Guilty until proven otherwise?

 

New hate speech laws kick up a storm in Ireland

Joshua Askew 

Donald Trump Jr has even taken aim at the proposed legislation labelling it "insane".

New laws aimed at curbing hate speech have sparked controversy in Ireland. 

                   The updated legislation will create landmark laws to deal with hate crimes, make it an offence to deny or trivialise genocide and expand protections to include gender identity and disability. 

Opponents of the Criminal Justice Bill have raised concerns the changes go too far and will stifle free speech. 

However, defenders say Ireland's current legislation has been outstripped by the internet and contains significant blind spots. 

Minister for Justice Helen McEntee, who first published the bill currently making its way through the country's Parliament (Oireachtas), hit back at claims speech would be restricted. 

Hate speech and freedom of speech are two separate things, with the former designed to shut people up and "make them afraid". 

“We are all horrified when we hear of homophobic, racist, and other hateful incidents in our country," she said in October. 

"While these repulsive acts of violence and abuse against innocent people have been extensively reported on, we know that some people go about their lives constantly in fear of abuse simply because of who they are."

The new law will introduce specific legislation to tackle hate crimes, which it considers intentional or reckless communication and behaviour that is likely to incite violence or hatred, establishing penalties of up to five years in prison. 

Victims of hate crimes are targeted due to prejudice against their age, ability, ethnicity, religion, nationality, sexual orientation or gender.

                        It will also make it much easier to secure convictions for hate crimes by allowing prosecutors to rely on the use of hostile slurs, gestures or symbols. 

Critics fear the changes could lead to politically incorrect views being censored, such as those around trans rights. 

                   Some public figures have waded into the debate with Donald Trump Jr calling the new law “insane” and Twitter boss Elon Musk branding it "a massive attack on the freedom of speech". 

The legislation is long-awaited. 

Ireland currently does not have specific laws to deal with hate crimes, while its laws on hate speech are widely seen as archaic. 

Existing hate speech laws date back to 1989, with the Prohibition of Incite to Hatred Act. 

This makes it an offence to communicate threatening, abusive or insulting material that is likely to "stir up" hatred against a group of people. 

                    However, under this law, a person can defend themselves against charges by proving they did not intend to spread hatred. 

Their defence can be based on not knowing the content of the materials or lacking a reason to suspect that it was threatening, abusive or insulting.

The new law changes this, making one liable for a hate crime even if they did claim they did not intend it. 

Others were cautious about the bill. 

"In general we support those changes as they are designed to make the law more effective and protect vulnerable groups from attack," said the Irish Council for Civil Liberties in a statement sent to Euronews.

                         "However, we have been advocating to strengthen and make more explicit freedom of expression defences in the Bill and we are advocating against the inclusion of an offence that would criminalise the possession and preparation of material that would incite hatred."

They suggested "other forms of hate speech, which might cause deep offence but do not reach a criminal threshold, should be combated by other means, including education and monitoring".

On the dark art of social hacking

 THE DARK ARTS: HACKING HUMANS

Will Sweatman 

One of the biggest challenges for a company that holds invaluable data is protecting it. At first, this task would seem fairly straightforward. Keep the data on an encrypted server that’s only accessible via the internal network. The physical security of the server can be done with locks and other various degrees of physical security. One has to be thoughtful in how the security is structured, however. You need to allow authorized humans access to the data in order for the company to function, and there’s the rub. The skilled hacker is keenly aware of these people, and will use techniques under the envelope of Social Engineering along with her technical skills to gain access to your data.

Want to know how secure your house is? Lock yourself out. One of the best ways to test security is to try and break in. Large companies routinely hire hackers, known as penetration testers, to do just this. In this article, we’re going to dissect how a hired penetration tester was able to access data so valuable that it could have destroyed the company it belonged to.

INFORMATION GATHERING

The start of any hack involves information gathering. This is usually pretty easy for larger companies. Their website along with a few phone calls can reveal quite a bit of useful information. However, you can be assured that any company who has hired a pen tester has taken the necessary precautions to limit such information.

And such was the case for our hacker trying to gain access to the ACME Corp. servers. Her first target was the dumpsters – dumpster dives have been proven to unearth a trove of valuable information in the past. But the dumpsters were inside the complex, which was guarded by a contracted security firm. Through a bit of website snooping and a few phone calls, she was able to find out the department that was in charge of trash removal for the company. She then placed a phone call to this department. Using a social engineering (SE) technique known as Pretexting, she pretended to be with a trash removal company and wanted to submit a quote to service their business. Using another SE technique called Elicitation, she was able to find out:

that trash collection took place on Wednesdays and Thursdays

the total number of dumpsters

that there was a special dumpster for paper and technology trash

the name of the current waste removal company – Waster’s Management

the name of the employee in charge of the waste removal – [Christie Smith]

DUMPSTER DIVE

Armed with this information, she went to the Waster’s Management website and grabbed their JPEG logo.

Within a few days, she had a shirt and hat with the logo in her hands. She called the security department and said she was with Waster’s Management, and that [Christie Smith] had told her one of the dumpsters was damaged, and she needed to take a look at it before the next trash removal.

The next day, wearing the shirt and hat she had ordered online, she was given a badge from security and allowed access to the dumpsters. Now, any hacker worth her weight in PIC16F84’s already knows what dumpster she dove into. It didn’t take her long to walk away with several hard drives, a few USB drives and some useful documents. She was able to gain knowledge of an upcoming IT contract work, the name of the CFO, and the name of a server with some level of importance – prod23.

HACKING THE SERVER

With some more SE, she was able to find out when the IT work was scheduled. It was after hours. She showed up a bit late and was able to walk right through the front door by claiming she worked for the IT contract company. She then shifted roles and pretended to be an employee. She approached one the real IT contract guys, and said she worked for the CFO, [Mr. Shiraz], and asked if he knew to be careful with the prod23 server. With more SE, she was able to find out the prod23 server was off-limits, encrypted, and only accessible by specific admins.

She was able to access an admin office, and it was there she would don her black hat. She booted the computer with BackTrack via USB and installed a key logger. She made an SSH tunnel to her personal server where she could dump the contents of the key logger, along with some other shells. Now, this is where things get interesting. She opened Virtual Box and used the computer’s hard drive as the boot medium. The VM booted the OS, and she hid all of the screen decorations to make it look like the target OS was running. The admin would log in without a clue, and our hacker would get their username and password through the key logger.

Once the login information came in, she was able to access the admin’s computer, and from there the prod23 server. You can imagine the look on the faces of the top executives for ACME Corp when our hacker handed them a copy of the keys to their kingdom.

Social engineering is human hacking, and a dark art in itself. Our hacker in this story would have never been able to even get close to the server if she did not have SE skills. No matter how secure you make something, so long as you allow humans access to it, it’s vulnerable to attack. And then it’s down to how well-trained your people are in repelling these kinds of intrusion.