SPE10117 Foundations in Information Systems


Part 1 Review Questions

  1. Explain what mundane threats are and why a security policy needs to protect against them.
  2. Take CityU as an example, develop a policy,(by giving any two policy/procedure statements), to ensure that mobile devices must be appropriately secured to prevent sensitive or confidential data from being lost or compromised, to reduce the risk of spreading viruses, and to mitigate other forms of abuse of the university computing and information infrastructure.
  3. What are "digital signatures" and what role do they play in the commercial world? What is required in order to obtain a digital signature? How might a digital signature be used to combat credit card fraud?
  4. Consider the following case "Amsterdam Airport To Test Iris Recognition Systems" Security Product [online] http://secprodonline.com/articles/2009/03/12/amsterdam-airport-iris.aspx (accessed March 1, 2020).

    "Sarnoff is proud that Schiphol Airport chose the IOM Portal as one of a select group of technologies for biometric verification testing," said Dr. Don Newsome, president and CEO of Sarnoff Corp. "Sarnoff's IOM technology keeps lines moving quickly at airports like Schiphol, while ensuring the security and ease of use that is crucial in high-traffic areas." The automatic border passage system process involves a second photograph of the iris being taken at the 'border'. If the iris information matches the data on the smart card, the passenger can proceed to the gate. While other iris scanning technologies require users to stop and stare directly into a scanner for a set period of time, IOM technology operates differently. It verifies identities at high speeds by scanning irises from a distance, allowing subjects to move quickly through security checks at speeds of up to 30 people per minute.

    • In assessing and selecting a biometric technology what factors need to be considered?
    • Compare with fingerprint, what are the strengths and weaknesses of iris recognition in border control application.

  5. Identify and describe the six ethical principles.
  6. Chan Tai Man is an employment agency and he can assess to a lot of applicants' resumes. Chan Tai Man's wife needs to hire someone who has applied to Chan Tai Man's company and she knows her husband has a copy of the applicant's resume. Chan Tai Man thinks it is ok to share the applicant's resume with his wife.

    Do you agree with Chan Tai Man? Explain with reference to HKCS code of ethics.

  7. What are the six data protection principles in HKSAR?
  8. Using example from the "Privacy Guidelines", What legitimate reasons can an employer have for monitoring their workforce?
Part 2 - Identity Theft
  1. Read the following story:

    The story reported below is told by Simon Bunce of Hampshire, UK, who was accused of buying, viewing and distributing materials about child-pornography.

    "In March 2004 I was arrested, my house was searched, and the Hampshire police seized my Compac handheld computer, numerous flash memory devices, compact disks and floppy disks.

    I was arrested because of evidence from the USA that someone, using my name and previous address, subscribed to an Internet pornography website via a gateway site called Landslide Productions Inc. in May 1999. This website was widely reported in the UK media under the name of Operation Ore.

    On 9 June 2004, I firmly believe that I was followed to work by officers working for the Hampshire Police. Subsequently, on 23 June 2004 I was sacked without notice or compensation by my employer, Interxion Carried Hotels Limited of London. A breach of contract action has been launched against my former employer because they did not follow the correct procedure.

    Prior to this I was earning $120,000 per year plus benefits. Last year (2006), I earned just under $30,000.

    My house was searched again in September 2004, and the Hampshire police seized another computer that my wife and I used.

    Later in September 2004, I received a letter from the Hampshire police stating that as there was no evidence of any wrongdoing found on any of my computers or on any of the hundreds of flash drives, CD disks or floppy disks they had seized during their two searches they were not taking any further action in my case. They told me to come and collect my property or they would dispose of it.

    There have been 39 reported suicides of innocent victims who could not bear the shame and humiliation of similar police accusations under Operation Ore. The unofficial number of suicide deaths of suspects on bail is likely to be in the region of 200.

    I appreciate that by now publicising what happened to me in this manner this may cause me more pain and suffering. I take heart in the fact that this further suffering will be nothing compared to the ongoing, lifelong suffering of the bereaved who lost innocent loved ones as a result of similar police actions. If my public stand gives those bereaved families just one crumb of comfort, then I will consider that my job will have been done.

    We, as a family, have been financially crippled by the actions of the police. Our family home is on the market because of the financial situation we now find ourselves in and we will be moving shortly.

    What the UK media seem not to have been told at the time Operation Ore was launched was that there was evidence of widespread credit card fraud associated with the database from Landslide. Only now is this information starting to come out.

    Tesco Stores Limited has confirmed the fraudulent credit card transaction. Furthermore they have confirmed that prior to me registering for their on line shopping service, they linked my Tesco Personal Finance Credit Card, issued by Royal Bank of Scotland plc, to my Tesco Club Card account, allowing me to earn Club Card points whenever I purchased goods or services with my Tesco credit card.

    It was only when I visited (the computer forensics expert's name is removed here for now) that I discovered the true extent of the fraud that was perpetrated in 1999. He has for the past 30 years been the pre-eminent computer forensic expert witness who has trained the police in evidence gathering. He was the expert witness in the Serious Fraud Office prosecution of BCCI in 1995. He was able to give me all the answers to all my unanswered questions. He forensically examined the Landslide database and produced for me a comprehensive report detailing the single entry showing my name that appeared on Landslide Subscriber Database. (Editor. This is the database that was secured by the Operation Ore action group last year and is being used as evidence in the class action against the UK police).

    The forensics expert was also able to show me verifiable evidence of credit card fraud and identity theft. From the information that he provided, which revealed the single entry showing my name that appeared on the Landslide Subscriber Database, this personal and financial information is identical to the information which I entered into the Tesco on-line shopping server when I registered with Tesco to shop on-line in 1998. Furthermore, the Tesco.Net email address was registered by me solely to enable my wife and me to log onto the Tesco on-line shopping server and thus enable us to shop on-line at Tesco. It is my belief that this is the route from which my data appears to have been obtained by fraudsters. I do not know how it came to be in the hands of a fraudster who used it on Landslide. I have written to Tesco to ask for information about security standards and leaks.

    In view of what happened to me, I fear that my personal information was then sold on to criminals. It ended up in the hands of a man called Michael Yamin who is resident in Jakarta, Indonesia. Mr Yamin is also known as "Miranda" and was indicted in the USA District Court for the Northern District of Texas, Fort Worth Division in April 2000. Mr Yamin's sealed indictment reference is 4-00CR-056-Y. He is a webmaster. This means that he produces and hosts websites. Some of his websites are pornographic. Yamin registered his websites with Landslide so that members of Landslide, for a monthly fee debited from a credit card, could view his websites, and he would receive commission from Landslide for every subscription.

    It appears from research since that Mr Yamin, or someone working for him, then entered my details into the Landslide Subscriber Database, subscribing to one of the websites that he owned, controlled and were active in 1999. Money was then debited unnoticed from my credit card account, and Mr Yamin received commission from Landslide Productions for that transaction. Current information is that Yamin actually owned or controlled a total of eighty-four websites, only twenty-six of which were active during 1999. The forensics expert went on to say that he has clear evidence that in August 1999 alone, it is estimated that Mr Yamin stood to gain in excess of $100,000 from these activities.

    These figures are for a period after Landslide's credit card processing facility had been withdrawn and thus they did not pay any webmasters after 08 August 1999. None of the webmasters (including Yamin) was aware of this and their fraudulent activities continued. This is likely to be on the conservative side because refunds and charge backs were not itemised, neither is it possible to assess the possible effects of multiple renewals.

    I do not know whether the police knew of the credit card fraud from the beginning of the Operation Ore investigation. If the police did know of the credit card fraud, then they chose to ignore it. (Editor. The class action will reveal that they did know about the fraud, but went ahead despite this. They also lied to Parliament and the media about it and continued to broadcast these lies until the action group began to publish the new evidence.)"

  2. Reference

    "Operation Ore - A Victim's Story" [online]Available at: <https://jillhavern.forumotion.net/t810-operation-ore-a-victim-s-story> [Accessed 11/30/2020].

  3. Discuss in your group. Did you think about such potential risks? Do you think it is only an extreme case?