Natalie Bravo is an IPilogue Writer and a 2L JD Candidate at Osgoode Hall Law School.

��

Do you ever get weird emails that are poorly-veiled attempts? Strange requests for payments? These phishing attempts are occurring more frequently, but they are just the tip of the ransomware iceberg. Cybersecurity breaches are a serious concern and the ever-evolving technological landscape is an endless playing field for dedicated malicious actors. Widespread breaches exemplify the need to updated software and security policies across all sectors which use online services. With the pandemic and many working from home, these attacks are on the rise. The Canadian Centre for Cybersecurity reported that ransomware is an and

Many Canadians have not heard of , a malicious software (“”) that attacks computers by user files so that malicious actors can request monetary ransom to decrypt or unlock the files. These are typically, though not always, carried out by an unauthorized or unknown transfer of a Users may download and/or open a file that appears legitimate and unknowingly infect the operating system with malware. Accompanying ransom demands are usually requested in the form of Bitcoin due to the presumed anonymity of the transactions. The use of Bitcoin is rampant in these types of attacks – so much so that they have impacted (“K�۰�”) . Sometimes hackers . In a recent report, McCarthy Tétrault’s Cyber/Data Group estimated that Canadian organizations . Ransomware attacks damaging more than finances as they can disrupt operations and corrupt or destroy sensitive data. During the pandemic, hospitals are of utmost concern. The click of an ad, a visit to a website, or a simple file download could risk your data.

In 2017, a high-profile ransomware attack named devastated various organizations worldwide. The automatically spread throughout networkers and did not require users to open or download any files. It encrypted user files and demanded Bitcoin ransom payments to decrypt them. WannaCry targeted “end of life” or outdated versions of and exploited certain vulnerabilities within the software. Operating systems must frequently be updated to implement security patches that prevent such exploits. However, updates for older computers are usually discontinued as technology progresses. Microsoft quickly released further following the mass attack. The international event was and reported to have impacted more than 200,000 computer systems and caused an estimated hundreds of millions to billions of dollars in damage. The WannaCry attack affected organizations such as factories, telecommunication companies, hospitals, governments, and delivery systems. Years later, ��

WannaCry was terrifying when it happened, but many more concerning high-profile cybersecurity attacks have occurred ��within the past year . Just imagine . Some alarming events in the past three months include the following:

• In May 2021, the largest petroleum pipeline in the United States, Colonial Pipeline is reported to have been hacked via a . The password had access to the company’s internal network and was also unfortunately leaked on the dark web. The hackers utilized the credential to attack and extort Colonial Pipeline. The systems started to shut down and the ransom demanded was $4.4 million in payment. The company stated they had no choice but to
• In June 2021, one of the largest meat producers in the US, JBS made the difficult decision to pay the $11 million USD ransom in Bitcoin to resume plant operations.
• On July 4^th, 2021, the ‘,’ allegedly conducted by Russian-associated hackers REvil, hit during the US holiday weekend. Kaseya, a software firm, was targeted in the . Supply-chain attacks, in brief terms, involve compromising a trusted supplier therefore sabotaging the distribution system. The Kaseya attack largely affected US businesses, but Canada was also impacted. Between 800 and 1,500 organizations across the globe were impacted and essentially paralyzed. They demanded from affected users/companies and expressed some willingness to .

It is difficult to know what will happen next with technology, computers, and software. It is best to be proactive and cautious. I have compiled some tips, supported by and the , to help keep your data and your employer’s networks safe:

• Check your computer(s) for updates frequently, and make sure your operating system is still receiving new updates.
• Back up your data periodically and preferably offline. If you are targeted and your data becomes inaccessible, you will feel so much better knowing you had a back-up or two handy.
• Make sure you are running a trusted anti-virus program, sometimes they are installed on your computer.
• Understand how to your data in the event of a breach and practice the recovery methods.
• Keep your passwords safe and unique - reusing passwords is never a good idea.
• Familiarize yourself with common types and methods of malware. You can find a handy list .
• Contact your organization’s IT department whenever you see anything suspicious, just in case.

Stay safe, don’t interact with strange emails, and always update and backup if possible! Feel free to comment below any tips or advice you may have.

The post Cyber Horrors: Ransomware and You appeared first on IPOsgoode.

In����the school’s computer technician found the photos and alerted the principal, who called the police. The police downloaded and stored the material as well as the browser history without a warrant. The defendant, the teacher Mr. Cole, argued a Charter of Rights violation under section 8, which protects Canadians against unreasonable search and seizure.

The outcome at the����– here validated by the Supreme Court – is a boon to employee rights and a warning to workplace HR departments. Moreover, the ruling is a strong step toward affirming the new reality that technology is not neutral in legal battles, it impacts the rights relationships we have with others and the way that individuals orient themselves in the world. The holding, written by Justice Fish, described the relationship between computer data and its user with the phrase “connected to his biographical core.”

Workplace policies are also not determinative of a person’s reasonable expectation of privacy…��The police in this case infringed the accused’s rights under s.��8 of the Charter.�� The accused’s personal use of his work-issued laptop generated information that is meaningful, intimate, and organically connected to his biographical core.�� Pulling in the other direction are the ownership of the laptop by the school board, the workplace policies and practices, and the technology in place at the school.�� These considerations diminished the accused’s privacy interest in his laptop, at least in comparison to a personal computer, but they did not eliminate it entirely.

The Ontario Court of Appeal (OCA) decision clarified that s.8����to the school technician performing inspections within the scope of their duties, but rather to state intrusion by police.

The Supreme Court outlined the concept that privacy can be reasonably expected on a workplace computer where personal use is reasonably expected.

In Cole’s case the determinant factors are mixed. The school board granted employees permission to use their laptops for “incidental” personal use. His expectation of privacy, though, should have been limited because the school’s policy was clear that data and messages “generated on or handled by” board devices would be considered school board property.

There are some HR and technology policy-type actions that employers can take to better protect the company's interest, as outlined , , and .

But there is only so much that employers can do to safeguard. ��If personal use is allowed or can be reasonably expected on company devices, employees can expect a degree of privacy. ��However, the situation is not always clear as there are that can diminish an employee's expectation of privacy.

One large area not yet explored by pundits is the growing prevalence of sanctioned social media use by companies for external communications and recruitment. The more companies require employees to be on quasi-professional and quasi-personal networks like LinkedIn, Twitter and even in some industries, Facebook, the more the line blurs between professional and personal use on company devices.

Ultimately in R v Cole, the majority felt that the evidence gathered from the laptop could be used when the case was retried. "The admission of the evidence would not bring the administration of justice into disrepute," wrote Fish.

Justice Abella dissented, arguing that it should be excluded.

There are two related lower court decisions.����(2009)��is an OCA decision confirming that a university professor must provide personal electronic data to a French government’s terrorism investigation.����(2009)��is an Alberta Court of Appeal decision��that allowed an employer’s application to dismiss a wrongful termination suit following the distribution of inappropriate material using a work computer.

There are multiple privacy statutes����and��, but little recognition of a tort of invasion of privacy. The recent����(2012) decision introduced a new privacy tort in Ontario, but this case was not appealed to the Supreme Court.

Denise Brunsdon is a JD/MBA candidate at Western University.

The post Pornography, Privacy and Professional Computers appeared first on IPOsgoode.