Inside the fightback against cyber-criminals
Britons are now more likely to be the victim of hackers than muggers. Cara Mcgoogan visits the police units set up to protect us all online
Mum is panicking at the end of the line. “I’ve lost £1,000 to the TV licence people,” she says. “What should I do?” She has never been tech-savvy, but I didn’t think she would become one of the tens of thousands of Britons who fall victim to common cyber-attacks every year, losing an average of £190,000 per day.
Cyber-crime is now the most prolific offence and – with more than a million incidents per year – Britons are more likely to lose money to hackers than be mugged on the street. This week, the National Cyber Security Centre (NCSC) revealed that they prevented 658 “major” cyberattacks in the year to September, including one involving more than one million stolen credit cards, and took down 177,335 malicious websites. Until this year, national and regional crime agencies were responsible for investigations into hacks – now, all 43 police forces in England and Wales have dedicated cyber-crime units, funded with a two-year £7 million Government investment.
For Mum, the hack started with a spam email: “There has been a problem with your TV licence payment. If you don’t renew, you’re liable to a standard fine. Please re-enter your credit card details.” She did so, dutifully.
“It was a huge scare thing for my generation, picturing the TV licence van driving up and down the road, doling out fines,” she says, by way of an excuse. “It came from a stupid email address – if I had looked at it, that is – but it caught me on the hop.”
A few nights later, a text from the bank alerted her to “suspicious activity”: hackers had taken three payments totalling £1,000.
“The [TV licence scam] is a massive one,” says Det Sgt Grace Hulse, 35, who heads the Greater Manchester Police cyber-crime division, one of the first local units to open four years ago alongside Met and Derbyshire police. Separate to hi-tech crime units specialising in digital forensics, these run investigations on everything from bomb threats to the police’s own website being brought to its knees by unscrupulous hackers. GCHQ, of which the NCSC is a part, this week announced it is opening a new base in central Manchester, where 1,000 staff will intercept threats to the UK.
Hulse shows me around her nineperson unit, which is a model for the new divisions. Until summer 2018, the team was housed in a windowless “cyber-cupboard” and restricted to working on basic issue computers and those fashioned from equipment seized in raids.
One Christmas, they drew a window on the office whiteboard; they struggled to connect to the Wi-fi, and their computers were slow, often crashing when detectives tried to access vital documents. It wasn’t exactly the picture of an advanced cyber team ready to fight the rising threat of online hackers. “Even though we had the knowledge, our hands were tied because we didn’t have the right equipment,” says Jim Lyons, 50, one of the first investigators to join the Manchester team from the fraud unit.
Hulse adds: “There was just no money for cyber-crime.”
But by 2018, the threat level was evident. Hackers had moved from the theft of money and data to threatening lives and livelihoods. Small businesses shut down, individuals lost their life savings, and operations had been cancelled in NHS hospitals after the notorious Wannacry attack.
That summer, hundreds of people in Manchester – and hundreds of thousands worldwide – received a spam email containing their password and a threat to send a video of them watching pornography to all their
contacts unless they paid a £2,000 ransom in Bitcoin. “Even though we knew it was spam, the content was extremely alarming,” says Hulse. “Some threatened violence, too. There was a massive spike in our work.”
Around the same time, teenager George Duke-cohan, who was later jailed for three years, sent emails to 1,700 schools saying that he had planted bombs in them – around 400 schools were evacuated, and a transatlantic plane quarantined.
As one of the few local cyber units at the time, Manchester was instrumental in advising officers on how to retrieve evidence from computers.
Since then, the unit has doubled in size – as has its workload. “This time last year, we were dealing on average one cyber-crime a day,” says Hulse. “Now, it’s nearing two a day. Unfortunately for our unit that’s ‘on average’, so sometimes we get them coming in at 20 a week.”
Are they fighting a losing battle? “That’s how I felt last year, to be honest,” says Hulse. “They do say we’re always one step behind – but we’re definitely catching up now.”
The threat will continue to grow with nation states practising cyberwarfare, more children learning to hack, and seasoned criminals moving into the trade.
“With £20 and a Youtube account, kids can start hacking,” says Lyons. A father of three, Lyons says the best thing parents can do is “be nosy and have strict rules”. The cyber-crime
units will educate parents about the signs that their children could be at risk – for example, if they like gaming and cheating.
“I’ve never seen a crime type morph as quickly as cyber-crime,” says Goodman. “We still have ‘kiddie scriptors’ – experimenting in their bedrooms – and hacktivists, but increasingly we’re seeing organised criminals turning to cyber.”
New hacks emerge constantly – one “alarming” new trend is hackers asking for explicit images, rather than cash.
“This time last year that was unheard of,” Hulse says. “It’s extremely alarming.” Unlike those who lose financially – like Mum, whose bank reimbursed her £1,000 – victims of “sextortion” will have lost ownership of those pictures forever.
It isn’t just the police that need to improve in the fight against hackers. “People fall for it because they don’t understand,” says Lyons. “Unfortunately, victims have got to take some responsibility for their actions and never trust anything that’s put on email.”
Mum’s biggest mistakes: not checking who had sent her the email, and ignoring the oftheard advice that no legitimate organisation will ever ask for bank details in an unsolicited message.
“We could eliminate 90 per cent of cyber-crime,” Lyons adds, “if people took those extra 10 seconds to think: ‘Is this genuine?’”
‘With just £20 and their own Youtube account, kids can start hacking’