The role of Kenyan Legal Professionals in Cybersecurity 0 578

  • Over 26.7 million Kenyans are currently online and engaging in digital transactions daily.
  • According to UN Research, at least one out of ten mobile money transactions in the World occur in Kenya.
  • These statistics make Kenya a prime target for cybercriminals who, according to the National Cybersecurity Strategy, published by the Ministry of ICT, have continued to evolve in terms of the complexity and severity of their attacks.
  • Unfortunately, Kenya shows a staggering lack of awareness and investment in cybersecurity solutions wit around 96% of all organisations investing less than $5000 in cybersecurity.
Kenya cybercriminal activity

According to the words of the Honorable Warren E. Burger, lawyers and judges remain necessary to society, so long as it is a place where men and women are gathered, as they must fulfil the noble role of healing conflict and providing reason as a lubricant to the rigours of the socio-economic engine which ought to drive the development of any civilisation.

Moreover, it is the role of the legal minds of society to act as sentinels, standing guard against man’s threat unto himself, his own inclination towards self-enrichment at the detriment of the common good in its entirety.

As such, society gives the highest of legal minds the power to influence, pass or ratify policies, to ensure their safety and continuity against the overwhelming urges of vices, human wickedness and in certain cases, natural catastrophes.

The legal minds of Kenya can thus be termed as, not only stewards of conflict resolution,but also as sentinels, who wield the power of policy-making to safeguard the development and evolution of the socio-economic organs of the nation-state whose well-being remains pivotal to Her survival.

Kenya is facing an exponential increase in cybercriminal activity

The digital wave has hit Kenya, and its effect upon our economy has been immensely positive. With the development of innovative products such as Safaricom’s M-Pesa money transfer service, as well as iCow, a farming digital product that has optimized dairy farmers’ productivity, the consumer market has developed an appetite for sound, data-centric solutions in order to enhance the various socio-economic activities present within Kenya.

The effect of digitisation in our economy has been significant. Since the advent of M-PESA, more than 73.1% of Kenyans are now formally banked.

In addition, according to the Quarterly Statistics Report for the Financial Year of 2016 (April-June 2016), mobile data/ internet subscriptions stood at 26.7 million during the quarter marking an increase of 8.3 per cent from 24.7 million subscriptions posted in the preceding quarter. The number has grown remarkably by 35.0 per cent from the same period of the previous year.

This essentially means that over 26.7 million Kenyans are currently online and engaging in digital transactions daily.

Kenya also boasts the largest mobile money transaction service in the World. According to UN Research, at least one out of ten mobile money transactions in the World occur in Kenya.

These statistics make Kenya a prime target for cybercriminals who, according to the National Cybersecurity Strategy, published by the Ministry of ICT, have continued to evolve in terms of the complexity and severity of their attacks.

The evolution of cyber threats between 2006 and 2012 are an iconic example. These threats include; Advanced Persistent Threats, Botnet Threats, Converged Threats, Cyberterrorism and Next Generation DoS (inclusive of DDoS).

The socio-economic impact of cybercrime in Kenya has been immense. According to a Serianu Cybersecurity Report, Kenya’s losses as at 2016, stood at a whopping $185m, a sharp increase from the estimated $100m lost in the previous year.

Notably, when cybercriminals face justice, only about 2% of prosecutions are successful. This can be attributed to the lack of proper regulation regarding data protection and cybersecurity, and the lack of appropriate measures to collect sufficient evidence to enable criminal prosecution.

The Legal Profession and the unique risks posed to them by cybercriminals

 

Kenya cybercriminal activity

Numerous professions in Kenya are facing digitisation as well. The legal industry has not been an exception. With the incorporation of modern filing systems, the use of e-mails and digital devices such as mobile handsets and laptops within law firms and legal offices, sensitive client data is being transacted and stored at a digital level across various platforms in various forms. Cybercriminals are aware of this and can exploit the gaps present in various ways.

A staggering lack of awareness and investment in cybersecurity solutions

Notably, around 96% of all organisations in Kenya invest less than $5000 in cybersecurity. A significant percentage of these sampled organisations consist of law firms, financial institutions, NGOs and governmental bodies where legal and compliance advisors safeguard the agenda of their respective institutions.

Around 96% of all organisations in Kenya invest less than $5000 in cybersecurity Click to Tweet

This highlights how low a priority cybersecurity is for institutions who are the custodians of sensitive data which can be compromised for profit by cybercriminals.

Man-in-the Middle Attacks

Legal practitioners often handle particularly sensitive internal or external, i.e. client information to carry out their mandate. An ideal example would be where numerous clients correspond with their hired advocates via e-mail, transacting confidential documents and data over the Internet with the faith that those communication channels are encrypted or secure. This makes law firms particularly prime for man-in-the-middle attacks.

A man-in-the-middle occurs where the attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other.

An example would be where files were intercepted over the network, and redirected to hostile parties, who then changed the details of those files and dropped them back into the firm’s filing system.

The entire scam could go on for months, until all the data is collected and collated by the criminals, and subsequently utilised in a terrible heist of client funds.

Various rights of the client had been substantially breached, such as their constitutional right to privacy and, if the law firm had no cybersecurity measures in place, a valid claim under the tort of negligence, as the advocate in question had failed to fulfil an essential duty of care in protecting the client’s information.

The loss of a client’s data integrity

The loss of a client’s data integrity remains one of the largest risks for any legal enterprise. This is due to its resultant effect which is a substantial erosion of trust and an adverse breach of the client confidentiality relationship which is part and parcel of the legal profession.

Data leaks can lead to truly disastrous results for any legal practice once their clients’ data is made public by hackers, regardless of their motivation. A prime example could be the occurrence of the Panama Papers leak in 2015.

The Panama Papers are 11.5 million leaked documents that detail financial and attorney–client information for more than 214,488 offshore entities. The documents, which belonged to the Panamanian law firm and corporate service provider Mossack Fonseca, were leaked in 2015 by an anonymous source, some dating back to the 1970s.

The leaked documents contain personal financial information about wealthy individuals and public officials that had previously been kept private.

While offshore business entities are legal, reporters found that some of the Mossack Fonseca shell corporations were used for illegal purposes, including fraud, tax evasion, and evading international sanctions.

The damage to the reputation of the legal enterprise was immeasurable and to date, their clients’ data remains available for scrutiny for members of the Press and the public.

Ransomware

Cybercriminals are also targeting legal enterprises because of the urgency of the data required. Law firms require constant updates of their: research material regarding continuing court cases, recordings of proceedings, updated legal documents and documentary evidence.

Moreover, legal enterprises must be able to quickly retrieve, edit, update and restore their work files within those particular systems. This makes them prime targets for malicious attacks which lock users out of their various digital filing and retrieval systems.

A prime example of this would be the deployment of ransomware within a law firm’s IT environment. Ransomware, as the name suggests, demands the payment of ransom in Bitcoin, upon encryption of computer files within a system.

Other variations of ransomware, known as lock-screen ransomware lock out users from accessing the computer system and demand payment in Bitcoin to unlock and gain access.

Conclusion

A joint awareness campaign

In collaboration with numerous law firms in Kenya, ESET East Africa is engaging with certain legal practitioners based in Kenya’s digital market to raise awareness regarding the numerous risks present for their enterprises as well as the nation with the advent and growth of cybercrime within Kenya.

This will be done through joint events, programs and training sessions to sensitize legal enterprises about their issues.

Policy recommendations

As a driver of thought leadership across the globe, the ESET brand is honoured to collaborate with the lawyers and cybersecurity specialists in suggesting cybersecurity policies designed to safeguard the Kenyan populace from the evolved threat of cybercrime within Kenya.

Previous ArticleNext Article

Mobile World Congress: Introducing 5G 0 358

Year after year Mobile World Congress (MWC) takes place in Barcelona, Spain. It is an event that brings together almost every vendor related to the mobile industry to show off their shiny new gadgets, apps and services in our ever-increasingly-connected world.

One of the hot topics surrounding this world at MWC 2018 was 5G — the next generation of mobile connectivity.

What is 5G and how will it affect us?

If we look back at previous incarnations of mobile networks, 1G, 2G and so on, there have been major changes to the technology. The next generation, 5G, delivers greater speed and lower latency, but also has the advantage of being able to connect many more devices concurrently. This is one of the reasons why MWC has gone from being just a show promoting smartphone manufacturers and operators to a gathering of companies showing off connected world devices that could benefit from being connected to a 5G network.

The reality is that none of the existing technologies will disappear anytime soon, in fact the speed that can be achieved on the existing network are up to 1.2Gbps. So, asking the sales representatives in a phone shop about a new 5G handset will probably have them wondering what you’re talking about.

The existing infrastructure for 4G relies on cell towers/masts, typically with reasonable distances between them, whereas 5G is based on smaller, more frequent cells. The smaller cells help deliver the additional bandwidth and lower latency as the network becomes more distributed. The speeds are reportedly able to deliver 20Gbps with just 1ms latency.

Any new networks require licenses, funding and significant effort to introduce them. In the US, AT&T claims it will be the first company with a 5G network, that will cover 12 cities by the end of 2018 and aimed at the mobile phone market. Verizon is taking a different approach and intends on implementing 5G to compete with existing home internet service providers, and with the speed and capacity available on a 5G network this could be a very competitive offering.

Many exhibition halls at MWC had devices designed for the smart city, driverless cars, smart bandages that track your healing, through to virtual reality gaming.

While faster speed is a result of the improved technologies, it is the low latency and capacity that will enable these technologies to deliver a world where just about everything could be connected. The need for capacity is compounded once the connected devices start talking to each other. For example, the future driverless car may be able to communicate with other cars, traffic monitoring, or sensors on the roads and take actions based on the environment around it.

While some 5G smartphone handsets may start to appear on shelves in 2018, we should expect the main vendors to start offering them in 2019.

The rollout of 5G is moving quicker in some regions than others, as already discussed, carriers in the US see competitive advantage and have already announced their plans. Other countries that have openly stated their commitment to early adoption of 5G are China, Japan, South Korea, Australia and Norway, and I am sure this list will grow. In Europe, commitment from both regulators and financiers for the new networks is slower. This could be seen as a competitive disadvantage, or you could view this as sensibly waiting to allow others to experience the difficulties of early adopter first.

As with any new technology there are security considerations. Providers of services will need to combat the expected evolution of advanced malware that will accompany the new 5G infrastructure and implement threat prevention services and solutions that deliver security through layers, including machine learning, to deal with the increased network performance and capacity. Threat intelligence and pro-active security measures are essential components for any device or service being developed to utilize 5G, secure by design.

It is important to remember that understanding the psychology and mindset of the cybercriminal is also important, and for this, deep research by experts in the security field will help the industry predict where the attackers may see the next opportunity. So, while 5G will move us quicker, the benefit of added speed will have a cost and means that for the time being the human component in maintaining safer technology remains crucial.

Smart, Smarter… Dumbest… 0 325

Technological evolution: who hasn’t heard of this yet? It brings happiness into our lives, more convenience and less cumbersome usage, more and more possibilities for the user… Why make life (more) difficult when it can be made so (much more) convenient?

Just look at a communication device that you cannot ignore anymore, even if you wanted to: the smart phone. For the younger generation, it’s as if a cybernetic system is prosthetically attached to their arms; resisting it is futile! And they want their phones to become smarter and smarter, taking over more and more functions of their daily lives.

Now this is, of course, heaven for manufacturers: they can all battle to find new unique money-making features to add… or to make one that already exists much better. Likewise for the developers of dedicated apps (think, for example mobile banking). Innovation to make our daily lives “easier and easier”, basically a one-click life.

With the technology evolving at an ever faster pace, and an increasing focus on being the first to have the latest selling point, thoughts of security tend to be secondary, at best. This creates more possibilities for hackers, those that want to steal information, eavesdrop, etc. As these new features are introduced more and more often, and with more and more haste, in the smarter phones, so the probability of zero-day exploits becomes higher.

It seems that with the speed of technological evolution, the “urge” of people to use new features as soon as possible – even though they may not even exist right now and while these tasks can already be done in ‘the old way’ – is unstoppable. And at the same time we complain about data leakage, data loss, lack of privacy and insecure operating systems.

Maybe it is time to press pause and make it all secure, or more secure, dial back on the technological potential technological possibilities – making devices more controllable. There is definitely a demand for that, too. Just last week the Dutch Government announced that officials must switch to dumb(er) phones, deliberately equipped with low-tech specifications, making it harder for hackers to intercept them. The new phones only can be used for calls or SMS; they lack the ability to install apps or connect to the internet (I still remember those (brick) phones from the late 90’s!). While the prime-minister and some ministers already use such a device, others will have to “abandon” their current mobile phones when travelling to specific countries or regions and will be issued with such a low-tech phone and urged to leave their regular phone at home. This should make communication secure, or at least less insecure’, since the replacement mobile phone has been prepared, checked and certified by the Dutch Secret Service. A great step back, getting rid of security by obscurity, and prioritizing safety over features.

The example of the Dutch Government is not an isolated incident, it seems to become a trend. Earlier this year, the White House banned personal cell phones from the West Wing, citing security concerns. Staff will be able to continue to carry out their business on government-issued devices.

But of course it is not only the device that needs to be more secure. You, the user of the device, have to be aware of security issues too, such as not taking a personal phone with you on business trips, but also making and receiving calls with your secure phone in a secure environment, making sure that there are no cameras or listening devices, and no windows conveniently nearby so that lip-readers can do their job. And then making sure you whisper as the walls in the hotel may be thin, and… Oh wait… Remote laser vibration sensors can decode the audio! Best to go into the hotel room bathroom, close the door (they tend to have some soundproofing), turn on the shower and stand quite close to it while calling… Am I getting paranoid?

By all means, let’s not get too James Bond-ishly paranoid. For politicians, top managers of large multinationals dealing with sensitive information that could affect stock markets, those who deal with (trade) secrets and intellectual property: this may be an issue and they should take the necessary precautions. But revert completely to using only a dumb phone, even for normal calls asking, for example, how grandmother is doing?

Just remember that in the past, listening in on calls made on the analog telephone system with no encryption was really easy. Technology brought us a long way ahead, but perhaps a bit too fast. A small step back, made by securing the current “standard”, is more feasible than complete eradication of what has been created and accepted as a normal part of our daily lives. Such a complete reversion would not even be considered acceptable anymore if we were to disallow commonly-used devices.

Are you going to tell your teenage and pre-teenage children that a hot-off-the-press-release model smartphone with the newest features is now prohibited, and an old phone that can only call/text is all that’s available? They will be angry, feel ashamed of their old-fashioned parents, and will not go out anymore as they refuse to have their friends see them with such a simplistic, dumb phone. As they will not be able to interact with their friends anymore, because social media apps do not exist for their dumb phone (and since they won’t leave the house anymore), they will have to talk to you again.

Wait a minute??? Kids that start to talk to their parents again… But that’s a good thing! Where can I get one of these phones?!