"Computer" articles of the Criminal Code of the Russian Federation

[Детективное агентство Тула]

FSB detained stolen database distributors

Who would have thought?

 

[Детектив-Юг]

In Kiev, an attacker was convicted of distributing confidential databases of government agencies.

The verdict of the Obolonsky district court of Kiev in respect of an employee of one of the consulting companies in the capital, who tried to illegally sell confidential databases, including government agencies, entered into legal force. This news was reported in the SBU press service.

So, employees of the metropolitan SBU Office detained the attacker when he wanted to sell magnetic media. He wanted to get 550 thousand hryvnias for information discs.
The accused was found guilty of an offense under Part 1 of Art. 361-2 of the Criminal Code of Ukraine. He was sentenced to a fine of 600 tax-free minimum incomes of citizens.


Employees of the Security Service of Ukraine during a special operation in Kiev detained a former employee of the Vasilkovsky branch of Ukrprivatzem LLC, who tried to unauthorized sell databases containing information with limited access that are stored in the automated information systems of the State Land Cadastre and are state property.

According to the SBU press center, LIGABusinessInform informs that the offender planned to sell the magnetic carrier with information about the registration and location of land plots in the Kiev region, with data on their privatization, lease and collateral, other technical documentation on land management, for $ 3,000.

He came to a meeting with a potential buyer with a laptop, on which he demonstrated the database. After he received the money in exchange for a USB drive, the attacker was detained.

In relation to the detainee, SBU investigators opened a criminal case on the grounds of a crime under Part 1 of Art. 361-2 of the Criminal Code of Ukraine (unauthorized marketing or distribution of information with limited access, which is stored in electronic computers, automated systems, computer networks).
Link is not valid ... ENT_ID = 651


At the end of February, information appeared on the websites that the hacker allegedly hacked the Ukrtelecom database, I quote:
"According to law enforcement officers, the suspect in the crime did not work at Ukrtelecom OJSC and had nothing to do with the enterprise. However, the guy was an experienced Internet user, where he found the information he needed," fraza.ua reported.

To publish this news in our publication did not give me a number of considerations, for one of them - this is not the reliability of the source. And according to this, this note migrated to my blog, for a note with possible comments by colleagues, "Well, isn’t it nonsense? - I write, if he (about the alleged hacker) is an experienced user and has found information in the public domain - then you need to punish whoever it is With respect to Ukrtelecom's databases, they are there, though out of ten out of ten, like this ... an experienced Internet user.

Although, I was not outraged by this publication in its essence, but by the fact - how journalists report information. "Either write objectively, thoroughly checking the information (without distorting it) or do not clog the network with such headers."

Everything would have ended on this statement, however ... the discussion began.

A certain "Hunter" wrote: "Yes, I have cracked passwords and logins of Ukrtelecom!"

Well, I think ... again, someone wanted to brag. And since it was April 1, I did not pay attention at all. In exactly a couple of weeks, the same “Hunter" posted a number of logins and passwords!

What to do here? I am writing a letter to the security department of Ukrtelecom - in fact, this is their department that should understand such issues.

Soon a response came from the security department of Ukrtelecom OJSC to the editorial office of IA SECURITY:

The information is verified, passwords and logins are up-to-date, but they were received by Ahotnik not from a supposedly hacked database, but from DSL modems of specific subscribers who did not replace the password to access their modem configuration, but left it in the form that was entered the manufacturer "default" is 1234. In fairness, I note that an unauthorized person is not able to practically use this knowledge of login and password, because in the overwhelming majority (maybe the old equipment still remains somewhere), our equipment for subscriber authentication also checks the “binding” to the port number from which the connection is established.

By the way, “Ahotnik” will soon turn 13 years old, which made him demonstrate his “hacker" abilities in the media.

Conclusions suggest themselves ...
Link is not valid ... NT_ID = 3224

And again the child prodigy .....

13-year-old student arrested for writing a virus // 09/07/2012

Last year, the upper house of the Judicial Committee of Japan approved a law passed by Parliament (Penal Code), which introduces criminal penalties not only for creating and distributing malware, but even for storing it on your computer (for distribution). For these crimes, up to three years of imprisonment and a fine of up to 500 thousand yen ($ 6,200) are provided, but only for the storage of the virus - up to two years in prison and a fine of 300 thousand yen ($ 3,720).

Soon after the adoption of the new law, there was a precedent when a person was convicted specifically for storing the virus: 38-year-old Yasuhiro Kawaguchi was found guilty. He tried to harm child porn lovers by spreading the virus through torrents under the guise of a child pornography file. Although the offender acted for humane reasons, he still violated the law, and he was convicted precisely for the storage of the virus, and not for distribution.

The fight against virus writers in Japan continues. Over the past year, several arrests have been made, and now it has come to juvenile offenders. Yomiuri Shimbun reports that Kyoto police arrested a 13-year-old student from Tokyo on suspicion of creating and storing a computer virus that could “shut down the system” (computer shutdown virus) and delete files on other computers. The eighth grade student is also accused of organizing a hacker forum on the Internet, where attackers exchanged information (translation of the news into English).

Kyoto police also arrested a 23-year-old builder who is allegedly a member of the hacker forum. He trained other hackers to create viruses and stored the virus on his computer.

The Slashdot forum jokes about this: they say, if you live in Japan, open a notebook, write the following lines there:
echo off
cls
echo y | format C:

Close the file, name it virus.bat - that’s all, you can go to jail.

 

[Детектив-Юг]

Is it possible to protect my personal data in Russia, even with the Law?
Link out of date - deleted
You fill out a questionnaire in the store, and information about you falls into a particular database, which after a while goes on sale.

The authorities made a new attempt to streamline the collection of confidential information about the Russians. In November, a government decree "On the characteristics of the processing of personal data carried out without the use of automation" began to operate in the country. Now, organizations working with personal data will be responsible for their safety from encroachments from the outside. Documents that presuppose the availability of confidential information must now indicate the purpose of their collection, the name of the operator (data collector), as well as a list of actions with the information received. In addition, a questionnaire is now required in the column in which the citizen puts a mark on his consent to the processing of information about himself. A very serious measure to combat information leakage, as expected, will be the introduction of a unified registry of operators entitled to request personal data. Rossvyazkomnadzor began to form such a list back in April of this year. The register will include both state and municipal bodies and services, and legal entities (notaries, lawyers). The main thing is that their desire to collect and process information about citizens should be clearly confirmed by official necessity. In addition, the authorized structures will be required to clearly prescribe the mechanisms for protecting information and identify methods for its storage.

In the collection of information, operators will be guided by the main document - the Law "On Personal Data". The latter categorically does not allow the processing of personal data regarding racial and national affiliation, political views, religious or philosophical beliefs, state of health and intimate life. Work with such information is possible only with the personal written consent of the person or in connection with the administration of justice. For example, defending the interests of his client in court, the lawyer states that he was in the clinic at the time of the commission of the crime and voiced the diagnosis. In case of leakage of confidential data, everyone has the right to go to court. Such precedents have already been. So, cellular communication operators were involved as defendants, who became responsible for the leak of details of incoming and outgoing calls of some subscribers. Physicians also appeared before the court, from the registries of which information constituting a medical secret mysteriously leaked to the tabloids and the Internet. The maintenance of the register should personalize the responsibility of authorized structures to the people who provided them with their data.

The law does not cope

In recent years, the country has increased by an order of magnitude the number of all kinds of databases containing personal information held by state and commercial entities. Consumer, client and other databases with private information are conducted by distance selling companies, direct sales, delivery services, call centers, mobile operators, banks and insurance companies, many trading and service companies. Sometimes we ourselves do not notice how the dossier swells on each of us. It happens almost daily. In one place he answered seemingly unpretentious questions of a restaurant profile, in another - he filled out a questionnaire at a gas station. He came home, registered on the site and left his email address there. It would seem - so what? In the meantime, all this information is carefully collected into databases, which then become an expensive commodity in the information market. And its volume is estimated by analysts at about 200 million rubles a year.

On July 8, 2006, Federal Law No. 152 "On Personal Data" was adopted. But in the process of its application in practice, it turned out that some points, and rather serious ones, were missed in it.

A simple example: based on the law, on the one hand, the client’s relationship with the bank is built, which, of course, does not have the right to disclose information, for example, about the size of the deposit, loan conditions, or collateral. The bank, being interested in your privacy, does it legally, as it risks its money. Moreover, the client is warned that the security service will carefully study his credit history, and he gives consent to the verification and signs the corresponding clause in the contract.

On the other hand, the law does not spell out in detail the relationship of the client with organizations that do not have the right to collect personal data, but nevertheless do so. For example, a supermarket. A rather obsessive offer to the buyer to fill out a questionnaire promises to receive a discount card in the future. Based on the discount, customers, almost without hesitation, share with the store information about themselves, their loved ones and property. And this data is sent in an unknown direction. Although why in the unknown?

It’s enough to type the key phrase “restaurant customer database” in any Internet search engine, as you can easily find several offers for its sale. How does she find herself in relatively open access? The mechanism is simple. Naturally, no chain restaurant will be engaged in the compilation of these databases, although its availability is, of course, very useful for business. As a rule, teams of programmers are invited to compile such databases, and these people, like no one else, know the value of personal information. It is possible that, having formed a database from the completed questionnaires, programmers will make copies of themselves.

Open Access X Files

Recently, a scandal erupted that has not subsided so far. On the Internet, on one Russian-language resource registered in the United States, almost all databases of citizens of Russia that are currently available were publicly available. Free resource worked for a week. During this time, everyone who heard about him took advantage of it with interest, learning, for example, the wages of their boss or ex-spouse for 2007. Currently, the resource continues to work, but for the money - the minimum contribution is 10 dollars. Payment - via the Internet.

Is it possible to cover this shop? It is practically impossible to do this, experts assure: today you close one resource, tomorrow two new ones will replace it. The floodgates opened - the water went. “Today our man is naked, absolutely naked. He is illuminated like an x-ray,” Viktor Ilyukhin, deputy chairman of the Committee on Constitutional Legislation and State Building of the State Duma, is indignant at the current situation. “A huge amount of personal data has been collected in commercial companies, and this leads to the temptation "Car dealers, banks and shops know which house you live in, what kind of car you drive and how the furniture is arranged in the apartment, which mobile phone and even what color of wallpaper you prefer." Who needs it and why?

The answer lies on the surface. Open your e-mail, and you will find in it a lot of offers for the sale of databases, which are a reference archive of individuals and legal entities in Moscow and the Moscow region, all forms of ownership, engaged in various activities. For 24 thousand rubles, the courier will deliver you a 240-gigabyte hard drive with fifty databases. The choice is rich and significantly broadens the horizons of the user: for this amount you can find out about all shareholders of banks, about homeowners, about tax debtors, about employees of law enforcement agencies and lawyers in Moscow, about unscrupulous payers for a communal apartment. The circle of consumers of this content can be very wide - from employees of resident offices of foreign intelligence services to trivial fraudsters.

And in vain many of our citizens think that their personal lives do not interest anyone, and therefore this problem does not concern them. It is from such bases, for example, that criminals can get information about your family members and, introducing themselves as a law enforcement officer, call and report the detention of your loved one, the release of which costs a lot of money. According to the most conservative estimates, there are at least a dozen cases of this type of fraud in Moscow every day. This type of crime has an extremely high latency - villains remain in the shadows.

Probably, some, to their surprise, came across the fact that almost immediately after the theft of the car they received a call and offered to provide information on the whereabouts of the car for a small amount. The source of the leak is the police hijacking database.

You have not yet been called from a certain insurance company a few days before the expiration of your insurance policy and, unmistakably giving the name of your car, have you been offered to conclude a new agreement on more favorable terms than with previous insurers? Wait, they’ll call soon. Insurance companies are fiercely competitive and literally hunt for each other's customers.

“The new resolution was adopted very on time, because the existing law on the protection of confidential data was clearly not enough,” said Mikhail Chupov, Director General of the Informzashita State Unitary Enterprise. - A lot of commercial structures seek to get the maximum information about customers, and in most cases it has nothing to do with the services provided.

Special registry

What is being proposed to do? First of all, limit the distribution of databases. In essence, two methods are proposed. The first is that citizens are encouraged to take personal information more responsibly and, in which case, be interested in who will be specifically responsible for the confidentiality of the data they left. Especially in situations that leave no choice. So, when visiting almost any organization or company, the guards require you to present a passport, the number of which, together with your last name and address of registration, is copied into a journal. Now, and this is spelled out in a new document, the departments guarded by zealous security agencies must justify the need for the existence of the registration journal itself with a special act, as well as ensure its safety. Copying information is strictly prohibited.

The second way is to strengthen control over the storage of information that appears in government bodies. So, the Law "On Personal Data" mainly concerned private enterprises. The requirements for state bodies in the law were generally less stringent than for commercial structures, and in some cases were completely absent. It turns out in vain.

It is no secret that the most valuable databases are leaking from government agencies. The decision should add to officials personal responsibility for the protection of confidential data. Actually, for this, a register of structures authorized to work with them is compiled. It appears to be a tool to identify the source of the leak. You say this is unrealistic? Well, why? For example, after a series of high-profile leaks, the traffic police was able to block the dissemination of information about vehicle owners and, according to experts, the new base has not been available on the market for two years. For no money. The fact is indicative. But all that was necessary was to strictly and personally restrict the circle of persons having access to information. According to experts on information security, it is personal responsibility that is almost the main way to preserve information.

“You can develop the most advanced information protection systems,” says Mikhail Chupov, “but then among the company’s employees there is sure to be a person who has access to the database, who writes his personal password on a piece of paper and sticks it on the monitor so that he doesn’t look at the diary every time ... "

Not everyone believes that the roster of authorized entities will cover a loophole for people willing to trade data. “Unfortunately, we do not have a mechanism for monitoring compliance with such standards,” said Vladimir Khimanych, chairman of the Freedom of Will human rights organization. “It will have to be developed, and I think that no violations can be done at the initial stage. Now, when passing through the world "passport control uses biometric data. When this system was introduced in Europe, many expressed doubts about the safety of the data. And then they decided not to enter the information into any database, but leave it only on the chip in the passport."

Of course, the new regulation, like the existing law, does not solve all the problems. Additional steps are likely to be required to introduce new rules into the Criminal Code. Today, if the seller of information is not caught red-handed, no investigation will prove that the client’s personal data has "leaked" from a specific person or from a specific organization. Moreover, police officers note that even with the successful arrest of database vendors (and not the couriers who deliver them), they can actually be accused of either illegal business or copyright infringement (both of which are very hard to prove). And the operatives in their practice have not yet recalled cases of detention of the entire chain.

In addition, fears are already being expressed that, under a good pretext, one can easily go too far. “The new resolution will lead to an information weakening of society,” said Andrei Babushkin, chairman of the For Civil Rights public committee. “For example, someone decided to track down a relative and turned to public organizations for help. They write requests to the FMS and the Federal Penitentiary Service , in the Ministry of Internal Affairs. And from there the answer comes, they say, gentlemen are good, you are not in the register, and therefore you do not have the authority to request information. " It is impossible for an ordinary citizen to obtain information from databases legally. At the same time, this does not mean that employees of structures included in the register will gain uncontrolled access to information about citizens. In the Ministry of Internal Affairs, for example, it is already impossible to request and receive any data about a specific person without having lit up himself. When receiving information from the Main Information and Analytical Center of the Ministry of Internal Affairs of Russia, the police officer must indicate the name, title, position and number of the certificate.

All these innovations, unfortunately, are not able to eradicate the market of incriminating evidence. Rather, they will clean it from random people, which will certainly reduce the number of leaks. Only professionals will remain in the arena - mainly former employees of law enforcement agencies, who, using the monopoly, will inflate prices.

One of the supporters of the protection of confidential information, the governor of the Ivanovo region, Mikhail Men, is confident: “Matters relating to the collection, processing, storage and transfer of personal data must have legal, organizational and technical support, and the responsibility for unauthorized receipt and use of personal data in Russian law should "I believe that it is especially important to prevent the penetration of crime into databases containing confidential information. Measures taken in this direction will help to respect the right of everyone to privacy."

Perhaps there is no point in challenging the indicated priorities, moreover, in Russia for several years there has been an idea to create an electronic dossier for every citizen. So far, however, not even a department has been identified that will oversee this project. But Big Brother is already at the doorstep: cameras are looking at you from everywhere, data is read from bank cards and driver’s licenses, and therefore it’s very important that the information about each of us is protected. Well, at least they were not sold at every intersection ...

All for sale

Today, the Moscow Firms database (905 thousand e-mail addresses) for 3.5 thousand rubles, Moscow Individuals (5937 thousand e-mail addresses) for 10 thousand rubles, All Moscow "(6842 thousand e-mail addresses) for 12 thousand rubles," Firms of Russia "(6101 thousand e-mail addresses) for 10 thousand rubles," Individuals of Russia "(9840 thousand e-mail addresses) for 18 thousand rubles, "All Russia" (15 941 thousand e-mail addresses) for 25 thousand rubles. Are you interested in not only Russia? Please, sellers have addresses in Australia, Argentina, Great Britain, Germany, Denmark, Israel, Italy, Canada, Norway, Singapore, USA, Turkey, Ukraine, France, Switzerland, Japan.

Prices for databases of power structures range from 1.5 to 50 thousand rubles, some can be bought on the Internet. The latest news: they say that employees of the disbanded Organized Crime Directorate threw a database of high-ranking police chiefs, officials and deputies onto the market. The price tag for bathing and drinking videos with the participation of generals, criminal authorities and cheerful ladies supposedly starts at 100 thousand rubles.

[21.11.2008]
Itogi / Nsbural


Source: GuardInfo

 

[Бюро Рысь]

Vitya, the information is interesting, but there are so many letters: lol:

 

[Детектив-Юг]

Vitya, the information is interesting, but there are so many letters: lol:

Ruslan agrees with a lot of letters. I don’t read such posts, I also didn’t read these posts ...: lol:

For many of us this is just a reminder, and visitors are warned about what awaits them if they suddenly read all sorts of nonsense and rush headlong into intelligence. : D

 

[Турабян Владимир]

THANK! PRO CRIMINAL CODE MUST ALWAYS REMEMBER!

 

[Детектив-Юг]

To the load.

Article 203. Excess of authority by a private detective or an employee of a private security company holding a private security guard certificate in the performance of their duties

1. The performance by a private detective or an employee of a private security organization, having a certificate of a private security guard, of acts that go beyond the powers established by the legislation of the Russian Federation, regulating the implementation of private security and detective activities, and entailing a significant violation of the rights and legitimate interests of citizens and (or) organizations or the interests of society or the state protected by law, -
shall be punishable by a fine in the amount of one hundred thousand to three hundred thousand rubles or in the amount of the convict's wages or other income for a period of one year to two years, or by restriction of liberty for a term of up to two years, or imprisonment for a term of up to two years with deprivation of the right to hold certain positions or engage in certain activities for up to two years.
2. The same act committed with the use of violence or with the threat of its use or with the use of weapons or special means and entailing grave consequences, -
the applicable sentence is deprivation of liberty for a term not exceeding seven years, with deprivation of the right to occupy certain positions or engage in certain activities for a term not exceeding three years.