UK police ill-equipped to deal with cyber attacks

A startling report from Her Majesty's Inspectorate of Constabulary (HMIC) shows that only three in 43 police forces in England and Wales have a comprehensive plan for dealing with a large-scale cyber attack.

UK police ill-equipped to deal with cyber attacks
UK police ill-equipped to deal with cyber attacks

The report, which was published earlier this week, shows that only Derbyshire, Lincolnshire and West Midlands have adequate plans in place to deal with such an attack, and further detailed that only two percent of police staff across 37 forces have been trained on investigating cyber-crime.

This result is a stark reminder to the UK government which – outside of its own initiatives to drive cyber security awareness – already advised the police to prepare for five threats last year but has failed to follow up adequately. These threats were terrorism, civil emergencies, organised crime, public order threats and large-scale cyber attacks.

"The capacity and capability of the police to respond to national threats is stronger in some areas than others - with the police response to the cyber-threat being the least well developed,” said HMIC's Stephen Otter.

The group found that the ability to deal with cyber-threats remains “largely absent” from some forces, and added that some senior officers across England and Wales are still “unsure of what constituted a large-scale cyber incident.”

In addition, the report – which didn't include Scottish police forces (police in the country have attempted to tackle cyber-crime by forming a “cyber-resilience group” with industry experts and academics) - claims that most forces were “silent" when it came to preventing cyber-crime and protecting people from these kind of attacks, despite the fact that they are “fast becoming a dominant method in the penetration of crime.”

Such news is unlikely to come as a surprise to those who attended the recent SC Congress London, where Mark Jackson – detective superintendent of the recently-established Met Police Cyber Crime Unit – gave an honest appraisal of the force's cyber-crime capabilities.

Jackson admitted that reporting cyber-crime is a “whole different process” and admitted that there are difficulties in that there are “no international boundaries” in cyber crime. Hackers often carry out attacks by using multiple proxies in numerous countries, making it difficult to identify who's behind the attack, and whose control the investigation falls under.

Responding to this latest report, Adrian Culley – a former Met Police Computer Crime Unit detective and now independent information security consultant – told SCMagazineUK.com that cyber-crime reporting will continue to flounder so long as police use traditional measures of law enforcement.

“The jist is, cyber crime coverage is at best a Curate's Egg. There are pockets of excellence, but as the report details, sadly the majority of constabularies are found wanting, and this starts and ends at a very senior level,” he said via email.

“Unfortunately the challenges of policing the intangible place that is cyberspace do not at all lend themselves well to traditional, measurable goals and objectives (both quantitive and qualitative).

“There is a far reaching question that needs addressing by all parties, police, government and society, which is does the Robert Peel model of policing, which has broadly served us well since 1829, continue to be fit for purpose?  It should be no surprise to anyone that a policing model founded in the early 19th Century is creaking at the seams with the demands of cyberspace and cyber-crime.”

Charles Sweeney, CEO of Bloxx, also expressed concern at the report's findings and said that bigger initiatives – such as CERT-UK and the National Crime Agency – would be undermined if cyber-crime couldn't be worked out on a local level.

"There has been a lot of political rhetoric about the threat of cyber crime and its rising dominance,” said Sweeney.

“However, establishing central resources such as CERT-UK is undermined significantly if police forces are unable to help and assist people at a regional and local level.  More needs to be done to help police understand the guidelines, their implications and to ensure that officers have the right skills to help victims of cyber crime."