Police E-Crime Co-ordination Unit

Report: 6
Date: 5 July 2007
By: Commander Specialist Crime Directorate on behalf of the Commissioner

Summary

The purpose of this report is to update the MPA on progress towards the establishment of a new police e-crime co-ordination unit, housed within the MPS, to co-ordinate the police response to e-crime for the benefit of all ACPO forces, industry and the public. The report will explain the rationale for incorporating an MPS co-ordination unit into the new unit. This report is provided as an update to the report submitted to the MPA Full Authority on 25 January 2007.

A. Recommendations

That members

1. note that the MPS now holds ‘lead force’ status for e- crime; and
2. note the impending implementation of the national police e-crime co-ordination unit within the Specialist Crime Directorate in the MPS

B. Supporting information

1. The Home Office 43 force structure is not conducive to efficient investigation of high volume and borderless criminality. Since the realignment of the National High-Tech Crime Unit into SOCA e-crime in April 2006, their focus has shifted on to trans-national offences, upstream work and gaining new knowledge. SOCA’s e-crime remit does not include a routine public interface.

2. Therefore, since April 2006 there has not been a single point of contact for Home Office forces, industry and the public to co-ordinate local and national policing responses to e-crime, a situation that is causing increasing concern across all sectors and has been widely discussed in the media.

3. During 2006/7, an MPA scrutiny into e-crime was conducted by Lord Harris and the Deputy Commissioner. The outcome of the resulting MPS strategy was presented to the MPA on 25 January 2007, where Members noted the proposal that an MPS e–crime co-ordination unit should be considered together with a Police e-crime co-ordination unit to cover all 43 Home Office forces. The formation of a ‘stand alone’ MPS unit would address only some issues encountered currently within the MPS e-crime response, and would fail to fully exploit all opportunities available at a national level to contribute and deliver lasting solutions. The current problems caused by a lack of national co-ordination would still need to be addressed in the future. At the same time the MPS would inevitably continue to deal with matters beyond the MPD, and failure to address these issues by not supporting and merging with the national unit would be strategically and operationally uneconomical. The cross-border nature of e-crime, the volume and the co-ordination requirements across force to tackle it effectively make a combined unit the logical way forward.

4. It should also be noted that Commander Wilkinson of the MPS holds the ACPO national lead on e-crime, which supports and benefits this approach. Chief Constables have agreed in principle for the new unit to be based within SCD and the MPS.

5. Importantly, by merging the MPS and national units, all parties will mutually benefit from anticipated sponsorship opportunities and overall funding stream applications.

6. The ACPO e-crime strategy reflects the current MPS strategy. The initial business case to establish the national police unit is supported by MPS Management Board, ACPO Crime Business Area and the ACPO Chief Constables Council. Approval has been given by the Deputy Commissioner for the proposed MPS e-Crime Co-ordination Unit (MeCU) to be merged into the national police e-crime co-ordination unit, which is designed to include an operational computer incident response team (CIRT). The Home Office has endorsed the principle of setting up the national unit and has requested sight of a full business case detailing costs. ‘The unit’ as discussed throughout this paper therefore refers to the joint national and MPS unit.

7. The key aim of the overall e-crime strategy is to mainstream e-crime as a core recording and investigative function across all 43 police forces and to improve the quality of the police response to e-crime or any other crime with an ‘e’ element.

8. Protocols will be put in place with partner agencies such as the Centre for the Protection of National Infrastructure (CPNI), SOCA, HMIC, HMRC, foreign law enforcement and Computer Emergency Response Teams (CERTS). In developing the strategy and the role and remit of the unit, consultation has been undertaken with other agencies and initiatives and is continuing, to ensure it complements and adds value to other existing units, and to avoid duplication. See Appendix 1.

9. Advantages to the MPS and Home Office forces of forming a national e-crime unit (incorporating the MeCU).

• Develop a Computer Incident Response Team (CIRT) to work alongside SOCA to provide an immediate operational police response as required to protect the economic, political and social infrastructure of the UK, and more specifically, to London (CIRT).
• A single centre acting as a focal co-ordination point on e-crime law enforcement issues for all Home Office forces, industry, Government and public, providing a consistent level of service, advice and co-ordination.
• Opportunity to consolidate disparate methodologies and practices across forces in dealing with e-crime into a cohesive national policy providing policy guidance, best practice and Standard Operating Procedures.
• Facilitate effective police liaison with SOCA and other UK law enforcement agencies, and international liaison as required through Interpol / SOCA with foreign law enforcement.
• Coordinated response to the public and media, and the development of a higher public profile of e-crime issues to enhance prevention advice and raise awareness.
• The consolidation and co-ordination of websites such as the National Fraud Alert facility.
• The development of a National Partnership Development Unit.
• To provide economies of scale in areas such as software/training/hardware procurement.
• The capacity to research and develop measures and countermeasures in partnership with external agencies to enhance investigative capabilities and e-crime prevention measures.
• All forces will benefit from the co-ordinated service it will provide, and from the significant sponsorship the unit expects to attract.
• Knowledge transfer and development opportunities will be achieved with other law-enforcement and industry partners by way of secondments into the unit.

10. An initial capability assessment of all e-crime assets within the MPS and across all 43 forces has been conducted. This assessment has been used to assist in designing the proposal for this unit, to avoid duplication of services already provided by SOCA, other law enforcement agencies, and centres of excellence in the regions or other forces – e.g. Wales, Scotland and the National e-crime Prevention Centre in West Midlands.

11. It is NOT intended that the unit should routinely accept e-crime reports. The perceived need for a national e-crime reporting centre is often publicly voiced, but the strategy for this unit will concentrate on ‘mainstreaming’ e-crime across all police business – the prevalence of technology and internet use in the commission and facilitation of both new and conventional crime types is increasing exponentially, and to provide a bespoke response to any but the most specialist crimes (e.g.: tackling Botnets or Denial of Service Attacks) would be counter-productive.

12. However, it is recognised that policy on the reporting of e-crime is of public concern and needs to be prioritised for development. One of the first tasks for the unit will be to develop a more accurate intelligence picture of e-crime as it impacts on the public and the consequent police service response. The development of ‘flagging systems’ and the increased use of web sites will be explored to do this. Already, for example, the banking industry provides a reporting process for Association for Payment and Clearing Services (APACS) and Dedicated Cheque and Plastic Crime Unit (DCPCU), and develops intelligence and crime patterns for the police service to action in so doing.

13. Much e-crime continues to be related to economic crime – the City of London Police are currently developing their role as ‘lead force’ for fraud and the development of a National Fraud Reporting Centre. Talks are already underway on working together on the issue of reporting in order to avoid establishing two parallel systems that will inevitably duplicate each other and require unnecessary cost.

14. It is widely recognised that the increasing use of the internet impacts across the delivery of core police services, which should be reflected in overall strategy and resourcing. Options to include e-crime more visibly in national policing strategy, performance measurement and inspection regimes are already being discussed at a national level and with the National Police Improvement Agency (NPIA).

Resourcing and implementation of the unit

15. The total annual cost for a fully implemented unit is estimated at £4,482,550. This figure includes annual salaries, related pension and expenses, training, accommodation, and equipment for the proposed unit. A fuller picture of the breakdown of costs will be available once the extent of sponsorship support has been ascertained. The MPS already contributes substantially to the national response to e-crime given its capital and world city status and the national and international nature of much of the organised crime affecting London. The MPS also, with its existing infrastructure and specialist skills in individual e-crime units, already accepts some e-crime on behalf of other forces. The MPA/MPS therefore already makes a substantial contribution and it is not intended that more should be invested at this time. It is anticipated that the eventual staffing requirement for the fully established unit will be 45 overall, including the CIRT. This includes options for secondments from the private sector, and secondees from other forces.

16. The NPIA has agreed to fund an initial £50,000 towards programme management to devise and support the implementation phase, and to provide accommodation for the implementation team. A business case will be put to the Home Office in a bid to secure government support once sponsorship opportunities have been fully scoped.

17. The MPS is pursuing potential funding streams from the EU. The team has been instrumental in progressing the MPS application for EU 'Framework Partnership' status. Should this be achieved an additional funding stream will become accessible for MPS projects, including the e-crime unit. Additionally the team is currently preparing an application for funding from the EU under the Justice and Home Affairs 'Prevention of and fight against crime 2007' call.

18. The MPS has actively solicited the early engagement of a broad cross-section of industry with a view to securing sponsorship opportunities. In order to expedite this process an 'Industry Engagement Seminar' is to be hosted at New Scotland Yard on 20th June. At the time of writing, some 160 delegates are to attend, representing over 100 companies and trade bodies. This seminar is to be followed by focus working groups to identify, in detail, the needs of 'UK PLC' and the support that will be provided to the unit, such as resources and data-sharing opportunities. At the same time focus groups are planned for law-enforcement agencies and government departments / NGOs.

The structure of the police e-crime co-ordination unit

19. The previous e-crime paper submitted to the MPA detailed the proposed structure of an MPS e-crime co-ordination unit. The functions of this unit are consistent with complimentary to the functions proposed for the police national e-crime co-ordination unit. The MPS strategy will be delivered from within the unit, probably from a dedicated desk.

20. The unit will comprise the following strands;

• Prevention Unit
• Partnership Development Unit
• Intelligence Unit
• Research & Development Unit
• Co-Ordination Unit
• Police Computer Incident Response Team (PolCIRT)

Current MPS activity

21. The development of the unit described here is a direct outcome of the MPA scrutiny into e-crime. Other current MPS activity on e-crime includes:

• Holds ACPO lead on e-crime issues, chair of ACPO e-crime Working Group and multi-agency Internet Crime Forum lead
• INTERPOL representation for UK police forces on e-crime (with SOCA)
• Provision and development of IT expertise in covert policing operations
• Creation & management of the UK-wide Fraud Alert system
• Partnerships established with IT and financial sectors for intelligence sharing
• Lead for Olympics 2012 and liaison with LOCOG re internet and computer security
• ACPO manual of guidance for forensic practitioners produced and published. ACPO e-crime manual of guidance for e-crime managers being delivered
• Training program of 200 Test Purchase Officers to be deployed for covert internet investigations
• Government and special interest group liaison
• Existing computer incident response on behalf of London and, as relevant, nationally and internationally (with SOCA)
• Training inputs developed for detective training courses

Abbreviations

ACPO

Association Chief Police Officers

SCD

Specialist Crime Directorate

CIRT

Computer Incident Response Team

CPNI

Centre for the Protection of National Infrastructure

SOCA

Serious Organised Crime Agency

HMIC

Her Majesty’s Inspectorate of Constabularies

CERTS

Computer Emergency Response Teams

APACS

Association for Payment and Clearing Services

C. Race and equality impact

Improved e-crime intelligence and notification opportunities will enable those communities who are traditionally reluctant or unable through physical or language reasons to communicate with police. The provision of the existing Fraud Alert notification site in several languages for victims of crime and to promote prevention and awareness opportunities in various languages is an ongoing activity. There is therefore an opportunity to enfranchise and engage community groups who have previously been inhibited in communicating with police. The existence of such virtual and on-line communities are numerous and easily accessible, and can be utilised to encourage and promote-crime prevention, intelligence sharing and communication.

D. Financial implications

1. The total cost for the Police e-crime co-ordination unit is estimated at £4,482,550 per annum. This figure includes annual salaries, related pension and expenses, training, accommodation, and equipment for the proposed unit. The full breakdown of costs will change subject to sponsorship support per year.

2. The MPS currently provides a limited response to national and international investigations. At present the Specialist Crime Directorate, Computer Crime Unit consists of twelve members of staff in total, who are in the main engaged in delivering a national and international e-crime response. The financial estimate of this resource is approximately £1.3m. The NPIA are initially contributing £50,000 together with accommodation for the project team towards, the implementation phase. The funding gap therefore amounts to £3.1 million.

3. Options such as increased funding from the NPIA, the Home Office, EU and other funding streams, and private sponsorship are currently being explored.

E. Background papers

• MPA full authority – 25 January 2007
• Appendices previously submitted 25 January 2007

1. Examples of MPS e-crime cases
2. MPS units
3. MPS e-crime strategy
4. MPS e-crime strands
5. MPS development opportunities

F. Contact details

Report author: DCI Charlie McMurdie, MPS.

For more information contact:

MPA general: 020 7202 0202
Media enquiries: 020 7202 0217/18

Appendices

The following appendices are not yet available online. Please contact the MPA if you require a copy.

• 1. Joint national and MPS unit chart.
• 1a. Verbal version of joint national and MPS unit chart.

Send an e-mail linking to this page

Feedback