Following the closure of the National High-Tech Crime
Unit, policing e-crime is set to become part and parcel of everyday
police work, with the focus on prevention.
Work is now well under way on a national computer crime strategy
that many hope will address the gap left by the closure of the
National High-Tech Crime Unit (NHTCU) which was absorbed last year
into the Serious Organised Crime Agency (Soca).
The closure of the NHTCU, which was the UK's only national
police unit devoted to fighting hackers and virus writers, provoked
a wave of concern from businesses when it was announced last
year.
The unit was responsible for funding high-tech crime specialists
in each of the UK's 43 police forces. Now chief constables have to
weigh up whether they can continue to justify paying for the
specialists at a time when there are cries to put more bobbies on
the beat. Privately, even senior policemen have described the end
of the unit as "very sad".
Commander Sue Wilkinson, who has responsibility for e-crime at
the Association of Chief Police Officers (Acpo), is at the helm of
the new strategy. She is working closely with Soca to drive the
plan forward.
Wilkinson's role is partly practical, partly political, as she
seeks to build a consensus with local police forces and the Home
Office at a time when e-crime appears to have slipped down the
political agenda.
In her first interview as Acpo lead on e-crime, Wilkinson gave
an insight into her thinking. Speaking from her office in New
Scotland Yard's Specialist Crime Directorate, she outlined the
essence of the plan: to make e-crime part and parcel of everyday
policing.
At its heart is a recognition that e-crime can no longer be
treated as a specialist area, but needs to become part of everyday
police work. The strategy recognises that computers, mobile phones
and PDAs increasingly play a role in crimes that have very little
to do with hacking or the internet.
"We can no longer separate it out as we have in the past. It is
a mainstream part of all our lives. It has to be mainstream. It has
to be treated like any other crime. It has to be recorded and
reported in the same way, and treated as we treat any other
allegation," Wilkinson says.
This means ensuring that the 43 police forces in England and
Wales have specified minimum levels of expertise in e-crime.
Wilkinson is working with the police forces to raise awareness of
e-crime and to ensure that each force is capable of responding to
incidents when they are reported.
"One of my key roles is to bring all forces up to a level of
resilience. By talking to chief constables, that is what I would
like to ensure. It is very important that every force should be
able to respond to something like this," she says.
"Generally, we need specialists all over the country who
understand how the internet can be used in the commission and
facilitation of crime, and also have a good understanding of how
you can disrupt that."
Acpo is talking with HM Inspectorate of Constabulary to look at
ways computer crime capability could form part of the
inspectorate's assessment of police force performance.
At the same time, Wilkinson is also anxious that forces make
better use of the computer crime expertise that already exists
throughout the country. Acpo has begun a mapping exercise that will
identify which forces have which expertise in which areas of
e-crime. It will also, Wilkinson hopes, identify any gaps that need
to be filled.
"Every force needs to have people in it who understand e-crime.
The important thing is we get the coordination right. So every
force needs to be able to take reports of, and coordinate the
response to, e-crime. One of the most important things is that
every force is aware of where it can go to get specialist support
in any particular area of e-crime," she says.
"I would not demand that every force had a particular model of
computer crime unit."
As well as helping each other, forces will be encouraged to draw
on private sector specialists for expertise in e-crime
investigations. This approach is being pioneered by the
Metropolitan Police's Computer Crime Unit, which has created a
database of special constables with IT expertise, who can be
drafted in to help with major investigations.
The Met was able to call on their services to help in a recent
investigation into a serious virus attack. When officers obtained a
compromised server containing details of more than 8,500 bank
accounts in the UK and overseas, the specialists were called in to
identify and alert thousands of potential victims.
"There is loads of potential for all forces to take on this kind
of approach," says Wilkinson.
The cornerstone of the new strategy, however, will be crime
prevention rather than investigation. After all, says Wilkinson,
the volume of computer crime is so large that only a fraction of
cases can ever be investigated.
"One of my big beefs is that everyone expects so much of the
police on this, but actually we all have a role to play. The big
institutions have a role to play, the great big technology
companies, the banks, the ISPs," she says.
"Proactive prevention is a really viable way forward. If you
understand what the emerging problem is, you then work with the
bank or the industry or public awareness to tell them about what
the problem is and how to prevent it happening to them."
Organisations that have fallen victim to e-crime will be
encouraged to report the incident through the internet. Although
this will not necessarily lead to a police investigation, it will
provide valuable data on e-crime trends that are used to develop
prevention strategies and awareness campaigns.
"We will then work with ISPs or businesses - whatever is most
appropriate to prevent that particular mode of e-crime happening.
And that is by far the most effective policing response to a very
unquantifiable issue like e-crime," she says.
Wilkinson acknowledges that work will need to be done to make it
easier for businesses to find websites that will offer them the
right crime prevention advice. There are a bewildering number,
including Getsafeonline, IT Safe, Soca, and various child
protection websites.
The experience of the Metropolitan Police Computer Crime Unit
shows that many of the crimes reported could easily be prevented if
businesses took the right advice.
Detective inspector Charlie McMurdie of the Met's Specialist
Crime Directorate is responsible for the unit's day-to-day
running.
"An awful lot of businesses come to us where it transpires that
sensible housekeeping rules have not been put into place. Numerous
people have access to systems. These may be disgruntled employees
who are dismissed, but whose passwords are not deleted. Or systems
administrators who have access to everybody's data and details,"
she says.
Special constables drafted in from industry could play a key
role in advising firms on e-crime prevention, McMurdie says. A
study is currently under way looking at how the scheme could
work.
"You do not need to be a police officer to go out and deliver
training or crime prevention advice. So there would be a role for
volunteers to come in and work alongside the computer crime unit in
the Met," she says.
Wilkinson is anxious to play down concerns that the creation of
Soca, which has absorbed the NHTCU has left a gap in policing
computer crime.
"The gap has taken on a mythological status. I actually think
that just by communicating among the 43 forces better, publicising
the capability assessment and everybody understanding where they
can go to get support, we can enhance policing response without any
kind of gap," she says.
Even so, she favours the creation of a policing body modelled on
the NHTCU to coordinate e-crime policing across the local police
forces.
"What I have been doing all year is scoping the possibility of
some sort of national coordinating unit for UK police forces. Soca
is a new agency, not a police force. So we probably need to set
something similar to what the NHTCU did," she says.
"I think the NHTCU had a valuable role. It was pretty high
profile. Everyone knew about it. It coordinated responses. It acted
as a single point of contact for industry and all law enforcement.
It had a lot to do with the development of policy and practice,"
she says.
Whether the new unit will win funding from the Home Office is a
moot point. And even if it does not, Wilkinson is confident she can
make a difference.
"The police are not the answer to all of this. We can play our
part working in partnership with everybody else. But it is actually
for all of us to take responsibility for the potential for e-crime
to be committed," she says.
"But clearly we will prioritise our policing activity. We need
to have everyone in policing thinking this is part of their
responsibility. That is how we get the extra resources. There is no
point piling specialist resources into every force."
More information:
www.acpo.police.uk
www.soca.gov.uk
Keep watch beyond the perimeter
Comment on this article:
computer.weekly@rbi.co.uk