Well, can you hear me well?
And, well, I'm from Seville, as some people may have noticed from my accent.
So, we've got the title of my presentation, which is Damned Hippies on Internet, or the Damned Internet Hippies, which is sometimes the way people see hackers.
I don't want to insist with the cyber issue.
I'm going to try not to repeat that too much.
But, well, before anything else, I would just like to thank you all.
I would like to thank you for staying here until 6 and apologise for arriving late.
Also, thank you to CyberCamp for allowing me to enjoy this time with you.
And the podcast 1984, and I think there are some representatives here of that.
So, what am I not going to talk about?
About how awful hackers are.
I'm not going to talk about politics.
I'm not going to talk about conspiracies or business solutions, you know, which are a kind of trick or they try to sell you rubbish.
I'm not trying to sell anything.
So, what are these terrible words that I want to avoid?
Synergies, big data, community.
All of these things we can see on the screen.
A hacker's ID card.
No, that's not what my talk is going to be all about.
So, what am I going to talk about?
I'm going to talk about the new criminal code.
The new law on criminal procedures.
The law on citizen security, which is an administrative law.
And the situations that I have come across in everyday life and the problems that come with them.
And what we can see here are statistics provided by the prosecutor's office in Spain where we can see, in this case, how telematic crimes or cyber crimes, as I call them, in 2014, represent 80% of the increase.
And the one which is most striking is fraud, damage, sabotage, as well as pornography, child pornography, amongst others.
And here, well, what is this?
Well, basically, this is what the legislator thinks about Internet crime.
So, what's fashionable at the moment?
Internet.
And what is out of date?
Well, the criminal code.
So, they decided to update the criminal code and bring into it all of the elements related to Internet.
So, it's a rather poor adaptation.
And I'm going to explain some of the points which I found particularly striking.
So, there are some crimes which can be committed on Internet, such as crimes against freedom, threats online, against moral integrity, cyber bullying or stalking, bullying.
Okay, if we talk about sexual harassment, pornography, crimes against the administration of justice, intellectual property, public order, humiliation of victims, all of these things brought together or linked up with crimes against public treasury, about the freedom of conscience.
So, these are many crimes that also affect or can be committed on Internet.
But I'm not going to focus on those kinds of crimes because there are a huge number of them and it would be enough material for two other talks.
And I would just like to, well, thank the GDT, the group which is the tutor agent program for working with young people to increase security and also the unit for, technological unit of the police, the judges and the prosecutors that look out for and protect the younger and more vulnerable people in society,
children above all.
So, we've got three parts to my talk.
We've got hacking and the crimes related to hacking, hacker activism and e-crime, so fraud and such like.
So, if we start with the first part and, well, when I talk to friends, most of them are specialists in IT, some of them are hackers, others aren't, some are auditors, there's a whole range.
And they normally say, hey, this tool that I use, is it legal?
Can I do this if I want to with my pal?
Can I launch a meta-exploit or can I send a Trojan horse to my girlfriend?
Well, I mean, am I going to be committing some kind of crime here?
And, well, if you've seen, some may be familiar with this meta-exploit start page, what kind of crimes could I be committing if I don't have authorization from the person who I am auditing, as you might say, which is quite interesting.
Well, one of them could be the one described by the criminal code article 197 combined with 201.
This would be a crime against privacy, image and the infringibility of the home.
And so the idea of them recording you with a web camera, sound or image, or if they steal some information or they introduce into your computer certain pieces of information, that would be typified according to the 197th article of the code.
And so now I could say, well, what is it we're looking to protect?
What would a lawyer say?
Well, what's the legal asset being protected?
Here we'll be talking about secrets and individual privacy so that all individuals have rights to that.
As according to the article 18 of the Spanish constitution.
So we have two premises that have to be fulfilled by 197.1.
So this means that there is no consent.
This is very important.
If I'm carrying out a security audit, then we must obtain consent for that.
So if the boss of the company of IT security sends us to do an audit of their web security or to analyze a company and they don't have a written consent, then you're getting yourselves into trouble.
And that's why it's very important to get consent, if possible, written consent in some kind of contract where they express that they give their consent.
And secondly, it's necessary in order for this to be typified as a crime, then it must be that the person affected places a report.
They feel the victim of an attack against their privacy.
Then what they have to do is report them.
They have to place a complaint.
The police and the prosecutor themselves cannot take action.
And that's what the criminal code states, according to the latest reform.
Another form of crime would be freaking, as we call it.
You may be familiar with the fact that the new routers from certain companies, which taste of oranges, they have some kind of fault.
And who knows, maybe you can use them as an IP... a voice IP kind of hub.
And these are things that happen and we've got lots of examples of that.
And then we have wall driving.
We have applications in Android, which perhaps were a bit trickier in the past, but right now they're easier in most cases.
And with these, the vast majority of people that have Internet have a flat rate.
So we have to... or you'd have to steal the Wi-Fi from your neighbor for several months to be able to consider that it's gone over 400 euros in order for it to be considered a minor crime.
That's what's set out in the 255 and 256.
Of the criminal code.
And here we have something which appeared on a forum on Internet.
And here a user is uncertain about a few things and they send this message at one o'clock in the morning, they say, they send this post.
It says, well, this morning I hacked a server of the company where I work.
And they've connected a botnet and the commands are sent through an IRC channel.
And this has led to a DOS.
We've taken the server from the Internet and we've sniffed the traffic to find out the information about the IRC channel.
And he then says, I'm going to connect onto that channel together with the administrator of the botnet.
And I can see all the bots.
So he has this great idea.
And well, let's see.
I mean, this is really quite unusual.
And he says this and then he says, not only that, but he says he wants to do business, you know, to break the ice.
He says, hey, since you've got a botnet, we're going to have another botnet somewhere else or in another place in my company and we can do a DOS.
And he says at the end, well, I know it's very difficult, but do you think you could find out some information?
And after, well, after this appearing on the forum, any user with a little bit of common sense, the first thing, well, they wouldn't publish this kind of post, but another user answers them.
He says, Miguel, why did you leave that up to the GDT?
So what this young man was suggesting in this case is typified in article 264 as a crime of damage and they can be sentenced to prison if found guilty.
So if you are controlling a system, the first thing you have to do is to inform your superior or the owner of the company.
That's the first thing you have to do.
And secondly, you don't go into any kind of fora or into any kind of IRC channel to continue investigating, because there's obviously a tracking system.
And the first person to be investigated if a legal case is opened up by the telematic group, obviously the administrator who was inside there, and you can get yourself into real problems, because otherwise it can be very hard to clarify.
And so if we continue, and so what do I do?
Besides telling my boss that a botnet is being set up in our server, can I report this to the police or am I going to get myself into more trouble?
Well, the answer is yes, you can report that to the police.
And how do you have to do that?
Well, you have to do it in the following way.
So depending on the seriousness, if you understand that it is really serious, they've infected the servers with a botnet that has child pornography, for example, I think this is a bit more serious than usual.
So then, with common sense, you would have to report that to your boss, if you have a boss, and if not, straight to this link that the police has on their website, policia.es slash colabora.php for the Spanish police.
And there you can provide information about behavior, and if it is perhaps not so serious, you can report it to the Spanish Data Protection Agency according to the LOPD Act and the LSICE Act.
And if you just go into Google, you just type in denunciar AEPD, report AEPD, and that will take you straight to those pages, so it's not complicated.
I would like to include a quote from Henry Toro, and it says, the law has never made men more fair, and in order to respect the same, even those who are willing, they are turned into agents for injustice on a daily basis.
And this is what we're seeing right now.
Freedom has to control security, but now we're in a situation in which there is too much fear, and that fear will end up devouring us and deteriorate our privacy and the limits of our freedom.
At least that's the way I see it.
And hacker activism is all about vindications and organizing demonstrations and protests, and everything that involves harmful activity for other people, I understand that that could be typified as terrorism.
Not any kind of expression or manifestation, but very serious versions, such as with ISIS and such like.
As a result of this, hacker activism.
This year, the Organic Law 4 slash 2015 on the protection of security, also known as the Ley Mordaza in Spain by many people, the gagging law.
And here we have a classification of crimes or of offenses.
We have very serious ones, which have fines of between 30,000 to 600,000 euros, serious from 601 to 30,000, and the minor cases, which have the lowest 100 to 600 euros.
And here it talks about serious ones, the unauthorized use of images and personal data from professionals and members of the security forces, which may place in danger the personal security or family of the agents and protected installations or may put at risk the success of an operation.
And there were raids in Brussels recently, and photos were being taken, and for having taken photos and uploading those photos of the raid, of the police investigation, if somebody did that, that would be considered within this clause of the law on citizen security.
And it has to be very clear that this law on citizen security, this gagging law, works in a subsidiary way.
So, first of all, you have to fulfill the penal rules, the criminal rules, and if not, then it is regulated using this.
So, what does this mean?
It means that if I'm at a protest, and I get into a fight with a policeman, because I feel very strong, besides the beatings that I could get and going to jail, if they see they cannot arrest me, because I altered the public order or any other crime, including the criminal code,
they would apply this rule.
So, sometimes getting a financial sanction may be more painful, and it may lead you to reflect a lot more on your actions.
So, another type of crime that tends to take place whenever there are actions with an activism are honor crimes, or insults from certain politicians, or even whenever they link to some routers that are not theirs, so they can't be located.
Such crimes, when they delete information of computers and machines that the activists have committed.
Another thing that tends to happen is the disclosure of secrets, accompanying secrets to the Internet, crimes against national defense, the insults to Spain, and the special crimes against the Crown, which are pretty much in vogue lately.
Last, we have online scams and frauds.
In this case, it's related in articles 248 to 251 and 269 of the criminal code, and I'll give you some common features that exist in all of them.
First of all, the transnationality.
In this case, the criminal, there's no cyber-criminal, for the criminal code there's only criminal, but he could be in Russia, China, North Korea, Malaysia, anywhere.
They may have their servers there, and carry out an attack against Spanish companies or users.
It may happen anywhere in the world.
And then the physical distance, as I was saying, they don't need to be here.
Thirdly, we have ubiquity, or the omnipresence.
That means that the same attack may take place in Malaysia, Russia, France and Spain at the same time.
That's something allowed by the Internet.
And these criminal networks tend to be managed by organized crime groups that earn massive amounts of money, much more than with drugs trafficking or human trafficking and weapons trafficking.
So, what would be regulated here?
And what is protected?
The owned assets and the ability to dispose of them and to use them.
If they rob into your bank account, you wouldn't like it at all, for example.
And these are some of the techniques used by cyber-criminals, such as phishing, that is very well known, they imitate their website.
To steal the identity of someone, some do it better than others.
Another type of scam is pharming.
They change the DNS addresses, the user thinks that he is going to Facebook, but he is not.
He is being redirected, he enters the data, they are kept, they do a redirection, and they send you to the real address, so that nobody realizes.
And last, this happens increasingly through VOIP, centrals that are compromised, so they send false DNS, inviting you to enter your data in a malicious link, to control your machine and access your data afterwards.
And then you can sell them and have access to them.
Another type of scam, that they are quite good at, is the so-called Nigerian scams.
They are missing obvious for most people, but we need to take into account that they are quite rational.
95% of the population wouldn't click on a link that says that you just want an iPad.
And that if you don't collect it in less than 5 minutes, you are going to lose it.
Most people have some common sense and they don't click on that link.
But other people, like 5% of people say, wow, I just got on the internet and I just want an iPad, I'll try to reclaim it.
Or to claim it, I'll put all my data in there.
I don't understand much about it, but these people do exist and they have this kind of premise.
You should say, well, we are the heirs of a rich and generous relative who has passed away.
Someone is offering us substantial business that we could get quite a bit of money out of.
Or we need your help to move or rescue some money from a foreign country.
And we have Nigerian scams and also online purchases.
On Facebook there were loads of fake Zara vouchers.
And there were 50 Zara vouchers and if you registered, maybe you got one.
Or there was a pack of 100 iPads that couldn't be sold in Spain due to customs issues and they were retained.
And if you registered, you can have access to one of them for a tiny price.
Also, lots of scams.
You know, some beautiful Russian ladies contact you because you are incredibly sexy.
So, this lady living in Sevilla with scarce resources, hanging a very basic Spanish,
she asks you to pay the trip and her beauty treatment so that she can look well when she comes to visit you.
So then you pay the money, the Russian girl disappears and so does her boyfriend.
Then we have the charity scams, very typical at Christmas time.
And the fake job offers.
Which I'm really annoyed with because they play with the hope of people and with the need that we all have in this current economic crisis.
This is usually related to the following.
Give the copy of your ID for your profile.
Once you give that and the account number, they can do lots of things.
They can register you in companies on your name and they can transfer money in an unlawful way.
And you could get into a really serious trouble or problem.
So, please do not give IDs to anyone only if you think that it's a serious company.
And that they have physical support that you can go to if problems do arise.
To finish this part, I created a chart stating who has most possibilities to get away with it in the international and economic sphere.
Companies, because they can be anywhere, they can have several headquarters, they have a lot of money, a lot of staff.
And they do act within certain legal frameworks.
Then we have criminal groups that have the same but they are not legal.
Then governments, then the administration and last, the security forces.
Who may have most possibilities with getting away with it?
Well, I think that companies are just.
They are tax movements who pay as little as possible.
We know that there are renowned companies who pay taxes in tax havens.
And they have tax agreements to pay as little as possible.
While common ordinary citizens cannot have access to those mechanisms.
Then criminal groups, they are out of the law.
They also have access to these kind of premium services.
Governments who comply with the law.
And then we have the justice administration that has few resources and staff.
And the state security forces in court.
So regarding the organic law bill of criminal trials.
In this case it affects fully.
The profession of IT experts and auditors.
And that is the bill on criminal procedures.
And this is the first slide with a bit of color.
And here we have the pre-cops.
We try to get the police in somebody that predicts the future before the crime takes place.
This is what this new regulation of the criminal procedure bill.
And I'll just deal with certain details that are quite remarkable on this criminal procedures act.
So this will be the famous police Trojan that we all know and has been debated within the IT community.
Remote registries on IT equipment.
Art.
588.
Sept.
8.
The judge may authorize the installation of remote software, a Trojan, without the knowledge of the equipment owner.
And on part E it says...
But let me explain first.
What is saying there below is the following.
The Trojan, the remote software, can be introduced without the knowledge of the owner to identify some criminal activities
believed to be carried away by the person under investigation.
When that investigation, that installation may be possible by the police at the request of the judge.
When the crimes have been committed through IT tools or any information technology.
So regarding our profession, pretty much everything.
That includes everything.
So let's say you think you're being investigated because you're using some sort...
or you're showing some sort of rude behavior through WhatsApp or Telegram.
Well, they may investigate you.
If they think you're trafficking with drugs through Skype with your colleagues in Azerbaijan.
Well, maybe the police is investigating you and they install a Trojan.
Currently, since the regulation is very new, I'm not aware.
I haven't had any customers saying that this Trojan has been installed.
But they will come.
For sure.
And I get a question here.
If they install the Trojan, how do you know they'll erase it?
That's just an open question.
And which limitation do they have?
Which data do they get?
Because maybe you have a file from 2007 when you were in the Dominican Republic.
And maybe that's not in the criminal investigation.
So, the topic of this Article 588, this refers to the police.
And the translation of the criminal article is the following.
The civil guard or the police, whoever is in charge of the investigation, will force the service providers to reveal any information they may have on you.
So, if you host a page with Joomla!
and they are hosting on that VPS server, the owner has hosted it in Spain.
I don't really know how to explain it.
But let's say they may be forced to collaborate.
They are invited to collaborate.
Because otherwise they may be subject to a penalty.
So there is a duty by the service providers to collaborate with the justice administration.
What does this mean?
That if your service provider has your passwords, they need to give them to the police for them to investigate you thoroughly.
There is yet another point here in the Sept.
B, stating the following.
The obligation of declaring is for everyone except for the person who are your relatives, like your wife or your husband, and whoever complies with Article 416.2.
I may not declare according to professional secrecy.
So let's say I'm an attorney or a lawyer, and I'm the owner of a company, of a uni, SP, or a hosting, and you are my customers.
As your defense lawyer, I may never give the passwords to the police, because professional secrecy comes above and protects you.
That's pretty good.
This is why you need a lawyer that always defends you and defends mainly your interests.
And you may say, well, and how long does this measure last?
In principle it lasts for a month.
These are not wiretaps, or matter-of-fact correspondence, but they may be extended for three months if the judge agrees so.
Another tip, well, may anonymize.
This doesn't mean that you should insult TOR.
TOR has many holes.
If you want to get protection, we're not going to talk about legal things, but if you want to protect yourselves, you need some minimum security measures.
And then you need to cipher or encode.
Then put the post-it on the screen, with your password being 123456, and trust your lawyer.
If you have any sort of situation where you feel at risk, talk to your lawyer, because you... if you think you can trust him or her.
Another remarkable aspect are the cover pre-cops.
This is something that the legislator or the lawmaker has introduced.
It's very American-like.
We've seen it on many TV series, where the police or the policeman wears a dirty jacket and paints his face to look like a drug addict, and all of a sudden he's a cover policeman that is drug trafficking in Miami.
So the figure of the cover agent tries to imitate, in my opinion, the American lawmaker, and he states the following regarding this figure.
That can be used whenever there is organised crime.
By law, this means three or more people that commit crimes.
This is what the jurisprudence and the law of the Supreme Court states.
For the undercover agent to act, he needs to be appointed by a judge.
So the police chief cannot just come and say, hey, the new guy, wear that dirty jacket and get out on the street.
And now you're an undercover agent.
If the measure is urgent, the general attorney should authorise this, and then should give an account to the judge.
The judge needs to give a base resolution.
But this case is not complied with in all cases.
And how long for?
For six months, and then it may be extended to other six months.
Always proportionally and without provoking a crime.
The police cannot upload pedophile files that are very serious in your computer to incriminate you.
That cannot be done, because it really goes against your most fundamental rights as a person.
And I don't think that the state security forces won't do it.
I know quite a few of them within the cyber security crime, and they do a great task.
And then to finish, which are the problems of cyber crime?
First of all, globality.
Secondly, simultaneity.
Third, anonymisation.
Fourth, traceability of money.
Let's say I'm the owner of a botnet in Russia.
How can I get money lost from your account, if you live in Spain, the only given town, such as Elba city, to my account in the Cayman Islands?
There are different ways of doing it.
Bitcoin, payments, MoneyGram, Payselfcard.
Many things that can be used for the person who was the victim not to be linked with the recipient of that botnet, in this case.
There's something that I see in Spain in particular.
I was referring to it in my speech.
The criminal procedural rules we have, on a global level, on a state level, are outdated, and they're not very useful.
For example, letter of derogatory.
If I insult someone on Twitter, Twitter is headquartered in the USA, so if the police want to locate me, they need to request a letter of derogatory.
So, they call here, they send it to the USA, the USA replies, and they send it to the appropriate company, the company says no, some data is missing, that is not a crime, and the information is returned, and more than a year goes by, that whole process.
So, it's not a very agile mechanism, and obviously, there are some crimes, quite a few of them, that go unpunished due to that lack of procedural criminal tools internationally.
So, we eventually thought that those robocops that were going to give us a new criminal regulation were to no avail, they were just playing with toy guns.
And that's it, thank you very much, and I'm happy to answer any of your questions or comments.
Hello, first of all, thank you for the talk.
Thank you very much for your presentation.
I have the following question.
What about activism in the Spanish laws to combat terrorism, such as Anonymous or Daesh?
Well, Spanish law understands that the security forces are the ones who are in charge of combating that.
We had a presentation this morning in that regard, and also the Civil Institute and the Civil Guard, they are the ones with their special units, the ones in charge of combating cyber-terrorism and cyber-crime.
Right now there is no legal mechanism of communication between good people who want to cooperate and give information regarding what they know on the internet forum, whether it's a chat, a forum or a tweet, to report that, because the user who participates in those activism actions will be to blame.
So my recommendation is that if you see that there is a need of communicating that, because it's a serious offence, you can communicate it to the Civil Guard, to the cyber-crime unit, and they'll answer very quickly and they'll probably help you to solve the situation that you may think will endanger the rest of the civil population.
Thank you very much.
You're welcome.
Feel free to ask.
I don't bite.
Hi, how are you?
Hi.
You cannot audit random pages or modify the prices of websites to get a discount that is self-imposed.
You can't do those things and create your own Black Friday.
If a company hires you to audit their security, they need to write you a written contract, they need to give you a written contract, and then you survive by those conditions.
If you don't have their permission, if the company has the appropriate evidence and the appropriate procedure, if you're not anonymous, you could get into a bit of a mess regarding Article 107.1 or Article 264.
If you just installed a nice ransomware, hi, up here, just like locksmiths have a professional ID to have their own door opening tools, IT experts only have a professional ID to use ethical hacking tools and forensic analysis.
So sometimes when we collaborate with the police, they may request things and the tools that we need to use are not within the legal framework.
How can we protect ourselves and not get into trouble?
For example, having a fake note in your report represents a crime.
But if when the judge comes out you need an expert's report, having that report represents another crime.
So how can professionals act within the law to help the law?
What I was saying earlier to the colleague who made the question went in the same direction.
How can we collaborate with the police without being arrested?
Because we went beyond our curiosity with our IT security friends and now they are curious by default.
So if you want to go beyond what happens here, you do that and you are not authorised, you could be in trouble, you could get in trouble.
That's what the law says.
And that's all I can say actually.
If you want to venture and do it, you venture and do it.
But are you exposed?
Yes, you may be exposed.
And nowadays, since there is no specific regulation, there is no set way for collaboration with the law, there is no hacker's ID.
And some of you may know other types of regions where there are representatives who create the hacker's card so that whoever is authorised may collaborate.
I understand that the IT experts may not agree with that position because it's quite limiting.
And there is a sector dealing with IT security that would be excluded if they don't have the hacker's ID.
However, if you know about a criminal fact, you make it known to the law.
You cannot do, I guess, if you are a criminal yourself, you wouldn't notify people about it because you are incriminating yourself.
But then putting it into a forensic analysis or contributing and giving information about it, I don't know.
In that report, I would state the landmarks or the milestones that they could have.
I would give that to the Civil Guard or the National Police or the Cybercrime Brigade so they can investigate the case and go deeper in it because that's their task.
Nothing is not the reply or the answer you are looking for, but it's the one I should give you according to my experience.
Yes.
Besides getting in trouble if you are at home with your staff and you do a Black Friday with quote marks, I actually read that if you have a simple tutorial video about how to boss the WordPress with any tool...
Is that educational?
Yes.
A simple, pretty, colourful video on your own virtual machine, but it really bossed the WordPress.
Your own WordPress?
No, another one.
Your video bossed the Presa Group.
That could get you in trouble?
No.
I don't think so.
We should argue that.
But my opinion is just my own opinion.
Other colleagues may disagree and other people may know more about this and may say that I may be included in the criminal code.
I don't think so.
You could teach people about shooting in a shooting field, like pigeon shooting, but showing people how to point with a rifle is not the same thing as shooting people with a machine gun.
It's a rough example, but, you know, I think we get the message.
OK.
Hi, good afternoon.
Hello.
Can I audit my domain's website since this is not a hosting provider where I detect vulnerabilities of the actual hosting service and that's from an American company?
Well, if you audit your own website, you can do it locally perfectly fine.
However, you couldn't dose Amazon services because that's hosted there or OVH because the domain is placed there for hosting or for any other hosting provider that is commonly used on a daily basis.
If the audit gets out of hand, maybe the admin will be a bit angry and realize that there is some traceability between your IP.
I understand that not many people will audit a system with their own IP in their case, but if they do and it gets out of hand, there will be a log linking the attack experienced by that server and that service provider with you.
And if the admin wants to get into a fight and the company owner wants to do so too, you could get in trouble.
But you could audit your own website at any time.
You get it in local and you do it.
And I think that's the most reasonable way of doing it.
Well, thank you very much everyone.