This section presents information gathered on the capacity of law enforcement authorities to prevent and combat cybercrime. Institutional ‘capacity’ in the context of policing has a number of elements, including strategic and operational capabilities, technical skills of personnel, and sufficiency of officers and resources.162 Another important element of capacity is the degree of
‘specialization.’ Crimes that require a ‘specialized’ response are typically those that present specific challenges in terms of offence definitions, applicability of laws, or evidence gathering and analysis.163
Cybercrime shows all of these characteristics, and a degree of law enforcement specialization is critical to an effective crime prevention and criminal justice response. Law enforcement specialization can occur at both the organizational and personnel levels – both of which often overlap. While specialization will likely always be required in the area of cybercrime and electronic evidence, it is also the case that – as the world advances towards hyperconnectivity – all law enforcement officers will increasingly be expected to routinely handle and collect electronic evidence.
Organizational specialization
The majority of countries that responded to the Study questionnaire reported the existence of specialized law enforcement structures for cybercrime. More than 75 per cent of countries
159 Ibid.
160 See above, Section 5.3 Privacy and investigative measures, Existence of privacy protections and procedural safeguards. 161 See, for example, http://www.edri.org/edri-gram/number6.24/bulgarian-administrative-case-data-retention
162 Katz, C.M., Maguire, E.R., Roncek, D.W., 2002. The Creation of Specialized Police Gang Units. Policing, 25(3):472-506. 163 Mace, R.R., 1999. Prosecution Organizations and the Network of Computer Crime Control. (Doctoral dissertation). AAT 9920188.
KEY RESULTS:
Over 90 per cent of responding countries have begun to put in place specialized structures for the investigation of cybercrime and crimes involving electronic evidence In developing countries, however, these are not well resourced and suffer from a capacity
shortage
Countries with lower levels of development have significantly fewer specialized police, with around 0.2 per 100,000 national internet users. The rates is two to five times higher in more developed countries
Some 70 per cent of specialized law enforcement officers in less developed countries were reported to lack computer skills and equipment
CHAPTER FIVE:LAW ENFORCEMENT AND INVESTIGATIONS
reported a specialized dedicated unit within existing enforcement organizations. Around 15 per cent reported a specialized dedicated agency for cyber or cybercrime related issues.164
Notably, both more highly developed countries (HDI>0.8) and less developed countries (HDI<0.8) reported significant degrees of specialization. Nonetheless, lesser developed countries showed a wider range of structures, with some countries reporting no specialized personnel, and some reporting the existence of specialized personnel, but not organized within a dedicated unit. With a single exception (in Africa), countries that reported a lack of specialized agency or unit indicated plans to establish one in the near future.165
Responding countries also showed variation across development levels regarding the way in which specialized units are integrated into federal, regional, state, and municipal law enforcement departments and agencies. In
some countries, ‘all federal
investigative agencies have dedicated units on cybercrime.’166 Others
reported federal level units with ‘variable law enforcement
arrangements at the State and Territory between the different jurisdictions.’167 There was also
considerable variation reported within countries in terms of the geographic coverage and consistency of units within enforcement
organizations or agencies.168 Several countries reported the establishment of a national specialized
unit or agency with additional plans to add personnel and units incrementally in field office locations.
Developed countries frequently reported ‘a wide range of’ or ‘sufficient resources’, although several indicated that 'Resources are basically adequate to conduct investigations with a view to upgrade capabilities
to a higher level’ and ‘All the resources are sufficient to the point that they help us get the job done. But for improved, more efficient and faster results, we would need new and updated hardware and software resources.’169 Other more
developed countries indicated also indicated specific personnel development needs, including ‘not
enough human resources and differences between federal and state resource levels of police ‘some state
[level] police have adequate capabilities, some don't.’170 Developing countries in Africa and Asia indicated
needs for ‘tools for forensics’ and emphasized that ‘forensic computers and computer forensic application are
outdated.’171
164 Study cybercrime questionnaire. Q113. 165 Ibid.
166 Study cybercrime questionnaire. Q113. 167 Ibid.
168 Ibid.
169 Study cybercrime questionnaire. Q109. 170 Ibid. 171 Ibid. 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% HDI <.8 (n=33) HDI >.8 (n=25) Figure 5.20: Law enforcement structure for preventing and combatting cybercrime Specialized, dedicated agency Specialized, dedicated unit Other specialized unit Specialized personnel, no unit Non‐specialized, general personnel Source: Study cybercrime questionnaire. Q113. (n=58)
154
Personnel specialization
Many countries reported the existence of law enforcement officers specialized in cybercrime.172 Countries with lower levels of development, however, have significantly fewer
specialized police, with around 0.2 specialized officers per 100,000 national internet users. The rate is two to five times higher in more
developed countries. For all countries, the proportion of police specialized in cybercrime was less than one per cent of total police.173
Overall, around 40 per cent of responding countries reported that officers specialized in cybercrime possessed ‘advanced’ IT skills. Just over 30 per cent of countries reported that specialized officers reported ‘intermediate’ skills. Twenty per cent of countries indicated that specialized officers possessed ‘basic’ IT skills, and six per cent reported that specialized officers did not possess any IT skills.
This overall picture masks significant differences by country development level however. In more highly developed countries around 70 per cent of specialized officers were reported to possess advanced IT skills and to have access to sophisticated computer equipment This proportion was around 20 per cent for lesser developed countries. In contrast, in lesser developed countries, some 45 per cent of countries reported that specialized cybercrime officers possessed only basic IT skills and access to intermediate-level computer equipment.
Within a country, however, the picture may also vary significantly. One country, for example, reported that ‘no
general statement is possible as the whole spectrum is represented.’174
Some units have appropriate ‘equipment and software, but the level
of skill (of employees) is insufficient to address a lot of issues.’ Other units
‘have advanced specialized officers, but
lack sophisticated resources.’175
172 Study cybercrime questionnaire. Q115.
173 Calculations based on Study cybercrime questionnaire. Q115; and United Nations Survey of Crime Trends and Operations of
Criminal Justice Systems, latest available year.
174 Study cybercrime questionnaire. Q116. 175 Ibid. 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% HDI <.8 (n=31) HDI >.8 (n=23) Figure 5.22: Reported technical capabilities of law enforcement Advanced IT skills and access to sophisticated computer equipment Intermediate IT skills and some sophisticated computer equipment Basic IT skills and intermediate‐level computer equipment No IT skills or computer equipment Source: Study cybercrime questionnaire. Q116. (n=54) 0.00 0.20 0.40 0.60 0.80 1.00 1.20 HDI <0.7 (11 countries) HDI 0.7 ‐ 0.8 (15 countries) HDI >0.8 (18 countries) % to ta l pol ic e / num be r pe r 100, 00 0 in te rn e t us e rs Figure 5.21: Number of specialized police, by level of country development % of total police specialized police per 100,000 internet users Source: Study cybercrime questionnaire. Q115 and Q61. (n=44)
CHAPTER FIVE:LAW ENFORCEMENT AND INVESTIGATIONS
Personnel development
Most countries reported providing some cyber-related training to both specialized and non- specialized law enforcement personnel. Specialized law enforcement officers received training that spanned a range of topics, from technology-orientation and basic investigations, to evidence and forensics issues.
Multiple training topics (35 per cent), computer evidence preservation (around 20 per cent) and online child exploitation (around 15 per cent) training were the most commonly reported subject matter for specialized officer training. Other topics included advanced internet investigations, digital forensics, use of
special forensic software, and malware analysis.
The extent and coverage of training programs provided to specialized officers varied widely. In some countries, all specialized officers received cybercrime training, either in person or online. In other countries, training was provided at the national level to officers in selected units on basic cybercrime terminology or basic investigative methodology. Some countries reported providing additional training on topics such as basic IT awareness, technology enabled crime awareness, data evidence preservation and remote forensics software. Training was reported as either integrated into specialized officer training or available as needed or on demand by officers.
Regular training is an important component of law enforcement capacity as it enables specialized officers to remain up- to-date with the latest techniques and developments. In both
more highly developed countries and lesser developed countries, regular training (more than once a year) was reported in around 50 3% 3% 3% 3% 3% 5% 8% 16% 22% 35% Cybercrime prevention International cooperation in cybercrime Internet structure and basic concepts Investigation of computer‐related terrorism Use of remote forensics software Legal framework for cybercrime Advanced internet investigations Investigation ‐ online child exploitation Computer data evidence preservation Other Source: Study cybercrime questionnaire. Q117. (n=37) Figure 5.23: Training subject matters for specialized law enforcement officers 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% HDI <.8 (n=32) HDI >.8 (n=24) Figure 5.24: Frequency of training for specialized law enforcement officers Regular ‐ more than twice a year Regular ‐ less than twice a year Training on new issues/topics as required Training only when requested by officers Initial on commencement of duties only Other No training is available Source: Study cybercrime questionnaire. Q118. (n=56)
156
per cent to 60 per cent of countries. Some lesser developed countries reported, however, that training was either ‘rare’ or that no training at all was available.176
Training for specialized officers was most often provided directly by a training unit of the law enforcement agency itself. International or regional organizations were mentioned by around 15 per cent of countries as a training
provider for specialized cybercrime law enforcement officers – indicating a significant role for technical assistance delivered by these organizations. Chapter Six (Electronic evidence and criminal justice) examines needs for, and delivery of, technical assistance in greater detail.
As electronic evidence
becomes an important component in the investigation of all crime types, ‘non-specialized’ law enforcement officers will increasingly be required to conduct basic computer-related investigations. Responses to the Study questionnaire showed marked differences between countries concerning the delivery of cybercrime-related training to non-specialized law enforcement officers. Around 25 per cent of countries, both more highly developed and lesser developed, reported delivery of basic training on internet structure and concepts to non-specialized officers. Some 40 per cent of lesser developed countries reported, however, that non-specialized officers do not receive any training concerning cybercrime or electronic evidence. Nonetheless, a number of countries highlighted
initiatives to improve cybercrime-related training for non-specialized officers. One country, for
example, reported ‘embarking on a
‘mainstreaming’ programme to give all officers a basic understanding of cyber crime and the relevant investigation techniques and legislation.’177
Another indicated that ‘regular officers receive training
on computer-related evidence preservation as part of some general investigation courses.’178 Others noted that cybercrime topics are ‘being incorporated in the regular police education’179 and officer initiated training is ‘available through online courses in our technology training platform.’180
176 Study cybercrime questionnaire. Q118. 177 Study cybercrime questionnaire. Q120. 178 Ibid. 179 Ibid. 180 Ibid. 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% HDI <.8 (n=33) HDI >.8 (n=23) Figure 5.26: Training for non‐specialized law enforcement personnel Yes, on computer‐related evidence/preservation Yes, on basic elements of cybercrime law Yes, on basic internet structure and concepts only Other No Source: Study cybercrime questionnaire. Q120. (n=56) 2% 4% 5% 5% 5% 7% 14% 20% 38% No training has been conducted to date National NGO or academic organization Cybercrime Unit Multiple Agencies Foreign government authority Private sector or consultancy firm International or regional organization National/Local Police & Other Agencies Training unit of Agency Source: Study cybercrime questionnaire. Q119. (n=56) Figure 5.25: Training provider for specialized law enforcement officers
CHAPTER SIX:ELECTRONIC EVIDENCE AND CRIMINAL JUSTICE