Computing is the UK's most authoritative voice on business technology issues. Our weekly editorial leader article is published here - what do you think of our views on the latest news? Computing is the UK's most authoritative voice on business technology issues. Our weekly editorial leader article is published here - what do you think of our views on the latest news? Computing is the UK's most authoritative voice on business technology issues. Our weekly editorial leader article is published here - what do you think of our views on the latest news?

Thursday, 07 June 2007

Get the Met onto e-crime

It should not be a surprise if the security software industry paints a picture of phishing that best serves its commercial aims. That is what business does.

What is surprising is that such a picture is the only one there is – like burglary figures available only from locksmiths.

As phishing attacks continue to rocket – from 1,714 in 2005 to a massive 14,156 last year – the need for a coherent response is more important than ever.

But currently the only information comes from those with an axe to grind: either financial institutions keen to protect their reputations, or security suppliers with an eye on market opportunities.

The confusion is a result of mismanagement by the Home Office.

The first stage in problem-solving of any kind is to establish the nature and extent of the task.

But, although electronic crime is completely unrelated to geography, responsibility for addressing it is fragmented across all 42 under-resourced police forces. Individual victims have no clear sense where they should report attacks. And some forces have a cash value threshold under which they will not investigate at all.

The result? No metrics except those from suppliers.

It took less than a year from the closing down of the National Hi-Tech Crime Unit in April 2006 for law enforcement groups to propose a replacement, run by London’s Metropolitan Police. But so far the Home Office has refused to put its hand in its pocket.

The government must fund the Met scheme. Any crime multiplying eight-fold in 12 months needs to be addressed.

And there is a longer game. The sooner the UK can modernise its law enforcement to cope with 21st century crimes, the better it can compete globally and the more it can benefit from helping other countries facing similar problems.

The UK needs a central law enforcement unit addressing electronic crime. Only then can we stop relying on software companies to tell us what is going on.

Thursday, 12 April 2007

All forensics are the same

The point about the confusion surrounding police forces’ contracting of digital forensic analysis is not to cast aspersions on the competence of the contractors.

Nor is it even a question of there being a genuine lack of security.

The point is that it takes only the suggestion that irregular practices may be possible to derail a trial. And to proceed on any other basis is simple negligence.

The situation unearthed by Computing emphasises, yet again, the police service tendency, when faced with anything involving computers, to either ignore it completely or behave as if none of the usual rules applies.

Police forces have been contracting out forensic analysis for as long as such work has existed. Why the security of digital evidence should not fall under the same procedures as any other kind of evidence is a question with no logical answer.

Apologists for the inconsistencies may suggest that the criminal role of computers is so recent, and the digital forensics industry so young, that the mature procedures applied to traditional forensics have not yet had time to be established.

But, from the police perspective, evidence is evidence and digital forensics are no different from the more traditional kind.

Sadly, the mistaken distinction comes as little surprise.

E-crime as a whole is still often treated as a baffling novelty, even though it is growing exponentially and already costs its victims an estimated £3bn a year.

In both cases, local forces lay at least part of the blame on restricted budgets. There is no extra funding for e-crime units and not enough resources for checking the security of digital forensics contractors, apparently.

But lack of money is a weak excuse.

The private sector has learned two crucial lessons in the past decade: technology is the medium not the message, and it is no longer an optional extra.

The police service and the Home Office budget-setters need to catch up.

Wednesday, 04 April 2007

E-crime is a national concern

Friday, 09 March 2007

Time to stand by IT plans

That the first phase of the national system for sharing police intelligence has foundered is not good news: not for police forces, nor the IT industry, nor the British public.

But more worrying still is the whisper that the cancellation of the Cross Regional Information Sharing Project (Crisp) could be the first of many.

It is no secret that public sector spending is tightening. Under the current review to set departmental budgets from 2008-11, only defence is expected to see any significant increases.

And many police insiders greeted the news about Crisp with the rueful observation that, with money so tight, the ordering on the home secretary’s priority list becomes clear.

Setting aside the specifics of the Crisp decision, there is a danger that IT programmes – expensive, difficult and often unpopular – are looked on as a trouble-free place for cuts.

It is an easy argument. In the face of bankrupt hospitals, an accusing finger is pointed at the multibillion-pound National Programme for NHS IT. In the face of prisons bursting at the seams, it is pointed at the identity card scheme.

But it is also a lazy argument. Technology is no longer a desirable but gratuitous extra, like an after-dinner mint. It is now the main course, a fundamental part of every policy decision not least the modernisation of public services.

There is undoubtedly scope for a more thoughtful approach.

But if the changes to the police intelligence programme can – like the new-look ID scheme – end with a system that is both cheaper and swifter to implement, then they are to be supported.

If technology is simply seen as easy prey, the UK public sector will not benefit. The government now needs to hold its nerve, stick to its commitments and play a long-term game.

Thursday, 01 February 2007

E-crime problem needs solving

The National High-Tech Crime Unit (NHTCU) was disbanded last April on the basis that its functions could be better performed elsewhere. Parts of its role were absorbed into the newly-created Serious and Organised Crime Agency (Soca), and parts were devolved back to police forces.

But Soca is only involved with very high-level incidences of certain types of crime. And Computing’s investigation showed that local forces, with straitened budgets and multiple competing priorities, are ill-equipped to deal with e-crime.

London’s Metropolitan Police – by far the largest of the UK’s 53 independent forces – is now suggesting that its own e-crime unit fills the gap left by the NHTCU.

The plan has much to recommend it, as the huge cost of creating a national organisation from scratch, so soon after its predecessor was disbanded, is impractical.

There is a clear and urgent need for a central agency, to co-ordinate responses to what is often a non-geographic offence and to track the scale and extent of e-crimes. The public information role of the old NHTCU, and its prevention work with the business sector, are also sorely missed.

But building up the Met’s capacity will still cost money that the Home Office may be unwilling to spend on anything other than extra prison places. And creating a middle tier between local forces and Soca does not mean the job is done.

What is required, as a matter of urgency, is a careful analysis of the multitude of activities covered by the single term e-crime. Only then will it be clear where different types of offence are best handled, and how the separate levels of response can be most effectively co-ordinated.

The UK’s ability to tackle e-crime is already suffering. The confusion and lack of understanding must be addressed before any organisational structures are established. Without such clarity, we will merely be left with the worst of both worlds.


Contacts

Powered by TypePad
© 1995-2006 All rights reserved