Author: Neil Miller

On April 26, TenIntelligence celebrated World Intellectual Property Day. Why? That’s an easy question…

“Fake” or “Forged” products pose a significant threat to consumers by putting their health and safety in jeopardy. Alcoholic beverages, food products, electronic goods, software, toys and luxury items, automobiles and aircraft parts are being maintained with substandard or counterfeit parts.

The money generated by the sale of fake goods doesn’t always end up in the sellers pocket. They often fund organised crime, human trafficking, child prostitution and terror groups.

This continues to be a huge risk to consumers safety and the brand owners’ reputation.

So next time you’re considering buying a cheap handbag, pair of sunglasses or cheap cigarettes – think again.

Based in Dubai UAE, our brand protection headquarters gives us local knowledge when we are asked to assist clients with brand protection services. Our team helps clients identify whether their products are being counterfeited.

We complete market surveys, test purchases, trademark infringement, law enforcement liaison and intellectual property due diligence research.

TenIntelligence has a long and trustful relationship with local Law Enforcement Agencies (including Police, Customs, Departments of Economic Development, Chambers) across the UAE.

Working alongside the Agencies, allows our brand protection services and infringement investigations to help identify and remove counterfeit products safely.

https://tenintel.com/brand-protection/

With over 15 years of experience in technology, cyber-security and regulatory compliance, Nikhil has deep understanding of data protection legislations, cyber-security threats, security compliance standards, auditing and business continuity.

Nikhil holds an Engineering and Master’s degrees in Computing; is a qualified BSI Certified ISO27001 Lead Auditor; Certified GDPR Practitioner; trained NIST Risk Framework expert; member of the Security Institute.

Nikhil is an experienced Data Protection Officer and Chief Information Security Officer.

He was responsible for leading business strategy for Compliance, IT systems, Cyber-Security and Business Continuity for a nationally renowned large security company.

Nikhil provides TenIntelligence with Data Protection, Cyber Security and Information Security Compliance consultancy through his company Databox 360.

Following an extensive annual audit, TenIntelligence continues to meet its ISO27001 compliance certification for 2021-2022.

This year’s ISO27001 annual audit was led by Heba Mostafa and Jake Durham.  Neil Miller, founder at TenIntelligence, added: “We have high standards of excellence and this continued certification and demonstrates that the protection of data continues to be of paramount importance to our clients and colleagues. My thanks to Heba, Jake and the team for coordinating and improving our procedures over the last year.”

The certification was assessed and recognised for the provision of global due diligence, digital forensics, brand protection, data privacy advisory and corporate fraud investigations services.

The company was assessed by the British Assessment Bureau (an UKAS accreditation body) across several fields including relevant documentation, the scope of our Information Security Management System, business continuity, risk assessments and internal procedures as well as control checks appropriate to our business and service provisions.

With ISO27001 in place, we continue to minimise risk to potential data security breaches, while demonstrating credibility, assurance and trust.  Integrity continues to be one of the core values at TenIntelligence and we have an integrated compliance programme for every process, which continues to provide assurances for our clients.

UKAS accredited ISO 27001 certificates all come with the coveted ‘Crown & Tick’ mark, underlining the security that only comes from Government-backed certification.

We are all still living and working through a time of continued uncertainty.  People are often anxious about their futures, resulting in the temptation to commit fraud or the more vulnerable falling victim to fraud. Neil Miller, CFE reports…

The pandemic has changed the way we will work forever.  There will be less travel, we will work remotely and rely on technology; and experience more logistical and operational challenges. All of these equates to uncertainty.

Where there is change or uncertainty, you will find fraud.

Evidence gathered over the last year of this pandemic demonstrates that employers have observed a 79% increase in fraud as of November 2020, with a further 90% expecting an increase in fraud over the next 12 months.

Fraud Triangle:

The fraud triangle is an excellent tool to help identify fraud.

Opportunity, motivation (pressure) and rationalisation are the three points of the triangle and a combination of any of these will increase the threat of fraud.

Unfortunately, pressure and opportunity are the 2 key points that have caused these increases in fraud during the pandemic.

Pressure:

It is well documented that pressure can affect an individual’s decision making process. Where as motivation was the usual fraud indicator prior to the pandemic, pressure in the last 12 months has been the main reason for the increase in fraud.

During this pandemic, pressure can originate or build up from various sources, such as:

• the uncertainty of losing a job or a partner/spouse losing theirs and now experiencing financial hardship
• being placed on furlough and not enough income to settle the monthly outgoings
• a change in personal circumstances that has affected their lifestyle
• productivity levels adding pressure to performance
• financial and commission targets not being met due to a downturn of customers etc.
• an increase in mistakes or a lack of attention to detail due to pressures

Opportunity:

Pressure mixed with opportunity, employees are more likely to be able to commit fraud, compared to people outside of an organisation.  Employees are more familiar with the internal systems and points of vulnerability, as well as unchallenged opportunities working remotely within an organisation.

These vulnerability points might be:

• a lack of proper procedures for authorisation of transactions
• placing too much trust in key employee positions
• no segregation of key duties and accounting functions
• a lack of clear lines of authority and responsibility
• an absence of frequent policy and procedure audits
• a lack of independent checks on performance

Red Flags:

Recognising and understanding behavioural red flags can help organisations to detect, prevent fraud and avoid monetary and reputational damage.

Several studies commissioned by the Association of Certified Fraud Examiners (“ACFE”) identified that fraudsters exhibited at least one behavioural red flag and that multiple red flags were evident in 50% of cases.

Red flags include some of the following:

• living beyond one’s means – lookout for lifestyle changes, purchasing of expensive cars, houses, and luxury goods
• financial difficulties – check for the history of debt and be aware of any arising financial problems,
• consider addictive behaviours such as gambling
• are there any unusually close association with a vendor/customer
• excessive control issues or unwillingness to share duties, or beating the system
• is anyone going through divorce or family problems
• “wheeler-dealer” attitude involving shrewd or unscrupulous behaviour
• feeling their salary was less than their worth or responsibility
• look for a lack of recognition for their performance

Remedies:

There are some key areas to help mitigate fraud risks.

• Review: undertake formal fraud risk assessments to understand and reflect the new fraud risk landscape. Consider specific analysis in areas around procurement, expenditure, commission and financial reporting.
• Fix & Monitor: build a support case for continued investment in anti-fraud programs and investigations
• Improving Culture: educate leadership, colleagues, families, friends and customers about the effects of the pandemic on the fight against fraud.

Contact us immediately if you have a suspicion of fraud. The integrity and continuity of evidence must be preserved in a secure manner.

Good financial crime compliance and anti-money laundering directives all require organisations to introduce a risk-based approach to customer and enhanced due diligence.

Counter Terror Financing

When assessing the risks of money laundering and terrorist financing, organisations should check whether any high-risk factors apply.

When dealing with individuals or companies established in high-risk jurisdictions, or are exposed to other cases of high risk, organisations should identify the areas of risk and apply enhanced due diligence measures to manage and mitigate those risks appropriately.

Specifically, look out for:

• whether any business relationships are conducted in unusual circumstances
• customers that operate in geographical areas of higher risk, including areas of non AML/CTF legislation, significant levels of corruption, countries subject to UN sanctions and/or countries harbouring designated terrorist organisations
• whether any individuals are using personal asset-holding vehicles
• customers who only have nominee shareholders or shares
• if any customers are cash-intensive
• ownership structures of customers who appear unusual or excessively complex given the nature of their business
• whether any business relationships are based on anonymity
• if your organisation has received funds from unknown parties

Ultimate Beneficial Owners

Identifying accurate, audited and up-to-date information on beneficial owners is a powerful tool in deterring financial crime activity, and to help identify those who might hide their identity behind corporate structures.

A beneficial owner means any natural person or persons, who ultimately owns or controls an organisation.

Most Anti-Money Laundering directives state that a shareholding of 25% or more, whether it be a natural person or corporate entity, shall be an indication of direct ownership.

Depending on an organisation’s risk-based approach, a lower percentage can be set depending on their criteria.  In exceptional cases, organisations having exhausted all other means of identification and provided there are no grounds for suspicion, may consider the senior managing officials to be the beneficial owners.

As part of the risk-based approach, organisations can reduce the likelihood of financial crime, assisting with customer and enhanced due diligence by;

• identifying the customer and verify the customer’s identity on the basis of documents, data or information obtained from a reliable and independent source
• take reasonable measures to verify the beneficial owner’s identity
• take reasonable measures to understand the ownership and control structure of the customer
• verify the control structure and ultimate beneficial owner
• conduct ongoing monitoring of the business relationship including scrutiny of transactions undertaken throughout the course of that relationship to ensure compliance
• verify that any person purporting to act on behalf of the customer is authorised and identify and verify the identity of that person

Politically Exposed Persons (PEPs)

With respect to transactions or business relationships with PEPs, organisations must implement appropriate risk-based procedures, to determine whether the customer or the beneficial owner of the customer, is a PEP.  Approval from senior management to establish or continue business relationships with PEPs is required.

Organisations can help satisfy PEP compliance by:

• checking and verifying sanction lists and registers to identify PEPs, close associates and subjects of interest
• establishing the source of wealth or funds that are involved in business relationships or transactions with PEPs
• conducting enhanced, ongoing monitoring of business relationships with PEPs

Notes:

If a PEP is no longer entrusted with a prominent public role, organisations are still obliged, for a period of at least 12 months, to continue enhanced due diligence with respect to the PEP until such a time that the PEP is deemed to pose no further risk.

EU Directive measures are of a preventative and not criminal nature and should not be interpreted as categorising a PEP as being involved in criminal activity. Although PEPs are considered a risk due to their public life making them vulnerable to corruption, organisations should not simply refuse a business relationship on the basis that he or she is a PEP, as this is contrary to the ethos of the Directive.

What is OSINT? 

Open Source Intelligence (“OSINT”) is a method of intelligence gathering in which you collect and analyse information from publicly available and open sources. Val Dockrell, shares some of the fundamentals…

Information can be gathered from a number of sources, such as:

• Blogs, forums and discussion boards
• Social media (sometimes referred to as its own as SOCMINT, meaning social media intelligence)
• Court Records
• Corporate Registries
• Google maps and images
• Dark and deep web

Although open source data can be both online and offline, such as physical paper records, traditional mass media such as radio, television and newspapers, the internet provides access to the largest range of OSINT.

The use of the internet has become an increasingly vital part of our daily life.  Especially during the past year of the pandemic in which we have become more reliant on the internet, be it for work, education, or entertainment.  The BBC report that UK internet use more than doubled in 2020. With more people spending their time online, it is important to consider the impact of this on our personal or industries digital footprint.

Digital Footprint

A digital footprint is the data that is left behind whenever a person uses a digital service, such as social media, emailing, banking, dating, gaming, geolocation services, etc.

There are two types of ways in which a digital footprint is created; passive, when data on you is collected without your awareness (like your IP address being shared with the website you visit), and active where you voluntarily share your information online, for example posting on social media).

What is my OSINT footprint?

Your digital footprint forms part of your reputation and can have a significant impact on your future. There have been an increasing number of examples featured in the media where people have lost their job or sanctioned over comments they have made online.

For example, James Gunn, writer and director, was fired by Disney over offensive tweets, which he had tweeted over ten years earlier, that later resurfaced in 2018.

Once something is on the internet it could potentially be there forever. Even when a web page of article is deleted, it can be retrieved using OSINT tools. For instance, Archive.org, a digital archive of the world wide web, can show past versions of a website even if they are not currently live and have since been deleted.

As of January 2021, there were 4.66 billion active internet users worldwide.  Even if you are not online regularly, or at all, your friends or family are likely to be, and these individuals can all contribute to your footprint whenever they mention you.

Not only is it useful to be aware of your digital footprint when it comes to reputation and employment, it is equally as important for safety.

Bad actors, such as, fraudsters and hackers can use information from your digital footprint against you, so knowing what is available can help identify the risks and threats that this can expose you to.

Your data can be compromised during a data breach and the information (usernames, logins and passwords) is then posted on paste sites, dark web marketplaces and forums, and shared via messaging apps.

Using OSINT techniques and tools you can identify whether your data has been leaked online.

For example, by entering your email into sites such as Have I Been Pwned, it will notify you if your data has been compromised in a data breach.

OSINT tools can be used to find IP addresses, networks, open ports, webcams, and printers which can act as access points into a user’s device.

Finding Nemo

In 2017, it was reported that someone hacked into a fish tank in North America at a casino and extracted data to a device in Finland. The sensors that regulated the fish tank were connected to the internet and allowed the hackers to gain bank details of the casino’s high-roller database.

Additionally, people finder tools such as 192.com can identify current addresses which sources open source data from the Electoral Register and corporate records from Companies House in the UK.

Registered email addresses and mobile telephone numbers can be extracted from LinkedIn profiles.

Information obtained during an OSINT gathering exercise can be used to build a full profile of a subject.

There are many other OSINT tools and techniques which can uncover a treasure trove of information and help you understand your own digital footprint.

By understanding what type of data exists online and how easily it can be found, you can learn how to better protect yourself online.

If you would like to understand your digital footprint, please contact the team at TenIntelligence.

Special Purpose Acquisition Companies (SPACs) are a new and convenient way of raising finance for a specific purpose, most usually the acquisition of a company. Neil Miller outlines considerations regarding regulatory compliance and due diligence.

SPACs are “shell companies” or “blank cheque companies” without any revenue or operating history and yet they have become an increasingly popular phenomena in raising corporate finance in the USA and are now appearing as a route to the UK markets.

The UK’s Financial Conduct Authority will launch a consultation on strengthening investor protections regarding SPACs and new rules are to be published by early summer.

Listing a SPAC on the London Stock Exchange for example, begins with an Initial Public Offering (IPO) that allows the company to attract investment from a wide range of investors who are looking to generate returns through the acquisition of another company, business venture or asset.

It takes an average of 18-24 months for a SPAC to attract investment, find and complete an acquisition using at least 80% of its net assets.  If a SPAC does not find a suitable acquisition in that timeframe, it could enter into liquidation. At which point, the investment proceeds will be returned to the shareholders and investors minus expenses.

As with any public listing, good governance and compliance is required to ensure that the investors are protected and do not fall foul of fraudulent schemes, non-compliance or embroiled with an unfit SPAC.

A SPAC should be managed by an experienced management team, who have had previous experience in the private equity, corporate finance and market advisors.

In a traditional IPO, the prospectus focuses on historical facts about the issuer and its past performance; with SPACs there is little history.  Therefore financial due diligence is extremely difficult to give an assured assessment of the company’s performance.

Investor Risk Considerations:

SPACs are subject to regulation and rules set by the Securities Exchange Commission (“SEC”) in the USA and London Stock Exchange in the UK. Therefore under regulations and in terms of mitigating risk, standard background checks on the board directors and senior management of the SPAC is essential.  Providing investors with the facts they require to make assured decisions should involve:

• an interrogation of the corporate and personal history of each board member, specifically looking for reputational risks, red flags, adverse findings, false, conflicting or exaggerated statements (www.tenintel.com/due-diligence/background-checks/)
• verifing the information provided by the SPAC and identify gaps for further analysis
• research covering multiple international jurisdictions and performed in different languages
• an independent and unbiased insight and assessment of the appropriateness of each board member/individual based on third-party interviews with former colleagues and clients.

Investment Considerations

Ensuring the appropriateness and the source of funds, wealth and investment in return for shares/warrants is essential for SPACs to comply with financial regulatory requirements and best practice anti-money laundering guidelines.

Insider Trading Considerations

SPACs cannot identify acquisition targets prior to the closing of the IPO.  The SEC requires disclosure in the IPO prospectus to the effect that the SPAC currently does not have any specific acquisition under consideration.

Investors and brokers should ensure that the SPAC’s officers and directors are not selected nor considered linked to an acquisition; nor have they had any discussions regarding possible acquisition targets among themselves or with underwriters or other advisors.

If there is unsolicited interest from a potential acquisition target, the SPAC and its board directors must refuse to engage and should respond that they will not consider the potential target until after the IPO is completed.

Demonstrate Compliance

The underlying guidance for all financial and investment transactions is to demonstrate, endorse and evidence good financial crime compliance. Implementing a robust due diligence checklist to mitigate risk is essential.

The Department of Anti-Economic Crime at Dubai Police arrested 2,430 accused and recorded 2,145 economic crime cases over the past five years. The Department has also made confiscations with an estimated value exceeding Dhs8.9 billion.

Brigadier Jamal Salem Al-Jalaf, Director of the of Criminal Investigations Department (“CID”) stated; “Dubai Police are keen to arrest those involved in economic crimes through a precise action plan in coordination with trademark partners” adding that; “regular meetings are held between brands’ representatives and officers of the Department of Anti-Economic Crime to explore methods and tools to uncover counterfeit goods.”

Our team in Dubai continually provides online training to the Dubai Police, and more recently the Ajman Department Economic Development back in November, on how to differentiate between counterfeit and genuine products.

Despite what the COVID-19 pandemic restrictions present, TenIntelligence continues to carry out enforcements along side the UAE Law Enforcement Authorities (CID, DED and Customs) for counterfeit products.

In 2020, our team were able to apply and attend the destruction of approximately 135,313 products. Furthermore, in collaboration with the Dubai CID and Dubai Customs the team have been able to seize a total of 9,036 counterfeit products (electronics and clothing) since October 2020.

Our brand protection services help clients identify whether their products are being counterfeited.

Firstly, trade mark infringements are serious Intellectual Property crimes.  Secondly, they threaten the health and safety of consumers and violate the rights of trademark, patent, and copyright owners. Food products, electronic goods, toys, software, luxury items, car and aircraft parts are being manufactured and maintained with substandard or counterfeit parts. This continues to be a huge risk to consumers and the brand owners’ reputation.

Our team helps brand owners gather the evidence required to produce prosecution packages for civil and criminal proceedings.

Our services cover on the ground enforcements in the UAE and investigations across the Middle East, including; Bahrain, Iraq, Kuwait, Oman and Saudi Arabia.

Email: dubai@tenintel.com