Examination of Witnesses (Questions 20-39)
Mr Vernon Coaker, Mr Justin Millar, Baroness Vadera
and Mr Geoff Smith
20 MAY 2008
Q20 Earl of Erroll: I am merely looking
at the track record of what is just going through Parliament now.
Baroness Vadera: That may well be but we have
not even seen what has been recommended. We are also attempting,
through the Regulatory Enforcement and Sanctions Bill, to look
at the imposition of proportionality in civil sanctions and fines
and actually that would be something that we expect to see, not
really in this sector, across the piece and that might give a
very different overarching picture of what people expect us to
do in terms of proportionality of fines relative to the damage
that is caused.
Mr Coaker: It certainly would not be our intention
to water down important legislation that we think is appropriate
to deal with issues in this area. That is a statement that we
would want to make this morning.
Q21 Lord Krebs: Just very briefly following
up the question about voluntary notification of security breaches,
if one is going down the voluntary route, I wondered whether the
Government had any view about auditing of voluntary reporting.
Presumably companies have internal audit mechanisms and is that
something where the Government should be providing guidance on
audit standards?
Baroness Vadera: Again, this was a part of the
discussion around the ICO and we will come back to you on the
fact that we understood that there was.
Mr Smith: I was trying to come back on Lord
Harris's point which I think you are extending. Instead of looking
at health and safety as an analogy, you could say that information
is another business risk, information management is a business
risk and should really be part of the corporate governance structure
for risk management. I have to say I do not think it is quite
taken in that way as much as it should be by corporate UK and
possibly that is a line of policy development that we could think
about. I am very nervous about Lord Harris's suggestion because
we both lived through the Sarbanes-Oxley episode in the USA which
was a knee-jerk reaction to the Enron scandal.
Q22 Lord Harris of Haringey: You get
knee-jerk reactions when Government do not respond to a problem.
If the Government responded proportionately at an early enough
and appropriate stage, then you will not necessarily get that
knee-jerk reaction.
Baroness Vadera: I do understand exactly what
you are saying which is why, as you said, there was a statement
made by Downing Street that we would be taking this forward. I
have already outlined a number of views and we have given ICO
extra powers, we do have guidance and we are monitoring the situation
and it would be disproportionate at this point suddenly to say
okay, therefore the answer is legislation.
Q23 Lord Harris of Haringey: A guide
for boards of directors on information risk has just been produced
as part of risk management and this might be something that the
Department for Business might want to be picking up and encouraging
boards to be taking very much more seriously.
Baroness Vadera: Quite a lot of recent events
have shown that boards do not always understand complicated things
about financial products or IT, so yes, that is certainly the
case.
Q24 Lord Crickhowell: The Committee received
evidence that there was no generally agreed definition of e-crime
and no real data about how much was occurring, who was committing
it, and what the trends were. Your response was that you were
setting up a small high-level government industry working group,
but there was "no need" for classification schemes "because
prosecution should be based on the offence and not on the tools
used". We have had a response from Nicholas Bohm of the Law
Society's Electronic Law Committee, commenting (in his personal
capacity) on your response and saying that it misses the point
and that what e-crimes have in common is they require particular
skills. It is all a very complex issue, they lack an ordinary
location because they are often committed in large batches affecting
victims in many different places at much the same time, they are
international, the development by law enforcement bodies of the
necessary skills and the effectiveness of their work and the priority
it is given are all liable to be affected adversely by the lack
of clear information about the incidents of e-crime and so on.
How on earth can you effectively enforce if you do not have adequate
data?
Mr Coaker: May I just start by saying thank
you very much for the opportunity to come again to the Committee
and may I just apologise to all the Committee if they felt that
our response was over-defensive. I hope, in part with the answer
that I give to Lord Crickhowell and to others, to be able to demonstrate
the report that was produced by this Committee a few months ago
now has actually helped drive the agenda forward and certainly
the re-submission of evidence and the re-thinking that that has
caused has also helped with respect to that. So may I apologise
to all of you; it is no disrespect to the Committee or to any
of the members. May I start with that point? If I can answer specifically
what Lord Crickhowell has asked and then just say something about
the way that we are thinking now to try to take forward some of
these particular points. We have not set up a particular group,
but let me come to what we are going to do. We have been working
with a number of groups about what we should do with respect to
the collection of data, how that should be measured, what would
be the most appropriate and indeed effective way of doing that.
We have been discussing this with a number of groups, not least
the national e-crime strategy group, the CBI, Cabinet Office and
others. Indeed we have also said that we will support the establishment
of an industry-led partnership such as the Internet Crime and
Disorder Reduction Partnership which my colleague Alun Michael
has been doing an awful lot of work on through the UK Internet
Governance Forum and we are very pleased to support that. In answering
the point that Lord Crickhowell has made and in trying to come
to an effective way of actually doing this, what we would like
to develop, as part of the National Fraud Reporting Centre, is
an integrated response to electronic crime. We know from the US
IC3 centre that some 75 to 80 per cent[1]
of crime on the Internet could be categorised as fraud, so we
believe that that gives us an important starting point and indeed,
IC3 has been advising us about how we might set up the National
Fraud Reporting Centre. As a starting point, we believe that we
would like to see all reports of fraud, much of which will be
computer related, IT related, sent to the NFRC. One part of that
work then, having done that, would be what we could reasonably
expect to gather from individuals and businesses with respect
to that, almost a one-stop shop for the reporting of fraud, much
of which will be Internet related. I know we will come to "What
about the bit of Internet crime that is not fraud?" and,
again, NFRC could develop in a way in which that part, the 20
to 25 per cent, could go there as well[2].
Lord Crickhowell asks about the classification. It is fair to
say that we would then expect, that information having been sent
to the National Fraud Reporting Centre, to consider what categories
that crime is falling into. Again, I was struck by the fact that
if you look at the information we had from IC3 in 2007, at the
data that they have had, you can see their top ten IC3 complaint
categories. I think the point the Committee was making to us was
that clearly, if you have that level of information being given
to you and that information and those facts used then that can
help inform the response, whether that should be what the individual
should be doing to protect themselves, what the ISP should be
doing to protect the consumer or indeed what Government should
be doing or indeed what law enforcement should be doing, that
level of information and statistical evidence can then be used.
I hope that what I was saying was that we have listened to what
the Committee have had to say. Whether or not people agree that
the National Fraud Reporting Centre is the best vehicle by which
that should be done, what we do not want is a multiplicity of
National Fraud Reporting Centre, eCrime Reporting Centre and so
on. We are just trying to find a way of sensibly bringing all
of this together. I hope that goes some way to reassuring Lord
Crickhowell that we use that to collect the evidence and then
to look at how we define that.
Q25Lord Crickhowell: Well I certainly agree
that that response was a great deal more positive and constructive
than the original response to the Committee. I am a bit worried
that that answer and a number of previous answers involve you
saying "Well, there is a lot of talk going on and we are
having a lot of discussion and a lot of consideration". In
the meantime, of course, the volume of computer crime internationally
is rising, all the evidence is that it is rising sharply and it
does seem to me that it is pretty urgent that some of these things
are brought to a positive conclusion. You say a lot of the kind
of information we felt was necessary will be emerging, but if
you do not have some fairly clear classification of what you want
when the process is ended, it does seem to me that there will
be a bit of a lacuna in what we need. May I say that I think most
people on this Committee would hope that all these discussions
are going to come to some positive answers fairly quickly because
the need is urgent? I suspect, if they do not, the Committee will
want to return and ask why not quite soon. I suppose as a Welshman
I am bound to ask another question which has been drafted here
about the evidence from Team Cymru who gave figures for credit
card trading on the underground economy, dedicated Internet Relay
Chat, IRC servers, where the criminals sell data about credit
cards and bank accounts to the people who know how to cash them.
Have government officials met Team Cymru? Have they obtained any
more information on the evidence? Do you in fact track the chatter
between the criminals that goes on on the Internet to see whether
there are things that need following up by government departments?
Mr Coaker: I should have introduced Justin Millar
who is one of the officials that deal with this. First of all,
may I answer the specific point that Lord Crickhowell made with
respect to his Welsh interest. The important point he has made
is a really important point. It is a fair comment to make that
there is a sense of urgency now in this and that is what I was
trying to say at the beginning about the injection of pace, momentum
and desire to change that has now been created by what the Committee
has done. To reassure for Lord Crickhowell, we have now established
an inter-ministerial group on fraud and I preface that with the
caveat that we do know that a large amount of computer related
crime is fraud. We have set up an inter-ministerial group which
includes ministers from a wide variety of departments. At the
first meeting, we did say that there was a need to look at the
issue of computer-related enabled fraud and indeed there is a
draft paper which is available for the next meeting, which will
take place before the recess about how we take all of this forward.
I will not move on to the other questions which will make other
points about some of the other issues that I know the Committee
had concerns about, but this document and the letter I have had
from the Attorney General about the need for urgency and will
give us the speed with which we need to act. I do not know the
specific case to which Lord Crickhowell is referring, but just
to say that we are all ensuring, partly in developing our work
through the National Fraud Reporting Centre, that we will be speaking
to people in the private sector and indeed in the devolved administrations,
et cetera, so there will be lot of work going on.
Mr Millar: I am aware of Team Cymru, but we
have not met them.
Mr Coaker: Perhaps we ought to.
Q26 Lord Crickhowell: As you were given
advance warning that we were going to ask the question, it might
have been wise for at least someone to pick up the phone and talk
to them.
Mr Coaker: I apologise if we did not. I had
not realised that question was going to be asked.
Q27 Chairman: There is no reason you
should have known that this question was going to come up but
in fact, they did provide evidence for us that has been published.
Mr Coaker: Well I apologise for that; we will
look into that and certainly we will meet with them.
Q28 Lord Harris of Haringey: I am not
sure they have much connection with Wales.
Mr Coaker: Yes, they are based in the States.
Anyway the serious point is that it is a point well made and we
will look into that of course.
Q29 Earl of Northesk: Let alone the classification
of e-crime, is there not an additional problem here, namely that
the available resources and expertise, for example within law
enforcement, just are not there either? I have two points to make
on this, one of which is that the absorption, for example, of
the National Hi-tech Crime Unit into SOCA then completely destroyed
any IT focus in terms of investigation, so far as I can tell.
There is another issue here which I find absolutely fascinating,
which is the knotty problem of Phorm. A number of aggrieved subscribers
think that an offence has been committed with their particular
Internet services purely and simply because BT conducted trials
secretly. However, I happen to know that a number of these aggrieved
subscribers have hawked themselves around, Home Office, the Information
Commissioner, law enforcement, and been given the brush-off time
and time again. What are the Government actually going to do in
terms of providing the relevant resources and expertise out there
so that action can actually be taken against e-crime?
Mr Coaker: May I ask whether we have moved on
to the issue of the funding for the e-crime unit?
Q30 Chairman: Yes, and the Earl of Erroll
will be picking that up as well. If you want to answer briefly
and then we will explore the issue of funding afterwards.
Mr Coaker: I may have some interesting things
to say in the next answer with respect to law enforcement, so
may I answer your question together with the Earl of Erroll's
question, if that is okay with you?
Q31 Earl of Erroll: A quick rider before
I start. The first thing I was going to say was that I did not
feel there was disrespect in the response from the Government
at all. I rather felt that there were probably problems of budget
and a feeling of how were you going to get it out of the Treasury,
therefore the usual thing was to say "Well, let's talk about
it a bit more and then hope that something appears in the next
budget round" or something like that, which was disappointing.
I think what the Earl of Northesk was asking was slightly different
from what I am about to ask which was that he was thinking about
how this was classified and whether Phorm is a crime or is not.
There are rules that would suggest that it is but no government
department wants to pick it up and say that it is. Everyone wants
to shift the buck and that is very different from what I am about
to ask actually, which is specifically about the funding for the
Police Central e-Crime Unit which I believe will now be called
the National e-Crime Unit and I believe it is something which
is happening finally. It did strike me that we recommended that
necessary funds should be made available to this, because it is
all very well having all your fraud reporting and the National
Fraud Reporting Centre, but if you do not go out and chase a few
people and lock them up, there is nothing to de-motivate future
criminals; you know all about them but you are doing nothing about
them. SOCA is tasked at serious and organised crime level and
with an international flavour, so they will not touch internal
e-crime and e-fraud. We were wondering where you have got to in
your thinking of funding a unit which can produce some coordination,
produce a central law enforcement unit and is very much about
enforcement, not reporting, which could work with your National
Fraud Reporting Centre into which you are about to pump £45
million, or something?
Mr Coaker: Fifteen million.
Q32 Earl of Erroll: Why could you not
find a little bit less money to go and actually arrest some criminals?
Mr Coaker: First of all, may I say that we have
received, as the evidence shows, the business case from the Association
of Chief of Police Officers and you received their evidence and
you know about that. Certainly that has been one of the questions
that I have continually been asking. The answer to Lord Crickhowell
is that I think it is a step forward and I was grateful for the
comment about it being more positive, about reporting to the National
Fraud Reporting Centre. However, the question really is, if all
these reports of fraud or computer related crime are going to
the National Fraud Reporting Centre, the famous "So what?"
question, is it not? What happens then as a result of all of that?
Just to put a bit of context on this, if it is okay with the Committee,
it seems to me that in asking that question that also begs other
questions around the fact that we have the SOCA e-Crime Unit,
we have CEOP dealing with issues of child abuse, which we would
not want, in any shape or form, to change because it has actually
been very, very successful and I am sure we would all agree with
that.
Q33 Earl of Erroll: Entirely.
Mr Coaker: Absolutely. Then we have other police
forces conducting their own local investigations and sometimes
the Met with its own unit and so on. So you have different pieces
of law enforcement doing different things, but there is a gap
without a shadow of a doubt. Again, as part of the work that was
done under the new inter-ministerial group, which has only met
once but has actually transformed the landscape, we asked how
to take this forward. What we need is the National Fraud Reporting
Centre developing in the way that I have said, but alongside that
a law enforcement capability. We have been working very hard with
the police, other law enforcement, with industry, with some of
my colleagues, both in the Lords and in the Commons on all of
this to try to take this all forward. What I did not want to happen
was for the National Fraud Reporting Centre to set up a law enforcement
arm which did not relate to all of these other bodies. Although
it would in the first few weeks gain plaudits and people cheering
saying what a wonderful thing it was that the Government were
finally funding an e-crime unit, without that structure, without
that context, without that sense of how that relates to all of
the other things that were going on, that would have been difficult.
Just for the information of the Committee, I am actually meeting
with law enforcement agencies, with the City of London Police,
who I should have mentioned have a lead force role with respect
to fraud, with the Metropolitan Police and with SOCA and with
others on 4 June to discuss this. Alongside that, is the issue
of funding and what we say in the Home Office is that within reason—I
have to put the caveat "within reason" because we have
no budget figure for this piece of work, although I know we have
a budget figure for the piece of work that went before with respect
to the ACPO e-crime unit, the police e-crime unit—within
reason the Home Office will look to fund that law enforcement
capability alongside the National Fraud Reporting Centre. What
we are trying to achieve, and what is hopefully more positive,
is somewhere fraud is reported to and a lot of work to be done
with that and then alongside that a law enforcement agency. My
final point on this is that the key question that then needs to
be worked out—and I notice the ACPO lead, Janet Williams,
has made this point on a number of occasions—is what you
do at a national level, then what you do at a regional level and
then what the local police do and how all of that relates to each
other and inter-relates so that we get national strategic law
enforcement acting as a catalyst for change, it seems to me, and
then working down to see how that works with organised crime at
regional level but also at a local level where we know, because
all of us we live in communities where people, who in the great
scheme of things have not lost millions of pounds but have lost
a few pounds which are immensely important to them and the lack
of confidence that they then have about using the Internet. We
are at the beginning of those sorts of changes and I do not want
to promise jam tomorrow but there is real work going on now which
will bring about that change.
Q34 Earl of Erroll: Is this not rather
a matter of urgency because, for instance, there was a recent
DDoS attack which hit 104 companies and only one got around to
reporting it to the police because of course they knew nothing
was going to happen. If you get this National Fraud Reporting
Centre website going or somewhere they can report it, it is going
to rocket. If you do not have some capability in place to deal
with it, you are just going to get overwhelmed; you are going
to add to the backlog. You used to have a huge amount of expertise
there in the NHTCU which got very efficiently removed into SOCA
to kill it and I am not quite sure why. Could you not have drawn
on some of that experience? They knew a lot about how they were
doing and beginning to coordinate things across police forces.
If you do not get started soon, we are going to get overwhelmed.
Mr Coaker: Again, in answers I made earlier
to Lord Crickhowell, there is a sense that there is a need to
act as quickly as possible on this, that is why, in terms of trying
to draw together all of the expertise, SOCA of course, where the
National Hi-Tech Crime Unit went to, will be at this meeting and
why the ACPO lead will be at this meeting.
Q35 Earl of Erroll: There are only five
originals left.
Mr Coaker: I appreciate that point; I cannot
go back to where it was. What I am trying to reassure you is that
obviously we want to listen to what all of the various law enforcement
people say, what the experts say about how we do this and, to
repeat myself, about what it means nationally, regionally and
locally.
Q36 Earl of Erroll: Very briefly, could
you also look, because I remember Commander Sue Wilkinson thinking
what we saw on our visit to the United States was an extremely
good idea, at the network of centrally-funded computer forensic
laboratories, because you are going to need that support as well
when you get going and if you do not start setting these up, you
are going to run out of time. Your report said you were considering
an infrastructure, so are you looking at these sorts of things
as well?
Mr Coaker: As part of all of this work, we are
indeed looking at all of this as part of that piece of work. What
I am trying to say is that we have moved considerably on from
where we were before, where in a sense there was a discussion
about what law enforcement made, to accept the Committee's recommendation
that there needs to be a formal law enforcement response to that.
What I cannot say to you, because the detail is not worked out
yet, is exactly what that means, but I agree absolutely with the
need for urgency, absolutely with the need for intelligence and,
alongside the National Fraud Reporting Centre, it is our intention
to have a National Fraud Intelligence Bureau which develops the
intelligence and then see how that information can be transformed
into work packages of information, how that can be transferred,
whether it be at a national level, at a regional level or at a
local level, into effective law enforcement which will make a
difference to the organised criminals at the top but also give
confidence to those people at the bottom that their crime which,
in the greater scheme of things, may not be a great loss to the
country as a whole but to that individual is a huge loss.
Q37 Earl of Erroll: It may not appear
to be a great crime because you are looking at the individual
end, actually the same person may be perpetrating it using the
Internet and then going back a thousand times so they are actually
ripping off £1 million.
Mr Coaker: I was only trying to say that so-called
small crime is important as well as the big crimes.
Q38 Lord Warner: We have been round the
track before in other areas like this, football hooliganism, animal
rights activists, child pornography and the wheels of ACPO do
tend to grind exceedingly slow sometimes when a key problem is
identified which does not fit well into 40 or so police forces.
It just does not fit well and there is a very good strong record
of ACPO holding out for more Home Office money before they actually
tackle some of these issues. You know it, I know it, the Committee
knows it. What guarantees do we have that this is actually going
to be taken seriously by ACPO and the kind of ceding of local
force sovereignty that is required to make this really happen
is actually going to happen? The past has not been reassuring
in that particular area.
Mr Coaker: That is an extremely good question.
The reason it is a good question is because, if you gave it £5
million, it would solve the problem, if you gave it £10 million,
you would double-solve the problem. Of course, there is always
an issue of resources, but there is always an issue of how those
resources are used. Let me just say to Lord Warner why I think
that ACPO will move on this. They have been very supportive in
helping us develop our work in this area. They have been very
involved and I have been very grateful for their involvement in
the development of our thinking around the National Fraud Reporting
Centre. Why I particularly agree is, that Janet Williams is the
ACPO lead now with respect to this who is saying that it is not
only about money, it is also about how this is all organised.
She is the one who is saying again and again and again how important
it is that, of course, you have a national unit which acts as
the strategic body and which is the catalyst for change, which
organises that, but if you then do not link that in to what is
happening, if you take the regional intelligence units at regional
level but also that individually the forces do not respond, then
she is saying that we will not have the change in capability or
indeed bring about that step change that we all want. That is
what gives me confidence in it because, when she discusses with
us about this, she does not only talk about money. She does not
only say if only she had the money she could deal with it. She
says that it is about bringing about a change; of course we need
resources but there is a cultural change which is needed as well
and organisationally we need to deal with that and that is what
gives me the confidence in this work.
Q39 Chairman: Is not one of the issues
here that, as you keep saying, properly, there is a national,
there is a regional and there is a local but of course this kind
of crime does not break down in that way? There is not the same
attachment to a location; where the individual loses money they
have a bank account and live in a house and equally there is someone
who is taking that money, who lives somewhere else, but the structure
of the crime is really radically different and therefore radical
thought is required.
Mr Coaker: That is an important point. I suppose
part of what I am thinking as well though is and, again, the next
question deals partly with that, is trying to give local people
a confidence that if they live in 14 Derry Street, Sunderland,
if they talk to their local police although they may not be the
appropriate first place to go, the local police will have some
understanding of how to deal with that, where that should go and
what the appropriate response is and that is the key organisational
change in pattern that we need to build.
1 It is based on IC3 Annual Report Back
2
This would be in the longer term. Back
|
