CASES AND ISSUES IN ICT .

Cyber Grooming is when a person builds an online relationship

with a young person and tricks or pressures him/ her into doing
Modern life has been transformed by computers, mobile a sexual act.
phones, and the internet. They give us with numerous
advantages. Online Job Fraud is an attempt to defraud people who are in
need of employment by giving them false hope/ promise of
Information technology, on the other hand, puts us vulnerable better employment with higher wages.
to a variety of hazards. These dangers may result in financial
losses or reputational damage. Online Sextortion occurs when someone threatens to distribute
private and sensitive material using an electronic medium if he/
Cybercriminals can gain access to our digital lives through a she doesn’t provide images of a sexual nature, sexual favors, or
little breach in our digital life management. As a result, money.
understanding how to protect ourselves from cybercrime is
critical. Phishing is a type of fraud that involves stealing personal
information such as Customer ID, IPIN, Credit/Debit Card
Cybercrime is a crime or unlawful act committed through the number, Card expiry date, CVV number, etc. through emails that
use of computers and networks. It's possible that the computer appear to be from a legitimate source.
was utilized in the commission of a crime or that it was the
intended target. Vishing is an attempt where fraudsters try to seek personal
information like Customer ID, Net Banking password, ATM PIN,
The majority of cybercrime goes into one of two categories: OTP, Card expiry date, CVV etc. through a phone call.
o Computer-related criminal conduct
o Computer-assisted criminal conduct. Smishing is a type of fraud that uses mobile phone text
messages to lure victims into calling back on a fraudulent phone
• Malware, such as viruses, are frequently used in cybercrime number, visiting fraudulent websites or downloading malicious
that targets computers. content via phone or web.
• Cybercrime that involves the use of computers to commit
other crimes can include spreading malware, illicit Sexting is an act of sending sexually explicit digital images,
information, or illegal photos. (computer related) videos, text messages, or emails, usually by cell phone.
• Cybercriminals exploit communication technology to steal SIM Swap Scam occurs when fraudsters manage to get a new
financial information and perpetrate identity theft. (computer SIM card issued against a registered mobile number fraudulently
assisted) through the mobile service provider. With the help of this new
SIM card, they get One Time Password (OTP) and alerts,
Cybercrime often includes the following
required for making financial transactions through the victim’s
• illegal spyware on people's computers without
bank account. Getting a new SIM card against a registered
their consent,
mobile number fraudulently is known as SIM Swap.
• exploitation of security vulnerabilities on online
merchants' websites to steal customers’ bank and Credit card or debit card fraud involves the unauthorized use
credit card details of another’s credit or debit card information for the purpose of
• sending out of phishing emails, which direct purchases or withdrawing funds from it.
customers to a bogus website, such as a fake
banking website, Impersonation and identity theft is an act of fraudulently or
• viruses and worms causing computers to dishonestly making use of the electronic signature, password or
malfunction, and any other unique identification feature of any other person.
• hackers sometimes use unwitting people's
Spamming occurs when someone receives an unsolicited
computers to generate spam email
commercial message sent via email, SMS, MMS and any other
Firewalls are used to protect against unauthorized access, similar electronic messaging media.
along with software to halt viruses and spyware, help to deter
Ransomware is a type of computer malware that encrypts the
online.
files, storage media on communication devices like desktops,
Examples of Cybercrimes Laptops, Mobile phones etc., holding data/information as a
hostage. The victim is asked to pay the demanded ransom to
Child sexually abusive material (CSAM) refers to a material get his device decrypts
containing sexual images in any form, of a child who is abused
or sexually exploited. Computer virus is a program written to enter your computer
and damage/alter your files/data and replicate itself.
Cyberbullying is a form of harassment or bullying inflicted
through the use of electronic or communication devices such as Worms are malicious programs that make copies of themselves
computers, mobile phones, laptops, etc. again and again on the local drive, network shares, etc.

Cyberstalking is the use of electronic communication by a Trojan horse is not a virus. It is a destructive program that looks
person to follow a person or attempts to contact a person to like a genuine application. It gives malicious users/programs
foster personal interaction repeatedly despite a clear indication access to your system, allowing confidential and personal
of disinterest by such person; or monitors the internet, email or information to be theft.
any other form of electronic communication commits the offence
of stalking.
Worms, Virus, and Trojan Horse are threats for electronic 3. Data Interference - Unauthorized alteration, damaging,
payment system. deletion or deterioration of computer data, electronic document,
or electronic data message, and including the introduction or
transmission of viruses.
Data breach is an incident in which information is accessed 4. System Interference - Unauthorized hindering or
without authorization. 18. Denial of Services (DoS) attack interference with the functioning of a computer or computer
network by inputting, transmitting, damaging, deleting,
Denial of Services (DoS) attack is an attack intended for
deteriorating, altering or suppressing computer data or program,
denying access to computer resources without the permission
electronic document, or electronic data messages, and including
of the owner or any other person who is in charge of a computer,
the introduction or transmission of viruses.
computer system or computer network.
5. Misuse of Device - The unauthorized use, possession,
Website Defacement is an attack intended to change the visual
production, sale, procurement, importation, distribution, or
appearance of a website and/ or make it dysfunctional. The
otherwise making available, of devices, computer program
attacker may post indecent, hostile and obscene images,
designed or adapted for the purpose of committing any of the
messages, videos, etc.
offenses stated in Republic Act 10175.
Cyber-Squatting is an act of registering, trafficking in or using
6. Cyber-squatting - Acquisition of domain name over the
a domain name with an intent to profit from the goodwill of a
Internet in bad faith to profit, mislead, destroy reputation, and
trademark belonging to someone else.
deprive others from the registering the same.
Pharming is a cyber-attack aiming to redirect a website’s traffic
7. Computer-related Forgery - Unauthorized input, alteration,
to another, bogus website.
or deletion of computer data resulting to inauthentic data with
Cryptojacking is the unauthorized use of computing resources the intent that it be considered or acted upon for legal purposes
to mine cryptocurrencies. as if it were authentic, regardless whether the data is directly
readable and intelligible.
Online Drug Trafficking is a crime of selling, transporting, or
illegally importing unlawful controlled substances, such as 8. Computer-related Fraud - Unauthorized input, alteration, or
heroin, cocaine, marijuana, or other illegal drugs using electronic deletion of computer data or program or interference in the
means. functioning of a computer system, causing damage thereby with
fraudulent intent.
Espionage is the act or practice of obtaining data and
information without the permission and knowledge of the owner. 9. Computer-related Identity Theft - Unauthorized acquisition,
use, misuse, transfer, possession, alteration or deletion of
CYBERCRIME LAWS IN THE PHILIPPINES identifying information belonging to another, whether natural or
juridical.
The country has passed several laws to regulate e-commerce
and other online activities. 10. Cybersex - Willful engagement, maintenance, control, or
operation, directly or indirectly, of any lascivious exhibition of
Republic Act 8484 or the Access Devices Regulation Act of
sexual organs or sexual activity, with the aid of a computer
1998
system, for favor or consideration
• An act regulating the issuance and use of access devices,
prohibiting fraudulent acts committed relative thereto, 11. Child Pornography - Unlawful or prohibited acts defined
providing penalties and for other purposes and punishable by Republic Act No. 9775 or the Anti-Child
Pornography Act of 2009, committed through a computer
Republic Act 8792 or the Electronic Commerce Act of 2000 system.
• An Act Providing For The Recognition And Use of Electronic
Commercial And Non-Commercial Transactions, Penalties 12. Libel - A published false statement that is damaging to a
For Unlawful Use Thereof, And Other Purposes, also known person's reputation; a written defamation.
as the "Electronic Commerce Act."
13. Aiding or Abetting in the commission of cybercrime -
Any person who willfully abets or aids in the commission of any
Republic Act 10175 or The Cybercrime Prevention Act Of
of the offenses enumerated in this Act shall be held liable
2012.
• An Act Defining Cybercrime, Providing for The Prevention, 14. Attempt in the commission of cybercrime - Any person
Investigation, Suppression and The Imposition of Penalties who willfully attempts to commit any of the offenses enumerated
Therefor and For Other Purposes. in this Act shall be held liable.

TYPES OF CYBERCRIME (R.A. 10175) ETHICS, PRIVACY, AND INFORMATION SECURITY .

1. Illegal access - Unauthorized access (without right) to a Ethics

computer system or application. • a branch of philosophy that deals with what isconsidered to
be right and wrong.
2. Illegal interception - Unauthorized interception of any non- • refers to the principles of right and wrong that individuals
public transmission of computer data to, from, or within a use make choices that guide their behavior.
computer system
Code of Ethics
• a collection of principles intended as a guide for members Misinformation has a tendency of messing up people's lives,
of a company or organization. especially when the party disseminating the false information
• a collection of principles that are intended to guide decision has a power and authority advantage.
making by members of an organization.
3. Property: Who owns information? What are the just and fair
Fundamental Tenets of Ethics prices for its exchange? Who owns the channels, especially the
airways, through which information is transmitted? How should
Fundamental tenets of ethics include responsibility, access to this scarce resource be allocated?
accountability, and liability.
• Responsibility - means that you accept the The topic of intellectual property rights is one of the most
consequences of your decisions and actions. complicated concerns we confront as a society. These rights are
• Accountability - means a determination of who is surrounded by significant economic and ethical problems, which
responsible for actions that were taken. revolve around the unique characteristics of information and the
• Liability - a legal concept meaning that individuals ways by which it is delivered. In the beginning, producing a
have the right to recover the damages done to them by single piece of data can be too expensive.
other individuals, organizations, or systems.
4. Accessibility: What information does a person or an
organization have a right or a privilege to obtain, under what
Four Ethical Issues of the Information Age by Richard O.
conditions and with what safeguards?
Mason
Literacy is our primary source of information. From the invention
Our period is an information age, and our civilization is truly an
of paper to the modern computer, each advancement in
information society. In this information age, we face a variety of
information management has placed new demands on literacy.
distinct issues. They come from the very nature of information.
To be literate in an information society, a citizen must have at
Information
least three skills:
• the way by which the mind expands and increases its - To deal with knowledge, one must have the necessary
potential to attain its objectives, frequently as a result of
intellectual abilities.
input from another mind.
• it serves as the intellectual capital upon which humans build • Reading, writing, reasoning, and calculating are
their lives and maintain their dignity. examples of these abilities. This is an educational task
The development of intellectual capital, on the other hand, is - Access to information technologies that store, transmit, and
vulnerable in a variety of ways. These dangers to human dignity process data is required.
must be addressed in the digital age's social compact.
• Libraries, radios, televisions, telephones, and,
The 4 ethical problems summarized by means of an increasingly, personal computers or terminals
acronym -- PAPA: connected to mainframes via networks are all
examples of this. This is a problem in social economics.
1. Privacy: What information about one's self or one's
associations must a person reveal to others, under what - One must have physical access to the data. This necessity
conditions and with what safeguards? What things can people harkens back to the issue of property, and it's also a social
keep to themselves and not be forced to reveal to others? economics issue.
Many consider privacy to be the most important area in which These literacy requirements are a function of the individual's
their interests need to be safeguard. Privacy has long been knowledge level as well as his or her economic status.
considered “the right to be left alone”. It has been defined in Unfortunately, both of these levels are currently decreasing for
terms of individuals’ ability to personally control information many individuals around the world. In modern organizations and
about themselves. society, they are major forces acting for and against
contemporary literacy.
Our privacy is under assault from two forces.
UNETHICAL VS ILLEGAL
• The advancement of information technology, which has
increased surveillance, communication, processing, 'Unethical' refers to something that is morally incorrect.
storage, and retrieval capabilities. 'Illegal' refers to something that is against the law.
• The rising usefulness of information in decision-making, a
more subtle threat. • Unethical is not necessarily illegal.
• The law is the deciding factor in an illegal act.
2. Accuracy: Who is responsible for the authenticity, fidelity and
• When it comes to unethical behavior, the man's own
accuracy of information? Similarly, who is to be held
conscience is the decisive factor.
accountable for errors in information and how is the injured party
• Although an unethical act is against morality, it is not
to be made whole?
against the law.
The accuracy or the correctness of information assumes real • An illegal conduct is always unethical, but an unethical
importance for society as computers come to dominate in action can be legal or not.
corporate record-keeping activities
Some more examples of unethical practices are deliberate retrieval, consultation, use, consolidation, blocking, erasure, or
deception, violation of conscience, and failure to honor destruction of data.
commitments.
“Personal information controller” is an individual or institution, or
Some examples of illegal practices are discrimination or any other body who controls the processing of personal data, or
harassment, theft, unfair employee treatment, and unjust health instructs another to process personal data on its behalf.
and safety protocols.
Data subject refers to an individual whose personal information
PRIVACY is processed.

• In Philippine law, the concept of privacy is enshrined in the KEY RIGHTS THAT SUMMARIZE THE DATA PRIVACY ACT
Constitution and is regarded as the right to be free from FOR THE PHILIPPINES
unwarranted exploitation of one’s person or from intrusion
into one’s private activities in such a way as to cause 1. The Right to be Informed
humiliation to a person’s ordinary sensibilities (Hing v. • The foundation for the Data Privacy law is consent.
Choachuy, 2013). Which means the willingness of data subjects to hand
• It has been described as the most comprehensive of rights over their data. Data can be accessed and used by
and the right most valued by civilized men (Morfe v. Mutuc, marketers so long as users give their permission to do
1968). so.
2. The Right to Object
Republic Act 10173 or Data Privacy Act of 2012 • At the opposite end of consent is the right of any person
to object to the collection and processing of their
• It is a law that seeks to protect all forms of information, be it personal data. While agreeing to the terms of use may
private, personal, or sensitive. It is meant to cover both be mandatory to use a service, data subjects have the
natural and juridical. It is an act protecting individual right to refuse to accept the terms at anytime.
personal information in information and communications 3. The Right to Access and Data Portability
systems in the government and the private sector, creating • Once someone has given you their consent to use their
for this purpose a national privacy commission, and for personal data, they also have the right to access it.
other purposes. These data subjects must have reasonable access to
• It was passed in accordance with the Philippines the data they have given. Access should be easy as
agreements under ASEAN Vision 2020 and at the urging of well as “data portable” meaning their personal data can
the growing business process outsourcing industry. The law be electronically stored and copied at anytime.
was modeled after the Data Protection Directive (95/46/EC) 4. The Right to Rectify
with many of its terminologies and provisions similar to • Access to their collected personal data entitles the data
privacy laws in other jurisdictions. subject to correct any mistakes or misrepresentation.
5. The Right to Erasure or Blocking
The National Privacy Commission (NPC) is in charge of
administering and implementing the DPA. It is also tasked to • Consent means permission but data subjects also have
monitor and ensure compliance of the Philippines with the right to withdraw their consent at anytime. This can
international standards for personal data protection. be addressed through unsubscription to email services
for example, or by directly emailing the company’s Data
The major functions of the NPC are as follows: Protection Officer.
6. The Right to Damages and to file a Complaint with the
• Rule making NPC
• Advisory. The NPC is the advisory body on matters related • At the extreme end of the spectrum, if damages are
to personal data protection. done to the data subject, he has the right to file for
• Public education. The NPC shall launch initiatives to damages as well as escalate matters with the National
educate the public about data privacy, data protection and Privacy Commission.
fair information rights and responsibilities.
• Compliance and monitoring. The body has compliance THREATS TO SECURITY AND PRIVACY
and monitoring functions to ensure personal information
controllers comply with the law. It is also tasked to manage Undetected intrusions on our privacy
the registration of personal data processing systems. • Identity thieves, hackers, unethical marketers, and other
• Complaints and investigations. nefarious actors usually attack in one of several ways.
• Enforcement. • One of the most effective methods to arm and protect
ourselves against these attacks is to become familiar with
Personal information refers to any information whether recorded these forms.
in a material form or not, from which the identity of an individual Data
is apparent or can be reasonably and directly ascertained by the • Data is valuable, which is one of the main reasons why your
entity holding the information, or when put together with other online privacy is at risk.
information would directly and certainly identify an individual.
• A hacker has struck gold if they can gain illegal access to
Personal data refers to all types of personal information. an airline's reservation system or an e-commerce site's
customer database.
Processing is any operation/s performed upon personal data. • Any information you post on the internet could be misused.
These operations include, but are not limited to the collection, As a result, you must exercise caution when it comes to
recording, organization, storage, updating or modification, your online privacy.
Digital data
• Transactional data, location data, electronic medical PROTECTING PRIVACY
records, e-commerce data, insurance data, images and Privacy policies or privacy codes
videos, thoughts and views, and other types of personal • The instructions for protecting the privacy of an
data are all examples of digital data. organization's customers, clients, and workers
• All of these data pieces are personal and sensitive • Senior management in many companies has realized
information that should not be shared without the data that when they collect large volumes of personal data,
owner's permission. they must secure it. Furthermore, many businesses
give their customers a say in how their information is
Privacy breaches can occur at several phases of data utilized by providing either opt-out or opt-in options.
processing (Ram, Murali, & Kumar, 2021).
Opt-in
Data breach • Opting-in means a user, acknowledging interest in a
• This can an happen at any point along the data product or service and authorizing a third party to contact
processing process, with different types of employees them with further information.
operating at different levels. • Subscribing to email and newsletter mailing lists, permitting
• Top-level management should ensure that no data cookie use, and consenting to legal terms are all examples
breaches occur at any point, necessitating the of circumstances when opting in is appropriate.
establishment of a policy and an ethical code of • When a user registers for an account, they have the
behavior for all firm personnel. opportunity to opt in to receiving emails as well as to agree
• Policies alone, however, are insufficient; a regulating to the terms of use and privacy policy. When users first
agency is required to ensure that the policies are arrive on this page, both boxes are unchecked, allowing
followed. them to take direct action to indicate their preferences.
• Individuals are also contributing to data leakage • It’s not only your privacy policy that you should ask users to
through irresponsible usage of social media and mobile opt in to. After you create terms and conditions, you should
devices. also host these on a banner or form, and request user
consent to agreement.
Threats to data security and privacy:
Data aggregators, digital dossiers, and profiling Opt-out
• Data aggregators companies that collect public • The opt-out model of informed consent allows the company
data (e.g., real estate records, telephone to collect personal information until the client expressly
numbers) and nonpublic data (e.g., social security requests that it be removed.
numbers, financial data, police records, motor • Opting out means a user takes action to withdraw their
vehicle records) and integrate them to produce consent.
digital dossiers.
• Digital dossier is an electronic description of you There are two main ways to offer opt-outs to users.
and your habits. 1. Unchecking boxes
• Profiling is the process of creating a digital dossier. • The user then has the opportunity to opt out,
Electronic Surveillance meaning they uncheck the boxes in order to
• The tracking of people ‘s activities, online or withdraw their consent.
offline, with the aid of computers. 2. Consent withdrawal
• Many people are blissfully unaware that they can • When you offer users a way to withdraw their
be under electronic surveillance while they are permission or change their preferences after the
using their computers. original point of consent.
Personal Information • The company notifies users that they may opt out
• information about individuals is being kept in many of receiving future marketing contact by directing
databases like banks, utility companies, them to a preference manager via the opt-out link.
government agencies, and the most visible
locations are credit-reporting agencies. “unsubscribe” link - more common method of opt out
Information on Internet Bulletin Boards, Newsgroups, o Unsubscribe links are often contained in the footer of
an email.
and Social Networking Sites
o They direct users to a page or form that allows them to
• Social Networking Sites often include electronic
opt out of receiving further outreach from the company.
discussions such as chat rooms. These sites
appear on the Internet, within corporate intranets, INFORMATION SECURITY
and on blogs. Key Information Security Terms
• A blog (Weblog) is an informal, personal journal • Threat is any danger to which a
that is frequently updated and intended for general system/information resource may be exposed.
public reading. • Exposure is the harm, loss or damage that can
• Social networking sites can cause you problems. result if a threat compromises an information
Anyone can post derogatory information about you resource.
anonymously. You can also hurt yourself. The best • Vulnerability is the possibility that the
thing to do is be careful what information you post system/information resource will suffer harm by a
on social networking sites. threat.
 • Risk is the likelihood that a threat will occur. o gathering techniques. Espionage crosses the legal
• Information system controls ere the procedures, boundary.
devices, or software aimed at preventing a o Information extortion
compromise to a system. o Sabotage or vandalism
o Theft of equipment or information
Factors Increasing the Threats to Information Security ▪ For example, dumpster diving
• Today’s interconnected, interdependent, o Compromises to intellectual property
wirelessly- networked business environment ▪ Intellectual property. Property created by individuals or
• Government legislation Smaller, faster, cheaper corporations which is protected under trade secret, patent,
computers and storage devices and copyright laws.
• Decreasing skills necessary to be a computer • Trade secret. Intellectual work, such as a business plan,
hacker. that is a company secret and is not based on public
• International organized crime turning to information.
cybercrime • Patent. Document that grants the holder exclusive rights
• Downstream liability on an invention or process for 20 years.
• Copyright. Statutory grant that provides creators of
• Increased employee use of unmanaged devices
intellectual property with ownership of the property for life of
• Lack of management support
the creator plus 70 years.
▪ Piracy. Copying a software program without making
CATEGORIES OF THREATS TO INFORMATION SYSTEMS
payment to the owner.
o Software Attacks
- Unintentional acts
▪ Virus, Worm, Trojan horse, and Logic Bomb
▪ Human errors
▪ Phishing attacks
- Tailgating
▪ Distributed denial-of-service attacks
• To deter tailgating, many companies have anti-
o Alien Software
tailgating doors protecting the entrance into high-
▪ Spyware
security areas. Note that only one person at a time
▪ Spamware
can go through this door.
▪ Cookies
- Shoulder surfing
o Supervisory control and data acquisition (SCADA)
• Shoulder surfing occurs when the attacker
attacks
watches another person’s computer screen over
that person’s shoulder. Particularly dangerous in
public areas such as airports, commuter trains,
and on airplanes.
- Carelessness with laptops and portable computing
devices
• Opening questionable sites
• Careless Internet surfing
▪ Poor password selection and use
▪ Deviations in quality of service-by-service providers
(e.g., utilities)
▪ Environmental hazards (e.g., dirt, dust, humidity)
• We should note that the biggest threat to the security of an
organization’s information assets are the company’s
employees.
• In fact, the most dangerous employees are those in human
resources and IT. HR employees have access to sensitive
personal data on all employees. IT employees not only have
access to sensitive personal data, but control the means to
create, store, transmit, and modify these data.

Social Engineering is an attack where the attacker uses social

skills to trick a legitimate employee into providing confidential
company information such as passwords. Social engineering is
a typically unintentional human error on the part of an employee,
but it is the result of a deliberate action on the part of an attacker.

- Natural disasters
- Technical failures
- Management failures
- Deliberate acts (Whitman and Mattord, 2003)
o Espionage or trespass is the competitive intelligence
consists of legal information-