It’s well over a year since the Government first brought forward their proposals to make security research illegal crack down on hacking tools.

They revised their proposals a bit — in the face of considerable lobbying about so-called “dual-use” tools. These are programs that might be used by security professionals to check if machines were secure, and by criminals to look for the insecure ones to break into. In fact, most of the tools on a professionals laptop, from nmap through wireshark to perl could be used for both good and bad purposes.

The final wording means that to succesfully prosecute the author of a tool you must show that they intended it to be used to commit computer crime; and intent would also have to be proved for obtaining, adapting, supplying or offering to supply … so most security professionals have nothing to worry about — in theory, in practice of course being accused of wickedness and having to convince a jury that there was no intent would be pretty traumatic!

The most important issue that the Home Office refused to concede was the distribution offence. The offence is to "supply or offer to supply, believing that it is likely to be used to commit, or to assist in the commission of [a Computer Misuse Act s1/s3 offence]". The Home Office claim that “likely” means “more than a 50% chance” (apparently there’s caselaw on what likely means in a statute).

This is of course entirely unsatisfactory — you can run a website for people to download nmap for years without problems, then if one day you look at your weblogs and find that everyone in Ruritania (a well-known Eastern European criminal paradise) is downloading from you, then suddenly you’re committing an offence. Of course, if you didn’t look at your logs then you would not know — and maybe the lack of mens rea will get you off ? (IANAL ! so take advice before trying this at home!)

The hacking tools offences were added to the Computer Misuse Act 1990 (CMA), along with other changes to make it clear that DDoS is illegal, and along with changes to the tariffs on other offences to make them much more serious — and extraditable.

The additions are in the form of amendments that are incorporated in the Police and Justice Act 2006 which received its Royal Assent on the 8th November 2006.

However, the relevant sections, s35–38, are not yet in force! viz: hacking tools are still not illegal and will not be illegal until, probably, April 2008.

Continue reading Hacking tools are legal for a little longer →

Just over a year ago I wrote about the, then upcoming, Serious Organised Crime Agency (SOCA), reporting that their aim in tackling “level 3” crime was to be “mysterious and menacing“. I pointed out how they were going to be absorbing the National High Tech Crime Unit (NHTCU) and that this would leave a large gap, in that there would apparently be no police organisation dealing with “level 2” eCrime — crime which is not local to a single police force area, but that is not sufficiently serious or organised to be dealt with by SOCA.

In fact, I’ve since learnt that the inability to deal with level 2 criminality is not just an eCrime issue. In 2005 Her Majesty’s Inspectorate of Constabulary (HMIC) published “Closing the Gap – Review of the ‘Fitness for Purpose’ of the Current Structure of Policing in England and Wales“, which found that the failure to deal with “level 2” criminality was an issue across a very wide range of different crimes (the whole report makes its points without once mentioning eCrime or the Internet). This led to the, now abandoned, proposals to compulsorily merge 43 police forces into 17 larger units. No further generic policy initiative appears to be forthcoming.

However, as I wrote in October, there is some thought going into eCrime and the current proposal is “mainstreaming“, viz: not treating it as anything special.

Additionally, the Met Police have been floating the idea of an national coordination centre for eCrime reports, as hinted at in this January 2007 Met eCrime progress report to the Metropolitan Police Authority. Current indications are that the Home Office may have problems coming up with the money to fund the centre, although SCDEA e-Crime, the equivalent unit in Scotland, is funded by the Scottish Executive. Perhaps more about progress south of the border will come to light in March, when Commander Sue Wilkinson, the Association of Chief Police Officers (ACPO) lead on eCrime testifies before a House of Lords Select Committee.

But, I’m digressing, so back to SOCA…

Last month I, and a couple of other eCrime policy opinion formers (!), were invited down to Docklands for the proverbial “free lunch” and several hours of presentations on what SOCA is doing about “level 3” criminality. It’s a little tricky to report on the detail, because they asked us to treat some of the material in confidence. However, two clear messages stood out:

The first is that the absorbed NHTCU is now significantly bigger, significantly better resourced, and with the hiving off of “child abuse image” issues to CEOP, is not being forever distracted into chasing down individual paedophiles (if there’s one child at risk, or an 420-million dollar bank hack to investigate, the former tended to get all the resource). This is basically a Good Thing, so far as it goes.

The second message is that SOCA is a “harm reduction agency” and is not just concentrating on detective work and prosecutions. They are also looking at a whole range of other interventions, from offender management (serious, organised criminals have a very high recidivism rate) through diligent application of the Proceeds of Crime legislation, to working with industry to harden systems against criminal opportunities.

They have a Bill before parliament at present (the Serious Crime Bill) which will give them sweeping new powers to create “gangster-ASBOs” to restrict the lives of convicted organised criminals, and will permit the wholesale swapping of data for the prevention of fraud, without infringement of the Data Protection Act. The Bill also reworks the framework for “inchoate” offences, viz: incitement to commit crimes or assisting with them — of which perhaps more on another occasion, since poor wording for the offences could make many security research activities problematic.

Looking back, it is this strong emphasis on SOCA’s approach to ensuring “crime doesn’t pay” that remains with me most strongly. This isn’t just the approach of locking Al Capone up for tax evasion because nothing else could be made to stick (though Capone actually served time for several other offences). This is all about SOCA developing an effective way of stripping criminals of their ill-gotten gains.

I’m reminded of Sir Alan Sugar giving a lecture about management way back in the 1980’s. He was mocking the catch-phrase/mission-statement culture, memorably saying, “‘Pan Am takes good care of you’, ‘Marks and Spencer loves you’, ‘Securicor cares’ . . . at Amstrad, ‘We just want your money’“. Twenty years on, that seems a rather apt phrase for a significant slice of SOCA’s activities.

Back in February I wrote about how the establishment of the Serious Organised Crime Agency (SOCA) was likely to lead to situation in which “level 2” eCrime could end up failing to be investigated. “Level 1” crime is “local” to a single police force, “level 3” crime is “serious” or “organised” and requires tackling at a national or international level — and “level 2” crime is what’s in-between: occurring across the borders of local police forces, but not serious or organised enough to be SOCA’s problem.

Over the past few weeks I’ve been at a Metropolitan Police “Knowledge Forum” and at a Parliament and Internet Conference. There I’ve learnt about how the police (at ACPO level, not just the Met) are intending to tackle eCrime in the future.

The jargon for the new policy is “mainstreaming” — by which is meant that the emphasis will move away from tackling “eCrime” as something special, and regular officers will deal with it just as “Crime”.

In particular when there are “e” aspects to a normal crime, such as a murder, then this will be dealt with as a matter of course, rather than be treated as something exotic. With the majority of homes containing computers, and with the ubiquity of email, instant messaging and social network sites, this can only be seen as a sensible adaptation to society as it is today. After all, the police don’t automatically call in specialist officers just because the murder victim owns a car.

Although there is a commitment to maintain existing centres of excellence, specialist units with expertise in computer forensics, units that tackle “grooming” by paedophiles, and undercover police who deal with obscene publications, I am less sanguine about the impact of this policy when it comes to crimes that rely upon the Internet to be committed. These types of crime can be highly automated, operated from a distance, hard to track down and obtain evidence about, and can be lucrative even if only small amounts are stolen from each victim.

I believe there is still some doubt that Internet-based crimes will be investigated, not just from lack of resources (always a problem, as anyone who has been burgled or had a car window smashed will know), but because it’s no-ones task and appears on no-one’s checklist for meeting Government targets (there’s still no central counting of eCrime occurring).

Mainstreaming is proposed to have some sensible adjuncts in that police forces will be encouraged to pool intelligence about eCrime (to build up a picture of the full impact of the crime and to link investigators together), and some sort of national coordination centre is planned to partially replace the NHTCU. However, although this may sometimes mean that an investigation can be mounted into an eBay fraudster in Kent who rips off people in Lancashire and Dorset — I am not sure that the same will be true if the victims are in Louisiana and Delaware — or if the fraudster lives in a suburb of Bucharest.

The details of what “mainstreaming” will mean for eCrime are still being worked out, so it’s not possible to be sure what it will mean exactly. It sounds like it will be an improvement on the current arrangements, but I’m pessimistic about it really getting to grips with many of the bad things that continue to happen on the Internet.