UK police face steep learning curve on cyber crime

UK police face a steep learning curve in getting to grips with cyber crime, a London watchdog has heard

UK police face a steep learning curve in getting to grips with cyber crime, but several initiatives underway are geared to growing capability and capacity, a London watchdog has heard.

The London Assembly’s Police and Crime Committee’s Online Crime Working Group is gathering evidence on the response of the Metropolitan Police Service (MPS) to cyber-enabled crimes.

Asked whether policing is behind the curve when it comes to tacking cyber-enabled crime, College of Policing CEO Alex Marshall said it is clear there is an inconsistent response to this threat.

“There is much catching up to be done,” he said, with experienced officers increasingly having to deal with complex, online and cyber issues, which they were never originally trained for.

Marshall said the 18-month-old College of Policing plans to publish new national standards for online investigation and intelligence in 2015 to replace outdated standards published in 2010.

The college has also developed a huge range of online training courses for police in England and Wales, as well as specific courses for different skill areas in cyber or online crime.

Marshall said the Mainstream Cyber Training programme is now part of the initial training for everyone who joins a police force because just about every crime now has an online component.

Many police forces are also including the programme in the initial training for detectives to help cover longer-standing force members.

However, he said not all forces are taking up the cyber training at the same rate or to the same degree, depending on local priorities. This meant some forces are better skilled in cyber crime than others.

Asked about MPS's take up, Marshall said the force is taking the training very seriously and has adopted a position of leadership in this regard.

“The MPS has set up a team of specialists to deal with particular aspects of business crime, fraud and online fraud, while also trying to raise the skill levels of everyone else in the service.

“The MPS’s approach of a department with specialists and dedicated resources, and trying to raise the skill levels elsewhere, is a good model,” he said.

Marshall added although there is some risk that a specialist unit, like the MPS’s Fraud and Linked Crime Online (Falcon) command, could become isolated, the objectives of Falcon indicate a strong approach.

He said the challenge for Falcon will be to deal with the volume of cases as cyber increasingly becomes a component of more crimes and to ensure delivery of the right secondary and tertiary responses.

Working with the banking industry

The Online Crime Working Group is also seeking to assess UK police forces’ working relationship with the banking industry.

Giving evidence, director of financial crime at the British Bankers’ Association (BBA) Matthew Allen assured the working group there is an excellent working relationship with UK police.

“Individual banks work very closely with a number of police forces and, as the BBA, we have proactively taken steps to facilitate a stronger dialogue with the banking industry,” he said.

Representatives of the BBA sit on a number of government committees, including the economic crime committee of the Association of Chief Police Officers (ACPO).

The BBA also runs operational groups with the City of London Police and the National Crime Agency (NCA), said Allen, which allows banks to look at operational challenges alongside law enforcement.

This collaboration includes the facility for law enforcement officers to send information such as alerts directly to banks through an online portal, which has helped prevent losses of more than £100m, he said.

According to Allen, progress had been made in promoting an understanding of the needs of law enforcement and the banking industry, but that a lot more could be done, particularly at an international level.

"In January 2015, we are rolling out a new alert service that will enable 12 public bodies to send this information through a single, coherent system to enable them to act faster and set strategy.

“We have a collective interest in building our skills and capabilities to address very sophisticated criminal networks, and we are committed to that,” he said.

Falcon division coping well with learning curve

It is about making sure the techniques and tactics we use for complex investigations can be applied to lower-level offences

Matthew Allen, BBA

Responding to questions about the steep learning curve being faced by recruits to the MPS’s rapidly expanding Falcon division, unit head Jayne Snelgrove said they were “coping very well”.

“We are accessing a lot of support and training, and the model we have put in place is based on using our more experienced investigators who look at complex offences to support junior colleagues,” she said.

Snelgrove said this model is working well to ensure investigations are not limited by knowledge and experience, and cases are being taken as far as possible.

“It is about making sure the techniques and tactics we use for complex investigations can be applied to lower-level offences when it is reasonable to do so,” she said.

Snelgrove admitted it is challenging for those recently recruited to the volume hubs, which were set up in August 2014, to cope with all the victims attached to more than 1,000 cases referred by Action Fraud.

Creating networks of industry partners

However, she said when officers need help, they know where to go internally and, where necessary, Falcon can access support from private industry.

“We are starting to create networks of industry partners that can give us technical help with very complex offences to unlock the evidence we need,” she said.

There is often risk when building a new capability and growing it very fast, said director of strategy at the Mayor’s Office for Policing and Crime (Mopac) Rebecca Lawrence. "However, in this case the leadership has been excellent,” she added.

Lawrence praised Snelgrove for the way she has built Falcon’s capability, brought systems in and trained people up, saying the process has been “extremely impressive”.

In response to a question about Falcon’s ability to deal with increased reporting of cyber crimes, Snelgrove said resources will be reviewed when phase two is completed at the end of the 2014 financial year.

“We will take stock to see if resources meet the demand and, if I can justify the need for additional resources, the commissioner will consider the need for that requirement,” she said.

Snelgrove said a key objective for Falcon is to improve the outcome rate for the referrals received from Action Fraud.

She said before Falcon was set up there was an outcome rate of about 5% in 2013, but it was aiming to achieve a target of 35% by the end of the 2014 financial year and 50% for 2015.

Challenges facing Falcon

Asked about the major challenges facing Falcon, Snelgrove said volume was a big challenge in terms of gathering digital evidence from computers and phones, and ensuring it is in a suitable format for court.

“That demand is only going to increase, so we need to get systems in place to ensure we are smart in terms of the devices we seize and how we can provide evidence without needing restraining orders on servers tht are in other countries,” she said.

Snelgrove said the continual evolution of technologies is always going to be difficult to keep up with.

We will need to be flexible and have a different approach to the training of officers, not by trying to have all the expertise in every officer, but instead having officers with a broad range of skills working together

Jayne Snelgrove, MPS

“We will need to be flexible and have a different approach to the training of officers, not by trying to have all the expertise in every officer, but instead having officers with a broad range of skills working together who may be experts in a particular device or fraud methodology,” she said.

At the same time, said Snelgrove, Falcon needs to ensure training and access to training and advice from private industry is dynamic, and that officers can react to new technologies as they arrive.

“It is challenging, but there are a lot of people who are keen to support us, and we are already getting a lot of our training externally to ensure we have that up-to-date technical understanding,” she said.

National police co-ordinator for economic crime for City of London Police Steve Head said the challenge and the solution are the partnerships the police develop across law enforcement, and across the public and private sectors.

“Volume will be a problem. We believe cyber crime is hugely under-reported, and I would like to see more reporting, so that is likely to become more of a challenge, but the answers are out there in terms of being more flexible in the way we deal with those challenges.

“Industry is investing an awful lot of money in this, but we do not need to replicate that investment – instead, we need to harness that investment and work in a more cohesive fashion,” he said.

Head welcomed the initiatives that have come from the banks. “They have made giant strides, but I think there is still a lot more we can do together,” he said.

The Online Crime Working Group has been tasked with reporting the outcome of its hearings to the London Assembly’s Police and Crime Committee, which may then make recommendations on the issue.

Read more on Hackers and cybercrime prevention