Examination of Witnesses (Questions 40-59)
Mr Vernon Coaker, Mr Justin Millar, Baroness Vadera
and Mr Geoff Smith
20 MAY 2008
Q40 Earl of Erroll: Two things, very
quickly. The first one is slightly linked with both sides of this,
which is that one of the things is where people go for advice
on these things and this is part of this whole thing and the Government
have been very vocal about backing Get Safe Online.
The interesting thing is that I was talking to PayPal the other
day and they feel that the Government are not putting their money
where their mouth is and business and industry would like to have
a definite lead, somewhere that they could all get in behind and
do it. Do we see Get Safe Online as being that thing in
the future?
Mr Coaker: Yes, we do see Get Safe Online
as a key vehicle to develop this and the Cabinet Office are responsible
for much of the information about that. Part of this is trying
to get that information out there and the Cabinet Office are on
this inter-ministerial group, there is a whole new emphasis on
getting the information out there. What we are saying has been
said before: of course ISPs have a responsibility, of course Government
have a responsibility, of course law enforcement has a responsibility,
but also we want, in the same way as we teach somebody the Highway
Code in order to help them cross the road safely but we have road
police and we have traffic lights and so on, to make the same
analogy to the Internet. You have to have all those other things
but you also have to tell people to take responsibility for themselves.
In order to do that, which is the point PayPal and others are
making, they need that information given to them in a way which
they can understand.
Q41 Earl of Erroll: The point they were
making was they wanted a clear lead from Government as to what
they should be getting behind and you need to be able to get together
with industry and decide which one you are going to back, whether
it is that one or another one.
Mr Coaker: Get Safe Online is the one
that the Government are currently backing.
Q42 Earl of Erroll: In which case, you
need to get the funding sorted out and talk to industry about
it.
Mr Coaker: Fine and we will do.
Q43 Earl of Erroll: The next thing is
about frauds being reported to banks rather than to the police.
We were quite worried about this because we felt that frauds should
be reported to the police first and they should then filter out
what goes to SOCA, what goes to banks, according to who is best
capable or to the National eCrime Unit, whoever is best able to
deal with it. Apparently an investigation by the BBC last June
showed dramatic falls in the amount of fraud being investigated
by the police. This change of reporting it to the banks first
was to try to make it all more efficient and less police bureaucracy
but have you actually changed the system for the better? Is there
an increase in banking fraud being investigated by the police
or has it all just been swept under the table?
Mr Coaker: Let me say the positive thing first.
We are trying to engage with the Committee because of the feeling
the Committee had that we had not properly engaged in some respects
with some of the points that were made before. I know the Committee
was unhappy about this particular matter. It was done because
the Government believed, with the Association of Chief Police
Officers and the banks themselves, that actually the system before
was not particularly working either. These figures are probably
available but in the last figures you have before the new system
came in, in April 2007 59,000 recorded crimes with respect to
fraud, cheque and plastic card crimes were recorded by the police;
59,000. That has been dropping dramatically over the last few
years; it is not a sudden thing but it has been consistently dropping
over a number of years. We wanted to see whether there was a better
way because we were worried about this reporting of fraud, that
perhaps it was not being reported. So it was an attempt to put
in place a system whereby people would go to the banks, report
that first, the banks would get a better overview of what was
happening and then report that to the police. In the first instance
this would reimburse the individual who had lost money through
no fault of their own, but, secondly, we thought that the bigger
overall picture might actually help with respect to the investigation
of the crime. The Committee asked us to review this. I know that
some of the professionals that you had evidence from have said
that they have received a lot of reports. All I can say to you
is that we have not, from the police or banks, although you might
say that is inevitable, or individuals, we have not had a lot,
if any, problems raised about this, but we will have a look at
it. I know the Committee asked if we would review it and see whether
it was working in the way that we intended, so we will have a
look at it. I am not saying we will change it, but it is reasonable
to say that we will review it. In terms of the investigation,
we do not collect the statistics on the levels of investigation
that are being conducted by the police with respect to this, so
I cannot talk to you about that and of course we do not have not
the 2007-08 crime figures yet; they are not published until July.
Q44 Earl of Erroll: One of the things
that really worried us as well though was where the liability
lay. We do know from some stuff from the Financial Ombudsman Service,
that the banks are trying not to pay out in certain circumstances.
This is not so much to do with online fraud but saying that the
chip and pin system in inviolable and absolutely totally secure.
We also know that the Financial Ombudsman Service does not really
have the expertise to adjudicate in this and yet is being held
to be correct. No-one yet has had the money to take a case to
the courts so it is tested properly. This is not in your briefing
at all.
Mr Coaker: It is the banking code; I know what
it is.
Q45 Earl of Erroll: There is some stuff
going on in there which at some point is going to hit the press
and is going to hit things because the banks do try initially
to offload liability and they have a history of doing this. They
did it when the first ATMs appeared with pin numbers; they are
now doing it with chip and pin which, because of the fallback
mechanisms and the magstripe, there are weaknesses in it which
they are not admitting and they are not actually showing true
technical evidence to the Financial Ombudsman Service, who do
not have the technical expertise to adjudicate. One of the things
we recommended was that liability should be passed, rather as
in the old Bills of Exchange Act, back onto the banks, not for
things which are clearly fraudulent instructions, but where the
token used is inadequate. In other words, trying to do electronic
transactions, with the sort of security they have, is inadequate.
If the liability went back onto the banks, they would then have
the financial incentive to issue a more secure two-way, two-channel
authenticated token and that would reduce fraud considerably.
This clearly will not be popular with the banks because it will
involve extra cost. What is your feeling about this?
Mr Coaker: I know that, with respect to the
liability, the banking code says that if people have not acted
fraudulently, then the banks will reimburse them for the money
that they have lost, and I know the issue then is that the banks
are saying that individuals were negligent in what they did, therefore
they lose. Then people take it to the Financial Ombudsman Service
and my understanding is that the Financial Ombudsman Service has
not found the banks to be acting inappropriately and people say
there is something wrong with the Financial Services Ombudsman.
I cannot say that, I am not an expert with respect to the Financial
Services Ombudsman but it seems to me that the ombudsman system
works extremely well. No doubt, this debate will continue.
Q46 Earl of Erroll: The way round it
is being done at the moment is that the person who has lost the
money has to prove that the bank system did not work. The problem
is that the banks are the people who have the information to say
whether it worked or not and they are not releasing the correct
information for that to be proven. It needs to be run through
the courts.
Mr Coaker: I do not know. Online banking fraud
has fallen; the issue now with banks is where the card is not
present, that is where the big increase in problems has come.
Q47 Earl of Erroll: If you put the liability
onto the bank, we were suggesting that they would issue a better
token.
Mr Coaker: That is part of the debate that has
been ongoing. If you make the business liable, we might see an
improvement. One of the things I was going to say earlier on is
that, with these things, the Government try very hard to move
through self-regulation and we have seen a lot of progress in
other areas. I have had a lot to do with child protection and
that has worked fairly well and that is the path that we have
chosen to take.
Baroness Vadera: I would be very happy to talk
to the Financial Ombudsman Service about any issues that they
might have. My understanding of this, and the way I would come
to it is that the banks already do feel liable via the banking
codes. It is not that they believe that they are not liable and
all that a piece of legislation would do would actually be to
say that they are. They do behave like they already are and they
believe that they already are. The issue comes around the area
of attribution of whose fault it was where there is a grey area
and I am in the middle not sure that the piece of legislation
would actually be able to define that so that actually it would
necessarily change that. It might be that therefore we need to
make the Financial Ombudsman Service better able to decipher that
or get through the greater powers of the bank to pass it on. I
am not sure the legislation would change that balance of power.
Q48 Earl of Northesk: You recommended
that you ratify the Convention on Cyber Crime, signed back in
November 2001. The Government's response was that this would happen
as soon as possible and that there would be Computer Misuse Act
changes in April of this year. However these changes have not
occurred. Why is that and what is causing the delay?
Mr Coaker: There has been some delay but I can
say to the Committee that we will enact the various pieces of
domestic legislation that need to be enacted in October this year
and we will ratify, unless something dramatic goes wrong. I can
say to the Committee that we do intend to ratify by the end of
this year.
Q49 Earl of Northesk: We also recommended
that you should review mutual legal assistance procedures and
the Government's response was that provisions within UK law for
this were sufficient. Much of the evidence the Committee received,
stressed how slow other countries were at providing assistance,
which would seem to argue in favour of the review. The Met Police
recently told us that almost all Internet investigations have
an international dimension. They also wanted to see a comprehensive
review of the process. Do you have any firm plans to address the
police's concerns?
Mr Coaker: I will ask Justin to talk to the
detail of it. May I just make the general point that whilst we
have talked about how, with respect to computer-related crime,
to distinguish between national, regional and local, the international
dimension to this will become increasingly important, about how
we work with other agencies across the rest of Europe but across
the globe as well. This will become of increasing importance which
is why ratifying the convention is extremely important but there
is a lot more that we need to do across the globe almost to tackle
this issue.
Mr Millar: Very briefly, the G8 hi-tech crime
sub-group is looking at this issue and I believe the Council of
Europe Convention group are looking at things like the 24/7 networks,
to see how their efficiency can be improved. There is also some
work going on bilaterally between the UK and some other countries.
Obviously those may not be the countries with which we necessarily
have the greatest time lag in gathering evidence. However, there
is work ongoing to look at improving the efficiency of the information
transfer.
Q50 Chairman: May I thank you very much
indeed? It has been a very helpful session.
Mr Coaker: Could I please make one point? I
was very struck by what the Committee has said about urgency.
Perhaps it would be helpful if every couple of months I dropped
a note on what is happening in this inter-ministerial group and
the progress that has been made, if that would be helpful to the
Committee, on some of the points that have been made. I am quite
happy to do that.
Q51 Chairman: That would be exceptionally
helpful. We are increasingly keeping a watching brief on what
happens to our reports and for your response to be proactive rather
than reactive would be very much what we had hoped for. We thank
you for the way in which you have responded and taken on board
what were some very serious issues. May I just refer in passing
to the issue of negligence? That is a difficult one to define
because of the complexity, but, on the other hand, there is responsibility
and it is where responsibility lies that is driving quite a lot
of our thinking in fact. Lastly, you refer to the events of the
last few months as a wakeup call. We like to think of our reports
as, from time to time, a wakeup call.
Mr Coaker: It has been that.
Baroness Vadera: It has been that.
Chairman: I just put that one on the
record. If there are any further clarifications, you will receive
a record, a transcript of the meeting or if there are points that
came up where you feel it would be useful to give us a note, that
would be very helpful and will be part of the formal proceedings
of the Committee.
| 
