MyCERT 3rd Quarter 2011 Summary Report - CyberSAFE Malaysia

More documents

Recommendations

Info

10Wassenaar Agreement “will not impedebona fide civil transactions”. In fact, thisclause, when combined with the impact thatcryptographic export controls are having onthe civil market, might allow such controls tobe legally challenged where the WassenaarArrangement is being used to justify them.Restriction on ImportsImport of cryptography can be defined as goodor services of cryptography brought into onecountry from another country. Cryptographyis subject to import restrictions. Severalgovernments place import restrictions onencryption technology. The availability ofthese encryption technologies depends onthe actual strength of the encryption thatyou are allowed to use for security. Thisvaries according to import restrictionsfor a specific geographical area. Not allcountries apply the restrictions on importingcryptography tools. It reflects on what is theoutcome that a particular government mayface if they simply allow import activities ofcryptography tools.Table 1 shows countries with restrictions onimporting cryptography tools (refer tablebelow), the colour green represents somecountries with no import restrictions at all.The ones in yellow shows that for countriesto import cryptography tools, a license isrequired to import them. Countries that aretotally banned from importing cryptographyare in red. The “Unknown” column statesthat these countries are encouraged toseek further advice from their governmentsbefore importing any cryptography tools.Meanwhile, those with mixed colours,represent mixed restrictive policies.Rationale to Import ControlThere are reasons why certain governmentsare really concerned about importingcryptography tools from foreign countries.They are afraid that the public might misusecryptography for negative purposes, forexample, planning a rebellion against thegovernment and the government will nothave a chance to monitor the communicationsas it is encrypted. Governments preferBahrainChinaEgyptIranIsraelKazakhstanLatviaLithuaniaArmenia Malta BelarusCzech Republic Moldova IraqHong Kong Morocco MongoliaGhana Hungary Pakistan Myanmar NepalSaudi Arabia India South Korea Russia NicaraguaMalaysia Poland Ukraine Brunei Turkmenistan RwandaSingapore South Africa Vietnam Tunisia Uzbekistan North Korea TatarstanGREEN GREEN YELLOW YELLOW YELLOW RED RED RED Unknown UnknownTable 1: Import Restriction Table(Source: Restriction on Cryptography Imports)e-Security | Cyber Security Malaysia | Vol: 28-(Q3/2011)© CyberSecurity Malaysia 2011 - All Rights Reserved
using locally developed cryptographytools because imported cryptography toolsmight have “trapdoors” or security holes.Trapdoors in this case concerns the use offoreign technology, where the producingcountry might have their own agenda tobreak into the national security of anotherbecause they know the weakness of thesystems that they have developed and theycan control the system at any time.Cryptography Restrictions inMalaysiaIn Malaysia, there are no export or importrestrictions on cryptography tools. Anytransfer of devices and technology relatedto cryptography from Malaysia to anothercountry or vice versa is allowed withoutany need for licenses. In terms of the use ofcrypto, no restrictions are in place and thepublic can use it freely.Although Malaysia has no restrictions oncryptography but we are still bound by afew Acts that are related to implications ofcryptography misuse. There were three Actsthat are worth highlighting here. These threeActs contain powers to require authoritiesto decrypt during an investigation; suchinvestigation is allowed when there isreasonable cause to believe that an offenceunder the Act at issue is being or has beencommitted. There is, therefore no generalpowers to order decryption.i. Computer Crimes Act 1997‘Art. 10 (1) (b) of the Computer Crimes Act1997 requires (likely) users and peopleotherwise concerned with the operation ofcomputers or material, during a search,to provide reasonable assistance for thepurpose of accessing programs or data ormaterial that is reasonably suspected to beused in connection with an offence under theAct, as well as to produce any informationcontained in a computer and accessiblefrom the premises to be produced in a formin which it can be taken away and in whichit is visible and legible. Refusal to cooperateis punishable with at most RM25,000 and/or three years’ imprisonment (art. 11).’A police officer conducting a search oran authorized officer conducting a searchshall be given access to computerizeddata whether stored in a computer. Theaccess may include copies of any books,accounts or other documents, includingcomputerized data, which contain orare reasonably suspected to containinformation as to any offence so suspectedto have been committed. The enactment ofappropriate laws, with the aim of protectingvictims of computer crimes and to providelegal means of prosecuting those who arefound guilty of committing such crimes. InMalaysia, the punishment may take threeyears imprisonment and/or a monetary fineof RM25,000. Note that stiffer penalties willbe meted out if it is found that the guiltyparty had the intention to cause injury whencommitting the crime.ii. Digital Signature Act 1997‘Art. 79 of the Digital Signature Act 1997requires people, during a search, to giveaccess to computerised data whetherstored in a computer or otherwise,which includes providing the necessarypassword, encryption code, decryptioncode, software or hardware required toenable comprehension of computeriseddata. Refusal to cooperate is punishablewith at most RM200,000 and/or four years’imprisonment (art. 83).’The Digital Signature Act was enforced onthe 1st October 1998. The Digital SignatureAct 1997 aims at promoting the processingof transactions especially commercial11e-Security | Cyber Security Malaysia | Vol: 28-(Q3/2011)© CyberSecurity Malaysia 2011 - All Rights Reserved
Page 3: MyCERT 3 rd Quarter 2011 Summary Re
Page 6 and 7: 4compared to the previous quarter.
Page 8 and 9: 6Based on the statistics, there was
Page 10 and 11: 8Legal Restriction on CryptographyB
Page 14 and 15: 12transactions, electronically thro
Page 16 and 17: 14deciding if software is considere
Page 18 and 19: 16SPAM, the Annoying Culprit on the
Page 20 and 21: 18Figure 4: The distribution of spa
Page 23 and 24: “wire-once” settings pool bare-
Page 25 and 26: San Francisco, CA. McKesson has dou
Page 27 and 28: 3. Consistency:It means that the be
Page 29 and 30: Mathematics Operations in BinaryNum
Page 31 and 32: compare the difference between a bi
Page 33 and 34: divided, it will remain as remainde
Page 35 and 36: Criteria is in a better spot to pro
Page 37 and 38: ASPECTS PLAN EXECUTE ANALYSISObject

MyCERT 3rd Quarter 2011 Summary Report - CyberSAFE Malaysia

Create successful ePaper yourself

Delete template?

Save as template?