Florida is seeking to outlaw the malicious distribution of sexually explicit images without the subject’s consent. 

New legislation advanced in the Florida Senate Criminal Justice Committee on Tuesday aims to curb the unauthorized digital trafficking of real and deepfake lewd content and establish new regulations around revenge porn.

Senate Bill 1798, introduced by senator Lauren Book, would prohibit someone from knowingly, willfully and maliciously disseminating deepfake sexually explicit images without the permission of the individual(s) pictured. 

It would also criminalize the theft of sexually explicit images from an individual’s phone or digital device with the intent to distribute or benefit from them in some way.  

Additionally, the legislation renames “child pornography” as “child sexual abuse material” to underline that all visual depictions of sexually explicit conduct involving a minor constitute abuse and exploitation. 

Senator Brook said: “This bill will transform the way the state of Florida prosecutes and enforces ‘cyber trafficking,’ where images are uploaded to the darkest corners of the internet for people to buy, sell, trade, and use however else they see fit.”

Brook, whose own childhood was marred by six years of sexual abuse at the hands of her nanny, was also victimized in adulthood when nude photos of her were stolen. The senator became aware of the theft only when a cyber-criminal threatened to expose the images unless she paid a ransom. 

An investigation into the theft revealed that the images had been traded on the internet since 2010. Discussions about the images online included requests for content showing Brook being raped, killed and tortured. 

“Horrifically, once these images are online, they never truly go away,” said Brook. 

“It’s time to give victims some hope and bad actors a reason to think twice.”

The new bill also seeks to allow victims of this form of cybercrime to be entitled to seek civil damages up to $10,000.

Speaking on Tuesday after SB 1798 won the Committee’s approval, Brook said: “Today is an excellent first step at updating our laws to reflect the added layers of terror and victimization that are emerging due to the digital world we live in.”

A configuration error has caused a prolonged data breach at a Florida County’s drug screening laboratory. 

The security incident occurred at St. Lucie County’s Drug Screening Lab (SLC Lab), which supplies drug testing services for employment, court cases and other purposes.

In a statement released January 20 2022, County leaders said that a misconfiguration detected in the lab’s website portal had inadvertently made some of the portal users’ personal data accessible for more than four years.

“Upon learning of this issue, SLC Lab corrected the misconfiguration and immediately launched an investigation in consultation with outside cybersecurity professionals who regularly investigate and analyze these types of incidents,” said the officials. 

“SLC Lab devoted considerable time and effort to determine what information may have been accessible to unauthorized users.”

A digital forensic investigation was launched to determine what data had been exposed by mistake. 

The County said: “SLC Lab discovered on December 28 2021 that the website portal misconfiguration allowed for data to be accessible to certain portal users between June 2 2017 and October 13 2021.”

Data exposed in the incident included full names and one or more of the following: Social Security numbers, dates of birth and limited lab test type and result information.

“To date, SLC Lab is not aware of any reports of identity fraud or improper use of any information as a direct result of this incident,” said the County. 

On January 20, the lab began notifying affected individuals of the security incident by letter and encouraging them to enroll in complimentary credit monitoring services. County leaders did not state how many residents of St. Lucie County may have had their data compromised.

St. Lucie County spokesman Erick Gill told WPTV that the mistake impacted no other data in the care of the county. 

“SLC Lab is committed to maintaining the privacy of personal information in its possession and has taken many precautions to safeguard it,” said Gill. 

He added: “SLC Lab continually evaluates and modifies its practices to enhance the security and privacy of the personal information it maintains.”

An anonymous hacker has raised the alarm after discovering a vulnerability impacting Switzerland’s national railway system.

The flaw allowed the hacker to gain access to personal data belonging to around 500,000 individuals who had purchased tickets to ride on Swiss Federal Railways (SFR).

After detecting a weak spot in SFR’s Swiss Card system, the hacker reported it to the Rundschau show, which airs on Swiss public television, SRF.

Information left vulnerable by the flaw included travelers’ names, dates of birth, the number of first- and second-class tickets they purchased, places of departure and final destinations.

Speaking to the Rundschau program, the hacker said that anyone could have easily viewed the data as no specialist IT knowledge was needed to exploit the flaw. 

“The sensitive data was practically public on the internet,” said the hacker. 

The security breach was reported to Switzerland’s Federal Data Protection Commissioner. 

According to Swiss news site Swiss Info, the data compromised by the hacker was never made public and has since been secured by SFR. 

The hacker said that their motivation in exploiting the flaw was to expose its existence in the hope of averting a potentially malicious cyber-attack. 

“This is a huge meltdown for Swiss Railways,” Otto Hostettler, an author and journalist specializing in cybercrime, told the Rundschau program. 

“Such data can be sold in hacker forums on the dark web. In the wrong hands, it would have great potential for abuse.”

Cyber-criminals have been known to target the Swiss rail industry. In May 2020, hackers stole data from Swiss train manufacturer Stadler Rail and demanded a payment of $6m in Bitcoin for its return.

Following the attack, Stadler released a statement saying that it “is not and has never been willing to make payments to blackmailers and has not entered into negotiations.”

In response to Stadler’s rebuff, the cyber-thieves published images of some of the stolen files on the internet. A message accompanying the images stated that the criminals had swiped no fewer than 10,000 documents from the train maker. 

The company said it had backups of all the data compromised in the attack. 

The importance of mentoring and role models in helping women develop careers in cybersecurity was emphasized during the HackerOne Women in Cybersecurity Press Roundtable.

The panel, which comprised a range of leading female figures in the cybersecurity industry, discussed practical ways of improving gender diversity in the industry.

Marjorie Janiewicz, chief revenue officer at HackerOne, began by setting out a bleak picture regarding cyber’s gender imbalance. “It’s no secret that the cyber skills gap is rapidly growing, and women continue to be a minority in technical and cyber roles. We especially notice that underrepresentation in leadership roles,” she outlined.

The panelists then highlighted personal experiences that inspired them to successful careers in cyber. Keren Elazari, a cybersecurity analyst, researcher, author and speaker, described initially feeling “lonely” operating in the industry as an anonymous white hat hacker. However, when attending her first hacker conference, Y2hacK, she became inspired mixing and interacting with like-minded people. In addition, while there were only three women present at the event, “the fact the organizer of the event was a woman, that gave me the signal that although I don’t see anyone that looks like me around, there’s space for me in this community.”

Sandra McLeod, head of security assurance at Zoom, similarly emphasized the importance of role models during her career. “I had the opportunity to work among and alongside some incredible top talent that I learned from and had some amazing mentors who encouraged me to take that next step.”

While the panelists had female role models they could look up to while navigating the start of their career in the industry, this is often not the case for many women. Lynn Dohm, executive director of Women in CyberSecurity, noted: “It’s hard to be what you cannot see and when you have that power of community and you have those women in front of you that you aspire to be, it builds up your confidence and strength to think ‘yes this is a place where we belong’ and we can advance in our careers.”

Therefore, a key means of enabling women to succeed in cyber is “creating the power of community where there is that collective strength as a network and as a community to grow and expand our cyber careers collectively.”

Annika Erikson, senior security manager at Salesforce, concurred, explaining how mentoring helped open doors to her in the industry. “I’ve had mentors, both women and men, that have invited me to tables I would never have invited myself to and brought me into conversations.” She said that these experiences “gave me the confidence to then invite myself to more discussions.”

Erikson added that she now offers the same mentoring opportunities to help others in the sector. “Anybody can be a mentor to anyone in their organization or across organizations and invite them into those discussions and conversations. This will let them know their contributions are extremely valuable,” she commented.

Threat actors laundered $8.6bn in cryptocurrency last year, although the real figure could be much higher when “non-crypto” crimes are included, according to Chainalysis.

The firm provides analysis and investigation software to help shine a light on the murky world of blockchains and decentralized finance (DeFi).

Findings from an upcoming report released yesterday revealed a 30% year-on-year increase in the value associated with money laundering activity via cryptocurrency in 2021.

However, that’s not the whole story.

“We also need to note that these numbers only account for funds derived from ‘cryptocurrency-native’ crime, meaning cyber-criminal activity such as darknet market sales or ransomware attacks in which profits are virtually always derived in cryptocurrency rather than fiat currency,” the firm explained.

“It’s more difficult to measure how much fiat currency derived from offline crime – traditional drug trafficking, for example – is converted into cryptocurrency to be laundered. However, we know anecdotally this is happening.”

Despite its reputation for being something of a Wild West, it’s easier to monitor money laundering efforts where cryptocurrency is involved because of the transparent nature of blockchains.

To that end, DeFi protocols received the majority of illicit funds last year, the first since 2018 where centralized exchanges haven’t been the number one recipient, according to Chainalysis.

That amounts to a 1,964% year-on-year increase in total value received by DeFi protocols from illicit addresses to a total of $900m in 2021. North Korean hackers, who stole an estimated $400m of cryptocurrency last year, were heavy users of DeFi, Chainalysis claimed.

The good news is that money laundering is still concentrated on a small number of services, although slightly less so than in 2020.

The analysis revealed that over half 55% of all cryptocurrency sent from illicit addresses went to only 270 service deposit addresses.

Among these addresses were those associated with two exchanges sanctioned by the US Treasury last year: Suex and Chatex.

“Law enforcement can strike a huge blow against cryptocurrency-based crime and significantly hamper criminals’ ability to access their digital assets by disrupting these services,” Chainalysis claimed.