Cybercrime Is The Biggest Evolving Source Of Crime In The UK

Cyber-crime is the biggest evolving crime type in the UK and beyond in terms of volume and complexity, according to detective chief superintendent Pete O’Doherty, lead of cyber and head of economic crime at the City of London Police.

“But it is difficult to police, because unlike other crimes where there is an offender, victim and location, cyber-crime tends to be multi-national. If you look at the globalisation of goods, people and services, and an epic evolution in technology, it is without doubt the most significant harm in the UK,” he told the information security track of the International Security Expo 2018 in London.  

“I have been a detective my whole career and the training I have been given has not equipped me with the skills and techniques that I need to investigate cyber-crimes involving multiple actors in multiple countries,” said O’ Doherty.

Capability to investigate cyber-crime is one of the top challenges, he said, particularly when it comes to cyber dependent crime involving botnets, distributed denial of service (DDoS) and malware, as opposed to the more traditional types of crime that are cyber enabled.

“The next problem is capacity. In the UK we are pleased to say we police by consent, but cyber, terrorism and economic crimes are not top of the list of what citizens [are worried about]. They are worried about things like anti-social behaviour, so there is a big gap between what the public wants from policing and our national threat strategic risk assessment.

“The challenge for us is finding a way to bridge the gap between the threat intelligence and the public voice if our main aim is to achieve public value.”

The third major challenge, said O’Doherty, is that while law enforcement and locking people up is important, it is not going to solve the problem of cyber-crime.

“There needs to be a massive focus on intervention, disruption, security by design and intelligence sharing if we are ever going to make a difference, and we need to start looking for digital skills in our recruitment and selection processes,” he said.

Another necessary change, said O’Doherty, is to increase the use intelligence to find links between cyber criminals and more traditional crimes “to leverage the politics” to get local policing to treat it as a priority. “Al Capone was not put in prison for homicide, but for fraud,” he said.

Adapting to Challenges

The switch from using credit cards to crypto-currencies on the dark web is another challenge for police who are now no longer able to use covert credit cards to buy goods to catch criminals offering illegal goods and services.

In the face of these challenges and the increased use of personal data stealing and illicit crypto-currency mining malware spread through social engineering emails, O’Doherty said the police are adapting their approach to combating cyber-crime.

The first area policing has achieved success is in shutting down websites providing unauthorised access to copyrighted content by cutting off their advertising revenue, which was around $50,000 a month.

The City of London Police stepped in by contacting the website operators, inviting them to contact the police for help to legitimise the business. “If they fail to contact us, we put them on a blacklist sent to UK advertisers who remove their brands from the offending websites, cutting off advertising revenues.

“We then share the intelligence with Mastercard and Visa, who take down the payment enabler so that any money generated can’t be generated overseas, and we share the information Europol, Interpol, the FBI and others so that each country can work within its own legal framework to take down offending sites. 

“In this way, we have saved millions of dollars for the [creative arts] industry, we have dismantled 70,000 websites and over 100 organised crime gangs operating in this space no longer exist.”

Cyber Griffin is another initiative by the City of London Police to provide a free service aimed at helping people protect themselves from cyber-crime. “Every month, we use the intelligence we receive to brief industry to help organisations to build robust cyber security practices to prevent the external and internal threats from damaging the business.

“We also do incident response exercises in which we map out an organisation’s infrastructure, identify the threat vectors and help design internal regimes to prevent the threats,” said O’Doherty.

In response to the capability challenges, police forces are building capabilities and volunteers. “There is now the opportunity to become a volunteer police officer called a special constable to work in investigations to use their expertise in risk mitigation and cyber security to help police do a better job.”

The use of “direct-entry detectives” is another effective strategy being used by police in combating cyber-crime. “Many people want to be a detective, but don’t want to walk the beat. So were are currently designing a way for experts to join the police as a detective by ‘direct entry’ to investigate fraud and cyber-crime as a specialism,” said O’Doherty.

“We are also in the process of designing a cyber academy to offer courses around, such as cryptocurrency and cyber investigations for policing and law enforcement,” he said.

In an attempt to get public support for investment in cyber-crime fighting, O’Doherty said police forces are giving police chiefs and commissioners a profile that “articulates the impact of cyber-crime on local people and draws the links between cyber and organised crime to give them the appetite to invest”.

As a result, he said there has been a “massive improvement” in the level of investment being made by policing and the cases that officers are now able to investigate.

Internationally, O’Doherty there is a UK policing representative in the office of the district attorney of New York in the US who shares intelligence about organised crime gangs that operate across the Atlantic to help coordinate investigations.

UK also has a team of specialists dedicated to working with convicted cyber criminals to understand how their crimes were committed with the incentive of getting their prison terms reduced. One success story, said O’Doherty, is about a 22 year old in the US who designed a chipset that enabled him breach voicemail services around the world to access linked computers and servers to access sensitive databases.

“Under this initiative, he helped police design prevention advice that we disseminated to industry and design a mechanism to ensure that this type of attack can never happen again.”

Another key tool in the police arsenal for fighting cyber-crime is disruption activity. “Action Fraud, receives about 24,000 reports a month, which policing does not have the capacity to investigate. But we have a capability that identifies bank accounts, email addresses, VoIP platforms and websites linked to fraud and we have a team that disrupts those entities to prevent further offences, and we estimate that through that work we save around £400m from being lost through fraud,” said O’Doherty.

In closing, he said that “partnership” is a key element of everything policing is doing to address the challenges associated with fighting cyber-crime. “Partnership with industry, government and education systems. We cannot do it alone.

“We want every victim of crime, which includes businesses to report those crimes, because if we know what the true scale of the problem is, we can start to develop and intelligence-led, coordinated response to cyber-crime, which is significantly under-reported, and that is a big problem,” he said.

Computer Weekly:

You Might Also Read:

Tackling UK Cyber Crime

« Germany Develops Offensive Cyber Capabilities Without A Coherent Strategy
Cyber Weapons Are Proliferating Beyond Control »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Wisegate

Wisegate

Wisegate is a community of IT experts providing advisory services on all areas of IT including security.

CORDIS

CORDIS

CORDIS is the European Commission's primary public repository and portal to disseminate information on all EU-funded research projects and their results.

Latvian Information & Communications Technology Association (LIKTA)

Latvian Information & Communications Technology Association (LIKTA)

LIKTA brings together leading Latvian companies, organizations and professionals in the field of Information & Communications Technology

Acutec

Acutec

Acutec is an award winning IT support, services and solutions provider including managed IT Security and backup/disaster recovery.

Sonda

Sonda

SONDA is the leading systems integrator and IT service provider in Latin America.

Iterasec

Iterasec

Iterasec provides a full range of security services to hacker-proof your products and make software engineering process secure by design.

Cranfield University

Cranfield University

Cranfield Defence and Security are at the forefront of their fields, offering capabilities ranging from cyber security and digital warfare to robotics, forensic sciences and simulation and analytics.

Asimily

Asimily

Asimily’s IoMT risk remediation platform holistically secures the mission-critical healthcare devices that deliver safe and reliable care.

National Cybersecurity Agency (ACN) - Italy

National Cybersecurity Agency (ACN) - Italy

The ACN is the National Authority for Cybersecurity in Italy. the Agency promotes public-private initiatives to strengthen the national cybersecurity and resilience posture.

Eleos Labs

Eleos Labs

Eleos Labs' suite of security tools prevent Web3 cyber attacks, reduce economic risks, and protect digital assets.

Foresiet

Foresiet

Foresiet is the first platform to cover all of your digital risks, allowing enterprise to focus on the core business.

Cyrex

Cyrex

Cyrex is a Web3 security and development company. Our mastery over decentralized applications, smart contracts and blockchain will keep you secure across Web3.

Leaf IT

Leaf IT

Leaf IT are a pioneering cloud-first MSP, dedicated to helping businesses in the UK and Ireland. We focus on delivering tangible results for our clients through IT transformation.

Cyber Security Global

Cyber Security Global

Cyber Security Global is a leader in electronic security, consultancy, technology, cybersecurity solutions, training, and specialized products.

Tranchulus

Tranchulus

Tranchulus are a global provider of offensive and defensive cyber solutions, information security assessment, compliance and managed security services.

Argantic

Argantic

Argantic aims to help organisations thrive and reach their full potential in a modern cloud-centric era.