With the active development of the Internet, the world community is faced with the problem of data security. After all, the Internet is essentially an unregulated environment that is rather weakly subject to the laws of individual states, which opens up a huge number of opportunities for attackers.
That is why developed countries today pay great attention and allocate millions of dollars to improve cybersecurity systems and immediately respond to cyber attacks.
But far from all companies can guarantee a high degree of data protection - it is very expensive. What can we say about ordinary users who do not understand cybersecurity at all.
In this article, I want to talk about situations from my practice and my own experience, when even with fairly serious legal support, it is not possible to protect yourself from scammers and their extortion.
The main problems of information and cyber security
Cybersecurity is a process, not a one-time decision. While specialists are coping with already known problems like viruses, ransomware, and zero-day threats, attackers are developing new, more advanced and effective tools.
Here are some of them:
- Jailbreaking is the installation of malware on smartphones with modified software.
- Ghostware is a virus that infiltrates a system to steal data and, after completing the task, self-destructs.
- "Two-faced" viruses are programs that mimic system files, and after successfully passing the antivirus scan, they begin the process of stealing data.
And there are dozens, if not hundreds, of similar tools. Even the most "ideal" protection is found to have flaws that a skilled hacker can turn into a leak of secret data. Periodically leaks happen even in the Pentagon, one of the most protected structures in the world in terms of cybersecurity.
Do search engine algorithms allow you to blackmail users?
But to see information security problems, you can simply open a browser. The fact is that the amount of indexed information on the Internet doubles every 1,5 years.
that by the end of 2020, the total amount of data on the Internet will increase to 44 zettabytes (44 billion terabytes), and search engines are already processing tens of thousands of requests per second.
Attackers skillfully use this data overload, when almost all data is processed by the search engine without human intervention.
What it looks like most of the time.
- The scammer creates a website whose purpose is to cheat money from users. Methods can be very different: win-win investments, promising work with an "insurance premium", buying goods at bargain prices. Or just some one-pager that infects computers with a virus.
- The scammer receives money from gullible citizens on average from 2 to 6 months - that is how long it takes for search engine managers to identify the problem and ban the site.
- But this does not help, because on the same day a fraudster can create a new site with similar content, continuing his criminal activities.
This is just one of the possible options for how scammers can use the functionality of search engines, because if there are no materials on the site that directly violate the rules (for example, plagiarized content), then the site is indexed by the search engine without any problems and goes into search results.
Such scammers are fought with varying degrees of success. Here the action is aimed at getting small amounts of money from as many people as possible.
A completely different format is fraud aimed at a specific person. And it is gaining popularity today because it is much more difficult to stop it - and not all blackmailers know how to do it. Usually the target is a fairly public businessman who needs a crystal clear image to succeed. These are mostly lawyers, private doctors (most often plastic surgeons), highly paid digital specialists (programmers, designers, authors).
How it's done?
- The scammer creates dozens of the same type of articles with negative reviews, in which he exposes his victim as a scammer, a bad and unreliable specialist. Materials can be created even with the help of a bot - their quality is completely unimportant. After all, the most important thing is that the search engine indexes them.
- These reviews and materials are then placed on second-rate sites where you can publish reviews and articles about anything without any problems.
- Reviews are indexed and returned when searching for keywords. The main key is "PROFESSION NAME SURNAME". For example, "designer Ivan Petrov" or "lawyer Petr Ivanov." Most people, before starting work with a particular specialist, look through information about him in a search engine. The result is predictable - a bunch of negative reviews like "Ivan Petrov is a scammer." And in most cases, a potential client does not risk starting cooperation.
- Then, after a month or two, when the object clearly feels the influence of black PR, he receives an email demanding to pay a certain amount of money to a bitcoin wallet or other financial service that guarantees anonymity, and then the extortionists will remove the articles (but this is not certain). In case of refusal to pay, scammers promise to multiply the number of negative reviews.
At this point, many targets of blackmail don't know what to do exactly. There are several options:
- Contact the police. But if the attacker didn’t leave clear evidence (like his bank card number), then the case will quickly turn into a hangover.
- Contact the owners of the resources on which reviews are located. It takes a huge amount of time - after all, there can be dozens of portals. In this case, the efficiency is close to zero. It is far from certain that even after listening to the arguments, the owners will agree to remove the slander from the site. And it’s not a fact that the owners will generally answer your request.
- Contact search engine support. Google and Yandex specialists are working slowly - it will take up to several months to remove slander, but today this is the fastest available way to deal with such scammers. But even in this case, it is far from a fact that such reviews will be deleted. I'll explain why below.
We get that even in the best case, the reputation of the entrepreneur will be seriously damaged, which will definitely hit the level of profits. Fraudsters, while maintaining anonymity, do not risk anything at all. Unless they spend time generating and posting materials.
How they tried to blackmail me in this way
Why did I even touch on this topic - quite recently they tried to blackmail me in a similar way.
In the spring of 2018, I found that insults about me, my family and my work appeared on the Internet too often. Moreover, the nasty things were the most banal - “he deceives everyone”, “does not fulfill obligations”, “non-professional”.
Naturally, there is no evidence - only a stream of emotions and insults from "deceived customers."
Besides the fact that it was unpleasant for me as a person, such “reviews” also hit my reputation hard. It worked well: a person drives “Yuri Mosh” into the search engine, and in the top ten he gets a couple of sharp negative reviews. He goes further, and there is solid slop. In this case, a person may not even follow the links, but simply read the headlines. This is enough to make the "right" impression.
At first I thought that this was an order from competitors, but everything turned out to be more prosaic. In September, I received a letter in the mail demanding to pay 20 dollars - and then the texts will be deleted. In case of refusal, the scammers promised to create even more such reviews.
I didn't pay, of course. I contacted Google and Yandex support with a request to disable the indexing of these pages.
The results were very different.
After a month of communication with Google support, experts confirmed that this content is slander and violates the rules for indexing web pages. False articles were removed from the issue. For which the managers of Google thanks.
But there are also difficulties. Nothing prevents the criminal from making more articles a little later - they will also be indexed in the search engine and appear in the search results. As the Google experts with whom I spoke say: in order to close indexing for specific keys (like “Yuri Mosha is a scammer” or “Yuri Mosha is a scammer”), you need a court decision that recognizes the above phrases as unreliable.
With Yandex, the situation is much more complicated. Managers already at the beginning of communication took the position of "My hut is on the edge." They stated that they are not responsible for the content that is indexed by the search engine, and are not required to monitor it.
It's true - the search engine should not follow the content. But there is a small caveat - it should not be until the matter concerns criminal offenses, which are slander and blackmail.
However, the support team has made it clear that they do not intend to deal with the problem.
In this regard, I studied the law and sued Yandex, because a direct refusal to remove illegal content from the issuance essentially makes the company an accomplice in crime.
In Russia, the case was lost. Nevertheless, Russian legislation in terms of cybercrime is very crude and does not allow to fully protect the rights of users, even despite the existence of the law “On Information, Information Technologies and Information Protection”:
According to the provisions of Article 10.3, the operator of a search engine that distributes advertising on the Internet, which is aimed at attracting the attention of consumers located on the territory of the Russian Federation, at the request of a citizen (individual) is obliged to stop issuing information about the site page index on the Internet , allowing access to information about the applicant, distributed in violation of the legislation of the Russian Federation, which is unreliable, as well as irrelevant, has lost its meaning for the applicant due to subsequent events or actions of the applicant, with the exception of information about events containing signs of criminal offenses, the terms of bringing to justice criminal liability for which has not expired, and information about the commission by a citizen of a crime for which a conviction has not been withdrawn or extinguished.
The case in the Moscow court was lost due to procedural inaccuracies. The evidence base was good.
Therefore, I decided to sue in an American court. The lawsuit against Yandex is now in the Federal District Court for the Southern District of New York (Case 1:18-CV-05444-ER).
I already had experience of successful litigation in the USA, so this option seems to me more promising in terms of restoring justice.
The case is currently pending a court decision. The debate of the parties has already passed and my lawyers are waiting for a positive decision of the process. But in litigation with corporations, the outcome of the case is unpredictable to the last.
The legal field in cyberspace is developing slowly, which allows fraudsters to use such rather primitive methods of extortion and blackmail. Personally, all these lawsuits took me more than a year - during this time my reputation with potential clients suffered greatly.
Even after a successful court decision, it will take a long time to restore it. But I hope that the court's decision will set a precedent by which similar fraud and extortion cases will be dealt with more easily and quickly in the future.
Source: www.habr.com
