Tips To Avoid Check Fraud

The 15 worst data security breaches of the 21st Century

Data security breaches happen daily in too many places at once to keep count. But what constitutes a huge breach versus a small one? For some perspective, we take a look at 15 of the biggest incidents in recent memory. Helping us out are security practitioners from a variety of industries, including more than a dozen members of LinkedIn's Information Security Community, who provided nominations for the list.

• 1. Heartland Payment Systems
• Date: March 2008
• Impact: 134 million credit cards exposed through SQL injection to install spyware on Heartland's data systems.

A federal grand jury indicted Albert Gonzalez and two unnamed Russian accomplices in 2009. Gonzalez, a Cuban-American, was alleged to have masterminded the international operation that stole the credit and debit cards. In March 2010 he was sentenced to 20 years in federal prison. The vulnerability to SQL injection was well understood and security analysts had warned retailers about it for several years. Yet, the continuing vulnerability of many Web-facing applications made SQL injection the most common form of attack against Web sites at the time.

• 2. TJX Companies Inc.
• Date: December 2006
• Impact: 94 million credit cards exposed.
There are conflicting accounts about how this happened. One supposes that a group of hackers took advantage of a weak data encryption system and stole credit card data during a wireless transfer between two Marshall's stores in Miami, Fla. The other has them breaking into the TJX network through in-store kiosks that allowed people to apply for jobs electronically. According to KNOS Project cofounder and chief architect Kevin McAleavey, this was possible because TJX's network wasn't protected by any firewalls. Albert Gonzalez, hacking legend and ringleader of the Heartland breach, was convicted and sentenced to 40 years in prison, while 11 others were arrested.


• 3. Epsilon
• Date: March 2011
• Impact: Exposed names and e-mails of millions of customers stored in more than 108 retail stores plus several huge financial firms like CitiGroup Inc. and the non-profit educational organization, College Board.
The source of the breach is still undetermined, but tech experts say it could lead to numerous phishing scams and countless identity theft claims. There are different views on how damaging the Epsilon breach was. Bruce Schneier, chief security technology officer at BT and a prolific author, wrote in a blog post at the time that, "Yes, millions of names and e-mail addresses (and) other customer information might have been stolen. Yes, this personal information could be used to create more personalized and better-targeted phishing attacks. So what? These sorts of breaches happen all the time, and even more personal information is stolen." Still, Kevin McAleavey of the KNOS Project says the breach is being estimated as a $4 billion dollar loss. Since Epsilon has a client list of more than 2,200 global brands and handles more than 40 billion e-mails annually, he says it could be, "the biggest, if not the most expensive, security breach of all-time."


• 4. RSA Security
• Date: March 2011
• Impact: Possibly 40 million employee records stolen.
The impact of the cyber attack that stole information on the company's SecurID authentication tokens is still being debated. The company said two separate hacker groups worked in collaboration with a foreign government to launch a series of spear phishing attacks against RSA employees, posing as people the employees trusted, to penetrate the company's network. EMC reported last July that it had spent at least $66 million on remediation. But according to RSA executives, no customers' networks were breached. John Linkous, vice president, chief security and compliance officer of eIQnetworks, Inc. doesn't buy it. "RSA didn't help the matter by initially being vague about both the attack vector, and (more importantly) the data that was stolen," he says. "It was only a matter of time before subsequent attacks on Lockheed-Martin, L3, and others occurred, all of which are believed to be partially enabled by the RSA breach." Beyond that, Linkous says, is the psychological damage. "The breach of RSA was utterly massive not only from a potential tactical damage perspective, but also in terms of the abject fear that it drove into every CIO who lost the warm-and-fuzzy feeling that the integrity of his or her enterprise authentication model was intact. Among the lessons, he says, are that even good security companies like RSA are not immune to being hacked. Finally, "human beings are, indeed, the weakest link in the chain," Linkous says.


• 5. Stuxnet
• Date: Sometime in 2010, but origins date to 2007
• Impact: Meant to attack Iran's nuclear power program, but will also serve as a template for real-world intrusion and service disruption of power grids, water supplies or public transportation systems.
The immediate effects of Stuxnet were minimal -- at least in this country -- but eIQnetworks' John Linkous ranks it among the top large-scale breaches because, "it was the first that bridged the virtual and real worlds. When a piece of code can have a tangible effect on a nation, city or person, then we've truly arrived in a strange, new world," he says. Linkous says Stuxnet is proof that nation-states, "are definitely actors -- both attackers and victims -- in the cyberwarfare game." He adds that the more that electro-mechanical industrial and energy systems migrate to larger networks -- particularly the Internet -- "the more we're going to see these real-world intrusions."


• 6. Department of Veterans Affairs
• Date: May 2006
• Impact: An unencrypted national database with names, Social Security numbers, dates of births, and some disability ratings for 26.5 million veterans, active-duty military personnel and spouses was stolen.
The breach pointed once again to the human element being the weakest link in the security chain. The database was on a laptop and external hard drive that were both stolen in a burglary from a VA analyst's Maryland home. The analyst reported the May 3, 2006 theft to the police immediately, but Veterans Affairs Secretary R. James Nicholson was not told of it until May 16. Nicholson informed the FBI the next day, but the VA issued no public statement until May 22. An unknown person returned the stolen items June 29, 2006. The VA estimated it would cost $100 million to $500 million to prevent and cover possible losses from the theft.


• 7. Sony's PlayStation Network
• Date: April 20, 2011
• Impact: 77 million PlayStation Network accounts hacked; Sony is said to have lost millions while the site was down for a month.
This is viewed as the worst gaming community data breach of all-time. Of more than 77 million accounts affected, 12 million had unencrypted credit card numbers. According to Sony it still has not found the source of the hack. Whoever they are gained access to full names, passwords, e-mails, home addresses, purchase history, credit card numbers, and PSN/Qriocity logins and passwords. "It's enough to make every good security person wonder, 'If this is what it's like at Sony, what's it like at every other multi-national company that's sitting on millions of user data records?'" says eIQnetworks' John Linkous. He says it should remind those in IT security to identify and apply security controls consistently across their organizations. For customers, "Be careful whom you give your data to. It may not be worth the price to get access to online games or other virtual assets."


• 8. ESTsoft
• Date: July-August 2011
• Impact: The personal information of 35 million South Koreans was exposed after hackers breached the security of a popular software provider.
It is called South Korea's biggest theft of information in history, affecting a majority of the population. South Korean news outlets reported that attackers with Chinese IP addresses uploaded malware to a server used to update ESTsoft's ALZip compression application. Attackers were able to steal the names, user IDs, hashed passwords, birthdates, genders, telephone numbers, and street and email addresses contained in a database connected to the same network. ESTsoft CEO Kim Jang-joon issued an apology and promised to, "strengthen the security system of our programs."


• 9. Gawker Media
• Date: December 2010
• Impact: Compromised e-mail addresses and passwords of about 1.3 million commenters on popular blogs like Lifehacker, Gizmodo, and Jezebel, plus the theft of the source code for Gawker's custom-built content management system.
Online forums and blogs are among the most popular targets of hackers. A group calling itself Gnosis claimed responsibility for the attack, saying it had been launched because of Gawker's "outright arrogance" toward the hacker community. "They're rarely secured to the same level as large, commercial websites," says the KNOS Project's Kevin McAleavey, who adds that the main problem was that Gawker stored passwords in a format that was very easy for hackers to understand. "Some users used the same passwords for email and Twitter, and it was only a matter of hours before hackers had hijacked their accounts and begun using them to send spam," says McAleavey.


• 10. Google/other Silicon Valley companies
• Date: Mid-2009
• Impact: Stolen intellectual property
In an act of industrial espionage, the Chinese government launched a massive and unprecedented attack on Google, Yahoo, and dozens of other Silicon Valley companies. The Chinese hackers exploited a weakness in an old version of Internet Explorer to gain access to Google's internal network. It was first announced that China was trying to gather information on Chinese human rights activists. It's not known exactly what data was stolen from the American companies, but Google admitted that some of its intellectual property had been stolen and that it would soon cease operations in China. For users, the urgent message is that those who haven't recently updated their web browser should do so immediately.


• 11. VeriSign
• Date: Throughout 2010
• Impact: Undisclosed information stolen
Security experts are unanimous in saying that the most troubling thing about the VeriSign breach, or breaches, in which hackers gained access to privileged systems and information, is the way the company handled it -- poorly. VeriSign never announced the attacks. The incidents did not become public until 2011, through a new SEC-mandated filing. "How many times were they breached?" asks eIQnetworks' John Linkous. "What attack vectors were used? The short answer is: we don't know. And the response to that is simply: we should." "Nearly everyone will be hacked eventually," says Jon Callas, CTO for Entrust, in a post earlier this month on Help Net Security. "The measure of a company is how they respond." VeriSign said no critical systems such as the DNS servers or the certificate servers were compromised, but did say that, "access was gained to information on a small portion of our computers and servers." It has yet to report what the information stolen was and what impact it could have on the company or its customers. Linkous says the company's "failure to disclose until legally required to do so is going to haunt VeriSign for some time."


• 12. CardSystems Solutions
• Date: June 2005
• Impact: 40 million credit card accounts exposed. CSS, one of the top payment processors for Visa, MasterCard, American Express is ultimately forced into acquisition.
Hackers broke into CardSystems' database using an SQL Trojan attack, which inserted code into the database via the browser page every four days, placing data into a zip file and sending it back through an FTP. Since the company never encrypted users' personal information, hackers gained access to names, accounts numbers, and verification codes to more than 40 million card holders. Visa spokeswoman Rosetta Jones told Wired News at the time that CSS received an audit certification in June 2004 that it was compliant with data storage standards, but an assessment after the breach showed it was not compliant. "Had they been following the rules and requirements, they would not have been compromised," Jones said. The company was acquired by Pay-by-touch at the end of 2005.


• 13. AOL
• Date: August 6, 2006
• Impact: Data on more than 20 million web inquiries, from more than 650,000 users, including shopping and banking data were posted publicly on a web site.
In January 2007, Business 2.0 Magazine ranked the release of the search data in among the "101 Dumbest Moments in Business." Michael Arrington, a lawyer and founder of the blog site TechCrunch, posted a comment on his blog saying, "The utter stupidity of this is staggering." AOL Research, headed by Dr. Abdur Chowdhury, released a compressed text file on one of its websites containing 20 million search keywords for more than 650,000 users over a three-month period. While it was intended for research purposes, it was mistakenly posted publicly. AOL pulled the file from public access by the next day, but not before it had been mirrored and distributed on the Internet. AOL itself did not identify users, but personally identifiable information was present in many of the queries, and as AOL attributed the queries to particular user accounts, identified numerically, an individual could be identified and matched to their account and search history by such information. The breach led to the resignation of AOL's CTO, Maureen Govern, on Aug. 21, 2006.


• 14. Monster.com
• Date: August 2007
• Impact: Confidential information of 1.3 million job seekers stolen and used in a phishing scam.
Hackers broke into the U.S. online recruitment site's password-protected resume library using credentials that Monster Worldwide Inc. said were stolen from its clients. Reuters reported that the attack was launched using two servers at a Web-hosting company in Ukraine and a group of personal computers that the hackers controlled after infecting them with a malicious software program. The company said the information stolen was limited to names, addresses, phone numbers and e-mail addresses, and no other details, including bank account numbers, were uploaded. But one problem was that Monster learned of the breach on Aug. 17, but didn't go public with it for five days. Another, reported by Symantec, was that the hackers sent out scam e-mails seeking personal financial data, including bank account numbers. They also asked users to click on links that could infect their PCs with malicious software. Once that information was stolen, hackers e-mailed the victims claiming to have infected their computers with a virus and threatening to delete files unless the victims met payment demands.


• 15. Fidelity National Information Services
• Date: July 2007
• Impact: An employee of FIS subsidiary Certegy Check Services stole 3.2 million customer records including credit card, banking and personal information.
Network World reported that the theft was discovered in May 2007, and that a database administrator named William Sullivan, said to own a company called S&S Computer Services in Largo, Fla., had been fired. But the theft was not disclosed until July. Sullivan allegedly sold the data for an undisclosed amount to a data broker, who in turn sold it to various marketing firms. A class action lawsuit was filed against FIS and one of its subsidiaries, charging the companies with negligence in connection with the data breach. Sullivan agreed to plead guilty to federal fraud charges and was sentenced to four years and nine months in prison and ordered to pay a $3.2 million fine. On July 7, 2008, a class-action settlement entitled each person whose financial information was stolen to up to $20,000 for unreimbursed identity theft losses.

By Taylor Armerding
http://www.csoonline.com

Nortel hit by suspected Chinese cyberattacks for a decade

Chinese hackers had access to Nortel files for nearly a decade, the Wall Street Journal reported on Tuesday (Nathan Denette/Canadian Press)

___________________________________________________________________________
 

Hackers based in China enjoyed widespread access to Nortel's computer network for nearly a decade, according to a report.

The hackers – who appeared to be based in China – had unfettered access to the former telecommunications giant as far back as 2000, according to Brian Shields, a former Nortel employee who launched an internal investigation of the attacks, the Wall Street Journal reports.

They “had access to everything”, Shields told the Journal. “They had plenty of time. All they had to do was figure out what they wanted.”

Over the years, the hackers downloaded business plans, research and development reports, employee emails and other documents.

According to the internal report, Nortel “did nothing from a security standpoint” about the attacks.
Corporate espionage is a growing problem for North American companies, with the majority of attacks coming from China.

China rejects cyberspying allegations

Last November, a group of U.S. analysts said there were as many as 12 different Chinese groups participating in cyberattacks on U.S. companies and government agencies.

China has rejected allegations of cyberspying, saying it is also a target of attacks.

The long-term attack on Nortel isn’t the only time a Canadian company has been targeted by hackers.
During BHP Billiton’s hostile takeover bid for Saskatchewan’s PotashCorp, hackers traced to China targeted Bay Street law firms and other companies to get insider information on the $38-billion corporate takeover.

Those same hackers also targeted Canadian government computers in fall 2010, targeting the Finance Department, the Treasury Board, and Defence Research and Development Canada, a civilian agency of the Department of National Defence.

Nortel attacks went unreported

Nortel, currently selling off assets as part of a 2009 bankruptcy filing, failed to disclose the attacks to potential buyers of its patents and business units, according to the Journal.

During the investigation, the telecom giant made no effort to determine if any of its products were compromised. Nortel, as a publicly traded company, would have been required by the U.S. Securities and Exchange Commission to disclose any “material” risks to investors.

According to Shields, Nortel discovered the hacking in 2004, and the company’s silence put acquiring companies at risk. Three former Nortel executives are currently on trial for allegedly tampering with quarterly results in order to trigger millions of dollars in bonus payments.

With files from The Associated Press

Satellite Phones Hacked! – Eavesdropping On James Bond

Researchers at a university in Germany have used open-source software to crack the encryption key for satellite telephones in about an hour.

The team bought two readily-available sat phones and downloaded firmware updates for them. The updates revealed the encryption on the sat phones was not much different from regular cell phone GSM encryption, which has been cracked in the past. From there, it did not take much to crack the sat phone encryption.

In some regions of the world standard cell phone communication is still not available. In war zones, developing countries and on the high seas, satellite phones are used instead. Here, the telephone is connected via radio directly to a satellite. This passes the incoming call to a station on the ground. From there, the call is fed into the public telephone network. So far this method was considered secure.

Encryption algorithms are implemented to protect the privacy of the user. There is, as yet, no alternative to the current standards. Since users cannot rely on their security against interception, similar to the security of standard cell phones, they will have to wait for the development of new technologies and standards, or make use of other means of communication for confidential calls.

By Mike Tuttle · February 8, 2012

Innocent Suspects' Response to Interrogation

The process of interrogation is reserved for suspects whose guilt is reasonably certain. This assessment may be based on a combination of forensic or testimonial evidence implicating the suspect in the crime, circumstantial evidence revealing the suspect's opportunity, access, motive and propensity to commit the crime, or the suspect's behavior, e.g., going into seclusion following the crime, catching the suspect in a known lie, etc.

At John E. Reid and Associates about 80% of suspects who are interrogated provide a corroborated, trustworthy confession.1 We believe that many of the remaining 20% of suspects are guilty of the crime but simply resistant to legally permissible interrogation tactics. However, some of those suspects were deemed by the investigator to be innocent of committing the crime resulting in the termination of the interrogation. This web tip addresses the typical behavior of an innocent suspect during an interrogation.

To understand the innocent suspect's response to interrogation it is important to consider that prior to an interrogation, the investigator has spent 30 or 45 minutes interviewing the suspect. This interview is totally non-accusatory and the suspect does most of the talking. Because of this format, a rapport or trust has been established between the investigator and suspect. On the other hand, during the interrogation of the suspect the investigator does most of the talking. The interrogation represents an effort to persuade the suspect to tell the truth about involvement in the crime under investigation. These persuasive efforts cannot involve threats of consequences or promises of leniency.

Initial Response

When an innocent suspect is initially accused of committing a crime, at the outset of the interrogation, it would be typical for the suspect to reveal indications of disbelief and confusion. On the verbal level the suspect may offer an unequivocal denial as the following dialog illustrates:

I: Joe, our investigation clearly indicates that you are the person who broke into your neighbor's home. I would like to sit down with you so we can get this clarified, OK?

S: That's crazy! I never broke into their house or stole anything from them!

Sometimes however, because of the rapport that has been established between the suspect and investigator during the interview, the innocent suspect will not immediately offer a strong denial following the direct confrontation. Rather, his initial reaction will still be one of disbelief as the suspect patiently waits for the investigator to explain why it is that he thinks the suspect committed the crime.

Early Responses

Even if the innocent suspect offers a denial following the direct confrontation, it is typical of the suspect to sit back in the chair and listen to the investigator for several minutes. In the suspect's mind, he is trying to figure out what went wrong - "Why does the investigator think I committed this crime?"

During early stages of the interrogation, however, the investigator does not present any evidence of the suspect's guilt. Presentation of real or fictitious evidence implicating the suspect in the crime is a possible tactic reserved for later in the interrogation, in response to denials typical of a guilty suspect. Rather, during early stages of the interrogation the investigator attempts to encourage the suspect to accept a concept called a transition statement. An example of a transition statement is, "What will be very important to establish in this case is why this whole thing happened." In an effort to reduce the moral seriousness of the offense, the investigator will then offer the suspect face-saving justifications for committing the crime. These justifications are termed an interrogation theme.

After listening to the investigator's theme for a several minutes the innocent suspect realizes that the investigator is not offering any evidence or explanations as to why the investigation indicates the suspect's guilt. Consequently, the suspect will lean forward in the chair in an aggressive posture reflecting confidence and certainty - he is no longer willing to allow the investigator to dominate the conversation and falsely accuse him of involvement in the crime. The suspect's eye contact will be direct and appear resentful. The investigator will then hear a denial.

Evaluating the Suspect's Denial

This is such a critical stage of the interrogation that an entire step of the Reid Nine Steps of Interrogation is devoted to handling a suspect's denial. Because both innocent and guilty suspects will offer denials during an interrogation, the first objective is to evaluate whether the denial is typical of an innocent or guilty suspect.

The innocent suspect's denial will often be broad and all-encompassing, e.g., "I've never accepted a bribe in my life!" It is also typical of the innocent suspects to use descriptive language during their denial. Examples of descriptive language include "rape", "steal", "rob", "molest" and "murder."

On the paralinguistic level, the innocent suspect's denial has a very characteristic delivery referred to as the use of "clipped-word" endings. Each word of the statement is delivered in a staccato and separated fashion, e.g., "I - did - not - break - into - that - house!" This is a good indication that the suspect is experiencing sincere resentment at being accused of committing the crime, i.e., the suspect is innocent.

Certainly some innocent suspects have less confidence than others; some innocent suspects are introverted, non-emotional or adhere strongly to a belief that it is wrong to challenge authority. Regardless of these intrinsic personality differences, once the innocent suspect offers a denial, he will be persistent in his position. He does not sit back in his chair and entertain the possibility that he may have committed the crime for a morally justifiable reason. Rather, his denials become stronger and stronger and transmit the same message - "You are wrong. I didn't do it!" It may take ten or fifteen minutes, but eventually all innocent suspects will offer persistent, strong, definitive denials.2

Attempts to Terminate the Interrogation

A non-custodial suspect is free to leave the interrogation room at any time. A suspect who is in custody merely has to say, "I don't want to answer any more questions" or, "I want an attorney." If those or similar phrases are uttered by a custodial suspect, the interrogation must be terminated.

However, from a behavioral perspective, the suspect who, upon being confronted with his guilt, immediately leaves the room or invokes his Miranda rights is revealing a clear symptom of guilt. Innocent suspects will remain in the room, argue their innocence and offer strong and persistent denials. Even after the investigator is convinced of the suspect's innocence and goes through a process called, "stepping down" the interrogation, the innocent suspect remains in the room to make certain that the investigator understands that suspect was in no way involved in the offense.

Conclusion

Investigators are not perfect and the process of rendering opinions of guilt or innocence during an investigation is not an exact science. Because of this, innocent suspects will occasionally be interrogated. Critics have tried to suggest that when most innocent suspects are told that there is no question they committed a crime and then are falsely told that evidence implicates them in the crime, that they collapse in the chair, put their head in their hands and blurt out a full confession. As anyone who interrogates on a regular basis can attest, this is certainly not true. However, innocent suspects do respond differently to the interrogation process than guilty suspects. When a suspect's behavioral response to the interrogation fits the description of an innocent person, the investigator should "step down" the interrogation and consider terminating it altogether.

------------------------------------------------------------------------------------------------------------------------
1 In our office we rarely have specific physical or forensic evidence implicating a suspect in a crime prior to an interrogation. When such evidence does exist, the confession rate would likely be higher.

2 This statement assumes that the suspect does not suffer from a significant mental or intellectual impairment and that the investigator did not engage in improper interrogation techniques that threatened consequences or offered promises of leniency. Credit and Permission Statement: This Investigator Tip was developed by John E. Reid and Associates Inc. Permission is hereby granted to those who wish to share or copy the article. For additional 'tips' visit www.reid.com; select 'Educational Information' and 'Investigator Tip'. Inquiries regarding Investigator Tips should be directed to Janet Finnerty johnreid@htc.net. For more information regarding Reid seminars and training products, contact John E. Reid and Associates, Inc. at 800-255-5747 or www.reid.com.

Thousands to be Stripped of Canadian Citizenship in Historic Fraud Sweep

OTTAWA — The federal government is set to crack down on 4,700 more people believed to have obtained citizenship or permanent resident status illegally in what’s being dubbed the biggest citizenship fraud sweep in Canadian history.

Immigration Minister Jason Kenney is expected to make the announcement that “Canadian citizenship is not for sale” on Friday.

He will unveil the details in Montreal where Nizar Zakka — an immigration consultant suspected of fraud — was arrested in 2009. Zakka is suspected of providing would-be Lebanese immigrants with false evidence — indicating that they were living in Quebec when they were not — to support their cases for permanent residency.


He’s also accused of filing or contributing to the filing of 861 false tax returns for at least 380 clients between 2004 and 2007. The returns allegedly were then used to claim refunds for child care and property taxes as well as the provincial sales-tax credit.

The announcement comes six months after the government moved to strip 1,800 people of their Canadian citizenship or permanent resident status for the same reasons. Up until this year, Canada had revoked just 67 citizenships since the Citizenship Act came into force in 1947.

The bulk of the citizenship fraud cases are said to be linked to Zakka as well as Halifax immigration consultant Hassan Al-Awaid, who was charged in March with more than 50 citizenship fraud-related offences.

The cases are also tied to a third consultant from Mississauga, Ont., west of Toronto, who remains under investigation, according to a government source who noted the others were brought to light thanks to the new citizenship fraud tip line.


Unveiled in September, the tip line already has fielded 5,366 calls.

Letters are currently being sent to the 6,500 people from 100 countries indicating that Canada is revoking their citizenship or permanent resident status due to fraud.

This comes following a lengthy investigation by the RCMP and the Department of Citizenship and Immigration.

Alleged fraudsters, the majority of whom are not currently living in Canada, have up to 60 days to appeal the decision in Federal Court before cabinet moves to void their passports and strip them of all rights and privileges.

According to Citizenship and Immigration, to maintain permanent resident status a person must reside in Canada for at least two years within a five-year period. Permanent residents seeking citizenship must show proof that they’ve lived in Canada for at least three of the last four years before applying.

At the time of Al-Awaid’s arrest, Kenney said he was suspected of helping people “create the appearance they were residing in Canada in order to keep their permanent resident status, and ultimately attempt to acquire citizenship.”

He said investigators had linked Al-Awaid to 1,100 applicants and their dependents, 76 of whom had obtained Canadian citizenship.

He noted that many people were prevented from “fraudulently obtaining citizenship” as a result of the investigation.

The government has been taking action against citizenship fraud for some time. The Cracking Down on Crooked Consultants Act, which imposes tough new penalties for immigration consultants convicted of fraud, including fines and/or prison, is now law in Canada.

Postmedia News