Nailing cyber crooks
Kiwi cybercrime-fighting skills are rated highly. We’ve even beaten the FBI to the punch, writes Damian George.
Acall is taken at a New Zealand high school, seemingly from a local number. The call, like several others around the country, is from a purported terrorist warning of a bomb about to go off on the school’s grounds.
The threat could be – make that most probably is – a hoax. But with so many lives at stake, now is not the time for assumptions.
Police are contacted and schools across the country go into lockdown.
As it turns out, the calls, made in early 2016, were indeed hollow threats, but for police, the work was only just beginning.
Superintendent Tim Anderson, national manager of criminal investigations, recalls the massive disruption the incident caused.
‘‘Schools had to shut, so that meant parents had to leave work, pick up their kids and then go home, and then wonder what’s going to happen tomorrow.
‘‘So it was a huge disruption, a massive disruption on an economic scale, and caused quite a lot of harm there in that sense.’’
A 17-year-old man on the other side of the world had been using a software called VOIP (voice over internet protocol) to send cellphone voice messages using an IP address, bypassing regular phone transmission.
The police cyber crime unit, together with other online security teams across the world, eventually tracked him down.
Dubbed Operation Cable, the police investigation not only pinned the offender but also put New Zealand’s cyber crimefighting capabilities on the map.
‘‘It was a great result,’’ Anderson says.
‘‘We beat the FBI to the punch on that one, and it got us a tremendous amount of international credibility in terms of law enforcement agencies.’’
The alleged offender, Michael Kadar from Ashkelon in southern Israel, is currently before Israeli courts.
Adecade ago, when international cooperation was much harder to come by, such a success story might not have resulted.
But these days the borders have been opened and informationsharing is making the job a lot easier, Anderson says.
‘‘The success in the Kadar case was because of our relationships. A couple of our key subject matter experts had really good relationships worldwide across a whole lot of platforms, which allowed us to find that offender.’’
While such stories could conjure up images of frenetic investigators gathered round computer screens, and ‘‘lightbulb’’ moments as the room goes silent, the reality is much different.
This is not CSI: Cyber. The path to the offender is slow and is traced from the police national headquarters in Wellington, where online investigators share a large open-plan room with other officers.
The cyber crime unit works on about 500 cases per year, as well as a smaller ‘‘subset’’ of cases such as Operation Cable.
The unit is split into two teams: one dealing with ‘‘traditional’’ crime such as child exploitation and drug dealing, and the other tackling ‘‘pure’’ cybercrime, where people are targeted for monetary gain and the offenders are usually overseas.
The latter can include a denial of service attack (which disables a computer while hackers plunder the user’s private information), malware (the sending of malicious programmes and software to other computer users and systems), and compromising business emails.
Hacking has also become a political weapon, with many in the United States pointing the finger at Russia for hacking the Democratic National Committee’s emails and drip-feeding damaging details in the lead-up to the 2016 presidential election.
Political operatives have also been blamed for trying to alter the course of elections across Latin America.
New Zealand is not immune: according to the National Cyber Security Centre, attacks from abroad on government agencies and businesses have risen sharply, with 396 attempts in the last full year of recorded data.
In Wellington, officers are kept constantly on their toes due to the ever-shifting nature of the threat.
Not all crimes are solved, but that is the nature of the beast, Anderson says. ‘‘It’s fair to say our resolution rates for serious crime are very high.’’
Repeat offenders are pursued, and police are constantly on the lookout for suspicious behaviour. They often have to imitate the targets they are looking for in order to draw them out.
‘‘You might have an offender who is just going round stealing small amounts, but doing it in a really widespread fashion, maybe targeting 100 people at a time,’’ Anderson says.
‘‘Those sorts of people we’re interested in as well. And we do catch them.’’
So what does that mean for the everyday internet user, and are police watching your every move?
Although police closely monitor the internet and ‘‘dark net’’ for illegal activities, New Zealanders are protected by legislation such as the Bill of Rights Act and the Search and Surveillance Act, which is currently under Government review.
Computer crimes such as accessing systems for dishonest purposes, or obtaining by deception, are covered by the Crimes Act.
But generally speaking, New Zealanders are more likely to be the victims of online crime than the cause of it, Anderson says.
Rather than just responding to scams and threats, it is important for police to raise awareness of online crime and how to combat it.
‘‘It’s about everyone across New Zealand playing their part, educating people in terms of how offenders operate and doing a bit of ‘horizon’ scanning – seeing what type of offending is happening overseas and then being able to adapt quickly to meet that.’’
Cybercriminals are targeting identity data instead of credit card information, for example, as that provides them with longer-term profits.
This conclusion is contained in the ThreatMetrix Cybercrime Report 2017: A Year in Review that found one in nine new online accounts in 2017 was fraudulent.
Accounts linked to ridesharing apps, for example, are among the most vulnerable as consumers fall for social engineering tricks – when a person responds to an email that says their account has been compromised and actually hands over their access to cybercriminals.
British teenager Kane Gamble recently used this method to spectacular effect when he accessed email addresses, phone numbers, and personal devices of former CIA director John Brennan, former FBI deputy director Mark Giuliano and several other highprofile people in 2015, when he was 15 years old.
In New Zealand, there are approximately 350 reports from victims of online crime received every week, according to Martin Cocker, chief executive of online safety organisation NetSafe.
About 50 of those were alleged violations of the Harmful Digital Communications Act 2015, which protects against abuse and harassment, and the others were related to scams, fraud, and offensive content.
While police were in charge of prosecuting offenders, NetSafe’s role is to report incidents to police and assist victims during investigations.
‘‘I think the most memorable cases are where we’ve had people caught up in exploitation-type arrangements with an offender from overseas.
‘‘We only have a handful of those, and solving those are the ones that make you most proud because you can see New Zealand’s cyber crime group working together to get good outcomes for New Zealanders.’’
Tracking down offenders involves finding small nuggets of evidence spread across the internet’s vast expanse. But it can be done, and often is.
The majority of day-to-day frontline police work, or ‘‘volume crime’’, currently consists of offences such as burglaries and car break-ins, but Anderson predicts it will not be long before the bulk of it takes place behind a computer screen.
‘‘I’d say in 10 years’ time; I’d be very surprised if our volume crime isn’t basically all online-based offending around fraud, theft, scamming, that sort of thing.
‘‘It is challenging to investigate. It’s not the same type of investigation as we traditionally do, but we have our own processes and policies and procedures we follow which are very good.’’
Online crime and cyber crime is a growing thing, so we’re looking to grow our expertise and also our teams in accordance with that. Detective Superintendent Tim Anderson, national manager of criminal investigations