Examination of Witnesses (Questions 1100
- 1119)
WEDNESDAY 25 APRIL 2007
COMMANDER SUE
WILKINSON, MR
BILL HUGHES
AND MS
SHARON LEMON
Q1100 Earl of Errol:
Would it not give more intelligence? You do not necessarily have
to react to the things but it would give you the intelligence.
Do the banks not have an interest in down-playing the level of
these things?
Commander Wilkinson: I think the partnerships
that we have with the banks, for example, are extremely good now
and we are working with them—sometimes confidentially depending
on the nature of what is going on—to get a good picture
of what is going on. If everybody just reported their crime to
the individual police force I do not think there is going to be
much benefit gained because if you have thousands of victims of
one particular crime right the way across the UK, given that there
are 43 police forces, you are not going to be able to get an accurate,
overall picture; the banks can.
Q1101 Earl of Errol:
Surely this is where your national Fraud Alert site—if it
were properly resourced and you had more than one person on it
and you had the software developed for it—would answer this
problem, should it be reported nationally to a single place. We
have heard some evidence from Detective Superintendent Russell
Day that financial institutions were not always reporting e-crime
to the police either because it would damage their reputation
or they knew you did not have the ability to cope. I do not know
whether that is true.
Commander Wilkinson: The Fraud Alert website
is feeding information into the banks in just the same way as
various other sources are. That covers that. We do have police
officers working within APAX and the Dedicated Cheque and Plastic
Crime Unit and that is directly funded and run by APAX and by
the Payment Clearing Services. Therefore I think the intelligence
picture is transparently shared within the banking industry and
law enforcement. The key thing here is that the scale of it is
so massive we can only deal with a situation where a proper crime
trend has been identified or a proper suspect can be located or
whatever and through the collation, working this closely with
the banks, we get a much better picture of what is going on.
Q1102 Earl of Errol:
When we visited the States the FBI told us that a side-effect
of data security breach notification laws was that more reports
reached them since companies had to tell their customers in any
case. Would you welcome such laws in the UK to give you better
intelligence? A lot of data breach is going unreported in other
words because people do not want people to know. Would it help
your intelligence gathering if we were to have data security breach
notification laws?
Commander Wilkinson: I cannot really comment
because I have not had the time to think it through properly and
clearly. It is quite a complex question. I would imagine the scale
of such breaches would be such that it would be very difficult
to manage and I do think that the partnerships that we have in
place with the banks and with other agencies such as the ISPs
for example are good, they are robust and they are improving.
I think that the intelligence picture is being shared in any case.
Q1103 Earl of Errol:
In the States it covers companies as well such as TKMax for instance.
The EU produced a directive on this in the summer.
Mr Hughes: It is a very interesting development.
I am aware of these issues. It creates quite a lot of bureaucracy
in the United States as the FBI will also tell you. Yes there
are advantages. It is like all things, if you have a better picture
of what is happening then you are better placed to be able to
respond to it. We welcome all ways intelligence and information
can be gathered. The danger of it is that if you stifle e-business
by putting too many constraints upon them then what service are
you also doing? You have to look at it from both sides. I know
that is an unusual thing for someone in law enforcement to say,
but if you make it so difficult or so restrictive then there will
be an army of people who will find other ways round it as well.
What we are looking at within SOCA is establishing good partnerships
whereby in confidence we get the information that will help us
to do something about it on behalf of the citizens and the bank
customers and other customers without causing the banks or financial
institutions to find themselves in such a bureaucratic tangle
that they do not want to do it. It is a difficult balance to strike.
I think it will be very useful to see your report on those issues
and what the issue and how it works in the United States is. The
issue that keeps coming back here is that the FBI is a federal
responsibility and is funded in a separate way to how we are operating
here in the United Kingdom. There are some differences there.
There are obviously areas where we could pick up. What we are
trying to do is coordinate what is happening in the United Kingdom
already and try to make that a working model. I hope you wish
us well on that.
Q1104 Chairman:
We are looking at it from the point of view of the individual
and the individual may not trust their bank. There are clearly
examples where banks should not have been trusted and they did
not reveal information they had for long periods of time. That
was not in the interests of the individual.
Mr Hughes: No, I accept that.
Q1105 Chairman:
That is what the American system is trying to solve so that the
individual can turn to the people who should be enforcing the
law, be their help and their friend there, and they are not necessarily
going to have to deal with somebody whom they may suspect themselves.
I am not saying for one minute that the banks are necessarily
doing anything that is against the law, but we have had cases
in this country where the banks have not disclosed, for considerable
periods of time, information that was in the interests of the
consumers to know. That is why I think, certainly talking from
my own personal point of view, I doubt this position that the
individual is told it has to go to the bank first; they should
go to you first.
Mr Hughes: That is why we work very closely
with the regulators, the FSA and others to make sure that we are
getting the accurate and full picture. It is back again to resourcing
and how best we can address the issues that are raised. We need
to find ways of doing that and we are not saying we would expect
individuals necessarily to put their trust in other institutions.
We are not saying that. It is where we can establish good working
relationships in regulated industries, where we can get the information
that we need in order to combat those who are impacting and causing
harm to the communities in the United Kingdom. We have to look
at every way we can to find that.
Q1106 Earl of Errol:
Does it concern you, Commander Wilkinson, that you could end up
with a national crime unit which is funded by the private sector
entirely if the Home Office and government do not come in and
jointly fund it?
Commander Wilkinson: That is a theoretical possibility
yes. I do not know what it is going to look like yet because this
is exactly the phase we have just moved into, the actual funding
of the unit and where the money is going to come from.
Q1107 Earl of Errol:
We could end up with a privately funded part of the police service.
Commander Wilkinson: It may start off as being
largely privately funded. The Metropolitan Police, by virtue of
the role it plays in terms of investigating level two crimes,
already puts considerable resources into it. They are largely
unseen but represent at least half a million a year, probably
about a million. We are taking that into account with the business
plan. What I would like to see is that if it goes into the National
Community Safety Plan that eventually it is taken out of the top
slicing from all the police forces. I think the way e-crime is
going, the nature of it and how it is becoming all pervasive in
lots of different types of crime, there will come a point where
all police forces could contribute into the national unit because
it is affecting them all so much.
Mr Hughes: There are very clear guidelines on
all forms of sponsorship and when police forces or law enforcement
agencies are inspected they will look particularly at those guidelines
to make sure they are properly in place and properly managed.
Commander Wilkinson: There are several parts
of the Metropolitan Police for example already that are either
wholly or partly sponsored by private industry. It is not new
territory.
Q1108 Chairman:
What is your experience of the quality of international cooperation
in investigating and prosecuting e-crime?
Ms Lemon: My experience is that this is a necessity;
it is not an option to have good relations with our international
partners in this crime type. From the very first days of the NHTCU
which has carried on to SOCA e-crime we have established some
exceptional working relationships with our international partners.
I can give examples of where we have used leverage of our relationships
with other countries. For example, my counterpart in Australia
needed to get into a country nearer us and I have a good relationship
with that country and was able to afford the introduction on an
operational basis which had a successful conclusion. More recently
exactly the opposite happened where he had a very good contact
on the other side of the world in Asia, I needed to make use of
that for an operational reason and that saved opening new doors,
creating new relationships and we were able to work together very
effectively. We held the e-crime congress in the UK in this year.
We invited 25 countries; 20 countries attended. We had a bespoke
law enforcement e-crime day which was the first of its kind which
was very, very encouraging and gave a lot of countries which would
not normally have had an opportunity to speak on an international
platform that opportunity. While it was very humbling because
they were so grateful, it was extremely informative because some
of the countries which might be overlooked have great skills and
experience from which we can learn. We have the G8 24/7 network;
we have the botnet taskforce; we have taskforces around the world
for specific e-crime offences; Digital Phishnet; the botnet. Also
we have a series of attachments within SOCA and we are trying
to create new jobs and techniques and there are other countries
who are way ahead of us so we have them attached to our unit on
semi-permanent basis so we are starting from a greater distance
in than we would have previously. So far as I am concerned, the
legislation we mentioned earlier can be problematic but despite
that I think it is extremely encouraging.
Mr Hughes: We have good examples of work for
example with the Russian and the Chinese and that has been very
helpful. We have an international liaison network within SOCA
which is now the second largest in the world after the DA in the
United States of crime liaison officers. They are there for the
whole of the United Kingdom and not just for SOCA. We have embedded
23 of them within other agencies in other parts of the world with
whom we have strategic alliances such as the RCMP in Canada, the
BK in Germany, et cetera. There are a lot of areas where dynamically
we can move a lot quicker than we ever could in the past in order
to take forward law enforcement. That service is available to
all police forces in the United Kingdom (it includes Scotland
and Northern Ireland as well).
Q1109 Chairman:
Collaboration is reasonable within the EU, is it? Would there
be any point in establishing EU cyber police?
Mr Hughes: We hold the Europol Bureau on behalf
of the United Kingdom and the Interpol Bureau. Working with Europol
we have a significant number of officers where all of these matters
are brought together. They have analytical working files on behalf
of all the EU countries around particular types of crime and cyber
crime. E-crime is one of those areas that Europol work on. So
we already have that sort of linkage across Europe. In parts of
the world that have already been referred to such as the United
States, Canada, Australia, these are not major problems. In some
parts of the world it is more difficult but we are still working
with those parts of the world to establish good relationships
and good investigation practices.
Q1110 Chairman:
Which are the countries that give us real trouble?
Mr Hughes: I think you mean the individuals
within certain countries who cause us trouble.
Q1111 Chairman:
Not necessarily. Some countries presumably are quite uncooperative
in terms of following up on leads that we might provide to them
about resources and bad practice.
Mr Hughes: We have not found too many countries
who are reluctant. Often they have problems about resourcing and
about expertise. As I said just now, we have worked and are continuing
to work with the Chinese Ministry for Public Security. In fact
Sue and myself were in China recently making sure that the relationship
with the Chinese authorities was of a very high order and has
improved remarkably and we were getting very good relationship
building there. Again the same with the Russians where we work
very closely with their Federal Drugs and Crime Units and with
the MBD in Russia so we are not seeing major problems there. There
are certain parts within Eastern Europe which are difficult to
access for various reasons, but that is not preventing us too
much at the moment. I would be reluctant to name individual countries
because in some instances they have not had the full opportunity
to cooperate with us.
Q1112 Chairman:
How do you resource this?
Mr Hughes: This is very expensive.
Q1113 Chairman:
It must be very manpower intensive.
Mr Hughes: Yes.
Q1114 Chairman:
You cannot send in teams of people to work with the Chinese presumably;
you do not have the people to send, do you?
Mr Hughes: We have officers working there but
what we do—this is the point of what we are trying to do
about embedding—is to work with other agencies in a global
alliance as it were so that other countries see the benefit in
working to help us with a particular issue that impacts on the
UK on the basis that a quid pro quo applies and we will help them
when they have an issue, such as the point that Sharon was referring
to just now with her colleague in Australia. It is about forming
good working partnerships and alliances and that is an area where
particularly the SEO have helped us enormously. The ambassadors
overseas their second highest public service priority is around
supporting the work against combating serious organised crime.
The support we have had from ambassadors around the world has
been of a very high order. Again the consulate services in China
put themselves at our service and were very, very helpful to us.
You are right, it is resource intensive, but we will only get
results if we work in that way.
Q1115 Lord Howie of Troon:
Are there some countries where the proportion of ill intentioned
villains is higher than others? You probably know this.
Mr Hughes: Yes.
Q1116 Lord Howie of Troon:
Are you going to tell me?
Mr Hughes: It does not always help to publicly
identify those countries but yes, there are problem areas and
you will find they are areas, perhaps countries, where there is
very low employment and a very high number of people with certain
skills who are now putting those skills to other uses. That has
been the case within certain parts of Eastern Europe.
Q1117 Lord Howie of Troon:
Do you have a black book or a book of any colour somewhere with
this in it?
Mr Hughes: I never carry it around. It is one
of the points that we need to make with our liaison officer network.
We have liaison officers in parts of the world that are very difficult
and they do a very difficult and demanding job. It is one of the
areas that we are trying to break down.
Q1118 Lord Howie of Troon:
You do know where you are looking.
Mr Hughes: Yes.
Commander Wilkinson: The only thing I would
add is that some countries just do not have the legislative framework
within which we can fully operate. They are willing to help but
it may be the offence we are talking about is not an offence in
their country or they do not have the powers that we have to intervene.
I think that is worth outlining.
Q1119 Earl of Errol:
There are a lot of websites out there providing advice on on-line
security and safety, opportunities for victims to report crimes
and so on. What is being done to map such sites and to ensure
that in future there are fewer, more authoritative, higher profile
sources of information?
Commander Wilkinson: I am very proud to be a
member of Sharon's National e-Crime Strategic Group that she chairs
as SOCA and I sit on as the ACPO lead on e-crime. The Met has
taken a tasking from the group to map those websites—we
know there are 200-plus—to actually look at them to quality
assure them and to come up with a strategy about how we can map
the sites and come up with a proper portal system, making it more
coherent for the public generally. We are in the throes of doing
that.
Ms Lemon: I think we have a lot to learn from
the work that is being done by Jim Gamble and the Virtual Global
Taskforce where most sites now relating to child abuse or child
issues on the Internet can be easily found and are linked to each
other. There are a lot of parallels there and we just need to
coordinate them.
| 
