Loading...

Author: Neil Miller

Data breach incidents and response planning: Our Ten Point Guide for preparing and responding for a breach incident:

by Neil Miller

TenInsight

Our Ten Point Guide for preparing and responding for a data breach incident:

A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data”. This includes breaches that are the result of both accidental and deliberate causes. It also means that a breach is more than just about losing personal data. Senior Compliance Executive, Heba Mostafa reports.

Examples of personal data breaches provided by the Information Commissioner’s Office (“ICO”) can include:

  • access by an unauthorised third party
  • deliberate or accidental action (or inaction) by a controller or processor
  • sending personal data to an incorrect recipient
  • e-devices containing personal data being lost or stolen
  • alteration of personal data without permission; and
  • loss of availability of personal data.

 

In the event of a data breach, GDPR gives regulatory bodies (the ICO in the UK’s case) the right to fine organisations four percent of their annual global turnover, or €20m, whichever is the greatest.

A key point is that any organisation should test various scenarios periodically to ensure that the response is rehearsed and roles are known.

  1. Responsibilities should be defined to key individuals (the response team) along with contact details. The response team may include the head of IT, information security, head of corporate communications and senior executives.
  2. The internal escalation process for incident responses should be documented and tested periodically. It may be that other bodies need to be notified depending on the industry in which the organisation operates.
  3. Robust breach detection, investigation and internal reporting procedures should be in place. This will facilitate decision-making about whether or not the organisation needs to notify the relevant supervisory authority and the affected individuals.
  4. You need to run incident risk assessment to decide if the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.  For example, if the data is encrypted and there is no way any personal information can be picked up from it, you do not need to let the ICO know. It’s worth noting though that the ICO recommends that if it is decided you don’t need to report it, you need to be able to justify the decision, and so you should document it.
  5. If the breach is likely to result in a high risk of adversely affecting individuals’ rights and freedom; you need to notify the ICO (or the supervisory authority in your jurisdiction if outside the UK) without what is termed “undue delay”. This means that, from the time that you become aware of the data breach, you have a maximum of 72 hours to report it, and really should do so as soon as you know about it.
  6. Working on the basis that the worst happens and reporting to the ICO is necessary. You will need to provide them with as much of the following information as possible:
  • The categories and approximate number of individuals and personal data records involved
  • The name and contact details of the data protection officer (if you have one) or another contact point where they can get more information
  • A description of the likely consequences of the personal data breach
  • A description of the measures taken, or you plan to take, to deal with the breach, including any measures taken to alleviate the effects
  1. In the case of a severe data breach, you will also need to inform anybody whose data has been caught up in the breach “without undue delay”. When communicating with these individuals, you will need to let them know:
  • The name and contact details of your data protection officer (as above, if you don’t have one, a contact where information can be requested)
  • A description of the likely consequences of the breach
  • A description of the measures taken, or you plan to take, to deal with the breach, including any measures taken to alleviate the effects
  1. Work to prevent any further breach and stop the current breach (if it’s ongoing) and mitigate the damage that the breach, and any leaked data, can cause.
  2. Giving instructions to isolate the affected systems and devices. These may be needed for any subsequent investigation. Bear in mind that closing down or isolating a system could have a huge impact on the organisation
  3. A record of any personal data breaches must be kept, regardless of whether you are required to notify.

 

How are personal data breaches discovered?

Data breaches are often discovered through several different channels, such as:

  • Automated system monitoring – detecting a potential data breach; this is usually reviewed manually prior to action being taken.
  • Whistleblowing facilities for groups such as staff, customers, and suppliers to report concerns anonymously.
  • End users may report breaches to the IT helpdesk, however be aware that issues reported in this way may not be logged as breaches. To report incidents, staff need to be aware of the process.
  • Data published by hackers, or when members of the public find IT equipment and report it to news outlets.
  • When an incident comes to light, the actual report of the breach itself may contain sensitive and/or personal data which should be subject to the organisation’s information classification policy and protected appropriately.

 

TenIntelligence can help support organisations with investigating a data breach:

  • Advise on developing procedures to effectively detect, report and investigate a personal data breach or incident. Under GDPR, failure to report a breach could result in a fine.
  • As an appointed DPO, act as the incident responder working with those identified within the Breach & Incident Response Plan.
  • Develop a communication plan for internal and external messaging to clients and staff.
  • Design and develop a Breach & Incident Response Plan.
  • Support the regular testing regime of breach and incident response including specific development of bespoke desktop and play book exercises to test decision-making procedures.
  • Provide support to the appointed nominated DPO or business lead in the incident response critical hours.
  • Conduct specific Data Flow assessments providing Gap Analysis to identify control weakness, strengths and areas for development

 

What are the 6 most commonly discussed data privacy regulations and how do they affect the way the world approaches data governance? 

The EU and UK:

General Data Protection Regulation (“GDPR”)

EU law on data protection and privacy in the European Union and the European Economic Area.

The USA:

California Consumer Privacy Act (“CCPA”)

State statute intended to enhance privacy rights and consumer protection for residents of California, United States.

Health Insurance Portability and Accountability Act (“HIPAA”)

Stipulate how personally identifiable information maintained by the healthcare and healthcare insurance industries in United States.

In Brazil:

Lei Geral de Proteção de Dados Pessoais (“LGPD”)

Applies to any business or organisation that processes the personal data of people in Brazil.

In Canada:

Personal Information Protection and Electronic Documents Act (“PIPEDA”)

Governs how organisations collect, use and disclose personal information in the course of commercial business in Canada.

In Dubai, UAE:

Data Protection Law (“DPL”)

Gives individuals control over their personal data and protects against its misuse in both public and private sectors in the Dubai International Financial Centre (DIFC).

Our
Services

Due Diligence

International Background Checks

Financial Crime Compliance

Strategic Intelligence

Investigations

Corporate Fraud

Litigation Support

Digital Forensics

Corporate Security

Brand Protection

Cyber Security

Corporate Security

Our Intelligence | Your Assurance

The working environment during COVID-19 in 2020 and into 2021 continues to change and for many, an increase in anxiety.

by Neil Miller

TenInsight

The working environment during COVID-19 in 2020 and into 2021 continues to change and for many, an increase in anxiety.

Our UK team has been working remotely since early March 2020, with a two week window last September, where the team enjoyed a welcome return to the office.

We regularly talk about positivity and communication during our weekly video meetings; and recently members of the team enjoyed a seminar which has prompted one of our new members of the team, Rae Legg, to open up about her thoughts on mental health.

Mental health in the workplace – what will really help?

Awareness and understanding of mental health have increased exponentially over the past few decades, with World Mental Health Day being celebrated every year on the 10th of October since 1992. Despite the growing awareness, clearly there is still a stigma towards mental health in the workplace.

According to a survey conducted on 1,000 people by Aetna International in June 2020, up to a third of employees claim physical illness to take a day off work when in reality, it is stress and mental suffering that is the cause. Yet they feel compelled to conceal the true nature of their illness.

Some may view being open and honest about their mental health as a barrier preventing them from entering the workplace with people being advised by well-meaning family members not to disclose their mental illnesses to potential new employers.

As someone who has suffered with depression and anxiety for several years, I will freely admit to all of the above.

This begs the following question: What steps can be taken to reduce the stigma towards mental health in the workplace?

Speak openly about mental health:

Often, people with social anxiety disorders (or people who are naturally more introverted) will feel reluctant to talk about themselves and their problems and simply encouraging them to speak out will not suffice.

Speaking candidly and openly about mental health will create a safe environment for people with mental illnesses and will make them feel secure enough to come forward and share their experiences.

This can be done by sharing and discussing articles or TV programmes that deal with mental health, supporting mental health charities, or even discussing past experiences.

Promote a healthy work/life balance:

I was told recently that people should invest more in their hobbies and interests and engage in more physical activity in order to maintain a healthy mental wellbeing.

This is sound advice, but let’s look at the reality where people skip lunch breaks and work overtime, where people have long commutes to work, where people go home to their families and resume the full time role of parenting.

The simple fact is that if you don’t have more time at home, you won’t have time to engage in the things you enjoy.

This can be changed by encouraging people to take mental health days and to take regular holidays in order to build a fulfilling life outside of work.

Provide access to mental health facilities:

Individuals suffering with mental illnesses often talk about feeling lost and not knowing where to turn.

Other people without a history of mental illness may begin to suffer from stress due to smaller difficulties, such as moving to a new house or dealing with divorce proceedings but will downplay their issues.

By providing access to mental health screening tools and counsellors, this will encourage those suffering to take the first step and seek the help they need; whether that be a safe place to discuss their depression, or someone to vent to about the stresses of everyday life.

The above steps are just the beginning to designing a mentally healthy workspace for employees and with time and work, the discussion of mental health will no longer feel like a taboo subject.

 

Analyst | rachael.legg@tenintel.com

 www.tenintel.com

+44 (0) 20 3963 1930

+971 (0) 4 424 9988

Our
Services

Due Diligence

International Background Checks

Financial Crime Compliance

Strategic Intelligence

Investigations

Corporate Fraud

Litigation Support

Digital Forensics

Corporate Security

Brand Protection

Cyber Security

Corporate Security

Our Intelligence | Your Assurance

How identifying red flags uncover financial, regulatory and operational risks

by Neil Miller

TenInsight

How identifying red flags uncover financial, regulatory and operational risks

Last year TenIntelligence conducted over 500 due diligence checks on directors and senior executives for our clients, using our traffic light system based on Red Flags (High Risk), Amber Flags (Moderate Risk) and Green Flags (Minimal Risk).  Analyst, Tim Minchin reports on why identifying red flags is important for your organisation. 

Analysis from 2020 identified 16% of our checks were flagged Amber and 3% were Red Flags.

Despite what can be perceived as a low percentage, 3% of red flags can have a big impact on a business. The flags uncovered, helped our clients prevent financial losses from potential reputational impact on the company’s public image.

For example, in January 2016, a senior Business Development Manager of an NHS Foundation Trust was dismissed after an internal investigation identified numerous discrepancies in his expenses. The investigation led to the discovery of approximately £350,000 worth of fake expenses and the lie of holding a PhD, a master’s degree and five other diplomas being unravelled. Had the right checks been in place, this could have been avoided.

Having the right background information and checking practices in place, allows our clients to work with continued assurance and integrity.

The guidance set out by the London Stock Exchange (LSE) regarding AIM due diligence, should be a substantive tool in assessing appropriateness rather than solely a compliance tick box function.

The flags we identified in 2020 ranged extensively, as do the checks we cover, uncovering numerous severe near misses:

  • Undisclosed litigation involving allegations of misrepresentation or insider trading
  • Undeclared insolvencies from personal historic bankruptcies to compulsory company liquidations
  • Ties to sanctioned individuals and companies or uncovering undisclosed offshore companies in notorious tax havens
  • Declared education qualifications faked or not passed by the individual.

Our open-source intelligence gathering, includes a detailed examination of subscribed databases, press articles, company registries, court searches, public records and documents, insolvency registers, financial regulator fines and licenses, sanction checks as well social media platforms.

In addition, our in-depth interviews (unbiased industry insights) with former associates also helped reveal undeclared red flag issues such as:

  • Misconduct, poor attitude, and misrepresentation
  • Mismanagement causing shortfalls, lost contracts, litigation and fines
  • Accusations of the misuse of alcohol, drugs and gambling
  • The misuse of company funds or shares, short selling and over inflating company shares for gain.

It remains critical at TenIntelligence that our focus is to identify any potential risks to our clients, ensuring the individuals are considered “Fit and Proper” and mitigate any possible loss for our clients.

For further information about how we can help with background checks and enhanced due diligence, contact us on +44 (0) 203 963 1930 or email Tim below.

 

tim.minchin@tenintel.com

Considerations when investigating fraud in different cultures

by Neil Miller

TenInsight

Considerations when investigating fraud in different cultures

While many aspects of human thought and behaviour are universal, my Psychology degree taught me that cultural differences can lead to often surprising differences in how people think, feel, and act; Senior Associate Valeryia Dockrell reports.

One of the key distinctions between national cultures can be characterised into individualism versus collectivism.

You will find individualistic cultures in Western European countries and North America where there is emphasis on individual goals rather than the group. Whereas Asian countries which have a collectivist culture, such as Japan, India and China, will emphasise group goals and personal relationships.

This is just one of the many ways in which culture can be split and examined, and even within this categorisation there are various nation-specific cultural differences.

It is certainly important to acknowledge that cultural differences exist and where an activity might be perceived as normal in one culture, it maybe be considered corrupt when investigated using the cultural values of another.

Culture also has an influence on the detection of fraud, where individuals in one culture may be less likely to speak out, or simply don’t recognise that fraud and corruption is taking place, as the observed practises are not perceived as wrong.

Looking at an example of a collectivist culture such as Japan, we can look at certain cultural traits which are more prevalent in this nation, such as obedience and loyalty.

While these characteristics can have a positive influence in some environments, they can be damaging in the case of fraud and corruption.

In 2015, it was uncovered that Toshiba had inflated their profits numbers by £780m over a period of 7 years from 2008 to 2014. An investigative panel concluded that it was the culture of silence, obedience and loyalty which influenced fraudulent accounting practices.

Additionally, although senior management did not explicitly instruct that fraud be committed, it is believed that they relied on the Japanese corporate culture of obedience. Falsification of the profits occurred as a result of impossible targets, which lead to employees lower in the hierarchy doing whatever it took to meet them.

Some research suggests that loyalty to colleagues and the business that is found in collectivist cultures will mean that employees will be reluctant to disclose improper behaviours of others and in turn discourages whistleblowing.

Data indicates that whistleblowing is the most effective way to detect fraud, therefore cultures which value group goals and harmony, can have a negative impact on fraud detection.

Research found that collectivism is negatively associated with auditor’s compliance with fraud risk assessment procedures as they are more motivated to maintain group harmony as part of their national cultural values.

Another cultural theory looked at tight and loose cultures in terms of enforcing social norms, and can be compatible characteristics with individualism.

For example, East Asia is collectivist and tight, and the US is loose and individualistic. But some places that are individualistic can also be tight such Germany and Switzerland.

In a 2018 study it was identified that people from tight cultures, like Norway, reported less tolerance for insurance fraud, were less likely to commit the fraud, and they perceive higher level of risk of being caught than their counterparts from loose cultures, such as Ukraine.

Other studies looked specifically at different cultures in relation to specific behaviours such as acceptability of bribe payments. Accountants in Asian and Pacific regions were found to not consider bribes as fraudulent behaviour.

A study of Chinese salespeople suggested that their attitudes towards unethical behaviour were more tolerant than those of their US counterparts.

Additionally, in African countries, such as Nigeria, there is a perception that a bribe is needed to solve various forms of administrative problems in a timely manner and refusal to give a bribe may be met with negative consequences.

As well as other areas of impact, such as culture and susceptibility to becoming a victim of fraud.

However, it should be remembered that despite national cultures, there are many subcultures and individual differences that can also have an effect.

The keynote is that to prevent, discover, and investigate fraud, the impact of culture should be understood. Failure to consider cultural differences may lead to ineffective fraud prevention and detection, in turn leading to major financial loss to the
business and reputational damage.

Typical anti-fraud policies may not consider cultural differences, which is especially important for a company which operates across different jurisdictions.

There are many other cultural differences and influences that can be discussed, such as power distance which relates to how society deals with inequality, masculinity and uncertainty avoidance, etc.

To fight fraud, you should understand the cultures in which you operate, then you can instil a corporate culture within your business that employees can identify with to facilitate an anti-fraud environment.

For further information about how we can help with investigating fraud, do get in touch with us!

Our Intelligence | Your Assurance

COVID-19 Fraud | Don’t Let Fraudsters Take Advantage of a Tough Situation

by Neil Miller

TenInsight

COVID-19 Fraud | Don’t Let Fraudsters Take Advantage of a Tough Situation

Despite the gradual easing of restrictions in the UK, the pandemic continues to be at the centre of the world’s focus.

The chaotic nature of the last year has provided a cover for fraudsters across the world and the thread of fraud for many of us is still very real.

Over the last 12 months, we have been highlighting some of the Covid-19 fraud cases and trends which have caught out many organisations, companies and people.

Action Fraud UK continues to highlight the key fraud trends relating to individuals.  One of the current fraud trends are via text or emails pertaining to offer vaccines. Pauline Smith, Head of Action Fraud, said: “The vaccine is a crucial tool in fighting the coronavirus and keepingpeople safe. We have seen an increase in the last two months, particularly around scam text messages. Remember, the vaccine is only available on the NHS and is free of charge.”

The NHS will never ask you for your bank account or card details; PIN or banking password.  NHS staff will never arrive unannounced at your home to administer the vaccine.  The NHS will never ask you to prove your identity by asking for copies of personal documents such as a pay slip, driving licence or passport.

If you receive a call you believe to be fraudulent, hang up.

If you are suspicious about an email you have received, forward it to report @phishing.gov.uk.

Most individuals are now becoming more aware of these types of threats yet many are still vulnerable.

Awareness of potential threats, is key to risk management. By increasing our understanding of the these fraud trends we can protect friends, family and colleagues from harm.

More advice can be found at www.tenintel.com/corporate-fraud/covid-19-fraud-trends-and-cyber-threats/

 

January 2021

In 2020 the UK Government implemented various relief and economy-boosting schemes as part of its coronavirus strategy. Yet, fraudsters have eyed up an opportunity, as Analyst Jake Durham reports:

Over the last few months, the team at TenIntelligence have been raising awareness and supporting the recent COVID-19 anti-fraud campaign and anonymous hotline initiatives led by  CrimeStoppers, the Cabinet Office and HMRC.

The Government introduced various financial stimulus packages and schemes including, job retention, self-employment income support, statutory sick pay and the famous “Eat Out to Help Out” scheme, which according to government figures attracted £849 million in claims for 160 million meals in August 2020.

While there continues to be a debate over the effectiveness of the UK Government’s COVID-19 response, these schemes have provided a valuable lifeline to employers large and small.

The job retention furlough scheme (or CJRS) in particular has granted financial support to nearly 10 million people restricted from their jobs.

Anybody working in fraud prevention and due diligence will tell you that where there is opportunity, there is fraud.

So it was welcome news that HMRC and other enforcement agencies have partnered with CrimeStoppers to open a hotline and online form for members of the public to report so-called “COVID-19 Fraudsters”.

As of 12 January 2021 there have been 21,707 reports of alleged fraudsters targeting COVID-19 stimulus schemes.

Here are three of the most common reported types of COVID-19 fraud, and steps to take to protect yourself and your business:

Furlough Fraud

In September 2020, HMRC’s Chief Executive Jim Harra disclosed a working assumption within HMRC that 5-10% of Coronavirus Job Retention Scheme (CJRS) payments were claimed fraudulently. A firm has committed furlough fraud if:

  • It furloughs employees but requires them to keep working
  • It does not tell the workers that they have been furloughed
  • It claims compensation for workers who do not currently work for them
  • The firm claims more money than it is entitled to

Authorities are cracking down on furlough fraud with investigations, hefty fines and in extreme cases prison sentences. HMRC recently released recommendations for reforms to the Finance Bill 2020 which if approved by Parliament, would grant the ability to hold directors directly accountable for tax charges if they have knowingly broken CJRS rules.

Many firms are victims of genuine error when claiming furlough reimbursement, but HMRC doesn’t discriminate. An investigation for CJRS fraud is a nightmare scenario for any business owner.

To avoid this scenario, firms should regularly audit their COVID compliance.

If you suspect compliance errors have occurred, consider a more forensic investigation, such as reviewing internal communications.

Eat Out to Help Out Fraud

Some eateries abused the “Eat Out to Help Out” scheme by submitting claims for takeaway and delivery food and alcoholic beverages that were not eligible for reimbursement. Misuse of the scheme can lead to criminal investigations including fraud by false representation, false accounting and conspiracy to defraud.

The government issued guidance on 2nd November for businesses seeking to repay wrongly claimed funds with a strict notification period of 90 days after receiving the unentitled payment.

There are around 4,000 restaurants facing potential probes by the HMRC and honest errors can and will occur, so eateries and their accountants should be sure to double-check their compliance before the grace period ends.

Scam Calls, Texts and Websites

Phishing scams/frauds have developed over the past year to take advantage of the governments use of texting to deliver official coronavirus alerts.

Fraudsters pretending to be from the government, GPs and the NHS have used calls, texts and fake websites to scam people out of their personal info and bank details.

Some frauds are obvious, while others convincingly mimic official UK Gov messages to direct marks to fake gov.uk and NHS sites which request their personal data.

Most recently, fraudsters have begun sending fake calls to register to get vaccinated. Employers can keep their employees safe and fight scammers by making them aware of phishing scams.

If you or your employee receives a suspicious call or text it should be reported to Action Fraud by calling 0300 123 2040 for investigation.

  • The NHS will never ask you for your bank account or card details.
  • The NHS will never ask you for your PIN or banking password.
  • The NHS will never arrive unannounced at your home to administer the vaccine.

Analyst

jake.durham@tenintel.com

Our
Services

Due Diligence

International Background Checks

Financial Crime Compliance

Strategic Intelligence

Investigations

Corporate Fraud

Litigation Support

Digital Forensics

Corporate Security

Brand Protection

Cyber Security

Corporate Security

Our Intelligence | Your Assurance

Top Ten updates you may have missed: October 2020

by Neil Miller

TenInsight

Top Ten Updates you may have missed Legislation changes and guidance from partners in the cyber-security, data protection and fraud investigations industry. Here are our top ten updates:

Top Ten Updates | January 2021

#1 EU-UK transition period:

The EU-UK trade agreement was reached on 24th December 2020 and data protection provisions have been temporarily extended for a 6 month period. This means organisations need to consider international transfers of personal data and to plan for minimal interruption to their business.

If you have issues or concerns relating to dataflow, data inventory or third party data sharing please contact us if you need help sorting out data transfers.

Last month, the Government announced that the Treaty agreed with the EU will allow personal data to flow freely from the EU (and EEA) to the UK until adequacy decisions have been adopted, for no more than six months.  This will enable businesses and public bodies across all sectors to continue to freely receive data from the EU (and EEA), including law enforcement agencies.

As a sensible precaution, we recommend businesses work with the EU and EEA organisations that transfer personal data to them to put in place alternative transfer mechanisms, safeguarding against any interruption to the free flow of EU to UK personal data.

#2 Latest fines by the UK’s ICO (Information Commissioner’s Office):

The ICO fined Marriott International Inc £18.4million for failing to keep millions of customers’ personal data secure. The Marriott group estimates that 339 million guest records worldwide were affected following a cyber-attack in 2014 on Starwood Hotels and Resorts Worldwide Inc.

The attack, from an unknown source, remained undetected until September 2018, by which time the Starwood Hotels had been acquired by Marriott.

On 29 Oct 2020, the ICO has fined Reliance Advisory Limited (“RAL”)£250,000 for breaking electronic marketing law. The ICO found that over a six month period from the start of 2019, the Bury based company RAL made 15.1million calls in relation to claims management services such as mis-sold PPI.

All of the calls, of which 1.1 million connected, were made to people who had not consented to receive them.

The ICO fined British Airways (“BA”) £20m for failing to protect the personal and financial details of more than 400,000 of its customers.  An ICO investigation found the airline was processing a significant amount of personal data without adequate security measures in place. This failure broke data protection law and, subsequently, BA was the subject of a cyber-attack during 2018, which it did not detect for more than two months.

#3 Fraud now accounts for one-in-three crimes in the UK:

A report by ex-Metropolitan Police Deputy Commissioner Sir Craig Mackey, found that fraud now accounts for one-in-three crimes in the UK. It is estimated that 86% of fraud is committed online, permitting fraudsters to operate from anywhere in the world.

London sees the greatest concentration of fraud cases. Throughout 2019, the Metropolitan Police investigated more than 8,000 cases of fraud, compared to the 1,600 by Greater Manchester Police.

 #4 Banking Fraud reports:

TSB Bank have reported that in H1 of this year, £582.2m has been lost to bank fraud. Of this figure, £207.8m was a result of “Authorised Push Payment”  fraud, where victims are tricked into making large bank transfers to an account posing as a legitimate payee.  TSB Bank believes that reporting only stands at 25% and the problem is likely to significantly larger than previously reported. The pandemic has seen an increase in internet banking, which has created more targets for the fraudsters.

#5 Deepfake Fraud:

Additionally, new fraud trends using artificial intelligence have been observed, namely “deepfake” fraud. A deepfake is a video or audio clip where someone’s face or voice has been replaced with another person’s likeness using Artificial Intelligence.

Last year, the CEO of a UK energy firm followed directions given over the phone by the chief executive of the firm’s parent company to transfer €220,000 to one of their suppliers. However, it was not the parent company’s CEO speaking, instead it was a convincing example of voice cloning. According to the victim, the voice was indiscernible from the real thing, and he only caught on due to certain inconsistencies including the phone number being Austrian when it should have been German.

Deepfakes can be used for new account opening fraud or account takeover fraud.  Security practices to protect from deepfakes:

  • Trust but verify, call back on a number you know to be correct
  • Consider the source
  • Look for inconsistencies, check the phone number, email, or account the audio or video came from
  • Limit access to your voice and images, fraudsters need recordings, images or footage of you to create deepfakes.

#6 The Office of Financial Sanctions Implementation (OFSI) 

Since the EU-UK transition period ended on December 31st 2020, the UK will no longer apply EU sanctions regulations and all sanctions regimes will be implemented through UK regulations.

The Sanctions and Anti-Money Laundering Act 2018 (the Sanctions Act) provides the legal framework for the UK to impose, update and lift sanctions autonomously.

The Foreign, Commonwealth and Development Office (FCDO), which determines international sanctions policy in the UK, has already implemented regulations for over 30 sanctions regimes in preparation for the transition.

Organisations should check the new legislation to ensure that their activities are still compliant.  A list of the UK regimes, legislation and guidance already made in preparation for the end of the transition period is available on FCDO’s website.

#7 H&M handed GDPR fine of 35M Euro

On 1 October 2020, the German State Commissioner for Data Protection and Freedom of Information (Landesbeauftragte für Datenschutz und Informationsfreiheit) of Hamburg (the DPA) imposed a fine of EUR 35.3 million under the GDPR against the German subsidiary of the fashion retailer H&M.

The DPA found that the company had collected extensive records relating to the private lives of several hundred employees, which included health data and sensitive data.  The DPA also expressed concerns over personal data collected in relation to so-called “Welcome Back Talks” which followed an employee’s leave of absence.

The records of these talks included not only the employees’ vacation experiences, but also symptoms of illness and diagnoses. In addition, some supervisors recorded other private information such as family problems and religious beliefs.

#8 Irish Organisations Online Cookie Compliance

Organisations in Ireland had until 5 October to update their online cookie compliance and there are significant penalties for non-compliance under GDPR legislation.

This is the advice of the Association of Compliance Officers Ireland (“ACOI”) who say that implementation of the Data Protection Commission’s (DPC) guidance has significant implications for Irish organisations, particularly those SMEs whose resources may be already fully focused on surviving Covid-19 and preparing for Brexit.

The ACOI advise that all organisations should give high priority to this issue for the remainder of this year.

#9 Egypt introduces new Data Protection Law

After several years of debate, the Egyptian government has introduced the Republic’s first standalone data protection law, which aims to regulate and protect citizens’ data online.

On 15 July 2020, Resolution No. 151 of 2020 (the Law) was published in the Official Gazette. The provisions under the new Law are modelled on GDPR and the Law adopts similar concepts and definitions.

It is hoped that the new Law will help Egypt attract foreign investment by increasing consumer confidence in electronic data processing and setting clear parameters for companies looking to capitalise on the growth of the digital economy.

The Law will enter into force three months from when it was published in the Official Gazette.

#10 Zimbabwe to amend its cyber security and data protection laws

Debates in the Zimbabwean Nation Assembly last week led to amendments in certain clauses of their Cybersecurity and Data Protection Bill. The clauses in question are 13, 17, 23, and 164.

Clause 164 suggests a criminal lawsuit against any person who sends data messages which have the potential to provoke or incite violence and damage to property.

The reprimand would be a monetary fine, or imprisonment of up to 5 years.

Top Ten Updates | October 2020

#1 EU-US Privacy Shield considered “invalid” by EU legislation

Following the recent invalidation of the EU-US Privacy Shield on 16 July 2020 by the Court of Justice of the European Union (“CJEU”), the situation with respect to data transfers is becoming progressively complex.

The EU-US Privacy Shield no longer constitutes a valid basis for the transfer of personal data to the United States and while Standard Contractual Clauses (“SCCs”) remain in force for the time being, constituting an alternative which is in principle legitimate for the US transfer of data, a number of EU Supervisory Authorities have adopted particularly critical positions. However, the UK’s Information Commissioner’s Office (“ICO”) posted the following statement on its website: “We are currently reviewing our Privacy Shield guidance after the judgment issued by the European Court of Justice on Thursday 16 July 2020. If you are currently using the Privacy Shield please continue to do so until new guidance becomes available. Please do not start to use Privacy Shield during this period.”

The CJEU has confirmed how EU standards of data protection must travel with the data when it goes overseas, which means this judgment has wider implications than just the invalidation of the EU-US Privacy Shield. It is a judgment that confirms the importance of safeguards for personal data transferred out of the United Kingdom.

The European Data Protection Board (“EDPB”) has recently issued FAQs on the invalidation of the EU-US Privacy Shield and the implications for the SCCs, and this guidance still applies to UK controllers and processors.

Further updates are being considered by the EDPB to provide more guidance on the extra measures you may need to take.  In the meantime you should evaluate and consider the international transfers you make and be ready to react promptly as guidance and advice becomes available.

It is therefore recommended that you consider undertaking a risk assessment as to whether SCCs provide enough protection within your local legal framework, whether the transfer is to the US or elsewhere.

#2 Guidance from the ICO on Artificial Intelligence frameworks

On 30 July 2020, the ICO published its final guidance on Artificial Intelligence (“AI”). The Guidance sets out a framework for auditing AI systems for compliance with data protection obligations under the GDPR and the UK Data Protection Act 2018.

The Guidance builds on the ICO’s earlier commitment to enable good data protection practice in AI, and on previous guidance issued on specific issues relating to AI. The ICO also provides advice and recommendations on best practice in applying core GDPR principles to AI and will be topical to those that develop or integrate AI into their products and services.

The ICO suggests adopting a risk-based approach when evaluating AI systems to help identify and mitigate data protection risks, especially in early product development phases.

#3 FCA Conduct Rules extension

On 17 July 2020, the Financial Conduct Authority (FCA) published Consultation Paper 20/10 proposing an extension to the deadline for training staff on the Conduct Rules and reporting “Directory Persons” data to 31 March 2021.

Extending these deadlines will provide extra time for FCA solo-regulated firms that have been impacted by the COVID-19 pandemic. The FCA will continue to publish details of Certified Persons at FCA solo regulated firms on the Financial Services Register from 9 December 2020, as firms submit this data. However, the FCA still encourages firms to submit the data before March 2021, to the extent they are capable of doing so.

#4 National Crime Agency Annual Report published

On 21 July 2020 the National Crime Agency (“NCA”) released its Annual Report outlining financial information and other data, and provides a snapshot of the NCA’s performance and wider enforcement patterns, increased forfeiture and confiscation. The NCA enjoyed a record year for forfeiture and confiscation receipts. It recovered £10,097,000, 41% more than in 2018-19 and 37% more than in its second-highest year, 2016.

The 2019-20 period also saw the NCA demonstrate the effectiveness of Account Freezing and Forfeiture Orders (“AFFOs”). Whereas in 2018-19 the NCA froze £64.2m in assets, in 2019-20 it froze over £145m, with more than £100m of the total frozen through AFFOs.

#5 UK Anti-Corruption Strategy 2017-2022 updated

The RH James Brokenshire endorsed the Government’s strategy, stating that corruption and illicit finance make it easier for criminals to commit and profit from crime. “They undermine our national security and prosperity and corrode trust in institutions. These threats enable serious and organised crime (including drugs, terrorism and fraud), and present threats at our borders. Bribery and weak anti-corruption laws stop British businesses competing on even terms in new markets, potentially undermining our position as an Independent trading nation, now we have left the European Union.”

“Perceptions of corruption and the spotlight being shone on elites playing by a different set of rules undermines trust in our nation.”

The updated report recognized that these threats have been heightened by the Coronavirus pandemic.

#6 The FCA delays deadline for Senior Managers and Certification Regime

In December 2019, the Financial Conduct Authority (“FCA”) replaced the Approved Persons Regime with the Senior Managers and Certification Regime (“SM-CR”) for the majority of solo-regulated firms. The SM-CR applies to regulated firms and employees whose role means it is possible for them to cause significant harm to the firm, its customers or the market more generally.  The new SM-CR places the responsibility on firms to assess and certify that the relevant individuals are “fit and proper” to perform their role at least once a year.

The FCA has since published an updated relating to “positive” and “negative” indicators in which it expects firms to assess the fitness and propriety of their Senior Managers and Certified Persons. As a result of this updated guidance, the FCA has agreed to extend the deadline for firms to perform their fit and proper checks from 9 December 2020 to 31 March 2021.

Regulated firms now have an opportunity to ensure they have effective systems and controls to make the best business decisions and to withstand potential scrutiny from the FCA.

#7 Action Fraud reports an increase in Cyber attacks at home

Action Fraud has revealed that a total of £11,316,266 has been reported lost by 2,866 victims of coronavirus-related scams and have received 13,820 reports of coronavirus-related phishing emails.

#8 Fraud Watch Group updates from the UK’s Fraud Advisory Panel

The Fraud Advisory Panel have set up a COVID-19 fraud watch group which is a cross-sector and cross-industry coalition of trusted partners (including the Cabinet Office and City of London Police) who meet to share information on emerging fraud threats and trends affecting business. The fraud watch group aims to act as a conduit to warn the public, private and third sectors about COVID-19 fraud risks and the preventative actions that can be taken.

The group can be found at https://www.fraudadvisorypanel.org/covid-fraud-watch-group/

#9 The National Cyber Security Centre issues Academia Alert

Since August 2020, the National Cyber Security Centre (“NCSC”) has been investigating an increased number of ransomware attacks affecting education establishments in the UK, including schools, colleges and universities.

Due to the prevalence of these attacks, institutions should be sure to follow NCSC’s recently updated mitigating malware and ransomware guidance.

This will help implement strategies to defend against ransomware attacks, as well as planning and rehearsing ransomware scenarios, in the event that your defences are breached. The guidance can be found at https://www.ncsc.gov.uk/guidance/mitigating-malware-and-ransomware-attacks

#10 Interpol global operation sees a rise in fake medical products related to COVID-19

In March 2020, Interpol launched Operation Pangea XIII, which saw police, customs and health regulatory authorities from over 90 countries take part in collective action against the illicit online sale of medicines and medical products. Counterfeit facemasks, substandard hand sanitizers and unauthorized antiviral medication were all seized under Operation Pangea XIII.

The operation resulted in 121 arrests worldwide and the seizure of potentially dangerous pharmaceuticals worth more than USD$14 million.

Our
Services

Due Diligence

International Background Checks

Financial Crime Compliance

Strategic Intelligence

Investigations

Corporate Fraud

Litigation Support

Digital Forensics

Corporate Security

Brand Protection

Cyber Security

Corporate Security

Our Intelligence | Your Assurance

Advisory Board Column, Colin Culleton reports…

by Neil Miller

Here is a hypothetical question for our loss prevention and professional security contacts:

The scenario is your company or organisation has suffered a substantial fraud, loss of goods or cash. There is strong circumstantial evidence that the offence was committed by internal members of staff, some of whom have senior and trusted positions. The timing and delays in reporting the incident adds to the suspicion of internal involvement and reduces the risk of recovery of the proceeds.

You are faced with 3 options:

1) Call the Police, trusting that they will do a full and thorough investigation in a timely manner.

2) Attempt to investigate the suspicion yourself.

3) Engage a professional investigations company that will conduct some or all of the investigation.

From my point of view, the following investigation elements will need to be considered, dependent upon the level of loss and severity of the suspicion:

  • Ensure prompt retrieval and viewing of any CCTV evidence in and around the premises
  • Profiling/background checks on all staff members who were on duty prior, during and after the theft (as well as those on furlough, those currently on annual/sick leave and also those who have been made redundant since lockdown)
  • Wi-Fi audit logs. Was there any connections to the local Wi-Fi prior, during and after the theft. If so, what devices were connected.
  • If the company phones automatically sync to the Wi-Fi, this may identify employee phone details
  • Secure and forensically preserve evidence from desktop/laptops in the relevant work areas. If required, these can be examined in more depth at a later stage.
  • Mobile and telephone logs for all suspected staff  – cross reference activity using forensic software to triangulate common/mutual communications/texts/calls.
  • Obtain telephone logs or access control records from the relevant area
  • Research social media and e-commerce platforms if physical, re-saleable goods were stolen
  • Interviews conducted promptly by trained and experienced staff
  • If required, surveillance on key suspects over a period of time.
  • Prepare a professional evidence package for criminal or civil action

This list is not exhaustive, and the offence could involve theft of sensitive data for example, which may require further bespoke, professional and independent investigative services and appropriate disclosure to the Information Commissioner’s Office (ICO).

I know what choice I would make, predominantly based on many years of frustration and disappointment over delays or minimal input by Police into incidents of internal loss.

Very often, the initial response by Police to internal dishonesty is good but the pace and scope of the investigation rarely matches what can be achieved by independent experts. This is by no way a criticism of the Police, who are required to prioritise resource and often don’t have the skills, experience or tools to conduct the necessary investigations. However, all loss prevention and security professionals are seeing the necessity for private policing in so many areas at the moment and investigation of internal dishonesty can also be outsourced to professional investigations companies.

Colin Culleton

TenIntelligence Board Advisor

Founder at Asset-Protect Consulting

Former Group Loss Prevention Manager at Next Group and Jack Wills

Laptops audits GDPR, furlough staff and data protection

by Neil Miller

Are you collecting laptops and devices from furloughed or redundant employees? Are your employees returning to work?

The General Data Protection Regulations (GDPR), the UK’s Data Protection Act 2018 (DPA18) and other international privacy laws, require all organisations to update and monitor their procedures on how personal information must be handled and protected. Therefore, we urge all organisations to perform non-intrusive forensic audits on devices, laptops and phones to confirm that your company data and any personal data remains secure and was not inadvertently been leaked or breached. Consider undertaking fundamental forensic examination or spot checks on company devices; to include an examination of USB usage, Wi-Fi access, download/upload history, browsing histories and security updates.

Disgruntled Employees

Be aware of the threat of disgruntled employees who have either been made redundant or furloughed; yet are still in possession of your company devices and confidential information. A large percentage of internal fraud is conducted by employees who were or are, facing some form of discipline or change at work. Have they had access to the network during this pandemic, if so what information could they have accessed, downloaded or possibly leaked to others?

Consider the situations and issues experienced over the last few months and review the following processes to help improve your remote working and data compliance posture:

  • Conduct data flow and information audits across the organisation to review, identify and assess the data being held remotely.
  • Update security controls and patches.
  • Develop staff training & awareness programs.
  • Consider gap analysis to help identify control weakness, strengths and areas for development, especially home working environments and update the Risk Register.
  • Design and implement appropriate remote working and internal measures to ensure Data Protection is integrated into all processes.
  • Design Data Privacy Impact Analysis frameworks linking to pre-existing and remote working processes.
  • Review the processing of data, identify and document the lawful basis for the processing activities, including clear and concise consent mechanisms.
  • Review and update framework of remote working policies and procedures needed to ensure GDPR/DPA18 audit compliance.
  • Monitor compliance and regularly review the effectiveness of processing personal data.
Our Intelligence | Your Assurance

Brand protection news from our Dubai Team | June 2020

by Neil Miller

Brand protection news from our Dubai Team | June 2020

From the early outset of COVID-19, the UAE government were quick to respond to engage its citizens in a phased approach to help reduce the spread of the virus. 

Business continuity during lockdown from an enforcement perspective

Under the tag line, “We are all responsible,” the campaigns have included the closing of schools in March, sanitisations performed in public areas, curfews and movement restrictions implemented, drives to promote the washing of hands, compulsory wearing of masks at all times and social distancing were just some of the measures set.

While entire families are working from home, the online demand for legitimate sanitising products and safety medical supplies has soared in the fight against this pandemic.  This growth in demand has caused a parallel risk of substandard and counterfeit medical supplies in the global market.

The health and safety of UAE residents is a primary objective, with inspectors from the Consumer Protection Departments and Criminal Investigation Departments in the Emirates proactively carrying out monitoring for price hikes of legitimate products; ensuring there is sufficient stock of food and household items and for the sale of counterfeit COVID-19 related products.

Our Dubai team have been working with clients and Law Enforcement Agencies across the UAE, supporting them with strong anti-counterfeiting measures and have carried out inspections with authorities in Abu Dhabi, Dubai and Ajman for the sale of counterfeit disinfectant cleaning products. Several thousand products have been seized from shops and supermarkets. These products are inferior in quality, the chemical properties are unknown and will most likely cause harm to the customer who has purchased it in good faith.

Here are our top tips to identify counterfeit disinfectant:

  • Check the packaging quality
  • Overt spelling mistakes
  • Verify using QR/Scan code checking apps
  • Identify any leakage on the product
  • Determine whether the price is too low

Now that customers are favouring online purchases over visiting shops, these traders who may have only relied upon customers visiting their physical premises have also had to change the way they operate and move the sale of products to social media platforms (Instagram, Facebook, TikTok) and local e-commerce platforms.

Taking proactive measures, our team have monitored these platforms, and have increased our online test purchases for counterfeit products. On confirming the counterfeit nature of the products, we then perform due diligence using Open Source Intelligence (OSINT) measures on the sellers to establish connections to trading and storage addresses in readiness for enforcement action with local UAE authorities.

TenIntelligence leads Abu Dhabi Customs online training

While working remotely, our team presented online training to over 100 inspectors from both departments at Abu Dhabi Customs and the Abu Dhabi Consumer Protection to assist in identifying counterfeit COVID-19 related products.

For more updates, you can follow us on LinkedIn and Twitter @TenIntelligence.

You can also visit our website at www.tenintel.com/brand-protection, where you can find out how we support clients in the identification, gather intelligence and the execution of enforcement notices on counterfeit branded goods found in the UAE.

To protect your brand and keep your customers safe, contact our brand protection team in Dubai at dubai@tenintel.com, so we can work collaboratively for the identification and safe removal of counterfeit products.

Insights

Brand Protection Services | Online and Offline

Brand protection news from our Dubai Team | October 2018

Dubai Police Liaison & Brand Protection

TEN facts on counterfeiting products

Counterfeit Investigation & IT Equipment

Counterfeit goods seized

Test purchases and evidence packages

Our
Services

Due Diligence

International Background Checks

Financial Crime Compliance

Strategic Intelligence

Investigations

Corporate Fraud

Litigation Support

Digital Forensics

Corporate Security

Brand Protection

Cyber Security

Corporate Security

Our Intelligence | Your Assurance

COVID-19 Business Continuity Planning – here are our Top 10 tips

by Neil Miller

COVID-19 Business Continuity Planning - here are our Top 10 tips

COVID-19 forced many organisations to implement their contingency and emergency plans, yet some did not have time to fully implement them. Many lessons have been learnt, and quickly too.  Here are our top ten considerations.

Business continuity planning is the process of creating an action plan to minimise the impacts of interruptions to your business. A robust business continuity plan (BCP), in conjunction with business processes and insurance, will help make your company more resilient against any type of incident or disasters such as a flood, fire and more recently, a global pandemic.

Each organisation will be different, and one size definitely does not fit all, at TenIntelligence we recommend 10 specific considerations when creating, implementing and maintaining a business continuity plan.

Risk Assessment

Identify the threats your business may face and what measures are in place or need to be put in place to protect your business, building and its assets. Understand the potential scale and impact of an incident from short-term power and IT outages and major incidents. Retrospectively, what has your organisation achieved well in its assessment during this pandemic, and benchmark what you learnt.

Business Impact Analysis

Identify your critical business functions and the parts of your company that are most vulnerable in the event of business interruption. How would they be impacted by an emergency? How long is it likely to take to get the business back up and running? What is the potential for damage to your reputation?

Command & Control

Establish a leadership team responsible for controlling all incident related activities and developing the business continuity plan.

Create & Implement a Business Continuity Policy (BCP)

Your BCP should contain all the procedures and details necessary to continue business operations during or after an emergency. All employees should be briefed on the BCP and trained on emergency evacuation, business recovery and restoration procedures.

Communication

A solid communication plan and supporting system is crucial for reporting emergencies, warning personnel of any danger, keeping families and off-duty employees informed about events happening at your facility, coordinating response actions and keeping in contact with customers and suppliers.

Your people

Ensure the health, safety and well-being of all your staff is your first priority. Evacuation, accountability, shelter and preparedness plans during a business interruption are key.

Protect your assets

Organising a system for protecting facilities, equipment and vital records is essential to restoring operations once an emergency has occurred. Intruder alarms, CCTV, fire alarms, and IT systems all need to be recorded, monitored and maintained.

Stakeholder & Community

Your relationship with stakeholders, emergency services and the local community will influence your ability to protect personnel and property as well as return to normal operations.

Recovery & Restoration

Business recovery and restoration goes right to a facility’s bottom line – keeping your business operational. Your plan should ultimately cover all the steps need to restore and resume your business as quickly as possible.

Test, Monitor & Maintain

Review and update your plan regularly to consider new and emerging threats, new technology, operational and personnel changes. Regular training, from walk-through drills to full-scale mock disaster exercises, will help you stay one step ahead of potential issues.

Richard Bell | Board Advisor

For further information, visit www.tenintel.com/cyber-security, where you can find out how we support clients with Corporate Security and digital forensics support.

Email us at info@tenintel.com and follow us on LinkedIn and Twitter @TenIntelligence for all updates.

Our
Services

Due Diligence

International Background Checks

Financial Crime Compliance

Strategic Intelligence

Investigations

Corporate Fraud

Litigation Support

Digital Forensics

Corporate Security

Brand Protection

Cyber Security

Corporate Security

Our Intelligence | Your Assurance