Select Committee on Science and Technology Minutes of Evidence


Examination of Witnesses (Questions 1040 - 1059)

WEDNESDAY 25 APRIL 2007

COMMANDER SUE WILKINSON, MR BILL HUGHES AND MS SHARON LEMON

  Q1040  Lord Mitchell: We have already touched on the issue of whether an e-crime is a traditional crime just done in a different way, but nevertheless the economics of the crime—which I think you also mentioned and which is the mass nature of it (we see this in large scale phishing attacks which can yield a high profit for relatively low investment)—does this actually transfer it into a different type of crime?

  Mr Hughes: Again, as both of my colleagues have said, I think the present legislation is right. What we would look for particularly is that perhaps this is an area which could be reflected in the sentencing, depending on the aggravation factor. If I give one example, we are investigating at the present time a fraud which many people in this room will probably have known about for a long time, which is when you receive a card telling you that you have won the lottery despite never having bought a ticket. If you pay a certain administrative charge and so on and so forth they will get you the winnings. This is a clear scam and it is operated often outside the jurisdiction. It is small scale but when you pull it together these can involve millions of pounds being taken from people. More importantly they are targeting vulnerable people because once you respond they put you on a sucker list and then they go back to you and back to you and back to you. This targets the more vulnerable in society. I would want to see, if there were a way of explaining and bringing that to the fore in a court case, that that should be reflected in the sentencing because of the aggravation factor of what is going on.

  Q1041  Lord Harris of Haringey: Following up on that in terms of the exacerbating factor, you have just given us an example of the sucker list and so on but we have also received evidence about the vulnerability of young people and new forms of bullying which are e-related. The nature of this is that the message or the crime is committed through something which is sitting in people's homes frequently. That is therefore a different sort of intrusion from when you might be more on your guard when you are going about your daily life outside. Do you think that that could be built in as some sort of exacerbating factor in terms of crime, that because of the computer sitting in people's homes—in their living rooms or their bedrooms or wherever—that this is something which makes the crime worse and should be taken into account in terms of sentencing or in terms of recording?

  Ms Lemon: I certainly think that in terms of bullying the effects could be far more damaging because the attacks could be so much quicker and more intense. If you are getting bullied by a text message of SMS or IMs it is there constantly, whereas if it is a physical bullying (which is equally bad) you have to actually engage with the person on the occasion you see them. Certainly it is an aggravating factor because it is then invading the whole of your life.

  Mr Hughes: I think the point you raise, Lord Harris, is a very important one. This takes me back to when we started doing drug investigations and often you would find courts who were not familiar with the effects of a particular drug or how large or what the significance of the sort of seizure was that had been made by police or customs officers and how much money and how much damage that could cause. We may actually be in that same type of environment that you are describing now where everybody has a laptop or desktop in their home and it is just seen as a piece of equipment in the house like a toaster or a kettle, but it is not because of the points you make; it can be used in another way. It may be that we need to point this out particularly with young children being bullied in this way either by SMS messages or e-mails that have been sent to them or in some cases where they have sent them to other people themselves. This is the point I was making just now, how do you present this in a court case where you can realise the aggravating factors and the damage that this can cause. This again may be something we want to look at in terms of prevention orders. It may be around not having access to such technology or not being allowed to use it in certain areas. I have to say as well that the issue here again is about education, making sure that people understand that having a desktop in your house there are certain things you need to be aware of. There are many beneficial aspects of having it, but there are dangers to it also. If I may say so, that is one of the reasons why Jim Gamble with CEOP is making such a strong case around protecting children on the net and the Virtual Global Taskforce, police officers patrolling the net through the use of that Virtual Global Taskforce to try to reinforce that message that this can be used for ulterior motives.

  Q1042  Lord Harris of Haringey: The Home Secretary I think has recently announced that he wants crimes where there is the use of a knife for there to be a separate recording category so that the fact that the knife has been used is recorded for data purposes. Would you see some value in respect of all crime in there being some recording where it is e-enabled simply to give some sort of indication of the problem of the scale and the issues?

  Mr Hughes: I think there would be benefit in that. I also think, from the point of view of criminal intelligence again, you are looking at recording knowledge about how a crime was committed, building up a picture, crime pattern analysis, the knowledge and MOs of individuals it would be useful, but that is me talking like a cop now. From the point of view of protection of communities, I think it would be useful to do that. Again it gives you the point that was made earlier on about picking up targets. At the moment what is actually happening in terms of e-related crime is a little bit in the dark. We do not know too much about the numbers involved and it would help us to pick up on quantifying what the actual problem is.

  Commander Wilkinson: The Metropolitan Police is flagging crimes which have an e-ingredient and it is giving us some idea perhaps of the proportion of crimes that are actually reported that have an e-element. However, it is really complex because is the use of a telephone during the commission of a crime an e-crime, right the way through to the crime which is wholly facilitated or commissioned on the Internet? It is a difficult question. I think we should aim towards that eventually, but as the world modernises and moves on you are going to end up with the vast majority of crime actually being shown as having an e-ingredient. In the Met we do actually record offences and we code against whether a hacking virus has been used in the course of the commission of the crime, whether a computer has been used to facilitate the offence (which could be to any degree really) and other offences where the Internet is being used. We do not currently count any crime that is committed using a mobile phone, for example. Certainly this is something which I shall be looking at. You are probably aware that I have recently received endorsement from the Chief Constable's Council to go ahead with setting up a police e-crime unit that will actually pull together policy, practice, standards and training across the whole of the 43 police forces and this is one of the key initial aims of this unit, to try to standardise recording, reporting and statistical analysis.

  Q1043  Earl of Errol: You made the point that some of these things are outside your jurisdiction. Surely if the crime is perpetrated against a UK citizen in the UK the fact that the initiator of the crime happens to be resident outside the UK at the time is still in your jurisdiction, in which case could you grab them, like the Americans do, using a European arrest warrant?

  Mr Hughes: The European arrest warrant is there to be used; it has potential. That is provided it is within the European jurisdiction, a lot of people we are dealing with are not.

  Q1044  Earl of Errol: If the victim is in the UK does it then fall within your jurisdiction?

  Mr Hughes: It depends on the strict definition of the offence, where it is perpetrated or where it is actually put into effect. If it is done via an e-mail or something like that then you have to prove where it has originated from of course.

  Q1045  Earl of Errol: The victim is in this country.

  Mr Hughes: That is true.

  Q1046  Earl of Errol: He has parted with money in this country.

  Mr Hughes: I accept that. We could probably spend several hours debating the legal aspects of all this.

  Q1047  Earl of Errol: So we are going to have to look at the law on this.

  Mr Hughes: I think the law is quite robust around this. The real point is that a lot of the people we are dealing with are outside the European jurisdiction as well and that is why we are putting global alliances into place so they can be dealt with in their country of origin.

  Q1048  Baroness Sharp of Guildford: To what extent do you think e-crime in the UK is actually increasing, and in particular given the caveats you have already announced about statistics, how far do you think the data based on e-crime is reliable and how far it is not?

  Ms Lemon: Definitely evidence of traditional off-line crime now going on-line because of the scale and reach and the instant contact around the world. We are forming very successful partnerships in the UK to share information intelligence around e-crime which I think is extremely promising. We have formed the National e-Crime Strategic Group which is going forward with different agencies in the UK to share intelligence and information. Bill referred to the global alliances we have where we are also sharing information about threats. I think we are getting a much more comprehensive picture but with a full admission that we have a long way to go.

  Q1049  Baroness Sharp of Guildford: Given the comprehensive picture do you think it is going up or down?

  Ms Lemon: I think certain areas are going up. The money-motivated crimes are on the rise; the "I can open the Pentagon crimes because I'm clever" are on the decrease. Money-motivated crimes are on the up.

  Q1050  Baroness Sharp of Guildford: In Get Safe Online, the survey where they announced the results last October, what they found was that people feared on-line crime much more than they feared mugging and burglary. Would you agree with that?

  Ms Lemon: Those were certainly the findings and my plea from this group would be about raising levels of awareness with realistic information for consumers, businesses and home users because unfortunately there is not a systematic way of informing consumers and we get dramatic headlines which do scare people when they do not know how to deal with an e-mail. I think there is a remedy through Get Safe Online perhaps promoting that and developing it. I think people need pragmatic, realistic advice to encourage them to use the on-line environment, which is what we would recommend.

  Q1051  Baroness Sharp of Guildford: How much of the e-crime experienced by UK citizens is actually committed by criminals based in this country and how much comes from abroad? Do you have any feel for that?

  Ms Lemon: I speak for the Serious Organised Crime Agency. Most of our offenders in the level three crime, causing harm to the UK and its citizens, are by people outside of the UK.

  Commander Wilkinson: We do not have accurate statistics but that does appear to be the case.

  Mr Hughes: Just to pick up on some of those areas, again it is back to becoming aware of how this crime is actually happening because, as you will know, there is a lot of hyperbole in the press, media and elsewhere, a lot of scare stories; sometimes they are very valuable but we have to be careful to sort out the wheat from the chaff on this one. That is why one of the things we are trying to do—and Sue's unit will be doing as well—is working with our colleagues in other sectors. For example, banks and financial institutions that can help us to get a picture round what is actually happening. You have talked of the fear of the crime, people have a fear of phishing attacks. They need to be on their guard but we do not need to slow everything down and stop e-commerce. We have to get some accurate picture out of that. If you read some media you will think that everybody is subject to a phishing attack but it is not that many numbers but equally when they are then it can cause serious damage. What we need is for the banks to give us some accurate picture, and they are being very helpful on this. Now of course we have moved on because the approach that we are taking where they are not fearing to tell us that they have been subject to this where in the past for competitive reasons they kept things quiet so we did not really become aware, now we have ways in to talk with them in confidence. Sharon and her team and the police forces now have ways to pick up the picture without exposing them to the risks of losing customers because they have had this attack. Unless we do that, unless we have that confidence, then we will not get an accurate picture of what is really happening.

  Q1052  Baroness Hilton of Eggardon: To pursue the matter of getting an accurate picture, when we visited the FBI in the States we heard about the IC3 network which obviously would be very resource intensive, but it would help you to analyse patterns and so on. Do you think we should have something which is much more publicly known about the ways of reporting e-crime?

  Ms Lemon: The IC3 essentially is very good for analysis and intelligence but it is not the single reporting centre in the US; it is an option. A third of their reports come from out of the US so that gives a few pieces of the puzzle and my comment would be that if we are going to have something let us have all the pieces of the puzzle.

  Commander Wilkinson: We did visit the IC3 centre as part of our preparation for setting up the new police unit and we will definitely take some best practice from there. I think we have a lot to learn from it. However, I think that there is a new issue emerging in the UK around the new strategic fraud authority and the new potential national fraud reporting centre that is currently being scoped by the City of London Police. Clearly so much of e-crime relates into fraud that actually the last thing we need to do now is start talking about a national e-crime reporting centre which would eat up a lot of money unnecessarily and will duplicate. I am currently talking with the Commissioner and his staff and the City of London Police to work out how any potential national fraud reporting centre can merge with e-crime reporting and build into the fraud reporting centre the extra types of crime that may be reported that are not specifically fraud. That is something we need to look at immediately in terms of the planning that the City of London are going through.

  Q1053  Baroness Hilton of Eggardon: Do you see that as an ACPO responsibility rather than a SOCA responsibility?

  Commander Wilkinson: I would, I think, yes, because we are the public face of law enforcement and policing in this country. Given the fact that the City of London are already scoping this particular issue we need to work closely with them to see how we can merge e-crime reporting in with it.

  Mr Hughes: Just to pick up on that, we are not in competition here; we are in competition with the bad guys. That sounds like a statement of the obvious but it has not always been that way and you know that very well indeed. The benefit of SOCA is that we are part of a continuum of law enforcement in this country and not an "instead of" which you will see from the cooperation and the collaboration here. The other point I would make as well is that the point you make about the ability of individuals to be able to report this to a law enforcement agency whomsoever, we are not complacent about that. We still have some way to go on getting this right. That is why we are working on this strategic grouping to get all of these different agencies who are beavering away in different areas pulling that work together and they can assure the individual, when they have been the victim of a crime, of a way of reporting it. This is what Sue was talking about, that mainstreaming. If you go into one police station in one of 43 police forces this is not going to be the best way of coordinating that response back to us. It will take time and the problem with the crime we are dealing with here is that it is very fast, very dynamic and they move quickly so we have to be able to do the same. We need to find ways to reassure individuals when they do report that their inquiry is being dealt with, to find ways of dealing with it at source rather than simply starting with the investigation side. If you like, that is one of the changes in law enforcement that we are trying to push through, both of us.

  Q1054  Chairman: Continuing on with the theme of who has responsibility, who is responsible for investigating level two e-crime which appears to fall outside the responsibility of both individual police forces and of SOCA?

  Commander Wilkinson: The Metropolitan Police Service has a computer crime unit and does take on those types of investigations that fall outside of those two remits. Certainly the new national unit or the new ACPO police e-crime unit that we now have the go ahead for would be the repository for such reports and would certainly assess such reports and decide how they should be investigated any by whom. The Metropolitan Police is currently carrying that responsibility; the new unit will be housed within the Metropolitan Police in any case. The point that is important to make is that Sharon and I are currently working on putting together a protocol whereby the nature of e-crime is such that any small local report can turn out to be the end product of a multi-national crime issue. Therefore it is very important that the protocol between the 43 police forces of SOCA works well so that we can work out exactly who is best placed to investigate. Often a level two crime is actually a level three crime; it is an international crime. We are working that through at the moment.

  Mr Hughes: It is one of the areas that is vital in what we are trying to do with SOCA and the way the police forces work. If we do not understand and have the knowledge around the whole of the problem then we will go at it piecemeal whereas what we need to understand is what is actually happening here? What you are seeing is the end result, as Sue has just said, of something which has started elsewhere and may be happening elsewhere and there is another way of attacking it. If we only focus on the individual case we will only forever be rushing round with sticking plaster whereas we need to be looking at the whole issue. There is a danger when talking about levels one, two and three—we have found this elsewhere on the national intelligence model—people seem to think that crimes fall into nice convenient slots and that the law enforcement response can follow that same route. It does not; it has to be a continuum activity and understanding so that we can address it properly. That is why we are working so closely together so that nothing does fall between the stools.

  Q1055  Chairman: This is an issue that we have focussed on quite a bit. If we look at this from the point of view of the individual in the United States we learned from the Federal Trade Commission that they have tried to generate a standardised form that the 28,000 police stations in the United States can have so that an individual now knows what to do. Presumably one hopes it is then coordinated and that is certainly their aim. If you look at the environment here, we understand that individuals could approach the National High Tech Crime Unit.

  Ms Lemon: The National Crime Unit never took reports of crime. We did provide advice on our websites and we did have people answering the phone for general inquiries. That is still the case with the exception of the website.

  Q1056  Chairman: What should the individual do today? We learned from Gareth Griffith, the Head of Trust and Safety for eBay that "When we try to get police engaged, sometimes they say, `Look, we'd love to help you. If it is not over x threshold'—thousands of pounds, or whatever it is—`we can't help you'." Is this true? The individual who has lost £500—which is important to the individual of course—does not look very large to an enforcement agency but it may be one of a thousand such cases.

  Mr Hughes: You have picked up on exactly the issue I was making which is e-Bay, for example, comes straight into us. Banks and financial institutions come straight into us because we have set up this way of picking up the issues so that we are picking up a big picture rather than simply responding to individuals. e-Bay will see where there is a pattern emerging and we can do something about it. You are absolutely right and again we are not being complacent. There needs to be a way for private individuals to be able to report a matter to the police service and that is what Sue and her team are working on doing. This is going to take a little time to put across the country. As I say, the danger with it is that every different police station across the whole of the United Kingdom, getting all that information in and being able to deal with it, there are other ways in which we deal with crime, perhaps in a different way, and that is also what we are looking for. I have no easy answers to that at all; it will take time to develop.

  Q1057  Chairman: Are you definitely assuring us that this feeling that people have, particularly with industry, that the abolition of the National High Tech Crime Unit demonstrated that the police were no longer serious about e-crime; you are saying exactly the opposite, are you?

  Mr Hughes: That is not the case. It is one of those things where SOCA is one year old; we have been working through a new agency. We have established through several of our different units—Sharon's is just one—with the Prevention Alerts Unit, the Crime and Techniques and other areas around proceeds of crime, the Suspicious Activity Reporting Database that we have been enhancing since Sir Stephen Lander's report that has helped banks and financial institutions report stuff to us. All of those are ways in which we are going out into what is happening out there to find out the true picture. As I say, there was a lot of bits and pieces written in various media about the National High Tech Crime Unit which, on occasion, bore little link with reality. What we are trying to do is establish something which will actually take forward in a better way the response that we need to have. We are not there yet; we are working on getting it there.

  Commander Wilkinson: From the point of view of the 43 police forces, I cannot sit here and assure you with total confidence that if any individual member of the public was to go into any police station in the UK that they would immediately get the level of service they would expect in terms of the person they were reporting the crime to understanding exactly what the problem is. This is one of the tasks that I have really set myself in setting up the new ACPO unit, to mainstream awareness and a certain level of skill amongst all police officers and police staff so that we can provide a better level of service. However, I am quite robust around this because I think that the nature of e-crime, because it is often geographically very wide and because often there may be many thousands of victims of one particular crime, I cannot—and I will never, I do not think—be able to take the position whereby I will be able to say to any single member of the public that every single e-crime will be investigated. What we need to do is to collate the picture of what is going on and there are a lot of different means already in existence of doing that and through various websites et cetera. We need to get a full picture of the pattern and the nature of the crime in order to tackle it in a very pro-active, preventative way, to stop it happening in the first place. Often the scale of the crime is such that the police service would just fall over if it tried to investigate each of them on an individual basis. It is a different type of crime from that point of view; this is a new type of crime where the technology is allowing a new scale of crime that we cannot deal with in the conventional way.

  Q1058  Lord Harris of Haringey: If a member of the public reports something to the new national unit, if it meets the investigative criteria and it fits into a pattern, then it will be followed up, it will not simply be a tick in the box, is that correct?

  Commander Wilkinson: Potentially it would be followed up. There will be investigators for major crime that is causing major threat or major harm at a level two, level three basis for example. I do not have those terms of reference or those criteria clear yet. We have only just got the go ahead for the unit in the first place and that all needs to be worked through and will take some time to work through. I am very conscious that the 43 police forces need to provide a better standardised service in terms of the reporting and the investigation of e-crime.

  Chairman: We will have to adjourn for a few minutes now for the division.

  The Committee suspended from 4.28pm to 4.36pm for a division in the House.

  Q1059  Lord Harris of Haringey: Could I just follow up about the National Unit? You have told us you have the go-ahead; does that mean the funding is in place?

  Commander Wilkinson: It does not mean that funding is in place but we do have a plan. We potentially have a great deal of sponsorship and we are now going to start work on a detailed business case to work out exactly what is likely to be forthcoming. That really is the very next step that we now need to take. I have no doubt that a considerable amount of sponsorship will be forthcoming and I have no doubt it will be enough to set the unit up. It needs to be managed well because this is a law enforcement unit with private industry backing it.


 
previous page contents next page

House of Lords home page Parliament home page House of Commons home page search page enquiries index

© Parliamentary copyright 2007