Activity
Mon
Wed
Fri
Sun
Nov
Dec
Jan
Feb
Mar
Apr
May
Jun
Jul
Aug
Sep
Oct
What is this?
Less
More

Owned by John

This Group discusses case law on Digital Fraud from selected jurisdictions around the globe and the implications of Court Decisions

4 contributions to Case Law on Digital Fraud
PNG Case Law on Financial Crimes, Unauthorised Disclosure, Online Financial Fraud through the Banking System.
​Case Brief: State v Ampalavio [2024] PGNC 394 ​Case Metadata ​Citation: State v Ampalavio [2024] PGNC 394; N11066 ​Court: National Court of Justice of Papua New Guinea (at Bomana) ​Date of Decision: 1 November 2024 ​Presiding Judge: Berrigan J ​Counsel: J. Batil for the State; J. Kolowe for the Offender ​1. Factual Background ​The Offender: Francis Ampalavio, a 43-year-old Lending Sales Officer employed by BSP Financial Group Ltd at the Harbour City Branch in Port Moresby, with eight years of service. ​The Offence: On four separate occasions between 5 August and 10 September 2021, the offender used his workstation computer to log into the bank's Integrated Comprehensive Banking System (ICBS). He accessed and extracted confidential customer file numbers, card numbers, and expiry dates for four bank customers: Xiana Trading Limited, Jerry Agus, Pape Accountants & Business Advisors, and Hannah’s 18 Construction. ​The Operation: He texted these details via mobile phone to an accomplice ("Elizah" or "Eko"). Eko used skimming devices to duplicate the bank cards and withdrew a total of K144,679 across the four accounts via ATMs and EFTPOS machines in Port Moresby. ​Personal Gain: The offender received a total of K500 on two occasions, but otherwise did not benefit from the stolen funds. He admitted the offences immediately during police interviews and pleaded guilty at the earliest opportunity. ​2. Charges and Statutory Provision ​Offence: Four counts of unlawful disclosure contrary to Section 25(1) of the Cybercrime Code Act, 2016. ​Maximum Penalty: For a natural person, a fine not exceeding K20,000, imprisonment for a term not exceeding 15 years, or both. ​3. Key Legal Principles & Sentencing Framework ​As this was the first time an offender was sentenced under Section 25(1) of the Cybercrime Code Act, Berrigan J established foundational sentencing guidelines for unlawful disclosure offenses in Papua New Guinea: ​Purpose of the Offence: Designed to protect individuals, the community, and the State from potential harm when confidential communications or sensitive digital data are unlawfully disclosed in an increasingly digitized economy.
0 likes • 24d
To explore how the sentencing ruling in State v Ampalavio [2024] PGNC 394 aligns with international data protection and cybercrime sentencing principles—such as those under the Budapest Convention on Cybercrime and related international frameworks—we can evaluate it across several key areas: ​1. Recognition of the Transnational and Economic Impact of Cybercrime ​International Principle: The Budapest Convention (and its Second Additional Protocol) recognizes that cybercrime and electronic data breaches are not merely isolated property crimes; they threaten the integrity of critical infrastructure, financial systems, and public trust in the digital economy. ​Alignment in Ampalavio: Justice Berrigan explicitly anchored her sentencing reasoning in national data governance policies, noting that data is a fundamental asset to economic and social development. She emphasized that unauthorized data disclosure by bank insiders creates systemic risks to financial institutions, directly mirroring the global concern for protecting trusted digital ecosystems against insider threats and data exfiltration. ​2. Shifting Paradigms: Moving Beyond Traditional Monetary Metrics. ​International Principle: In traditional financial crimes, sentencing is heavily dictated by the total monetary value stolen. However, international cybersecurity frameworks emphasize that the integrity and confidentiality of data itself are the primary legal objects of protection. ​Alignment in Ampalavio: The court noted a critical distinction: unlike standard larceny or money laundering, where the sum of money dictates the starting point, sentencing for unlawful disclosure under cybercrime legislation must start with the source and nature of the data (e.g., how sensitive or confidential it is) and the degree of breach of trust. This aligns with international legal theory that treats data breaches as severe offenses regardless of whether the immediate cash theft matches the digital exposure's total potential harm.
0 likes • 24d
To understand how the provisions of the Second Additional Protocol to the Budapest Convention on Cybercrime apply to tracking digital trails of accomplices like "Eko"—the external co-conspirator in State v Ampalavio who received text messages, operated skimming devices, and coordinated cash withdrawals—we can map specific articles of the Protocol to the investigative workflow of cross-border cyber-enabled fraud. ​While the Ampalavio case took place domestically in Papua New Guinea (involving local mobile phones and ATMs), modern financial cybercrime syndicates frequently fragment their operations across multiple jurisdictions (e.g., messaging apps hosted on foreign cloud servers, overseas crypto wallets, or cross-border telecom providers). The Second Additional Protocol was explicitly designed to eliminate the bottlenecks that investigators face in such multi-jurisdictional scenarios. ​1. Piercing Anonymity via Direct Requests (Article 7: Disclosure of Subscriber Information). ​The Challenge with "Eko": In many cases, an accomplice like "Eko" communicates using pseudonymous mobile accounts, prepaid SIM cards, or over-the-top encrypted messaging platforms (such as Telegram, WhatsApp, or Signal) whose corporate servers reside in foreign jurisdictions. Under traditional Mutual Legal Assistance (MLA) treaties, requesting subscriber details can take months, during which time the suspect abandons the account. ​Application of Article 7: This provision empowers competent authorities to issue orders directly to service providers or entities based in another Party's territory to obtain subscriber information (such as registration details, billing names, associated email addresses, and IP logs) without going through sluggish diplomatic MLA channels. This allows investigators to rapidly trace "Eko's" digital footprint back to a real-world identity. ​2. Preventing Evidence Destruction (Article 8: Giving Effect to Orders for Expedited Production) ​The Challenge with "Eko":
AUSTRALIA'S IT CONTRACTOR FRAUD CASE
​Case Brief: R v Beck (Sydney Central Local Court, 2024) ​Citation ​Prosecuted by the Australian Federal Police (AFP) Eastern Command Cybercrime Operations; sentenced in the Central Local Court, Sydney (March 2024). (Note: Commonly referred to in public records as the Australian National Maritime Museum IT Contractor Fraud Case). ​Procedural History ​The matter came to light when the victim institution detected internal accounting anomalies in November 2022 and engaged independent forensic investigators before reporting the incident to the Australian Federal Police. Following an investigation by the Joint Policing Cybercrime Coordination Centre, the offender was arrested in March 2023. He pleaded guilty in the Central Local Court and was convicted and sentenced on March 15, 2024. ​Facts ​The Offender: Andrew Beck, a 25-year-old IT contractor working for an external third-party service provider deployed to support the Australian National Maritime Museum. ​The Conduct: Exploiting his credentialed system access, the offender infiltrated the museum’s accounts payable system. He covertly altered the banking details of multiple legitimate corporate vendors and individuals, redirecting institutional payments to his own personal bank accounts. ​The Deception: He additionally harvested restricted personal financial information from the museum’s databases, utilizing stolen credit profiles to execute unauthorized online purchases—including over $20,000 on high-end IT hardware and more than $15,000 on automotive upgrades for his four-wheel-drive vehicle. ​Total Quantum: Total direct fraudulent acquisitions exceeded $66,000. ​Legal Issues ​Whether an IT support contractor with authorized system access commits a criminal offense under Commonwealth law when they bypass standard operational boundaries to modify financial records for personal enrichment. ​Whether the concurrent application of Commonwealth cybercrime statutes and state-level deception/fraud provisions can be prosecuted simultaneously for hybrid tech-enabled financial crimes.
0 likes • 24d
The policy considerations arising from the case of R v Beck (concerning an IT contractor exploiting accounts payable systems) highlight several systemic vulnerabilities in modern organizational governance, procurement, and cybersecurity. ​The primary policy considerations span four distinct operational and legislative domains: ​1. Vendor Risk Management and Third-Party Access Control ​The Policy Gap: Many organizations maintain stringent security controls for permanent internal staff while granting broad, under-monitored access to external vendors, IT contractors, and third-party service providers. ​Policy Direction: Agencies and corporations must establish mandatory, standardized vetting and credentialing frameworks for all external IT personnel. Policies should enforce the principle of least privilege, ensuring contractors only possess temporary, task-specific access that is actively revoked upon project completion. ​2. Segregation of Duties and Automated Anomaly Detection ​The Policy Gap: The offender was able to access administrative systems, alter vendor banking details, and siphon funds without immediate internal interception. ​Policy Direction: Financial governance policies must mandate strict segregation of duties (SoD) in accounts payable processes—ensuring that the person who inputs or modifies vendor banking data cannot approve the final disbursement. Furthermore, organizations should implement automated continuous monitoring and anomaly-detection tools that flag sudden alterations to high-value vendor payment profiles. ​3. Identity and Access Management (IAM) and Auditing ​The Policy Gap: Inadequate logging of privileged user activity can obscure who made specific changes within a database or financial ledger. ​Policy Direction: Policy frameworks must require robust Identity and Access Management (IAM) infrastructure, including mandatory Multi-Factor Authentication (MFA) for all backend systems, immutable audit trails, and regular independent access reviews to detect dormant or over-permissioned accounts.
0 likes • 24d
Flow chat of the Criminal Justice Process of the Case.
Reshaping Gloval Power and Staying in Control
UN Secretary's Speech at the UNGA on wars, threat to humanity, international law loses effect, geopolitical divide deepens, human rights collapsed, climate change worsens and the speed of artificial intelligence blindsighted those who created it. It is all about who reshapes power and who is in control.
0
0
Reshaping Gloval Power and Staying in Control
Introduction
Hi Members, Welcome to general discussions on sharing knowledge and experiences on digital wealth creation and its regulations. Hope you all are enjoying your festive season. What are your favorite movies and travel destination? Can any of you able to share your favorite workplace setting?
0
0
1-4 of 4
John Laule
1
5 points to level up
@john-laule-7712
My Motto is "Where there is a will, there is a way"

Active 8d ago
Joined Dec 26, 2025
Papua New Guinea