent infliction of emotional distress after he witnessed the death of his son, which was caused by the negligent conduct of healthcare providers. Ind. Patient's Comp. Fund v. Patrick, 906 N.E.2d 194 (Ind. Ct. App. 2009).


> Oral findings and conclusions that are "thoroughly detailed in the record" satisfy the purpose of special findings under Indiana Trial Rule 52(A). Nunn Law Office v. Rosenthal, 905 N.E.2d 513 (Ind. Ct. App. 2009). Additionally, an attorney employed under a contingency fee contract who is discharged prior to occurrence of the contingency is limited to quantum meruit recovery.


> Trial court should have granted party's request for a hearing on motion to change venue pursuant to Indiana Trial Rule 75(A) because of conflicting evidence and the lack of evidence regarding the location of plaintiff's principle office. Painters Dist. Council 91 v. Calvert Enter. Electronic Servs., Inc., 906 N.E.2d 254 (Ind. Ct. App. 2009).


> The Indiana Motor Vehicle Protection Act, commonly known as the Lemon Law, "obligates a consumer to demonstrate that the vehicle was subject to repair at least four times and that the same defective condition remained unresolved after the fourth attempt." Metro Health Profs., Inc. v. Chrysler, LLC, 905 N.E.2d 1026, 1033 (Ind. Ct. App. 2009). Once a consumer has met the four-repair requirement and files a claim shortly after the fourth attempt, as a matter of law, the automobile manufacturer is obligated to either refund the amount the buyer paid or provide a replacement vehicle of comparable value.


> Employee's claim against political subdivision employer is governed by the three-year statute of limitations contained in the Federal Employers' Liability Act instead of the two-year statute of limitations governing Indiana personal injury claims. Januchowski v. N. Ind. Commuter Trans. Dist., 905 N.E.2d 1041 (Ind. Ct. App. 2009).


> Bureau of Motor Vehicles' policy of revoking driving privileges after class members whose recorded personal information did not match information on file with the Social Security Administration violated federal due process because the BMV failed to articulate ascertainable standards for current identification holders. Leone v. Ind. Bureau of Motor Vehicles, 906 N.E.2d 172 (Ind. Ct. App. 2009). The policy did, however, have the rational basis of preventing identity theft, and the trial court properly denied the class members' request for a preliminary injunction because the class failed to show an injunction would be in the public interest.


> Jim Mansfield was initially declared the winner of the Muncie mayoral election but his opponent, Sharon McShurley, was declared the winner after a recount. Mansfield v. McShurley, --- N.E.2d ---, No. 18A02-0804-CV-375 (Ind. Ct. App. 2009). The trial court dismissed Mansfield's statutory challenge to the election as well as his amended complaint asserting a quo warranto action. On appeal, the Court of Appeals held that a statutory contest action "may not be brought outside the statutorily prescribed time frames even if, as in the case before [the Court of Appeals], the election result changes by virtue of a recount." Additionally, the trial court did not err by dismissing the quo warranto complaint because the recount commission did not act unlawfully by declining to count certain absentee ballots.

TRANSFER ORDERS

> Babes Showclub v. Lair, 901 N.E.2d 44 (Ind. Ct. App. 2009) (whether a police officer's claims for injuries he suffered responding to a complaint on the club's premises were barred by the Fireman's Rule), transfer granted on May 7, 2009.


> Ind. Family & Soc. Servs. Admin. v. Meyer, 900 N.E.2d 74 (Ind. Ct. App. 2009) (whether the trial court had discretion to respond to procedural error by granting a belated extension of time), transfer granted on May 14, 2009.


George T. Patton, Jr., is a partner at Bose McKinney & Evans LLP, Indianapolis/Washington, D.C. and co-chair of its Appellate Group. He was the first chair of the ISBA Appellate Practice Section, served as an Adjunct Assistant Professor of Appellate Advocacy and Procedure at the Indiana University School of Law-Bloomington for five years, and has written four articles on recent developments in Indiana appellate procedure for the Indiana Law Review. George's book on the 2001 Indiana Appellate Rules is 24 Indiana Practice-Appellate Procedure (3d Ed. West Publishing Co. 2001 & 2006 Supp.).

Kellie M. Barr is an associate at Bose McKinney & Evans LLP, Indianapolis, and works on business, commercial, and appellate litigation. Upon graduating from the Indiana University School of Law-Bloomington, Kellie served as a law clerk to Chief Judge John G. Baker at the Indiana Court of Appeals. Kellie is the co-author of an article on recent developments in Indiana appellate procedure to be published in the Indiana Law Review later this year.

Friday 13 November 2009

Contract Law

Contract Law? What is contract? Contract in legal sense refers to an agreement between two or more parties that is legally binding between them. It is an agreement enforceable by law. The contract must be dealing with law of contract in Malaysia in the Contracts Act 1950.

Agreement means i understand what you understand and you understand what i understand between legal people. All contract is an agreement but all agreements are not automatically contracts. This is because they lack of certain essential element.

What is the neccessary elements for a legal contract?
The essential elements of contract include proposal (offer) and acceptance, intention to create legal relations, consideration, legal capacity, legality, certainty, and free consent.

Basically discharge of contract occurs in three ways which are discharge by performance, discard by frustation and discharge by breach of contract.

Nowadays people prefer to sign or prepared contract over the internet. Internet is use to facilitate transaction and contracts as the transaction are being formed electronically. E-transaction become more popular due to few advantages of internet which are cost and time saving, increasing in productivity, increasing in profitability, can be access to customer in anywhere anytime and access to huge market.

Althought E-Commerce bring a lot of benefits to people but it also have to face some challenges too. For instant, should all transaction and communications be print out on paper and signed there fo make them legally binding? Can data message be redeem as an "written information" for the purpose of fulling the requirement? How to fulfil the requirement of signature?

As signature serves as method of authetication. Malaysia government have released Digital Signature Act 1997. The Act requires that a digitally signed message is deemed to have fulfillied the signature requirement.

Malaysia parliament passed the Electonic Commerce Act 2006 that seeks to set rules and legal recognitions and protection on the transactions that take place electronically on year 2006. After that, the law is adopted following the model law of e-commerce that was issued by UN body in charge of international trade law (UNCITRAL).

Wednesday 11 November 2009

How to Telltale Signs of E-Commerce Fraud

http://www.ecommercetimes.com/story/66278.html

In a time of economic crisis, there tends to be an increase in the number of people that turn to criminal activity. Although petty crime is usually one area that shows a significant upswing, an additional form of criminal activity on the rise is fraud.

Before you can stop fraud, you need to know how to define it in order to properly identify it. Fraud is defined as the use of deception to obtain money or something else of value. Although typically carried out online, some fraudsters pursue the riskier physical fraud in which they interact with people face-to-face.

When fraud is carried out online, however, fraudsters can orchestrate an attack on a much larger scale, allowing them to sit back and wait for the goods to arrive.

Define and Identify

To identify fraud, there are some red flags that all businesses should be aware of. Some of the red flags include the following:

  • Order velocities -- Defined as multiple orders placed within the same day, hour or minute, they typically appear from one device, one address, one card or one user ID.
  • Risky street addresses -- Often, you can accurately estimate the level of risk of carrying out an order by utilizing Google Maps Street View to determine the location of the shipping address. If the address looks like an abandoned building, making a call to validate the card holder really made the purchase is advised.
  • Anonymous/free email accounts -- These email accounts illustrate a higher percentage of fraud activity than those associated with a paid Internet service provider or a company email address.

Types of Fraud

There are a number of different types of fraud. Here we provide you with a brief description of some types most frequently encountered within the e-commerce industry:
  • Card-not-present fraud -- Also known as "CNP fraud," this is the basic form of fraud carried out online. A purchase can be made with just the card number; no physical card is needed.
  • Gift Card Fraud (card purchased in store) -- To avoid being caught by initial fraud screening technology, the fraudster pools together several small denomination gift cards to purchase a bigger ticket item online. Typically, the gift cards are purchased with stolen credit card information.
  • Gift Card Fraud (card purchased online) -- This type of fraud is frequently carried out with the utilization of a fake email account. Since the purchase of a gift card online requests only an email address in order to receive a confirmation code, this allows the fraudster to purchase many gift certificates on one [stolen] credit or debit card and send the gift card credits to multiple email addresses. Typically, the fake email accounts are set up with free email services.
  • Friendly Fraud -- This type of fraud is carried out by someone who places an order online and follows up with a complaint. Usually stating that they never made the purchase or did not receive the merchandise, this is one of the most difficult types of fraud to detect since it crosses into both the online and physical realms. Because of friendly fraud, fraud will never be completely eliminated.

Fraud in the E-Commerce Industry

Fraud ranks as one of the biggest problems within the e-commerce industry. Fraud rings pose the biggest threat as this technique utilizes the latest technology with one purpose in mind: Get away with as much fraud as possible. Fraudsters are getting better at fraud ring activities, as well, causing merchants to find it difficult to link transactions in order to find fraud. Many merchants ranked fraud rings as one of the biggest challenges to fighting online fraud.

An additional emerging threat to the e-commerce industry is the challenge of m-commerce, or mobile commerce. Mobile device users are generally less protected when accessing a merchant's Web site, frequently due to the merchant's establishment of "light" versions of the Web site, ironically designed to attract more mobile users. Merchants typically have not yet considered the potential new security threat or established stronger user-authentication on this platform, and fraudsters know it.

Possible Solutions

At this point, you're probably wondering if there is even anything that can be done to stop fraud before a company or a legitimate customer becomes a victim. There is. Although fraud may be one of the biggest threats to the e-commerce industry, there exist a number of solutions which focus on utilizing the technology and techniques that are readily available today. Depending on the type of goods/services that are sold, there are two approaches:

  1. Digital goods (such as music, software and video) -- These items are delivered in real-time, making it critical to assess the order quickly to determine the likelihood of fraud. Because the goods must be released almost instantly, it is recommended to fulfill any order not immediately deemed fraudulent. Re-screening the order later enables a more thorough investigation. If upon further investigation the order is found to be fraudulent, the card should be credited back for the goods that were purchased. This protects the victim from the charge and the company from eventual chargeback.
  2. All other goods -- Since these orders are processed and then scheduled to ship, there is time to allow the fraud detection screening system to fully assess the risk of an order, and then sort-out questionable orders for further review. With this system in place, fraudulent orders can be stopped before being processed. This protects the legitimate customer or fraud victim, and eliminates the fees associated with a future chargeback for the company.

Basically, to protect yourself and your customers from becoming victims of fraudulent activity, utilize every aspect of today's technology to protect the e-commerce venue, including those offered by card issuers. Today's leading technology enables the use of tagless/covert device ID, risk engines tuned for the environment they support, and link analysis tools for finding additional instances of fraud.

Every device with Web access leaves a digital fingerprint. With device ID technology, the digital fingerprint of these devices is captured and stored, enabling any Web accessible devices to be equally monitored among primary e-commerce orders for fraudulent activity. This information can then be referred to with link analysis; by linking similar transactions, it helps the company determine the risk-level associated with a transaction.

It is fair to assume that with the proper tools in place, an enterprise can screen fewer than five percent of all orders while capturing upwards of 85 percent of all fraud (minus friendly fraud). This also plays an important role in the number of chargebacks.

It is important to note that there is no silver bullet to prevent fraud. Some type of fraud will always exist, as evidenced by the presence of friendly fraud. In order to protect both customer and company, it is best to implement a layered security approach to identify potential fraud first and then investigate orders that appear suspicious. This enables both a real-time and time-delayed system to be employed, in addition to human intelligence. This will assist you in achieving maximum security online.

Tuesday 10 November 2009

E-Commerce Fraud: Build a Human Firewall

http://www.practicalecommerce.com/articles/170-eCommerce-Fraud-Build-a-Human-Firewall

There is a fellow from Europe named Kevin Mitnick, who can find your Social Security number online in 15 seconds. He was the hacker who was elevated to “computer terrorist” status by the FBI and Interpol. They caught him and put him in jail for five years, but there are thousands like him, who spend their hours, days, and lives in search of the mother lode of information. There also are less sophisticated folks who dive in dumpsters and trash cans for receipts, bills, anything that might bear sensitive information. They steal an identity and with that, they steal your money.

Mitnick doesn’t “hack” anymore, he is banned for life from surfing the web. He makes his money now from the people he used to victimize, the big companies whose systems he used to break into. Mitnick teaches people how to avoid being hacked. And guess what. He doesn’t talk much about firewalls or secure portals or encryption keys; he talks a lot about people. In a Reuters news story in early March, Mitnick argues that that while sophisticated technology can help keep networks clean from viruses, it is useless if hackers can con a company's employees or any unsuspecting citizen into handing over passwords by posing, for example, as colleagues.

“Hackers find the hole in the ‘human firewall’,” Mitnick told an information technology security conference in Johannesburg, South Africa. “What’s the biggest hole? It’s the illusion of invulnerability.”

“Social engineering”, as hackers call tricking people, formed the main thrust of his career, in which he penetrated some of the world’s most sophisticated systems, often by persuading unwitting staff to hand over top-secret information.

The Front Line

The front line of defense against the Internet fraudsters is a proactive approach on the part of anyone who collects, possesses, uses or transmits sensitive data. You can have all of the latest and greatest technical tools to protect data and your system, but when the human component breaks down, the hordes can and will come through the gate.

Is it really that big an issue? You bet it is. For merchants, the threat comes in areas like credit card fraud and vulnerable data storage systems. Because the threats are so many, so varied, and so sophisticated, companies like Authorize.Net, one of the world’s largest electronic payment gateways, spend millions of dollars and tens of thousands of man-hours every year to build and maintain secure systems to protect data in storage and transmission.

Authorize.Net uses a set of integrated fraud tools as standard features of every customer account, such as Address Verification Service (AVS) and Card Code Verification (CVV/CVC2/CID) that provide merchants with general protection from fraud. However, to proactively fight and prevent fraud, merchants need to employ more advanced fraud detection tools in their own systems that are designed to single out fraudulent transactions. Authorize.Net’s Fraud Detection Suite is composed of several filters and tools that work together to evaluate transactions for indications of fraud. Their combined logic provides a powerful and highly effective defense against many fraudulent transactions.

However, as powerful as the tech tools are, the biggest campaign against fraud needs to be waged on the education front. Stephanie Gibbons is a fraud-prevention expert at Authorize.Net. “The average merchant may not know how much they can do when it comes to protecting themselves and their customers from fraud,” says Gibbons. “There are a number of steps that they can take, but they must be consistent and constantly on alert.”

Most major payment gateway companies offer technical tools, high levels of encryption and transaction monitoring, and most small merchants tend to leave it at that—it’s that false sense of invulnerability. However, in order to protect themselves and their customers, Gibbons says they need to take some measures of their own.

The 13 Bricks Of A Human Firewall

Here are 13 things an ecommerce merchant can do to lower their fraud exposure:

  • Never send sensitive information via email.
  • Leave discreet voicemail messages. Do not leave detailed messages involving sensitive information that can be overheard.
  • Make copies carefully. Always remove and retain originals from the copy machine when making copies of sensitive documents.
  • Do not cut and paste potentially sensitive information from any proprietary or confidential business application into emails or otherwise distribute sensitive information insecurely to customers.
  • Only share customer data with internal personnel on a need-to-know basis.
  • Do not discuss sensitive information where it can be overheard.
  • Check the Internet regularly for phony copies of your website. If you find a “spoof site,” contact the website’s provider immediately.
  • Implement industry standard computer systems security and keep virus detection, firewall, and other prevention solutions updated.
  • Only download software and files from sources you trust. Files from the Internet might include spyware or viruses that can compromise your security.
  • Only use, or interface with, proprietary or confidential business applications on networks or the Internet in the manner in which they were designed.
  • Keep your external USPS mailbox empty. Never leave outgoing or incoming USPS mail in boxes overnight.
  • Keep operating-system patches up to date.
  • And, number 13? Never, never, never give a password, a credit card number or any sensitive information to anyone on the phone, especially a cordless or cell phone. That nice man who is trying to help your mother with her taxes may be another Kevin Mitnick trying to get his digital foot in the door.

Monday 9 November 2009

E-Commerce Law

Today, is the 2nd chapter class for BBL 3014. The new topic for this sem which is E-commerce Law. E-commerce law must at least involve two organization. The "legal persons" that involve normally are refer to companies. It is categorize under private law.

E-Commerce means all form of commercial transactions inviloving both organizations and individuals that are based upon the electronic processing and transmission of data, which include text, sound, and visual image.

Why E-Commerce become more famous nowadays?
Because it is worldwide accessing. It help companies to enhance competitiveness and quality of service. It also allow customazation and personalised products and services. Besides that, It also help to eliminate intermediaries. Last but not least, the cost is really low and cheap.

Although E-Commerce bring a lot of convenient to people but consumers still have their concern for certian issues. For example, unsafe products, insecure payment methods, loss of personal privacy,sharing of liability, and other concerns such as computer fraud, hacking, virus and ect.
There are plenty of risks in E-Commerce. Consumers might worry about disclosure of their personal data. Or maybe the transaction comfirmation and cancellation policies. For instant, sometimes the e-transaction was failed due to power down, the bank or payment system will not take the responsible to solve the problem. The term of condition " bank with your own risk" always stated in their service privacy statement.

Malaysia Government had set up law to overcome problems that happen in cyberspace by implement the Electronic Commerce Act 2006. This law helps to guarantee the rights of people who involve in E-commerce. It also helps to conviced more people to join the E-Commerce world.

Consumers can do lot of activities via E-Commerce websites. For example, online employement services, online bookshops, online auction, online banking, online travel services and others.

Tuesday 3 November 2009

1st Tutorial Class

Today, we had our first BBL tutorial class for this semester. Every group were ready with the article that found from newspaper that regarding issue of law.

Our group had found an articles about Bumiputera Status Issues that happened in Sabah and Sarawak. The articles was had claimed that differences of Bumi Putera Status between Peninsular Malaysia, Sabah and Sarawak.

For Peninsular Malaysia, a child consider as Malaysian if either one of his/her parents is Malaysia.
For Sarawak, a child will be consider as Malaysian with the term that both father and mother must be Malaysian.
For Sabah, a child will be consider as Malaysian with the term his father is a Malaysian.

The differentiate of Bumi Putera Status had cause a lot of children from Sabah and Sarawak been denied for the entry to Matriculation of Local University Programme. A lot of complaint had been make from parents to Sawarak Teaching Union.

The main issue for this case was Bumi Putera Status. Parties that involved were government and resident which STU and students with their parents. It was a case categorize in public law and under administrative law.

Our group's opinion on this case is Malaysia Government must enforce a new law to standisesd Bumu Putera Status for the whole Malaysia as soon as possible. Thus help to solve status discrimination and to unite Malaysian more stronger.