Table Of ContentCyber Law and Cyber Security in Developing
and Emerging Economies
To Victor, my husband and friend
To Rana, Reem and Ruba
My daughters, my raison d’être.
To them all, I dedicate this book.
Zeinab
Cyber Law and
Cyber Security in
Developing and
Emerging Economies
Zeinab Karake Shalhoub
Director of Research, Dubai International Financial Centre,
Dubai, United Arab Emirates
and
Sheikha Lubna Al Qasimi
Minister of Foreign Trade, United Arab Emirates
Edward Elgar
Cheltenham, UK • Northampton, MA, USA
© Zeinab Karake Shalhoub and Sheikha Lubna Al Qasimi 2010
All rights reserved. No part of this publication may be reproduced, stored
in a retrieval system or transmitted in any form or by any means, electronic,
mechanical or photocopying, recording, or otherwise without the prior
permission of the publisher.
Published by
Edward Elgar Publishing Limited
The Lypiatts
15 Lansdown Road
Cheltenham
Glos GL50 2JA
UK
Edward Elgar Publishing, Inc.
William Pratt House
9 Dewey Court
Northampton
Massachusetts 01060
USA
A catalogue record for this book
is available from the British Library
Library of Congress Control Number: 2009937894
ISBN 978 1 84542 871 6
Printed and bound by MPG Books Group, UK
2
0
Contents
1 Establishing the context 1
2 Security and trust in cyber space 30
3 Resource- based view and theory 82
4 Methodology and development of hypotheses 127
5 Data collection and empirical results 169
6 Conclusion, recommendations, and future research 213
Index 237
v
1. Establishing the context
INTRODUCTION
The advances of digital technology and the intertwined connections
between computing and communications have set in motion many changes
aff ecting the way we live. From 2000 to 2008, the Internet has expanded at
an average annual rate of 290 percent on a global level, and currently an
estimated 1.4 billion people are connected to the Internet, which is close
to 25 percent of the world’s population. The technology has advanced so
fast and has become more and more user friendly; at the same time, people
around the world have become more and more sophisticated in the use of
technology. These inclinations have also created unparalleled opportuni-
ties for cyber criminals; criminal behaviors that were not imaginable a few
years ago have become daily occurrences today. Digital technologies today
make available to ordinary citizens tools which have the power and capa-
bility to infl ict considerable damage. As never before, and at insignifi cant
cost, criminals can cause calamitous harm to individuals, companies, and
governments from places unheard of. The new advancement in technology,
both hard and soft, is creating new opportunities for cyber criminals; and
though, in principle, the same crimes considered illegal off -l ine are equally
illegal in cyber space, online crimes take diff erent forms in regard to the
nature of the off ender and the proof of crime. In order to create a control
mechanism over cyber space and some form of deterrent for cyber crimi-
nals, a number of countries around the world have reformed their existing
laws and legislation; however, these have proven to provide vague and inef-
fi cient solutions. It is argued in this book that in order for ethical standards
to be established in cyber space, penal legislation must be developed and
adopted which is clear and transparent; in other words, new laws have to
be legislated to deal with cyber crimes. In addition, since cyber crime is bor-
derless, where off enders can aim their attacks at many people, systems, and
organizations in any country of the world regardless of their geographic
location, international collaboration of law enforcement agencies and har-
monization of cyber laws in the diff erent countries are critical.
As information and computer technologies (ICTs) have developed, so
have crimes related to their utilization; as a result of the move to the use
1
2 Cyber law and cyber security in developing and emerging economies
of computer networks in the online society in cyber space, new techniques
of carrying out crimes have been exploited. Traditional laws were not
developed with cyber society in mind. The main issue is how relevant these
legislations are in dealing with cyber crime and to what degree. Traditional
criminal laws describe qualifi ed unethical behaviors which were developed
over hundreds of years. The technological advancements of ICT networks
have provided criminals with new opportunities to carry out attacks and
commit fraud online. The costs incurred due to these attacks are consider-
able: loss of data and information, loss of revenues; losses associated with
reputation and image of the entity aff ected, and damage to soft and hard
infrastructure. Given the nature of cyber space in terms of lack of geo-
graphic boundaries, these attacks can cause instantaneous and inestimable
devastation in a number of countries at once. Several individuals have been
engaged in the fi ght against computer crime from its early development.
The pioneer in the area of computer crime is, by the account of many
experts in the fi eld, Donn B. Parker, a senior computer security consultant
at the Stanford Research Institute in the United States. His journey with
computer crime and cyber security started in the early 1970s; his fi rst book
on the subject was Computer Crime published in 1976.1 Parker was also the
lead author of Computer Crime: Criminal Justice Resource Manual (1979),
the fi rst basic US federal manual for computer-r elated law enforcement.
In 1982, the Organisation of Economic Co- operation and Development
(OECD) appointed an expert committee, the Information and Computer
Communication Policy (ICCP) Committee, to discuss computer-r elated
crimes and the need for changes in the legal systems. This committee pre-
sented its recommendations in 1986, stating that, given the nature of cyber
crime, it was highly desirable to forge some form of international coop-
eration to reduce and control such activity. In addition, it recommended
that member countries change their penal legislation to cover cyber crimes
(OECD, 1986).
Cyber criminals have been very active both in developed and develop-
ing countries. While the developed world has moved at an early stage to
enact laws to deal with cyber crime, the developing world has been very
lax in moving in this direction. The 1980s and 1990s saw a great number of
developing countries diversifying their economies from reliance on com-
modities. Many have elected to make use of information technology (IT)
to become knowledge- based societies; to that end, there is a strong need
for an appropriate legal foundation, or cyber laws. This is further neces-
sitated by the fact that the Internet is diffi cult to regulate, given that no
single, independent regulator has jurisdiction over international domains.
The legal system, even in developed economies, has always had diffi culties
in keeping abreast with the advancement of technology.
Establishing the context 3
One of the most disturbing trends in recent years has been the surfacing
of an advanced, well- developed underground economy in which spam soft-
ware, credit card information, and identity theft information are all availa-
ble at aff ordable prices. Symantec, a security software company raised red
fl ags about what it calls the ‘underground server’ economy in December
2008, with the publication of a report which estimates that nearly US$276
million worth of goods and information is available on online black
markets. Credit card data accounted for 59 percent of the information
available for sale on these underground market servers; further, Symantec
reports that identity theft information constitutes 16 percent and fi nancial
information accounts for 8 percent (Symantec, 2008).
What is even more frightening than the accessibility of this information
is its aff ordability. According to Symantec, bank account information is
selling for US$10 to US$1,000, while information about fi nancial websites’
exposure is promoted for an average of US$740. If all the information
available on the servers were made use of successfully it would net in close
to US$5 billion, the report estimates. A primary reason why this data is
more broadly available is that hackers have made hacking a full-t ime job,
earning a living by stealing information and putting it on the market for
sale on underground server systems. Malware has also extended its reach
throughout the Internet. Google reports that close to 1.25 percent of all
Internet search results in February 2008 had a minimum of one malicious
URL, a large increase from the 0.25 percent of Internet search results in
April 2007 that contained at least one malicious URL (Google, 2008).
The rise of malware and underground servers has resulted in alarm-
ing fi nancial disasters for some businesses. This past summer (2008), the
US Department of Justice announced that a group of hackers had used
a combination of sniff er software and structured query language (SQL)
injection attacks to gain access to more than 40 million credit and debit
card numbers from TJX, Offi ceMax, Barnes & Noble and other compa-
nies; they store them on underground server systems in the United States,
Latvia, and Ukraine (Gross, 2008).
Given the fi nancial crisis, fi nancial crimes are expected to increase as
cyber criminals take advantage of the predominant economic confusion
and desperation of jobless people. The present global economic crisis will
become a goldmine for cyber criminals and will most likely lead to more
fi nancial crimes in the next couple of years.
Businesses and governmental agencies around the world are being
pressurized by the economic downturn, and the insecurity facing them
is compounded by signifi cant added risks due to data leakage, data loss,
and outside attacks, all of which have increased signifi cantly over the past
couple of years. The current economic downturn has aff ected the ability of
