CRTC levies CASL fines in malware case

Due to actions which constituted “malvertising,” or the dissemination of malicious software in online ads, the CRTC issued notices of violations to two companies under the Canadian anti-spam legislation (CASL) Wednesday, culminating in fines totalling $250,000. It’s the first time the CRTC has used the legislation to take “enforcement action to combat the installation of malicious software through online ads,” it said in a press release. According to the CRTC summary of the investigation, anonymous actors used Datablocks Inc.’s automated ad-buying software as well as Sunlight Media Network Inc.’s ad network to deploy malware on the computers of people visiting the website where its ads are found. This is a contravention of section 8 of CASL, according to the CRTC, which “prohibits the installation of a computer program on any other person’s computer system without the express consent of the owner or an authorized user of the computer system,” it said. The malware included ransomware, banking trojans and click fraud trojans, according to the summary. The CRTC claimed “Sunlight Media substantially increased the likelihood of section 8 violations by seeking out, and successfully attracting, a non-CASL compliant clientele,” in the investigation summary. According to the text of CASL, this violates section 9 of the legislation which prohibits aiding acts that flout other parts of the law, including section 8. The regulator has ruled these actions warranted a $100,000 fine for Datablocks and a $150,000 penalty for Sunlight Media. The activity was discovered by cybersecurity researchers in 2015, as well as a later search warrant executed by the CRTC. Among other issues, said the CRTC, neither company had customer contract documents, which are required under CASL, there was no oversight of the ads’ contents, and no written policies that outline the compliance to CASL. The two companies didn’t change their practices or implement safeguards after being notified by the CRTC, the release noted. The violations occurred between February and May 2016, said the summary, and the two companies have 30 days from the notice to file a response or pay the fines.

CRTC levies CASL fines in malware case

Brief | July 12, 2018

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

CRTC levies CASL fines in malware case

Brief | July 12, 2018

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

CRTC licenses Uvagut for mandatory carriage, Inuit TV as discretionary

CRTC chair Vicky Eatrides talks strategic planning at IIC conference

The Big Fix: Vass Bednar, Denise Hearn tackle competition in Canada in new book

CRTC says decision on Google’s Online News Act exemption expected this fall

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us