I used to think all Internet-based crimes came about as a result of the criminals present on the Internet but I now realize that is a naïve perspective on the problem. Even in the Bible we find murder, rape, brutality and deception. It is actually full of sinful acts and as such I think it should be more than obvious to all of us that criminals exist in all spheres of life including the Internet. In Part 1 of this series, Keeping Children Safe on the Internet, I wrote about the problems in general in the hope it would get people to sit up, take notice and feel some responsibility towards dealing with the threats they and their children face on the Internet. In this part I’m going to spend a little more time helping you to understand the criminals’ methods. Many years ago I was in the USA and watched a presentation delivered by an ex-FBI agent who was a key part of the team that caught the first ever known hacker. He was talking about security threats in general and how to identify them and he told us all a key element in understanding potential threats it to think like a criminal when evaluating the various environments we’re trying to protect. For example, many of us assume that the best way to keep burglars out of our homes it to put in place burglar bars, security guards, alarms connected to armed response and electric fences. Although these are good measures to put in place they usually represent conventional wisdom and really do very little to protect us in scenarios in which people have invaded our homes as we sleep in our beds or criminals have followed us up our driveways before our motorized gates can close. The key to protecting yourself is actually to look around your home and try to figure out how people could possibly get in and then decide what to do about those. A security gate and a front door can be taken apart in seconds, burglar bars are easily breached, electric fences can be deactivated or avoided and armed response does not have a teleporter to get them there the instant you press the panic button. My article is not focussed on physical security and there are great practitioners out there, of which I’m not one, but I’m hoping you understand the example.
As I wrote part 1 of this series I was convinced I had some important knowledge to share in a field I’m passionate about. Although I’m pretty qualified to talk on these topics I can’t give you an absolute assurance that your children will be safe. I am, however, spending time evaluating the threats I think of by thinking like a criminal and can hopefully point out some key areas that will help you do a better job of helping you to keep your loved ones safe. It is important to me that I can use my skills and expertise in some kind of way to help our community. These articles take me a number of hours to write and I have to be especially cautious about what I write in IT-related articles because there are just so many people in my field of expertise that I would neither want to become engaged in some form of one-upmanship nor give criminals the ideas, tools and methods to carry out their dark art. If you have ideas or thoughts and would like to contribute to the pool of knowledge I’m addressing then comment away. That way everybody, including me, learns.
What does an Internet criminal look like? In reality they look like anything they want to. They will always adjust how they appear to suit the victim they’re pursuing. Just as a conman will come across as honest and responsible so do these criminals assume a shape or form that is useful for the situation. I actually think it’s worse on the Internet. When we’re confronted by people in the real world we often have a gut feeling that something is out of kilter. If we trust our gut we can get ourselves out of many difficult situations before they escalate out of our control. On the Internet criminals only send words via email or messages and as such none of the warning signals we get from body language, general appearance, kinesics and haptics are present to trigger that queasy feeling in our stomachs.
So, lets think like a criminal for a while. Hacking into one person’s computer is not a very profitable exercise, but filtering through a list of millions of people and determining specific people you can target can be very profitable indeed! As you look at that box with a keyboard and monitor in front of you try to imagine how someone would find you, or your children, and then how they would break in. Let’s look at the first of the problems namely, how they identify your children.
I must stress this is a typical victim profile, but older and younger children of both genders are also targeted by these evil people. All sex predators need to look for is a status update or some kind of personal information that helps them determine those things. It is relatively easy to set-up a fan page or group on a social networking site and advertise it enough that people will begin to either like it or join it. Imagine the group was called some like “Divorced parents counselling”. It would be easy for a predator to then start browsing through the profiles of only those users that joined the group or liked the page and see if any of them contain accessible lists of their friends, including any of their children. It is never a good idea to randomly join groups or like fan pages without considering the consequences first! For example, consider the huge publicity that was generated about an outrageously provocative and disrespectful fan page devoted to Everybody Draw Mohammed Day on Facebook recently. If you happened to ‘like’ that page, did you set yourself up as a target for a fanatic? We can never know, but it is how one should think at all times. We are not safer just because we’re behind a screen and keyboard. Our behaviour on the Internet should not be any different to how we behave in the real world. Consider that similar consequences can apply for any applications you might add to your profile. Applications might actually be worse because as these applications are given access to your profile they can dig deeper into the personal details of your life, including following your status updates. Read those privacy statements and be aware of what you’re giving away because the responsibility lies with you, not just with the sites you frequent.
What if a hypothetical, children's’ game application called Bunny Farm (any references to a possible, existing game of that name are purely coincidental and/or accidental) was trawling your children's’ profiles looking to see if their personal information, status updates or blogs, journals and notes met one or more of the sexual predator profile items above. It would be able to instantly alert the application author that your child fits an attack vector and make him or her a target! Criminals find their targets easily when we don’t set-up our privacy settings appropriately and recklessly add applications without thinking. The latter, adding applications, is much harder to control than the former but as children get more and more savvy through prolonged use of such tools it becomes easy for them to change their settings. Until we reach a point in time where, as with Windows 7, Windows Live Family Safety and other tools, parents can become administrators and their children merely users of sites we have no real control over what they do.
Once a predator has found a victim they ‘groom’ them with the intention of making physical contact with them. Usually a child will be fooled into thinking they’re chatting with someone their own age and many will trust people who are seemingly their own age if they share elements in common. For example if a predator has found out that your daughter likes bunny rabbits and has a pet called, “Bugs,” they may well start a conversation that will include mentioning that they have a pet rabbit they call, “Bugs.” The sort of communication will excite your child who will simply not believe the happy coincidence. As the predator starts to share more and more about themselves children will engage with them more and more until ultimately they may start talking on the phone, via a web-cam or even meet. It is a scary thought and these types of things go on and on daily. Are you worried yet?
Although I’m no psychology major I am aware of some warning signs to look out for if this is may going on in your home:
It is important to realize that it is common for girls to believe they love the predator and may even imagine he will marry them some day. Do not underestimate the lengths that they may go to to keep the relationship a secret just so that they don’t lose the loving bond that may have been established. Boys are just as easily fooled and may through trickery or curiosity be fooled into a homosexual relationship. Always be aware the boys are just as much targets for predators as girls are. The best line of defence is to simply ensure they never, ever talk to strangers online and to keep alert for the signs above.
Of course there are some clever things you can do to limit the risks, but mostly you need to be an alert parent with open and honest communication between you and your children. As I warned in part 1, not all problems can be solved with technology. There are some steps you can take to keep things safer and these are listed below:
I have an acceptable use policy in my home for my children who access the Internet. These come over and above all the steps I've already described in Part 1 and this article. You may or may not want to include them in your acceptable use policy too. It effectively represents a deal. I let them access the Internet as long as they comply with the rules I’ve stipulated. Their safety is my concern and as such silly arguments about their privacy simply do not fly with me. I’m their parent and just as they don’t have free reign in the physical world I don’t give them free reign in the virtual world either! I’m not the type to hand my car key to my young child and let them learn to drive the hard way by bumping into things. I allow access and slowly as they become more proficient over time I lighten the restrictions a little so that they are able to do more while remaining safe. I don’t look at the content of their conversations, unless they ask me to, because I do want them to have a degree of privacy and I know, from past experiences, that both of my children will tell me if anything makes them uncomfortable or frustrates them. Here are the basic rules that apply in my household, over and above all the steps I’ve described previously (these apply to smart phones too):
Internet access is restricted to specific sites, until they competent enough for me to lighten the restrictions
Breaking any of these rules can mean no Internet access for a long period of time. That’s the deal and I stick to it! It is very important you set out guidelines for use in your home too and that you follow-up now and then to be sure everything is being adhered to. While the Internet is a fun place to 'exist', the fun can rapidly come to an end when things go wrong!
As I 'think like a criminal' and write this it I’ve come up with a list of new trends that I find disturbing. Although the technologies listed below are very interesting and compelling and represent a step forward in the evolution of technology it is important to consider the risks associated with them before using them to ensure you can keep your family as safe as possible. I'm not suggesting that you don't use them, I am simply recommending you consider how and when you use them. It is important to determine whether the risks outweigh their benefits or at least how to mitigate the risks. I have attempted to brainstorm some of these to aid you in your evaluation of their use.
Lastly i-Safe America (http://www.isafe.org) tells us to, “Remember the Four R’s,” when it comes to Internet safety
There is still so much more I could write about, but hopefully the two parts I’ve written will give you some specific actions you can take into your homes and help provide a greater level of safety for your and your family. Don’t be naive about the information you share. Don’t expect only technology solutions to solve the problems you can encounter in the virtual world and act as responsibly as you can while you enjoy all the amazing functionality social networking provides.
Be an awesome Internet parent!