Search

Mistake in email causes Virgin Australia passenger to miss flight

A Virgin Australia passenger was left $800 out of pocket after he arrived at a closed check-in desk despite arriving well before the departure time, and he now believes that it's because of a mistake in the email he received from the airline. Max Cameron, 64, flies several times a week between Launceston airport in Tasmania and Melbourne for work, and received an email from the airline saying his flight was delayed back in January. "I got a text and an email from Virgin saying, very sorry to let you know your plane has been delayed by 45 minutes," he told Yahoo News Australia. The email also read "Check-in will now close 30 minutes prior to this time." "I thought, well done Virgin. You've come through… you've let me know when I have to be there. And as a result, I got out to the airport at 9:25pm for a 9:45pm closure of check-in," Cameron said. However when he arrived there was "literally not one person in the Virgin terminal," so he eventually had to leave, with no choice but to buy another flight ticket which cost him $800 including extra accommodation and transport costs. "I put my tail between the legs, went back and bought another ticket. I was very annoyed about that but I had no choice... check-in closed early," he said. After submitting an enquiry to the customer service team, they told him he had to arrive 30 minutes before the original departure time - a different instruction to what he received in the email, with the revised departure time. At the time, the enquiry was closed and the team said he would not receive any compensation. Cameron, who was unsatisfied with the response, then spoke to a supervisor at the airport, who told him: "Oh my God, it looks like they sent you the wrong email". According to Yahoo News Australia, Cameron reportedly did receive incorrect information which led him to miss his flight. Cameron has since been in touch with the airline and hopes to be reimbursed, but remains "unhappy" after what he had to go through. "It's not the money but the lack of accountability... there is no service mentality anymore," he said. "What Virgin has done to me is just so wrong". <em style="box-sizing: inherit; margin: 0px; padding: 0px; border: 0px; font-size: 16px; vertical-align: baseline; color: #323338; font-family: Figtree, Roboto, 'Noto Sans Hebrew', 'Noto Kufi Arabic', 'Noto Sans JP', sans-serif; background-color: #ffffff; outline: none !important;">Images: Yahoo News / Getty

Travel Trouble

"Eviction season": Real estate slammed for callous Christmas email

A real estate agency has been forced to apologise after tenants were sent a callous email about paying their rent on time over the Christmas period. The email, which is believed to be sent by Professionals Taylor Lakes in Melbourne, referred to the festive period as "eviction season", and encouraged renters to make timely payments to ensure "your living arrangements are not jeopardised over this festive period". "Christmas is a fantastic time of year and also a very busy time," the email begins. "Christmas time is also known in property circles as 'eviction season' as so many people choose to use their rental payments for Christmas spending instead of ensuring that their family accommodation remains top priority over this period. "We see so many tenants fall behind in their rent and then get into the position where they are not able to catch up, as this is their biggest financial obligation." The agency said it didn't want to be tasked with the "unfortunate job" of having to remove and evict them from their homes over Christmas. "We find this action very unpleasant for everyone concerned and we all enjoy our Christmas much less because of it," it said. "We urge you to pay careful attention and ensure that throughout December and January, you pay your rent on time, every time!" The email was met with a wave of backlash online, with many calling the message "thoughtless" and "not professional". "This is just appalling," Anti-Poverty Network SA wrote on Facebook. Professionals chief executive Katherine Gonzalez-Cork said the email was brought to her attention on Wednesday morning, and offered an apology to the recipients. "The email was distributed to tenants directly from the Taylors Lakes office and the content was not endorsed by me or the Board of Professionals and does not represent our company's expectations of communication with our property renters," she said. Image credits: Getty Images

Money & Banking

Why do I get so much spam and unwanted email in my inbox? And how can I get rid of it?

<a href="https://theconversation.com/profiles/kayleen-manwaring-8735">Kayleen Manwaring</a>, <a href="https://theconversation.com/institutions/unsw-sydney-1414">UNSW Sydney</a> Spam might not have brought an end to the internet or email, as some dire predictions <a href="https://www.zdnet.com/article/why-spam-could-destroy-the-internet/">in the early 2000s</a> claimed it could – but it’s still a massive pain. Despite all the spam being removed by spam-filtering technologies, most people still receive spam every day. How do these messages end up flooding our inboxes? And are there any legal consequences for the senders? <h2>What is spam?</h2> The Organisation for Economic Co-operation and Development (OECD) noted in 2004 “there does not appear to be a widely agreed and workable definition for spam” across jurisdictions – and this remains true today. That said, “spam” generally <a href="https://www.oecd-ilibrary.org/docserver/232784860063.pdf?expires=1693541947&id=id&accname=ocid177499&checksum=D0C5BDAC49951DF353618B8E38483253">refers to</a> unsolicited electronic messages. These are often sent in bulk and frequently advertise goods or services. It also includes scamming and phishing messages, according to the OECD. Most people think of spam in the form of emails or SMS messages. However, what we now call spam actually predates the internet. In 1854, a spam telegram was sent to British politicians advertising the opening hours of dentists who <a href="https://www.theguardian.com/technology/2013/aug/09/why-spammers-are-winning-junk-mail">sold tooth-whitening powder</a>. The first spam email came more than 100 years later. It was reportedly sent to 600 people on May 3 1978 <a href="https://web.archive.org/web/20080628205216/http://www.latimes.com/technology/la-fi-spam11may11001420,1,5168218,full.story">through ARPAnet</a> – a precursor to the modern internet. As for how much spam is out there, the figures vary, possibly due to the various <a href="https://www.spamhaus.org/consumer/definition/">definitions of “spam”</a>. One source reports the average number of spam emails sent daily in 2022 was about <a href="https://dataprot.net/statistics/spam-statistics/">122.33 billion</a> (which would mean more than half of all emails were spam). As for text messages, another source reports a daily average of 1.6 billion <a href="https://thesmallbusinessblog.net/spam-text-statistics/">spam texts</a>. <h2>Where do spammers get my details?</h2> Each time you enter your email address or phone number into an e-commerce website, you may be handing it to spammers. But sometimes you may even receive spam from entities you don’t recognise. That’s because businesses will often transfer customers’ contact information to related companies, or sell their data to third parties such as data brokers. Australia’s Privacy Act 1988 somewhat limits the transfer of personal information to third parties. However, these laws <a href="https://theconversation.com/accc-says-consumers-need-more-choices-about-what-online-marketplaces-are-doing-with-their-data-182134">are weak</a> – and <a href="http://handle.unsw.edu.au/1959.4/unsworks_75600">weakly enforced</a>. Some entities also use “address-harvesting” software to search the internet for electronic addresses that are captured in a database. The collector then uses these addresses directly, or sells them to others looking to send spam. Many jurisdictions (including <a href="http://www8.austlii.edu.au/cgi-bin/viewdoc/au/legis/cth/consol_act/sa200366/s19.html">Australia</a>) prohibit these harvesting activities, but they are still <a href="https://www.projecthoneypot.org/statistics.php">common</a>. <h2>Is spamming against the law?</h2> Australia has had legislation regulating spam messaging since 2003. But the <a href="https://www.legislation.gov.au/Details/C2016C00614">Spam Act</a> surprisingly does not define the word “spam”. It tackles spam by prohibiting the sending of <a href="http://www8.austlii.edu.au/cgi-bin/viewdoc/au/legis/cth/consol_act/sa200366/s15.html">unsolicited commercial electronic messages</a> containing offers, ads or other promotions of goods, services or land. However, if the receiver <a href="http://www8.austlii.edu.au/cgi-bin/viewdoc/au/legis/cth/consol_act/sa200366/sch2.html">consented</a> to these types of messages, the prohibition does not apply. When you buy goods or services from a company, you will often see a request to click on a “yes” button to receive marketing promotions. Doing so means you have consented. On the other hand, if your phone or inbox are hit by commercial messages you haven’t agreed to receive, that is a breach of the <a href="https://austlii.edu.au/cgi-bin/viewdb/au/legis/cth/consol_act/sa200366/">Spam Act</a> by the sender. If you originally signed up to receive the messages, but then unsubscribed and the messages kept coming after <a href="https://austlii.edu.au/cgi-bin/viewdoc/au/legis/cth/consol_act/sa200366/sch2.html">five business days</a>, that is also illegal. Senders must also include a <a href="https://austlii.edu.au/cgi-bin/viewdoc/au/legis/cth/consol_act/sa200366/s18.html">functioning unsubscribe facility</a> in every commercial message they send. Spammers can be penalised for breaches of the Spam Act. In the past few months alone, <a href="https://www.acma.gov.au/articles/2023-06/commonwealth-bank-penalised-355-million-spam-breaches">Commonwealth Bank</a>, <a href="https://www.acma.gov.au/articles/2023-08/doordash-penalised-2-million-spam-breaches">DoorDash</a> and <a href="https://www.acma.gov.au/articles/2023-06/mycar-tyre-auto-penalised-1m-spam-breaches">mycar Tyre & Auto</a> were fined more than A$6 million in total for breaches. However, most spam comes from outside Australia where the laws aren’t the same. In the United States spam is legal under the <a href="https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business">CAN-SPAM Act</a> until you opt out. Unsurprisingly, the US <a href="https://talosintelligence.com/reputation_center/email_rep#spam-country-senders">tops the list</a> of countries where the most spam originates. Although spam sent to Australia from overseas <a href="https://austlii.edu.au/cgi-bin/viewdoc/au/legis/cth/consol_act/sa200366/s16.html">can still breach</a> the Spam Act – and the Australian Communications and Media Authority (ACMA) co-operates with overseas regulators – overseas enforcement actions are difficult and expensive, especially if the spammer has disguised their true identity and location. It’s worth noting that messages from political parties, registered charities and government bodies aren’t prohibited – nor are messages from educational institutions to students and former students. So while you might consider these messages as “spam”, they can legally be <a href="http://www8.austlii.edu.au/cgi-bin/viewdoc/au/legis/cth/consol_act/sa200366/sch1.html">sent freely without consent</a>. Factual messages (without marketing content) from businesses are also legal as long as they include accurate sender details and contact information. Moreover, the Spam Act generally only covers spam sent via email, SMS/MMS or instant messaging services, such as WhatsApp. Voice calls and faxes aren’t covered (although you can use the <a href="https://www.donotcall.gov.au/">Do Not Call Register</a> to block some commercial calls). <h2>Staying safe from spam (and cyberattacks)</h2> Spam isn’t only annoying, it can also be dangerous. Spam messages can contain indecent images, scams and <a href="https://www.cyber.gov.au/learn-basics/explore-basics/watch-out-threats/phishing-emails-and-texts">phishing attempts</a>. Some have <a href="https://www.cyber.gov.au/threats/types-threats/malware">malware</a> (malicious software) designed to break into computer networks and cause harm, such as by stealing data or money, or shutting down systems. The <a href="https://www.cyber.gov.au/protect-yourself/securing-your-email/email-security/protect-yourself-malicious-email">Australian Cyber Security Centre</a> and <a href="https://www.acma.gov.au/dealing-with-spam">ACMA</a> provide useful tips for reducing the spam you get and your risk of being hit by cyberattacks. They suggest to: <ol> <li> use a spam filter and block spammers – email and telecommunications providers often supply useful tools as part of their services </li> <li> unsubscribe from any emails you no longer want to receive – even if you originally agreed to receive them </li> <li> remove as much of your contact details from websites as you can and always restrict the sharing of your personal information (such as name, birth date, email address and mobile number) when you can – beware of pre-ticked boxes asking for your consent to receive marketing emails </li> <li> install cybersecurity updates for your devices and software as you get them </li> <li> always think twice about opening emails or clicking on links, especially for messages promising rewards or asking for personal information – if it looks too good to be true, it probably is </li> <li> use <a href="https://theconversation.com/what-is-multi-factor-authentication-and-how-should-i-be-using-it-191591">multi-factor authentication</a> to access online services so even if a scam compromises your login details, it will still be difficult for hackers to break into your accounts </li> <li> report spam to your email and telecommunications providers, and to <a href="https://www.acma.gov.au/dealing-with-spam#complain-or-forward-spam-to-the-acma">ACMA</a>. <img style="border: none !important; box-shadow: none !important; margin: 0 !important; max-height: 1px !important; max-width: 1px !important; min-height: 1px !important; min-width: 1px !important; opacity: 0 !important; outline: none !important; padding: 0 !important;" src="https://counter.theconversation.com/content/208665/count.gif?distributor=republish-lightbox-basic" alt="The Conversation" width="1" height="1" /> </li> </ol> <a href="https://theconversation.com/profiles/kayleen-manwaring-8735">Kayleen Manwaring</a>, Senior Research Fellow, UNSW Allens Hub for Technology, Law & Innovation and Senior Lecturer, School of Private & Commercial Law, UNSW Law & Justice, <a href="https://theconversation.com/institutions/unsw-sydney-1414">UNSW Sydney</a> Image credits: Getty Images This article is republished from <a href="https://theconversation.com">The Conversation</a> under a Creative Commons license. Read the <a href="https://theconversation.com/why-do-i-get-so-much-spam-and-unwanted-email-in-my-inbox-and-how-can-i-get-rid-of-it-208665">original article</a>.

Technology

Use these 10 passwords at your own peril

With cyberattacks increasing by the month, it’s crucial to have a strong grasp or what is - or isn’t - a strong enough password to hopefully deter hackers. And with the cybercriminals capable of unveiling 921 passwords each second, people all over have become easy targets with their choices - whether that’s from including easy-to-guess terms like the word “password” itself or common sequences like “123456” and “qwerty” - as reported by 9News. And as analysis by CyberNews has revealed, just 13 per cent of leaked passwords - from a review of almost 15 billion - were actually unique. According to them, two of the most popular names to appear in the selection were “Eva” and “Alex”, with a total of seven million respective uses. “Food” and “pie” were regulars, as well as the season “summer”. While these might be easy for users to remember, and appealing for that, My Business general manager Phil Parisis had a clear warning in store when he explained that “if it’s easy for you to remember, chances are it’s also easy for cybercriminals to guess. “That's not only putting you at risk but also exposing the businesses and corporations that you work for. "Another common inclusion is a year - often their birth year or another significant year in their life." Having the right information and advice at your disposal is crucial when it comes to protecting yourself, so with all of this in mind, the 10 passwords that you should avoid at all costs the next time you’re asked to come to up with one are the following: <ul> <li dir="ltr" aria-level="1"> 123456 </li> <li dir="ltr" aria-level="1"> 123456789 </li> <li dir="ltr" aria-level="1"> qwerty </li> <li dir="ltr" aria-level="1"> password </li> <li dir="ltr" aria-level="1"> 12345 </li> <li dir="ltr" aria-level="1"> qwerty123 </li> <li dir="ltr" aria-level="1"> 1q2w3e </li> <li dir="ltr" aria-level="1"> 12345678 </li> <li dir="ltr" aria-level="1"> 111111 </li> <li dir="ltr" aria-level="1"> 1234567890 </li> </ul> To further protect yourself, it can be of great benefit to mix your upper and lowercase letters in your passwords, as well as throwing in a range of symbols and numbers to further disguise your intended terms. For example, and as 9News noted, the likes of “password123” is considered a weak password, while something like “MySecurePa$$word785!” is considered much stronger, and much more protected. And the Australian Cyber Security Centre have further suggested that internet users consider using passphrases - a number of random words put together in a string -, as they’re “harder to guess but easier to remember” than common passwords. But most of all, they recommend avoiding obvious, significant, and easy-to-guess words, like the names of children and beloved family pets. Images: 9News

Technology

Devastating leaked email places Jenny Craig on brink of collapse

Weight loss firm Jenny Craig is reportedly closing its doors after four decades leading the industry. According to leaked staff communications, NBC News have shared that the company’s corporate and salaried field employees will face their final day of work on May 5, while their hourly staff will experience theirs on May 9. In the email, Jenny Craig explained that this was occurring “due to its inability to secure additional financing”. Employees were informed, however, that they would be receiving a “final pay cheque, including your full compensation earned through your last day of work and all accrued, unused paid time off”. Rumours have circled the company for some time, with Bloomberg reporting in just April 2023 that they were on the hunt for a buyer. The publication claimed that a source told them the company was “considering a bankruptcy filing” if their efforts to secure a buyer failed. Bloomberg also shared the news that the company was in around $250,000 USD in debt (~$376,000 AUD/NZD). Around the same time, corporate staff at the company’s California office received notice that they would be closing June 24, but that that day may actually be as soon as the next Friday. An FAQ was also released to them, alongside an explanation that they would be decreasing their physical operations to make way for their more e-commerce focussed business model. As a spokesperson told NBC News in the wake of the reports of potential layoffs, the company was “embarking on the next phase of our business to evolve with the changing landscape of today’s consumers. “Like many other companies, we’re currently transitioning from a brick-and-mortar retail business to a customer-friendly, e-commerce driven model. We will have more details to share in the coming weeks as our plans are solidified.” Despite this assurance, even coupled with the latest communications, it remains unclear whether or not that transition will still be taking place, with employees left in a state of limbo. The industry supergiant currently employs over 1,000 members of staff, with approximately 500 stores - both company-owned and franchised - across just the United States and Canada, with a further 600 around the rest of the world, including Australia. The company was actually founded in Melbourne in 1983, by husband and wife Jenny and Sidney Craig. The American couple went on to take their venture back to the states, but not until two years later in 1985. And while the situation looks dire overseas, an employee did tell Bloomberg that franchise-owned locations “may remain open”, though this is yet to be confirmed. Images: Getty

Body

How to declutter your inbox

Lisa Du is director of <a href="http://www.readytechgo.com.au/" target="_blank" rel="noopener">ReadyTechGo</a>, a service that helps people gain the confidence and skills to embrace modern technology. Is your inbox looking a little cluttered? Are you finding it hard to find past emails amongst the sheer mess that it already houses? There’s a solution, of course! Delete, delete, delete The first thing you should do? Delete stuff. Delete as much as you possibly can. And be ruthless about it. Don’t delete anything that you might need, obviously, like important receipts, password information, or reminders. But something like a notification from Facebook telling you that it’s someone’s birthday...yeah, that can go. For someone who doesn’t delete their emails, this will clear up your inbox considerably. In fact, it might take you a long while if you’re the type to leave hundreds of emails unread in your inbox. And for those of you who have thousands of unread emails, well... this process will be a lot more impractical for you. File away your emails Following this act of ruthless deletion, if your inbox is still looking a little too messy for your liking, there’s something else you can do: categorise. What this essentially means is that you can create different folders or labels for your emails, and then file your emails under each of these different folders accordingly. For instance, if you’ve been doing a little online shopping, and getting lots of confirmation emails for your orders, you might want to keep them in a folder called, “Shopping Receipts”. Though there are a lot of email hosts out there, the steps are generally the same. Here’s how to do it on a couple of sites. On Gmail.com: <ol start="1"> <li>Go to Gmail on your browser and login to your account</li> <li>You’ll see a sidebar on the left-hand side of your screen with different email categories, including “Inbox” and “Sent Mail”. Click on “More”</li> <li>This will expand the sidebar selection. You’ll see a section that says “Categories”. Click on “Create new label” under this section</li> <li>In the dialog box that pops up, type in the name of your label</li> <li>Now, you’ll see your new label under the left-hand sidebar</li> <li>Simply click and drag your emails into this label to file them</li> <li>From now on, when you want to find emails under this label, you’ll need to click into the label to see them</li> </ol> <img style="display: block; margin-left: auto; margin-right: auto;" src="../media/29156/gmail-declutter-inbox_499x445.jpg" alt="Gmail Declutter Inbox" width="499" height="445" /> On Outlook.com <ol> <li>Login to your email account on Outlook.com</li> <li>You’ll see a sidebar on the left-hand side of your screen titled "Folders" with different email categories, including “Inbox” and “Junk Email”. Hover your mouse over this title</li> <li>Beside the word “Folders”, you’ll see a plus sign. Click on this plus sign to create a new folder</li> <li>At the bottom of your sidebar, you’ll see a new entry for a new folder. Type the name of your new folder into this entry and press ENTER on your keyboard</li> <li>This entry will now be a new folder under the left-hand sidebar</li> <li>Simply click and drag your emails into this folder to file them</li> <li>From now on, when you want to find emails under this folder, you’ll need to click into the folder to see them.</li> </ol> <img style="display: block; margin-left: auto; margin-right: auto;" src="../media/29155/outlook-delclutter-inbox.jpg" alt="Outlook Delclutter Inbox" width="449" height="168" /> Being able to file your emails under different categories will not only clear up your inbox, but it will also introduce some order to your emails. Finding certain emails will be easier, your inbox will be less of an eyesore, and important emails will be less likely to become lost amongst a sea of spam. For more information about ReadyTechGo, visit their <a href="http://www.readytechgo.com.au/" target="_blank" rel="noopener">website here.</a> Images: Getty

Technology

Leaked email advises landlords to increase rent amid housing crisis

A real estate agency in Brisbane has come under fire over a leaked email in which landlords were advised to consider raising rents by more than 20 percent amid Australia’s worsening rental crisis. The email, sent by Ray White East End, asked landlords to consider whether their properties were being “under-rented” and advised them to increase rents by “above 20 percent” - more than double the rate of inflation - with potential earnings of an extra $10,000 a year. “Our property managers have been reviewing all our lease renewals and on average recommending a 17% rent increase on the leases renewed in October & November this year,” the email said, per <a href="https://www.theguardian.com/australia-news/2022/oct/17/brisbane-real-estate-agency-advises-landlords-to-increase-rents-by-over-20-amid-housing-crisis" target="_blank" rel="noopener">The Guardian</a>. “As we are planning December lease renewals, the average lease renewal recommendation is above 20%. This can be as much as $10,000 per year in additional rental income.” The agency said that “many landlords are not being provided with the information to make an informed decision” about rent increases, claiming that landlords were being advised to sign long-term leases with increases of $5 to $20 a week. The email also said that most tenants “are agreeable” to the increases and would understand that it is “fair and reasonable” based on what is available on the market. “On average, apartments in West End/Highgate Hill/South Brisbane/Brisbane CBD are renting for one bedroom $480 to $520+ [a week and for] two bedrooms $675 to $850+ [a week],” the email said. “If you are not achieving these rents (at a minimum), you should be asking why?” It comes as the Queenlsand government prepares to hold a housing summit to address rising homlessness and rental stress across the state. Penny Carr, the chief executive at advocacy organisation Tenants Queensland, said the email was an example of “opportunistic price-gouging” that is happening across Australia at the moment. “Rents are unaffordable for people at the moment and tenants are having to absorb increases because of fear of not finding another property or becoming homeless,” she said. “We should only allow rent increases above CPI if they’re justifiable and there’s been major work to the property or something’s had to be replaced.” Ms Carr said rent increases have been due to vacancy rates and supply and demand, and that the email dispels the myth that a land tax proposed by the government last year for interstate investors is to blame. Meanwhile, Ray White East End principal realtor Luke O’Kelly said rental affordability relies on investors. “Over the past 12 months, Brisbane has had some of the strongest population growth in the country and this has most clearly shown up in rental growth,” Mr O’Kelly said. “Right now, Brisbane doesn’t have enough homes for those that want to live here … with rents rising so quickly, Brisbane needs more property investors.” Fiona Caniglia, executive director of not-for-profit housing and homelessness organisation Q Shelter, said the timing of the email couldn’t be worse. “It is disappointing to hear this the week of the emergency housing summit to be honest,” she told <a href="https://www.news.com.au/finance/real-estate/renting/dont-have-enough-homes-rental-agency-ray-white-tries-to-increase-rent-by-20-per-cent/news-story/e4ff2ab4807fffe3b50b90fe81069156" target="_blank" rel="noopener">news.com.au</a>. “We already know that many vulnerable Queenslanders are struggling to secure a rental property in the first place.” “There are record numbers of people showing up for the small number of properties listed right across Queensland. Such an increase will only benefit those on higher incomes and will of course again negatively affect vulnerable Queenslanders, forcing more people into homelessness.” Ray White’s chief economist Nerida Conisbee defended the email in a statement shared with the outlet, saying that the market is currently ideal for investors. “Right now, Brisbane doesn’t have enough homes for those that want to live here,” she said. “This is making it tough for renters but does make it a good place to invest. While red hot house price growth is unlikely to start up again in the near future, yields are increasing as rents rise.” With Australians paying an extra $7.1 billion in rent over the past year and the average renter spending $62 more a week than this time last year, Greens housing and homelessness spokesperson Max Chandler-Mather said the email showed that urgent action is needed. “It’s this sort of flagrant price-gouging that demonstrates exactly why we need a national two-year freeze on rent increases,” he said. Image: Getty Images

Real Estate

Dream home turns into nightmare for scam victims

A Queensland couple who thought they had snapped up the home of their dreams have been left devastated after they lost almost $40,000 to a “cunning” email scammer instead. When Mitch Wilson and Penny Davies received an email from what appeared to be their real estate agent’s email address, they believed they were following their agent’s advice to then transfer the deposit for their house into a bank account. “It plays over and over in my head all of the time,” Ms Davies said. “We got an email from the real estate agent we had been dealing with, from their email account, saying in light of the contract please pay money to this account,” Mr Wilson told 9News. <img src="https://oversixtydev.blob.core.windows.net/media/2022/08/receipts.jpg" alt="" width="1280" height="720" /> The couple lost nearly $40,000 after receiving the fraudulent email (left), realising their costly mistake while messaging the actual real estate agent (right). Images: 9News After transferring the $39,000 sum, they thought nothing of it until the agent contacted them several days later asking where the funds were. “We went back and forth, we exchanged screenshots and emails from their side and ours, and what was obvious is the money didn’t go where it was supposed to go which was their account,” Mr Wilson said. “(It) ended up in some fraudster‘s account and then offshore to a crypto account.” But, the couple aren’t the only victims of this kind of scam, which police refer to as an email compromise scam. The scammers infiltrate an email account and use it to send emails to victims - making it difficult to identify that they are being scammed. Constance Hall, a mummy blogger, told news.com.au she felt “stupid” after losing thousands of dollars to the scam after she transferred money via a link sent from the real estate agency that managed the rental property she believed she was paying a deposit for. When she contacted the bank, she was told that the chance of recovering the funds was minimal as she had authorised the transaction, and that she should report it to the police. In the end, only $7.57 was recovered. “To have it all stolen in an instant … felt unbelievably unfair,” she said. Ian Wells, of Queensland Police’s Cyber Crime Group, told 9News: “These people with these skills, they‘re very cunning, they’re very calculated.” Police are advising home buyers to contact the business before paying invoices online to confirm bank account numbers, as the hackers change the bank accounts in invoices sent by business owners before forwarding the altered invoices to unsuspecting customers. Victims are also urged to contact their bank as soon as possible to report the fraudulent transaction. As for businesses impacted by the scams, the Australian Cyber Security Centre advises that they report the incident at <a href="https://www.cyber.gov.au/acsc/report" target="_blank" rel="noopener">https://www.cyber.gov.au/acsc/report</a>, alert other employees and clients, and report the breach to their email service provider. Image: 9News

Real Estate

Beauty brand praised for “thoughtful” opt-out email

Beauty brand Mecca has received a divisive response after sending out a marketing email giving subscribers the chance to opt out of Father’s Day promotions. The email, which was sent to all members of the Australian site last week, gave those who didn't celebrate Father's Day due to poor relationships or death a chance to opt out of further emails. “An option to opt out,” the email subject read. “Sometimes it's nice to choose which emails you see from us. In the lead up to Father's Day, we understand if you don't want to receive emails on the subject - so we've made it easy to opt out.” Thousands of Mecca customers flocked to Facebook to praise the brand's initiative, as many revealed that they had difficult relationships with their fathers. “I'm so glad for this email because I was burnt pretty hard by my dad and I don't need any reminders,” one woman said. “Even if it's not a go-to place for Father's Day gifts it's still great to see the initiative! I just hope they do the same for Mother's Day because I also don't have her around and it hurts to see,” she added. While the brand received a lot of praise for the email, others slammed it as a “shameful marketing stunt” and condemned people for being “overly sensitive”. “I think a lot more thought could have gone into it,” wrote one disgruntled customer. “I understand the sentiment but the specific reference to Father's Day was a bit weird.” “I don't remember getting one of these for Mother's Day. Why not a general email with a list of holidays allowing customers to choose which ones they want to opt out of?” she asked. While some people opposed the emails, the reception was largely positive, with customers calling on other brands to do the same. Image credits: Supplied

Beauty & Style

Woman scammed out of $730,000

A woman has lost an eye-watering $730,000 after opening an email from who she thought was her settlement agent. The victim was in the process of purchasing a property in Western Australia and had clicked on the email which asked for money to be deposited into an account they were in control of. After filling out the “authentic-looking documents”, the scammers were able to take control of $730,000. Consumer Protection WA confirmed that the settlement agent’s email was hacked by the scammers in what is described as payment redirection scams. Payment redirection scams are almost impossible to tell the difference between the real and the fake thing. In this instance, the woman did not think twice that the email would have been a scam after the agent reminded her of the payment. Consumer Protection executive director Trish Blake said the hack is sophisticated and can make it difficult to know when the hacking took place. “These scams usually involve the hacking into someone’s email account or computer system but it can be difficult to determine exactly where the hack has occurred,” she told <a href="https://www.news.com.au/technology/online/hacking/woman-loses-730000-after-one-scam-email-while-buying-property/news-story/0eabd0fcc189dc3a0bd7c472f0034150" target="_blank" rel="noopener">news.com.au</a>. “The hackers may have successfully guessed the password or installed spyware or malware on computers or laptops after recipients open attachments or click on links in scam emails. “The losses from these scams can be extremely devastating to the victims who may have lost their home deposit that they have been saving for many years and may not be able to buy the home of their dreams. Or it may be a business doing it tough that can least afford to lose such a large amount of money.” Image: Shutterstock

Money & Banking

Man rejected from interview through accidental email to management

Alexander Wood was refused an opportunity to be interviewed for a position he applied for thanks to an accidental HR email. This was the third time Alexander applied for a barista position at Utica Coffee Roasting Company in New York. He was interviewed by the company in April 2021 and was offered the role but was unable to accept due to his living circumstances. In December 2021, after reapplying, HR got in touch with Alexander saying they will set up a time for an interview…but no one got back to him. After applying again recently in March 2022, Alexander was rejected from any interview after he was CC’d in an email from HR saying he never showed up last time. “Well, today is the first time I got CC'ed on an email I should not have been,” he wrote on Facebook on March 15. “It was an email an HR employee meant to send to management about how I never showed up for an interview and I was CC'd into their responses.” He explained that he was at an “all-time low in my life, I had just left downstate after being rendered homeless for over a week, I had left my toxic relationship, and I was legally tied to an apartment that I did not feel safe living in.” After sorting out his life, Alexander applied once again, only to randomly check his phone and saw the “triggering email” from the company. “I got hopeful and checked when I could only to find out it was an email meant for the other managers talking about how I never showed up for an interview,” he continued. Sharing a screenshot of the email thread, HR had informed management that Alexander had allegedly not shown up for a previous interview. “Well that’s interesting ok so lets reject him…” management responded. Alexander said he would “never no-call, no-show an interview, especially at that point in my life.” Shocked at their unprofessionalism, Alexander responded with proof of their emails showing that someone from HR would get in contact with him but didn’t. “I am absolutely astonished at the carelessness in this situation. Needless to say, I will not get a job there and will most likely never step foot in the establishment again. “I'm confident in my skills and I hold enough pride not to put up with this kind of absolute garbage. These are the things you don’t do with your business.” Image: Facebook

Money & Banking

Don't leave yourself vulnerable to hackers in 2022

Passwords are just as vitally important as they are frustrating. However, making a mistake with our passwords could leave us exposed to hackers and other fraudulent activities online. According to the Australian Competition & Consumer Commission, Australians lost a record $323.7 million to scams and identity theft in 2021, with phishing scams up 62% on the previous year. It’s not just your main accounts like social media or online banking that are at risk. As our list of logins grows, all it takes is one data breach to compromise everything. So, what can you do in order to protect yourself? 1. Don’t use the same password across multiple sites If you use one password across multiple platforms or sites, you’re at greater risk. “By far the biggest mistake people make with passwords is using the same one across multiple sites,” says Val Quinn, Sunrise tech expert. “Because if one site gets hacked, then the hackers have the same password that they can use on different sites to try to login under your name.” 2. Use a passphrase instead “Hackers can use special tools where they can actually brute force guess your passwords,” says Quinn. “That means we have to make them very complicated, long combo of letters, characters and numbers, upper and lower case.” For extra protection, try using a passphrase instead of a traditional password. But – make sure to remember that phrase! It’s also a good idea to ensure it’s not a common or popular quote or song that can be easily guessed by somebody who knows you. 3. See if you’ve been breached Sites like <a href="https://haveibeenpwned.com/" target="_blank" rel="noopener">Have I Been Pwned?</a> allow you to check if your email address or password have been caught up in known data breaches. Started by Australian cyber security consultant Troy Hunt, who is also Microsoft’s regional director, the site aggregates known issues, providing a snapshot of that sites where your data may have been compromised. 4. Don’t use personal information This tip sounds simple but a lot of people continue to fall into the trap of using personal information. Avoid using obvious things like a pets name or birthday. 5. Use a password manager Most of us have passwords across email, social media, banking, streaming services and online shopping. Keeping track of login details can be daunting, that’s where password managers come in handy. “A password manager is almost a must,” explains Quinn. “It really helps ensure you use different passwords for all of the sites you log into, otherwise you just can’t remember very easily.” Most common passwords of 2021 According to NordPass, these are the most common passwords globally in 2021, all of which the tech company estimates take under one second to hack.<ul><li>123456</li><li>123456789</li><li>12345</li><li>qwerty</li><li>password</li><li>12345678</li><li>111111</li><li>123123</li><li>1234567890</li><li>1234567 </li></ul>NordPass research also revealed these were the most common passwords in Australia.<ul><li>123456</li><li>password</li><li>lizottes</li><li>password1</li><li>123456789</li><li>12345</li><li>abc123</li><li>qwerty</li><li>12345678</li><li>holden</li></ul>Image: Getty

Technology

This New Year, why not resolve to ditch your dodgy old passwords?

Most of the classic New Year resolutions revolve around improving your health and lifestyle. But this year, why not consider cleaning up your passwords too? We all know the habits to avoid, yet so many of us do them anyway: using predictable passwords, never changing them, or writing them on sticky notes on our monitor. We routinely ignore the <a href="https://theconversation.com/choose-better-passwords-with-the-help-of-science-82361">recommendations for good passwords</a> in the name of convenience. Choosing short passwords containing common names or words is likely to lead to trouble. Hackers can often guess a person’s passwords simply by using a computer to work through a long list of commonly used words. The <a href="https://nordpass.com/most-common-passwords-list/">most popular choices</a> have changed very little over time, and include numerical combinations such as “123456” (the most common password for five years in a row), “love”, keyboard patterns such as “qwerty” and, perhaps most ludicrously, “password” (or its Portuguese translation, “senha”). Experts have long advised against using words, places or names in passwords, although you can strengthen this type of password by jumbling the components into sequences with a mixture of upper- and lowercase characters, as long as you do it thoroughly. Complex rules often lead users to choose a word or phrase and then substitute letters with numbers and symbols (such as “Pa33w9rd!”), or add digits to a familiar password (“password12”). But so many people do this that these techniques don’t actually make passwords stronger. It’s better to start with a word or two that isn’t so common, and make sure you mix things up with symbols and special characters in the middle. For example, “wincing giraffe” could be adapted to “W1nc1ng_!G1raff3” These secure passwords can be harder to remember, to the extent you might end up having to write them down. That’s OK, as long as you keep the note somewhere secure (and definitely not stuck to your monitor). Reusing passwords is another common error – and one of the biggest. Past data leaks, such as that suffered by <a href="https://www.ncsc.gov.uk/blog-post/linkedin-2012-hack-what-you-need-know">LinkedIn in 2012</a>, mean billions of old passwords are now circulating among cyber criminals. This has given rise to a practice called “<a href="https://www.wired.com/story/what-is-credential-stuffing/">credential stuffing</a>” – taking a leaked password from one source and trying it on other sites. If you’re still using the same old password for multiple email, social media or financial accounts, you’re at risk of being compromised. <h2>Pro tip: use a password manager</h2> The simplest and most effective route to good password hygiene is to use a <a href="https://www.choice.com.au/electronics-and-technology/internet/internet-privacy-and-safety/buying-guides/password-managers">password manager</a>. This lets you use unique strong passwords for all your various logins, without having to remember them yourself. Password managers allow you to store all of your passwords in one place and to “lock” them away with a strong level of protection. This can be a single (strong) password, but can also include face or fingerprint recognition, depending on the device you are using. Although there is some risk associated with storing your passwords in one place, experts consider this much less risky than using the same password for multiple accounts. The password manager can automatically create strong, randomised passwords for each different service you use. This means your LinkedIn, Gmail and eBay accounts can no longer be accessed by someone who happens to guess the name of your childhood pet dog. If one password is leaked, you only have to change that one – none of the others are compromised. There are <a href="https://en.wikipedia.org/wiki/List_of_password_managers">many password managers</a> to choose from. Some are free (such as Keepass) or “freemium” (offering the option to upgrade for more functionality like Nordpass), while others charge a one-off fee or recurring subscription (such as 1Password). Most allow you to securely sync your passwords across all your devices, and some let you safely share passwords between family members or work groups. You can also use the password managers built into most web browsers or operating systems (with many phones offering this functionality in the browser or natively). These tend to have fewer features and may pose compatibility issues if you want to access your password from different browsers or platforms. Password managers take a bit of getting used to, but don’t be too daunted. When creating a new account on a website, you let the password manager create a unique (complex) password and store it straight away – there’s no need to think of one yourself! Later, when you want to access that account again, the password manager fills it in automatically. This is either through direct integration with the browser (typically on computers) or through a separate application on your mobile device. Most password managers will automatically “lock” after a period of time, prompting for the master password (or face/finger verification) before allowing access again. <h2>Protect your most important passwords</h2> If you don’t like the sound of a password manager, at the very least change your “critical” account passwords so each one is strong and unique. Financial services, email accounts, government services, and work systems should each have a separate, strong password. Even if you write them down in a book (kept safely locked away) you will significantly reduce your risk in the event of a data breach on any of those platforms. Remember, however, that some sites provide delegated access to others. Many e-commerce websites, for example, give you the option of logging in with your Facebook, Google or Apple account. This doesn’t expose your password to greater risk, because the password itself is not shared. But if the password is compromised, using it would grant access to those delegated sites. It is usually best to create unique accounts - and use your password manager to keep them safe. Adopting a better approach to passwords is a simple way to reduce your cyber-security risks. Ideally that means using a password manager, but if you’re not quite ready for that yet, at least make 2022 the year you ditch the sticky notes and pets’ names. Image credits: Getty Images This article first appeared on <a rel="noopener" href="https://theconversation.com/this-new-year-why-not-resolve-to-ditch-your-dodgy-old-passwords-172598" target="_blank">The Conversation</a>.

Technology

Serious claim about Ben Roberts-Smith’s most private emails

Ben Roberts-Smith’s lawyers <a rel="noopener" href="https://www.abc.net.au/news/2021-09-17/ben-roberts-smith-ex-wife-accesses-email-101-times/100469928" target="_blank">have accused</a> his ex-wife Emma Roberts of accessing the veteran’s email more than 100 times, as the case between the former couple continues in court. The case is running at the same time as his defamation proceedings against several newspapers. During the defamation case, Mr Roberts-Smith’s opponents issued a notice to produce specific documents. His legal team suspects the notice may have been issued following access to an email address he used for confidential correspondence. They have accused Ms Roberts of accessing the account and passing confidential information on to third parties, with Telstra records suggesting a close friend of Ms Roberts may have accessed the account. Arthur Moses SC, Mr Roberts-Smith’s barrister, applied to add Ms Roberts’ best friend Danielle Scott and her husband as respondents in the case currently being heard in the Federal Court. Mr Moses claimed that Telstra records established that either Ms Scott or her husband accessed a “hosting account” of RS Group Australia, the company Mr Roberts-Smith owns. He told the court the account was accessed “on at least 101 occasions” between January 2020 and May 2021. “The RS Group Australia email hosting account … is password-protected and enables a person, once logged on, to access the email account of any RS Group user, including the applicant’s,” Mr Moses said. The accusations come after Mr Roberts-Smith previously swore in an affidavit that neither Ms Scott or her husband had been given the password. Mr Moses said the Telstra records raised new issues, such as how the couple found the password, whether they had accessed Mr Roberts-Smith’s specific account, or whether they had shared confidential information with other parties. “If Ms Scott and her husband are not joined to these proceedings then the applicant [Mr Roberts-Smith] would have a basis to commence separate proceedings against them,” Mr Moses said. He continued, saying he would have included the pair as respondents when the case began, had his client been aware of the records. Justice Robert Bronwich reserved his decision. The defamation trial against the newspapers is currently on hold until at least November 1, and is expected to continue into 2022. Image: Getty

Legal

Woolies shoppers warn of major $250 voucher scam

Woolworths customers are being warned to avoid a major scam email that can be easy to fall for. The email has made its way into the inboxes of many unsuspecting customers and appears to have the supermarket’s branding to inform customers that they have the opportunity to receive a $250 Woolies gift card for just $1. Customers are told the voucher will be delivered through mail in just three days, as long as a first name, last name, postcode, and credit card details are provided. <img style="width: 500px; height: 281.25px;" src="https://oversixtydev.blob.core.windows.net/media/7841474/woolies-2.jpg" alt="" data-udi="umb://media/5c5ffdb3eb4e43209ae93bfc78741f96" /> The phishing scam is just one of the latest that have been dropped into the inboxes of naïve, unsuspecting shoppers. Website criminals use highly sophisticated scams that trick customers into giving out personal information. Woolworths told <a href="https://au.news.yahoo.com/woolworths-shoppers-warned-over-250-voucher-scam-003535085.html">Yahoo News Australia</a> the emails that claim to be offering the $250 voucher is not an authorised message from the supermarket. "As always, we encourage our customers to be vigilant of online and text phishing scams, which seek to imitate well-known brands to collect personal information," a spokesperson said in a statement. "We never ask customers for their personal or banking details in unsolicited communications."

Caring

Urgent email warning to Aussies over China hackers

<div class="post_body_wrapper"> <div class="post_body"> <div class="body_text redactor-styles redactor-in"> Australians are being urged to check their emails after a major Chinese infiltration of Microsoft's email system has left many exposed. There are fears that 7,000 servers are impacted by the threat in Australia after the Chinese state-backed hacker group known as HAFNIUM hit more than 30,000 servers in the USA. The campaign led by the hackers found recently discovered flaws in Microsoft Exchange software and stole emails while infecting computer servers with tools that left hackers to take control of the servers remotely. Brian Krebs, a cybersecurity expert, has reported on this massive breach. “At least 30,000 organizations across the United States — including a significant number of small businesses, towns, cities and local governments — have over the past few days been hacked by an unusually aggressive Chinese cyber espionage unit that’s focused on stealing email from victim organisations,” Krebs wrote in the <a rel="noopener" href="https://krebsonsecurity.com/2021/03/at-least-30000-u-s-organizations-newly-hacked-via-holes-in-microsofts-email-software/" target="_blank">post</a>. One insider close to the incident explained whose been hit. “It’s police departments, hospitals, tons of city and state governments and credit unions,” said one source who’s working closely with federal officials on the matter. “Just about everyone who’s running self-hosted Outlook Web Access and wasn’t patched as of a few days ago got hit with a zero-day attack.” A zero-day attack is where hackers exploit potentially serious software security that the developer might be unaware of. The Microsoft Threat Intelligence Center (MSTIC) attributed the attacks with "high confidence" to a "state-sponsored threat actor" based in China which they named Hafnium. Microsoft is urging network owners to download the security patches available as soon as possible. It told customers "the best protection" was "to apply updates as soon as possible across all impacted systems". However, if your Microsoft Exchange servers have already been compromised, the patches are not "full protection against attack". You can find out <a rel="noopener" href="https://msrc-blog.microsoft.com/2021/03/05/microsoft-exchange-server-vulnerabilities-mitigations-march-2021/" target="_blank">more information here.</a> </div> </div> </div>

Legal

A computer can guess more than 100,000,000,000 passwords per second. Still think yours is secure?

Passwords have been used for thousands of years as a means of identifying ourselves to others and in more recent times, to computers. It’s a simple concept – a shared piece of information, kept secret between individuals and used to “prove” identity. Passwords in an IT context <a href="https://www.wired.com/2012/01/computer-password/">emerged in the 1960s</a> with <a href="https://www.techopedia.com/definition/24356/mainframe">mainframe</a> computers – large centrally operated computers with remote “terminals” for user access. They’re now used for everything from the PIN we enter at an ATM, to logging in to our computers and various websites. But why do we need to “prove” our identity to the systems we access? And why are passwords so hard to get right? What makes a good password? Until relatively recently, a good password might have been a word or phrase of as little as six to eight characters. But we now have minimum length guidelines. This is because of “entropy”. When talking about passwords, entropy is the <a href="https://www.itdojo.com/a-somewhat-brief-explanation-of-password-entropy/">measure of predictability</a>. The maths behind this isn’t complex, but let’s examine it with an even simpler measure: the number of possible passwords, sometimes referred to as the “password space”. If a one-character password only contains one lowercase letter, there are only 26 possible passwords (“a” to “z”). By including uppercase letters, we increase our password space to 52 potential passwords. The password space continues to expand as the length is increased and other character types are added. However, the problem with depending on password complexity is that computers are highly efficient at repeating tasks – including guessing passwords. Last year, a <a href="https://www.cbronline.com/news/stolen-user-credentials">record was set</a> for a computer trying to generate every conceivable password. It achieved a rate faster than 100,000,000,000 guesses per second. By leveraging this computing power, cyber criminals can hack into systems by bombarding them with as many password combinations as possible, in a process called <a href="https://www.kaspersky.com/resource-center/definitions/brute-force-attack">brute force attacks</a>. And with cloud-based technology, guessing an eight-character password can be achieved in as little as 12 minutes and cost as little as US$25. Also, because passwords are almost always used to give access to sensitive data or important systems, this motivates cyber criminals to actively seek them out. It also drives a lucrative online market selling passwords, some of which come with email addresses and/or usernames. How are passwords stored on websites? Website passwords are usually stored in a protected manner using a mathematical algorithm called <a href="https://www.wired.com/2016/06/hacker-lexicon-password-hashing/">hashing</a>. A hashed password is unrecognisable and can’t be turned back into the password (an irreversible process). When you try to login, the password you enter is hashed using the same process and compared to the version stored on the site. This process is repeated each time you login. For example, the password “Pa$$w0rd” is given the value “02726d40f378e716981c4321d60ba3a325ed6a4c” when calculated using the SHA1 hashing algorithm. Try it <a href="https://passwordsgenerator.net/sha1-hash-generator/">yourself</a>. When faced with a file full of hashed passwords, a brute force attack can be used, trying every combination of characters for a range of password lengths. This has become such common practice that there are websites that list common passwords alongside their (calculated) hashed value. You can simply search for the hash to reveal the corresponding password. The theft and selling of passwords lists is now so common, a <a href="https://haveibeenpwned.com/">dedicated website</a> — haveibeenpwned.com — is available to help users check if their accounts are “in the wild”. This has grown to include more than 10 billion account details. If your email address is listed on this site you should definitely change the detected password, as well as on any other sites for which you use the same credentials. Is more complexity the solution? You would think with so many password breaches occurring daily, we would have improved our password selection practices. Unfortunately, last year’s annual <a href="https://www.securitymagazine.com/articles/91461-the-worst-passwords-of-2019">SplashData password survey</a> has shown little change over five years. As computing capabilities increase, the solution would appear to be increased complexity. But as humans, we are not skilled at (nor motivated to) remember highly complex passwords. We’ve also passed the point where we use only two or three systems needing a password. It’s now common to access numerous sites, with each requiring a password (often of varying length and complexity). A recent survey suggests there are, on average, <a href="https://www.newswire.com/news/new-research-most-people-have-70-80-passwords-21103705">70-80 passwords per person</a>. The good news is there are tools to address these issues. Most computers now support password storage in either the operating system or the web browser, usually with the option to share stored information across multiple devices. Examples include Apple’s <a href="https://www.computerworld.com/article/3254183/how-to-use-icloud-keychain-the-guide.html">iCloud Keychain</a> and the ability to save passwords in Internet Explorer, Chrome and Firefox (although <a href="https://www.howtogeek.com/447345/why-you-shouldnt-use-your-web-browsers-password-manager/">less reliable</a>). <a href="https://tech.co/password-managers/what-is-a-password-manager">Password managers</a> such as KeePassXC can help users generate long, complex passwords and store them in a secure location for when they’re needed. While this location still needs to be protected (usually with a long “master password”), using a password manager lets you have a unique, complex password for every website you visit. This won’t prevent a password from being stolen from a vulnerable website. But if it is stolen, you won’t have to worry about changing the same password on all your other sites. There are of course vulnerabilities in these solutions too, but perhaps that’s a story for another day. Written by Paul Haskell-Dowland and Brianna O’Shea. Republished with permission of <a href="https://theconversation.com/a-computer-can-guess-more-than-100-000-000-000-passwords-per-second-still-think-yours-is-secure-144418">The Conversation.</a>

Legal

Leaked emails reveal patient zero for Victoria's second wave disaster

Leaked emails have determined who patient zero is in regards to the resurgence of the disastrous second wave of COVID-19. It has been revealed that the spread of the deadly infection has been linked back to a night duty manager at the Rydges hotel on Swanston Street - not actually a badly behaved security guard. Leaked information shows that the night manager reported on Monday, May 25, that he had come down with a fever. The following day Department of Jobs, Precincts and Regions officials were told the hotel employee had tested positive. It is presumed he caught it from a returned traveller, who has not been identified. The emails show a commendable effort was made to stop the spread of the infection, however their efforts were proven futile. <img style="width: 500px; height: 281.25px;" src="https://oversixtydev.blob.core.windows.net/media/7837356/rydges-3.jpg" alt="" data-udi="umb://media/2c0bedc41c174b068038e22744c9635f" /> Seven security guards who were hired to patrol the hotel were stood down immediately and told to go home, isolate and get tested. Another small number of hotel staff and health workers were told to do the same. An email headed “Hotel staff member status and exposure to staff” reported on May 26 that the night manager himself was “now isolating at Rydges” and “feeling as well as can be expected”. Unfortunately, it was already too late and attempts to curb the spread of the infection failed. Five of the original seven guards, all from contractor Unified Security, soon returned positive COVID-19 tests. The disease was spread to their families in the northern and western suburbs of Melbourne, which helped seed the second wave that has infected 15,863 Victorians, including 7866 active coronavirus cases as of Thursday. As of Thursday, 275 people have died of COVID-19 in the state. Officials assumed it was a security guard who had been the first one to contract the disease however as it turns out, it was the night manager. There is no suggestion from any party that the hotel manager partook in any improper behaviour. Victoria’s Health Minister Jenny Mikakos was running the operations of the crisis, however former Health Minister and Attorney General Jill Hennessy has taken charge. “The suggestion that security guards ever had responsibility for infection control is one of the biggest myths of this debate,” a source closely involved in the hotel quarantine program told The Age. “Private and public hospitals use security guards, but those guards don’t deliver babies, perform surgery or oversee infection control. Full responsibility for infection control lay with the authorised officers who were brought in from various government departments.” Victoria Premier Daniel Andrews has created a board of inquiry to investigate the shortcomings in the hotel quarantine program. Chief Health Officer Brett Sutton has previously revealed that genomic sequencing carried out by Melbourne’s Doherty Institute shows that most, if not all of Victoria’s second-wave cases, may be traceable back to breaches in hotel quarantine. “Clearly there has been a failure in this program,” Professor Sutton said in July.

News

Can police demand the password to my phone or computer?

Many will recall last year’s <a href="https://www.sydneycriminallawyers.com.au/blog/fbi-cracks-apples-encryption/">battle between the United States Justice Department and technology giant Apple</a>, whereby the former spent millions of dollars trying to force the latter to unlock the IPhone of a gunman allegedly involved in the San Bernadino terrorist attack. The Justice Department felt the need to take such action because it knew the United States constitution would never allow the forced disclosure of an individual’s personal identity information in circumstances where it may incriminate them. However, the situation in Australia is different. Here, there is a legal mechanism for police to <a href="https://www.loc.gov/law/help/encrypted-communications/australia.php">force the disclosure</a> of an individual’s passwords, personal identification numbers and private encryption keys to enable them to access an individual’s smartphone or computer during the investigation of a <a href="https://www.sydneycriminallawyers.com.au/criminal/offences/commonwealth-offences/">Commonwealth offence</a>. That mechanism is contained in <a href="http://www.austlii.edu.au/cgi-bin/viewdoc/au/legis/cth/consol_act/ca191482/s3la.html">section 3LA</a> of the Crimes Act 1914 (Cth) (“the Act”), which provides that “a constable may apply to a magistrate for an order to provide any information or assistance that is reasonable and necessary” to allow them to access data stored on “a computer or data storage device.” A “constable” is defined by <a href="http://www.austlii.edu.au/cgi-bin/viewdoc/au/legis/cth/consol_act/ca191482/s3.html">section 3 of the Act</a> as “a member or special member of the Australian Federal Police or a member of the police force or police service of a State or Territory”. Police can apply to a magistrate for an “assistance order” requiring the owner or user of a computer or data storage device to provide such information they can establish <a href="https://www.sydneycriminallawyers.com.au/blog/police-powers-to-stop-require-identification-and-search-in-nsw/">a reasonable suspicion</a> that the device holds or can enable access to evidential material relevant to a crime. The subject of the order is not required to be suspected of any crime. He or she merely needs to be the owner of the device that police reasonably suspect holds information relating to an offence. If the application is successful, the subject will be required to provide the password/s enabling police to gain access to the device/s, as well as any decryption information in order to make data accessible and intelligible to police. Failure to comply with an assistance order is a criminal offence. When the law was first enacted, the maximum penalty was 6 months imprisonment. However, authorities have since raised the maximum penalty to 2 years behind bars. A climate of paranoia The <a href="http://www.austlii.edu.au/cgi-bin/viewdoc/au/legis/cth/num_act/ca2001112/sch1.html">Commonwealth Cybercrime Act</a> inserted section 3LA into the Crimes Act in October 2001. The Cybercrime Act was passed through federal parliament in a post-September 11 climate of mounting fear about the threat of terrorism and <a href="https://www.sydneycriminallawyers.com.au/blog/section-308h-of-the-crimes-act-computer-hacking-and-high-tech-offences/">cybercrime</a>. That Act created seven new criminal offences: three serious computer offences and four summary computer offences. It also extended police investigative powers in relation to search and seizure of electronically stored data. The circumstances behind section 3LA In his 2004 University of Queensland paper titled <a href="http://www.austlii.edu.au/cgi-bin/viewdoc/au/journals/UQLawJl/2004/1.html?context=1;query=%22ca191482">Handing Over the Keys</a>, Nikolas James points to several reasons why a law that provides police with such pervasive power was passed at the time. The EU’s Convention on Cybercrime recommended that countries implement laws that guaranteed authorities could access user data under the threat of imprisonment. And France suggested that the convention be open to all countries. The Australian laws at the time were seen as inadequate when it came to the growing threat of cybercrime. Police were pushing for new powers, as encrypted data represented a significant obstacle to the gathering of evidence. The Australian business community was also losing faith in the ability of law enforcement to guard against the rising cost of <a href="https://www.sydneycriminallawyers.com.au/blog/do-we-need-new-technology-laws-in-nsw/">cybercrime</a>. And the public’s perception of the threat posed by cybercrime helped enable authorities to broaden their reach. Mass surveillance Mr James also lists Australia’s involvement in the <a href="https://www.sydneycriminallawyers.com.au/blog/rip-government-accountability-in-australia-a-privacy-guide-for-journalists/">Five Eyes global electronic surveillance alliance</a> as a reason the law was allowed to pass with little fanfare. The alliance is comprised of the USA, UK, Canada, New Zealand and Australia, and was established under the <a href="https://www.my-private-network.co.uk/vpn-provider-14-eyes-country-something-know/">UKUSA Agreement</a> back in 1946. The Five Eyes agreement allows security agencies of these nations to collect and share private and commercial communications data with one another. In Australia, strong encryption had been hampering operations, and section 3LA helped facilitate data access. The implications of section 3LA <a href="https://www.sydneycriminallawyers.com.au/blog/turnbull-continues-assault-on-civil-liberties/">Civil liberties</a> groups have always been highly critical of the provision. They point out that the wording of the section is vague and the scope of the investigative powers it provides is almost unlimited. They argue that the section’s intrusion on the privacy of the populace – including those who are not suspected of an offence – is not justified or outweighed by the benefit it provides to law enforcement. Electronic Frontiers Australia <a href="https://www.efa.org.au/Issues/Privacy/cybercrimeact.html">described</a> the passing the Cybercrime Act as a “knee-jerk reaction to recent well-publicised virus attacks,” that “introduces an alarming law enforcement provision requiring release of encryption keys or decryption of data, contrary to the common law privilege against self-incrimination.” The digital rights protection organisation <a href="https://www.efa.org.au/Publish/cybercrime_bill.html">further pointed out</a> that the law has the potential to lead to the imprisonment of an individual who has genuinely forgotten their password or encryption keys. The provisions under section 3LA also have the potential to enable police to access whole computer networks. If an officer has a reasonable suspicion a computer contains some evidential information, they can obtain an order, which will also provide access to any other computer it’s connected to. And with the scope of the internet, the potential reach is virtually unlimited. Brandis plans to broaden powers In July this year, Australian prime minister Malcolm Turnbull <a href="http://www.abc.net.au/news/2017-07-14/facebook-google-to-be-forced-to-decrypt-messages-fight-terrorism/8707748">announced</a> proposed new laws that will require social media and technology companies like Facebook and Google to allow Australian security agencies access to people’s encrypted messages. Attorney general George Brandis has actually been pushing for these laws <a href="https://www.itnews.com.au/news/attorney-generals-new-war-on-encrypted-web-services-375286">since early 2014</a>. In a submission to the Senate inquiry into the comprehensive revision of the <a href="https://www.legislation.gov.au/Details/C2013C00361">Telecommunications (Interception and Access) Act 2014</a>, the attorney general’s office stated that these laws “would operate in a similar fashion to orders made under section 3LA.” “Section 3LA permits agencies that have seized physical hardware… under a search warrant to apply for a further warrant requiring a person to ‘provide any information or assistance that is reasonable and necessary’ to allow information held on the device to be converted into an intelligible form,” the authors wrote. Co-convenor of the UNSW Cyberspace Law and Policy Community David Vaile told <a href="https://www.sydneycriminallawyers.com.au/about/">Sydney Criminal Lawyers®</a><a href="https://www.sydneycriminallawyers.com.au/blog/digital-surveillance-an-interview-with-the-cyberspace-law-and-policy-communitys-david-vaile/"> in August</a> that the trigger for social media companies starting to use encryption on a wider scale was revelations that the NSA had been hacking into Google data centres. This information was revealed when Edward Snowden leaked classified documents from the NSA in mid-2013. The thousands of documents exposed by Snowden informed the public that global surveillance programs were being conducted by the NSA, along with other Five Eyes nations. Big brother is watching In his 2004 paper, Mr James outlined that by “undermining the effectiveness of encryption, section 3LA redirects the flow of power away from business and private citizens towards law enforcement agencies.” Encryption empowers citizens to protect themselves against cybercrime without the need of police protection. But by applying the provisions of section 3LA, law enforcement can now shift that balance of power, making individuals more reliant on those agencies. The provision also works to monitor citizens through panoptic surveillance, according to Mr James. The panoptic surveillance effect of this law is that individuals are aware that, at any time, police have the potential to access their personal computers and smartphones. So people may begin to self-regulate their behaviour on these devices, as at any moment they might be subject to the investigation of authorities. Mr James warned that as the population becomes aware such provisions exist, “citizens will willingly and obediently reduce the space within which they feel free to live, to play, to act and to create away from authority’s scrutiny and judgment.” Written by Paul Gregoire. Republished with permission of <a href="https://www.sydneycriminallawyers.com.au/blog/can-police-demand-the-password-to-my-phone-or-computer/">Sydney Criminal Lawyers.</a>

Travel Tips

Commonwealth Bank issues urgent warning over phishing scam

Commonwealth Bank has issued an urgent warning telling customers of an email scam that has hit thousands of unsuspecting inboxes across Australia. The scam, which contains the words “CommBank” was detected on November 29 by anti-virus software company Mailguard. Customers have received an email asking them to verify recent transactions on their card. “We encourage our customers to stay vigilant and look out for fraud and scams,” a spokesperson told<a rel="noopener" href="https://7news.com.au/business/banks/commonwealth-bank-issues-urgent-warning-on-new-email-scam-hitting-inboxes-right-now-c-587199" target="_blank"> 7NEWS.com.au</a>. “We offer our customers the benefit from our 100 per cent guarantee against online fraud where they are not at fault. “Where there is fraudulent activity, our process is to fully reimburse our customers as quickly as possible to minimise inconvenience.” <img style="width: 500px; height: 281.25px;" src="https://oversixtydev.blob.core.windows.net/media/7833028/commbank.jpg" alt="" data-udi="umb://media/881a4a09c8e34134bef991afd5b851ab" /> A blog shared by Mailguard about the phishing scam gave clear signs customers can follow to check if their emails from banks are authentic or not. The blog warned to check for spelling errors, and be aware if it takes you to the actual bank website or not. “This is another reminder for those who utilise online banking, to pay close attention to the emails they receive from their banks,” the post read. “To best protect yourself, it is imperative that you do not click any link contained within an email, especially if it does not address you by name.” Anyone who believes they have been scammed is urged to contact Commonwealth Bank.

Technology

Our Partners

Over 60

News

Shop

Catalogues

Newspaper

Contests

Entertainment

Travel

Health

Lifestyle

Finance

Property

Compare

Games

Information

Keep up to date

Search

Mistake in email causes Virgin Australia passenger to miss flight

"Eviction season": Real estate slammed for callous Christmas email