The Home Secretary, Amber Rudd MP, has announced plans to crack down on the dark web. The government is providing a £9 million fund available to law enforcement. The money is expected to ensure that: “..law enforcement’s response will be bolstered to tackle those who use the anonymity of the online space for illegal activities such as the selling of firearms, drugs, malware and people.”
Rudd also announced that more than £5 million will be used to support the police to establish dedicated cyber crime units. These units will be established at local level as well as regional level. The funds are part of a £50 million fund to help police get to grips with cyber crime in 2018/2019. There is no indication that this is anything more than a one-off extra funding deal.
In a statement contained in the press release Home Secretary Amber Rudd said: “The world of cyber is fast-developing and we need a fast-developing response to match. One that recognises that it is the responsibility of everyone in the UK to fight the evolving threat.
“That’s why today I’m pleased to announce that we will be investing over £50 million over the next year to bolster cyber capabilities within law enforcement at a national, regional and local level. We need to make sure we stay not just at pace but steps ahead of those who seek to exploit the possibilities of modern technology, and I am determined that this Government will continue to tighten the net.”
£50 million is unlikely to go far especially as later in the release it says: “A proportion of the £50 million will be used to develop a new national training programme for police and the wider criminal justice system, sponsored by the National Police Chiefs Council. This will equip them with the tools to properly investigate and prosecute cases of cyber crime, including those relating to the dark web.”
Rudd made the announcement at CYBERUK 2018 in Manchester. The transcript of her speech can be found here
Is this a new policy and new money?
Home Office announcements about helping police forces deal with cyber crime are nothing new. In the 1990’s and early 2000’s the plan was for each force to have its own cyber crime fighting unit. It was poorly funded and a disaster. Officers, especially in regional forces, were unable to keep up with the changing nature of the threat. This left big gaps in the policing of cyber crimes.
Eventually, with the formation of the National Crime Agency (NCA) in 2013, the National Cyber Crime Unit (NCCU) came into force. It was an amalgamation of personnel from different cyber crime teams. It has had some success but is not geared up to properly support local forces on a day to day basis.
The National Cyber Security Centre (NCSC) and GCHQ are already providing some support for local forces. However, this latest announcement seems to be a realisation that local forces need not just support but money and training for dedicated officers. It raises a number of questions. Will this be enough? Will forces be able to recruit new officers or are they going to be taking officers from other roles? How long will it take to get officers up to speed? How much support will they get to investigate cases that can become complex? Will we also see training for more computer forensic staff?
Is this enough to stop the dark web?
Between 2013 and 2015 researchers at Carnegie Mellon studied the dark web. They discovered that no matter what crime networks were disrupted, the nature of the dark web was that it was self healing. As part of their research they valued dark web economy as being as much as US$100 million per year. The problem is, nobody really knows what it is really worth just that where there is money there will be criminals. However, there is a big gap between the illegal side of the dark web and the use of it by people who just want to be private.
The cyber security industry is far from convinced by what Rudd has announced.
Matt Walmsley, EMEA Director at Vectra commented: “Giving police additional resources to investigate and bring cybercriminals to justice is a laudable goal, but £5M alone, allocated for the regional local level support, isn’t going to scratch the surface. Even if you get over the significant barriers of accurate attribution of the cybercrime, it’s more than likely the suspects will be outside of UK legal reach, and so challenging to bring to justice. Talking of cleaning up the dark web is more political rhetoric rather than practical reality. If the Government seeks to impose UK access controls to the dark web, then aside from technical workarounds for the more online savvy, we’re going to be reopening the net-neutrality debate.”
Ross Rustici, senior director, intelligence services, Cybereason, agrees with Walmsley. He commented on the complexity of the dark web saying: “Black markets on the dark web is less of a hydra problem than one might expect. Fundamentally, the market places have to operate on a basis of trust. If criminals don’t believe that they are anonymous while conducting the illegal activity they are unlikely to conduct it in that forum. The take down of Alpha Bay shook this trust quite a lot. If Interpol/Europol can take down a few more of the major markets, the ones that replace them will be less robust and trafficked. This doesn’t solve the problem, but it increases the cost of conducting the illegal activity which will hopefully serve as another deterrent.”
Why does this matter
Politicians like headline grabbing news. This story certainly got TV and media coverage today for Rudd. Unfortunately it also exposed the continuing lack of understanding of the problem by ministers. We already have the laughable belief that it is possible to build secure backdoors into encrypted products that only government would have access to.
Joseph Carson, Chief Security Scientist, Thycotic is seriously unimpressed. “Amber Rudd cracking down on Dark web appears to be a political motive because it makes dark web actually sound like a real location where cybercriminals hang out but just don’t use their real names. However, it does have some positive news about cracking down on real criminals who use dark web to hide their tracks and criminal activities; this is definitely something we all want to see.
“The real shock is that the person responsible for security is far from the reality of cybercrime, and £9m to clean up the dark web is not even going to make a dent. You will have a better chance at cleaning the entire ocean from garbage than cleaning the dark web. This money would be better spent on educating the future generation on identifying cybercrime, rather than trying to clean something which is almost impossible.”
The disappointing thing is that government is trying to do a better job on education. The NCSC has put out a lot of good information over the last year and continues to do so. The worry is that this is yet another attempt to provide a quick fix to the problem of cyber crime.
