I used to think all Internet-based crimes came about as a result of the criminals present on the Internet but I now realize that is a naïve perspective on the problem. Even in the Bible we find murder, rape, brutality and deception. It is actually full of sinful acts and as such I think it should be more than obvious to all of us that criminals exist in all spheres of life including the Internet. In Part 1 of this series, Keeping Children Safe on the Internet, I wrote about the problems in general in the hope it would get people to sit up, take notice and feel some responsibility towards dealing with the threats they and their children face on the Internet. In this part I’m going to spend a little more time helping you to understand the criminals’ methods. Many years ago I was in the USA and watched a presentation delivered by an ex-FBI agent who was a key part of the team that caught the first ever known hacker. He was talking about security threats in general and how to identify them and he told us all a key element in understanding potential threats it to think like a criminal when evaluating the various environments we’re trying to protect. For example, many of us assume that the best way to keep burglars out of our homes it to put in place burglar bars, security guards, alarms connected to armed response and electric fences. Although these are good measures to put in place they usually represent conventional wisdom and really do very little to protect us in scenarios in which people have invaded our homes as we sleep in our beds or criminals have followed us up our driveways before our motorized gates can close. The key to protecting yourself is actually to look around your home and try to figure out how people could possibly get in and then decide what to do about those. A security gate and a front door can be taken apart in seconds, burglar bars are easily breached, electric fences can be deactivated or avoided and armed response does not have a teleporter to get them there the instant you press the panic button. My article is not focussed on physical security and there are great practitioners out there, of which I’m not one, but I’m hoping you understand the example.

As I wrote part 1 of this series I was convinced I had some important knowledge to share in a field I’m passionate about. Although I’m pretty qualified to talk on these topics I can’t give you an absolute assurance that your children will be safe. I am, however, spending time evaluating the threats I think of by thinking like a criminal and can hopefully point out some key areas that will help you do a better job of helping you to keep your loved ones safe. It is important to me that I can use my skills and expertise in some kind of way to help our community. These articles take me a number of hours to write and I have to be especially cautious about what I write in IT-related articles because there are just so many people in my field of expertise that I would neither want to become engaged in some form of one-upmanship nor give criminals the ideas, tools and methods to carry out their dark art. If you have ideas or thoughts and would like to contribute to the pool of knowledge I’m addressing then comment away. That way everybody, including me, learns.

What does an Internet criminal look like? In reality they look like anything they want to. They will always adjust how they appear to suit the victim they’re pursuing. Just as a conman will come across as honest and responsible so do these criminals assume a shape or form that is useful for the situation. I actually think it’s worse on the Internet. When we’re confronted by people in the real world we often have a gut feeling that something is out of kilter. If we trust our gut we can get ourselves out of many difficult situations before they escalate out of our control. On the Internet criminals only send words via email or messages and as such none of the warning signals we get from body language, general appearance, kinesics and haptics are present to trigger that queasy feeling in our stomachs.

So, lets think like a criminal for a while. Hacking into one person’s computer is not a very profitable exercise, but filtering through a list of millions of people and determining specific people you can target can be very profitable indeed! As you look at that box with a keyboard and monitor in front of you try to imagine how someone would find you, or your children, and then how they would break in. Let’s look at the first of the problems namely, how they identify your children.

It is likely that most criminals would target social networks and instant messaging systems because they usually contain millions of profiles users; many of them naïve about privacy and security. For example it was recently reporting in Time Magazine that Facebook has approximately 500 million users and counting (up from 150M a year ago!). That means Facebook has about 25% of the Internet’s eyeballs, including me, focussed on it and sharing their information. Many other social networking sites and instant messaging and email environments can count hundreds of millions of users too. It costs nothing to sign up to these types of sites and some even allow one to search them. In some cases one can even search for specific demographics. Of course that could be a time consuming exercise and the results could be shockingly poor in terms of useful information for a criminal. If we examine the types of information a sex predator might seek then we can also narrow down their methods a little. The typical victim profile of sexual predators like these are:

 

  • Are between 11 and 15 years old 
  • Live in the suburbs or rural areas
  • Are loners, with few or no off-line friends
  • Are sheltered and naïve
  • Are looking for attention and love
  • Have divorced parents
  • Believe they are communicating with someone their own age

I must stress this is a typical victim profile, but older and younger children of both genders are also targeted by these evil people. All sex predators need to look for is a status update or some kind of personal information that helps them determine those things. It is relatively easy to set-up a fan page or group on a social networking site and advertise it enough that people will begin to either like it or join it. Imagine the group was called some like “Divorced parents counselling”. It would be easy for a predator to then start browsing through the profiles of only those users that joined the group or liked the page and see if any of them contain accessible lists of their friends, including any of their children. It is never a good idea to randomly join groups or like fan pages without considering the consequences first! For example, consider the huge publicity that was generated about an outrageously provocative and disrespectful fan page devoted to Everybody Draw Mohammed Day on Facebook recently. If you happened to ‘like’ that page, did you set yourself up as a target for a fanatic? We can never know, but it is how one should think at all times. We are not safer just because we’re behind a screen and keyboard. Our behaviour on the Internet should not be any different to how we behave in the real world. Consider that similar consequences can apply for any applications you might add to your profile. Applications might actually be worse because as these applications are given access to your profile they can dig deeper into the personal details of your life, including following your status updates. Read those privacy statements and be aware of what you’re giving away because the responsibility lies with you, not just with the sites you frequent.

What if a hypothetical, children's’ game application called Bunny Farm (any references to a possible, existing game of that name are purely coincidental and/or accidental) was trawling your children's’ profiles looking to see if their personal information, status updates or blogs, journals and notes met one or more of the sexual predator profile items above. It would be able to instantly alert the application author that your child fits an attack vector and make him or her a target! Criminals find their targets easily when we don’t set-up our privacy settings appropriately and recklessly add applications without thinking. The latter, adding applications, is much harder to control than the former but as children get more and more savvy through prolonged use of such tools it becomes easy for them to change their settings. Until we reach a point in time where, as with Windows 7, Windows Live Family Safety and other tools, parents can become administrators and their children merely users of sites we have no real control over what they do.

 

Once a predator has found a victim they ‘groom’ them with the intention of making physical contact with them. Usually a child will be fooled into thinking they’re chatting with someone their own age and many will trust people who are seemingly their own age if they share elements in common. For example if a predator has found out that your daughter likes bunny rabbits and has a pet called, “Bugs,” they may well start a conversation that will include mentioning that they have a pet rabbit they call, “Bugs.” The sort of communication will excite your child who will simply not believe the happy coincidence. As the predator starts to share more and more about themselves children will engage with them more and more until ultimately they may start talking on the phone, via a web-cam or even meet. It is a scary thought and these types of things go on and on daily. Are you worried yet?  

Although I’m no psychology major I am aware of some warning signs to look out for if this is may going on in your home:

  • They spend a lot of time online everyday (more than a couple of hours on instant messaging or social networks) – You might have a little Internet addict on your hands so you can’t use this as your only warning sign
  • They’re secretive about Internet activities (does the screen go blank when you walk past? do they quickly switch to another application or website when you’re near?)
  • There are strangers on their friend/contact/buddy list – strangers being anyone you don’t recognize or they have not met
  • They are making or receiving calls to and from strangers
  • They are receiving packages from strangers
  • They demonstrate distracted behaviours and a more secretive demeanour than usual – while grooming a prospective victim many predators will impress upon their trusting victims that they must keep their relationship a secret

It is important to realize that it is common for girls to believe they love the predator and may even imagine he will marry them some day. Do not underestimate the lengths that they may go to to keep the relationship a secret just so that they don’t lose the loving bond that may have been established. Boys are just as easily fooled and may through trickery or curiosity be fooled into a homosexual relationship. Always be aware the boys are just as much targets for predators as girls are. The best line of defence is to simply ensure they never, ever talk to strangers online and to keep alert for the signs above.  

Of course there are some clever things you can do to limit the risks, but mostly you need to be an alert parent with open and honest communication between you and your children. As I warned in part 1, not all problems can be solved with technology. There are some steps you can take to keep things safer and these are listed below:

  • Set all privacy settings to a minimum of 'Friends only' or something similar on the sites you visit. Your children's’ friends may just have ‘friends’ that are not all they appear to be and all other settings may allow your child’s information to be shared more broadly than you anticipate.
  • Sort through your child’s friends list with him or her and delete and block anyone they’ve not actually met in person. Also block anyone else odd or who worries them a little bit that she has met in person because you can never be certain
  • Tell them never to add anyone to their friend or buddy list that they ave never met in person and know well
  • If he or she uses Facebook go to account application settings (Account/Application Settings - Show Authorized in the drop down at the top)and delete all applications they do not make use of. You can change the permissions these applications have in this location too. The settings are all there, you just need to be responsible enough to use them! There may be similar settings for the other sites you visit. Familiarize yourself and act appropriately.
  • Tell your child to always respond to anything that bothers him or her, including bad behaviour or bullying, as firmly as possible by telling people to 'leave me alone'. Tell you child not to escalate the conversation by shouting back and also to save any messages and their replies (evidence is important if the problem needs to be addressed by the police or any one else in authority). Tell you child that if someone is making him or her feel bad or hurting them child that they are not a 'snitch' or 'tell tale' if they tell someone. Encourage them to tell you! This applies to cyber bullying too.
  • Ensure the alias/nickname/screen name they use on the Internet is doesn’t give away anything person about them e.g. BibleGirl may reflect an interest in religion, but does not give away any typical victim profile details, while Lisa13 might just give away their age! There are many examples of personal information they should not give away including; first name, city, favourite colour, pet’s name, school, birthday, parent’s names and birthdays and many, many more.
  • Tell them not to respond to emails, messages and instant messages they receive from strangers at all… EVER! Even a toe in the door might be enough for a predator to get through to them!
  • Try to limit the use of computers that access the Internet to open areas in your household. It is much harder for them to hide suspicious behaviour if you’re walking past them now and then. If they’re being secretive they’re probably going to rapidly switch applications or blank the screen whenever you approach and you simply would not see that behaviour if they were hiding away in their bedrooms.

I have an acceptable use policy in my home for my children who access the Internet. These come over and above all the steps I've already described in Part 1 and this article. You may or may not want to include them in your acceptable use policy too. It effectively represents a deal. I let them access the Internet as long as they comply with the rules I’ve stipulated. Their safety is my concern and as such silly arguments about their privacy simply do not fly with me. I’m their parent and just as they don’t have free reign in the physical world I don’t give them free reign in the virtual world either! I’m not the type to hand my car key to my young child and let them learn to drive the hard way by bumping into things. I allow access and slowly as they become more proficient over time I lighten the restrictions a little so that they are able to do more while remaining safe. I don’t look at the content of their conversations, unless they ask me to, because I do want them to have a degree of privacy and I know, from past experiences, that both of my children will tell me if anything makes them uncomfortable or frustrates them. Here are the basic rules that apply in my household, over and above all the steps I’ve described previously (these apply to smart phones too):  

  •  Internet access is restricted to specific sites, until they competent enough for me to lighten the restrictions

  • No address or personal information (except where I’ve specifically given them permission and in all cases that might be a subset of information only)
  • Social networking lists can be checked at random – I have set an expectation that I will check now and then and ask them who each person on their list might be
  • My children must friend me on their social networks – although I don’t participate much in their online worlds I do want to be sure nothing bad is going on and that they’re not giving away too much personal information through their profile, notes or status updates. In some cases you might ask an adult friend they adore to do this for you. I’m always amazed when my best friend tells me things my daughter has written. Although not bad usually I do find some comfort in knowing someone else is keeping watch for me too
  • Windows Live Family Safety is required for Internet access – I am able to use this to restrict and monitor access. It is a free online tool and can be downloaded to all your computers from http://downloads.live.com. There are other tools like this too, so you’re welcome to research and find one that suits your needs.
  • They have no permission to install of software – I am able to set that in Windows Vista and Windows 7. I have to type in my password to allow them to run set-up programmes
  • We power off our computers when they’re not in use. We don’t leave our computers online to the whims of the Internet while we’re not present. You will be surprised just how many people do!

Breaking any of these rules can mean no Internet access for a long period of time. That’s the deal and I stick to it! It is very important you set out guidelines for use in your home too and that you follow-up now and then to be sure everything is being adhered to. While the Internet is a fun place to 'exist', the fun can rapidly come to an end when things go wrong!

As I 'think like a criminal' and write this it I’ve come up with a list of new trends that I find disturbing. Although the technologies listed below are very interesting and compelling and represent a step forward in the evolution of technology it is important to consider the risks associated with them before using them to ensure you can keep your family as safe as possible. I'm not suggesting that you don't use them, I am simply recommending you consider how and when you use them. It is important to determine whether the risks outweigh their benefits or at least how to mitigate the risks. I have attempted to brainstorm some of these to aid you in your evaluation of their use.

  • ChatRoulette – this is a form of chat the essentially connects the user with random people throughout the world. Some users of this system sit in front of their web-cams showing their private parts for kicks. It is definitely not an appropriate technology for children or anyone conservative for that matter! Some may get their kicks in this way, but forewarned is forearmed.
  • GPS ‘location’ tagging of photos – I would use this technology in appropriate circumstances only. I would not location tag cute photographs of my children standing outside my home, their school or anywhere they hang out regularly. As many children have mobile phones with built in cameras that offer this functionality it is critical you warn them of the risks. Location tagging provides their exact location to any predator that wishes to find them! Only use location tagging when you photograph places they don’t frequent and areas of interest such as tourists sites, hiking trails and the like.  
  • GPS ‘location’ tagged status/micro-blogs – Posting your status with your current GPS co-ordinates seems insane! This new form of information sharing seems dangerous and should only be utilized appropriately. Many of my friends update their social network status via applications that do this without ever realizing I can tell when they’re not home or exactly where they are at any given time. Setting appropriate privacy settings can limit these sorts of risks and it is incredibly important you do so. I would advise children never ever update their location information unless for a specific reason such as they’re lost and need someone to come and fetch or find them.
  • Mobile phone data theft – Although we experience a high rate of mobile phone theft in South Africa, the reasons for such theft are usually economic i.e. the perpetrator wants to sell the phone or run up the bill. They could just as easily copy all your contact information off your phone and visit you or your friends’ homes or use it to hack your bank account. Despite the inconvenience it is smart to set an unlock pin on your phone and ensure it is completely erased if the pin number is entered incorrectly a few times. The potential risks easily outweigh the inconvenience.
  • Ubiquity of web-cams – As web-cams become and more present in devices such as laptops in our homes we should become at least a little wary of them. Worms, Trojans, viruses and malware may just be activating them and transmitting the information to somewhere you do not like. Consider how you would feel if pictures of you getting dressed, or worse, were made public because your computer was infected with something. Turn them away if you can. At the very least keep your anti-virus software up to date. There are a number of good, and free of charge, anti-virus solutions you can make use of. My entire family makes use of Microsoft Security Essentials which can be found at http://www.microsoft.com/security_essentials. It is highly regarded and was one of the very few anti-virus products that could not be bypassed by a critical flaw in early May of this year.
  • Hate groups on social networks – Many social networks allow freedom of speech. Of course freedom of speech comes with responsibility and in our country it is illegal to incite people against others which limits our freedom of speech to a degree that is acceptable. In many other countries no such laws exist and as such you and your family may be exposed to these kinds of groups. The Everybody Draw Mohammed Day fan page on Facebook is just one such as example. Trampling on the feelings of others could quite easily lead to disastrous consequences for those who become involved. Never ever become a fan or join a hate group online no matter how innocuous it seems.

Lastly i-Safe America (http://www.isafe.org) tells us to, “Remember the Four R’s,” when it comes to Internet safety  

  1. RECOGNIZE techniques used by online predators to deceive their victims.
  2. REFUSE requests for personal information.
  3. RESPOND assertively if you are ever in an uncomfortable situation while online. Exit the program, log off or turn off the computer, and notify your Internet Service Provider or local law enforcement.
  4. REPORT to authorities, any suspicious or dangerous contact that makes you uncomfortable

There is still so much more I could write about, but hopefully the two parts I’ve written will give you some specific actions you can take into your homes and help provide a greater level of safety for your and your family. Don’t be naive about the information you share. Don’t expect only technology solutions to solve the problems you can encounter in the virtual world and act as responsibly as you can while you enjoy all the amazing functionality social networking provides.

Be an awesome Internet parent!