Judge calls for new laws on cyberfraud

TORONTO A deputy judge is calling for passage of clear laws on which innocent party should bear responsibility for financial losses related to cyberfraud.

In calling for legislation, Ontario Deputy Judge Shane Kelford said it was clear the law had yet to catch up with a growing problem.

“In reviewing legal commentary on computer fraud, this is clearly an area that would benefit from legislation,” Kelford said in a recent decision. “(Legislation should) establish clear principles and guidelines for the allocation of liability in the event of computer frauds.”

The case in small claims court in Perth arose out of a settlement between two parties that required one side, Mark Schokking, to pay the other $7,000.

Settlement terms stated that Schokking had to transfer the money into a specific trust account with the Bank of Montreal belonging to the law firm representing the payee, St. Lawrence Testing and Inspection.

Before Schokking paid up, someone somehow hacked the email account of the law firm’s paralegal, Debra Baker, acting for St. Lawrence. The hacker then emailed instructions that appeared to come from Baker telling Schokking to transfer the money to a completely different account, which he did, and the money disappeared.

Schokking asked the court to declare he had fulfilled his end of the settlement contract and no longer owed St. Lawrence anything. St. Lawrence countered that it had not received any money and asked the court to order Schokking to pay up.

“Both parties are innocent,” Kelford said in his decision. “Unfortunately, one of them must bear the loss.”

At trial, Schokking ’s lawyer suggested his client had no reason to question the payment instructions from Baker’s email account.

Kelford disagreed. The bogus instructions contradicted those in the formal settlement, and changed the payee from the law firm trust account in Ontario to one of an unknown third party in Alberta, the deputy judge said.

Kelford found Schokking had no right to rely on the scammer’s email instructions and should have realized something was amiss when the payment instructions suddenly changed. He also found no negligence on the part of the hacked law firm or paralegal.

Kelford concluded that Schokking had failed to pay St. Lawrence as agreed and ordered him to do so.