Cybercrime Is The Biggest Evolving Source Of Crime In The UK

Cyber-crime is the biggest evolving crime type in the UK and beyond in terms of volume and complexity, according to detective chief superintendent Pete O’Doherty, lead of cyber and head of economic crime at the City of London Police.

“But it is difficult to police, because unlike other crimes where there is an offender, victim and location, cyber-crime tends to be multi-national. If you look at the globalisation of goods, people and services, and an epic evolution in technology, it is without doubt the most significant harm in the UK,” he told the information security track of the International Security Expo 2018 in London.  

“I have been a detective my whole career and the training I have been given has not equipped me with the skills and techniques that I need to investigate cyber-crimes involving multiple actors in multiple countries,” said O’ Doherty.

Capability to investigate cyber-crime is one of the top challenges, he said, particularly when it comes to cyber dependent crime involving botnets, distributed denial of service (DDoS) and malware, as opposed to the more traditional types of crime that are cyber enabled.

“The next problem is capacity. In the UK we are pleased to say we police by consent, but cyber, terrorism and economic crimes are not top of the list of what citizens [are worried about]. They are worried about things like anti-social behaviour, so there is a big gap between what the public wants from policing and our national threat strategic risk assessment.

“The challenge for us is finding a way to bridge the gap between the threat intelligence and the public voice if our main aim is to achieve public value.”

The third major challenge, said O’Doherty, is that while law enforcement and locking people up is important, it is not going to solve the problem of cyber-crime.

“There needs to be a massive focus on intervention, disruption, security by design and intelligence sharing if we are ever going to make a difference, and we need to start looking for digital skills in our recruitment and selection processes,” he said.

Another necessary change, said O’Doherty, is to increase the use intelligence to find links between cyber criminals and more traditional crimes “to leverage the politics” to get local policing to treat it as a priority. “Al Capone was not put in prison for homicide, but for fraud,” he said.

Adapting to Challenges

The switch from using credit cards to crypto-currencies on the dark web is another challenge for police who are now no longer able to use covert credit cards to buy goods to catch criminals offering illegal goods and services.

In the face of these challenges and the increased use of personal data stealing and illicit crypto-currency mining malware spread through social engineering emails, O’Doherty said the police are adapting their approach to combating cyber-crime.

The first area policing has achieved success is in shutting down websites providing unauthorised access to copyrighted content by cutting off their advertising revenue, which was around $50,000 a month.

The City of London Police stepped in by contacting the website operators, inviting them to contact the police for help to legitimise the business. “If they fail to contact us, we put them on a blacklist sent to UK advertisers who remove their brands from the offending websites, cutting off advertising revenues.

“We then share the intelligence with Mastercard and Visa, who take down the payment enabler so that any money generated can’t be generated overseas, and we share the information Europol, Interpol, the FBI and others so that each country can work within its own legal framework to take down offending sites. 

“In this way, we have saved millions of dollars for the [creative arts] industry, we have dismantled 70,000 websites and over 100 organised crime gangs operating in this space no longer exist.”

Cyber Griffin is another initiative by the City of London Police to provide a free service aimed at helping people protect themselves from cyber-crime. “Every month, we use the intelligence we receive to brief industry to help organisations to build robust cyber security practices to prevent the external and internal threats from damaging the business.

“We also do incident response exercises in which we map out an organisation’s infrastructure, identify the threat vectors and help design internal regimes to prevent the threats,” said O’Doherty.

In response to the capability challenges, police forces are building capabilities and volunteers. “There is now the opportunity to become a volunteer police officer called a special constable to work in investigations to use their expertise in risk mitigation and cyber security to help police do a better job.”

The use of “direct-entry detectives” is another effective strategy being used by police in combating cyber-crime. “Many people want to be a detective, but don’t want to walk the beat. So were are currently designing a way for experts to join the police as a detective by ‘direct entry’ to investigate fraud and cyber-crime as a specialism,” said O’Doherty.

“We are also in the process of designing a cyber academy to offer courses around, such as cryptocurrency and cyber investigations for policing and law enforcement,” he said.

In an attempt to get public support for investment in cyber-crime fighting, O’Doherty said police forces are giving police chiefs and commissioners a profile that “articulates the impact of cyber-crime on local people and draws the links between cyber and organised crime to give them the appetite to invest”.

As a result, he said there has been a “massive improvement” in the level of investment being made by policing and the cases that officers are now able to investigate.

Internationally, O’Doherty there is a UK policing representative in the office of the district attorney of New York in the US who shares intelligence about organised crime gangs that operate across the Atlantic to help coordinate investigations.

UK also has a team of specialists dedicated to working with convicted cyber criminals to understand how their crimes were committed with the incentive of getting their prison terms reduced. One success story, said O’Doherty, is about a 22 year old in the US who designed a chipset that enabled him breach voicemail services around the world to access linked computers and servers to access sensitive databases.

“Under this initiative, he helped police design prevention advice that we disseminated to industry and design a mechanism to ensure that this type of attack can never happen again.”

Another key tool in the police arsenal for fighting cyber-crime is disruption activity. “Action Fraud, receives about 24,000 reports a month, which policing does not have the capacity to investigate. But we have a capability that identifies bank accounts, email addresses, VoIP platforms and websites linked to fraud and we have a team that disrupts those entities to prevent further offences, and we estimate that through that work we save around £400m from being lost through fraud,” said O’Doherty.

In closing, he said that “partnership” is a key element of everything policing is doing to address the challenges associated with fighting cyber-crime. “Partnership with industry, government and education systems. We cannot do it alone.

“We want every victim of crime, which includes businesses to report those crimes, because if we know what the true scale of the problem is, we can start to develop and intelligence-led, coordinated response to cyber-crime, which is significantly under-reported, and that is a big problem,” he said.

Computer Weekly:

You Might Also Read:

Tackling UK Cyber Crime

« Germany Develops Offensive Cyber Capabilities Without A Coherent Strategy
Cyber Weapons Are Proliferating Beyond Control »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Wilson Sonsini Goodrich & Rosati (WSGR)

Wilson Sonsini Goodrich & Rosati (WSGR)

WSGR is the premier provider of legal services to technology, life sciences, and growth enterprises worldwide. Practice areas include cybersecurity and data protection.

Thermo Systems

Thermo Systems

Thermo Systems is a design-build control systems engineering and construction firm. Capabilties include industrial control system cybersecurity.

7Safe

7Safe

7Safe has been delivering hands-on digital security training courses since 2001 and offer e a portfolio of university and industry-accredited courses.

Ubiq Security

Ubiq Security

Ubiq has developed a software solution that secures any type of data, on any device, anywhere, with nearly no impact to system performance or user experience.

Austrian Trust Circle

Austrian Trust Circle

Austrian Trust Circle is an initiative of CERT.at and the Austrian Federal Chancellery and consists of Security Information Exchanges in the areas of the strategic information infrastructure.

Gigacycle

Gigacycle

Gigacycle is one of the leading IT disposal and recycling providers in the UK. We specialise in IT asset disposal (ITAD) and data destruction.

Cyber Security & Cloud Expo

Cyber Security & Cloud Expo

The Cyber Security & Cloud Expo is an international event series in London, Amsterdam and Silicon Valley.

Concentric

Concentric

Concentric Data Risk Monitoring and Protection. Deep Learning to discover, monitor and remediate risks to sensitive data on-premises and in the cloud.

SterlingRisk Programs

SterlingRisk Programs

SterlingRisk’s Cyber practice brings experience working with a wide array of clients across a broad spectrum of industries.

Tromzo

Tromzo

Tromzo's mission is to eliminate the friction between developers and security so you can scale your application security program.

TPx Communications

TPx Communications

TPx is a leading managed services provider offering a full suite of managed IT, unified communications, network connectivity and security services.

Hush

Hush

Hush is a premium privacy service that gives people unprecedented visibility and control of their digital footprint. Hush assesses threats, and goes to work to eliminate digital risks on your behalf.

Cybersecurity Dubai

Cybersecurity Dubai

Protect your business from cyber-attacks with Cybersecurity Dubai, your partner in online security solutions.

Agile Defense

Agile Defense

Agile Defense is an Information Technology services provider, delivering leading-edge Digital Transformation solutions to the Federal Government.

Epic Machines

Epic Machines

Epic Machines is a Value Added Reseller and Managed Security Services provider offering Security Transformation using Cloud-native solutions to commercial and government markets.

Robosoft Technologies

Robosoft Technologies

Robosoft Technologies is a full-service digital transformation partner. We provide end-to-end digital transformation services in areas including cybersecurity.