^[1]

At the launch of the Australian Cyber Security Centre in November 2014, Prime Minister Abbott underlined the importance of cybercrime in the Government’s thinking, estimating that cybercrime costs Australia around $1.2 billion per year ^[2]. That number would seem conservative as most cybercrime incidents go unreported—especially at the top end of the private sector, with few companies coming forward with information on their losses resulting from cybercrime. As more and more of us go online, and companies increasingly switch to an online business model, criminality has also shifted its focus.

Cybercrime isn’t an emerging threat, it has already arrived, and law enforcement must adapt quickly to meet the challenge that it poses. This new reality is explored in the Australian Strategic Policy Institute’s latest report Underground web – the cybercrime challenge ^[3]. In the report’s introduction Australian Federal Police Commissioner Andrew Colvin explains:

‘Cyber technologies create a new paradigm for the criminal – a more sophisticated method to attack the vulnerable – and a new fear for the victim. No longer is the evidence of the perpetrator visible to the victim…Modern cybercrime draws no distinction between government targets, larger corporations and individual users. Its sole purpose is to exploit vulnerabilities for gain.’

 For law enforcement agencies, cybercrime is a significant and complex national, human and economic security challenge. Their response must often be multijurisdictional, demanding close collaboration with international and domestic partners. Criminal elements can split and merge, reshape and reprioritise, and move or disperse at will. Government agencies don’t have that flexibility and can often be held up by their own structures and agreed-upon areas of responsibility. There’s no doubt that the complexity, sophistication and impact of cybercrime are growing, so there’s an onus on law enforcement agencies to respond and at least keep pace with the criminals.

These problems are amplified with the shift in crime towards largely anonymous means in the ‘darknet’, where illicit marketplaces trading in illicit goods and services have become increasingly commonplace. Agencies already struggle with the relative anonymity of the online world, with attribution a major challenge whether determining the real-world identity behind an online nickname or victim identification in a child abuse case. Anonymisation techniques such as the use of the Tor browser, and the use of cryptocurrencies make both the technical and money trails hard to pick up and trace.

When addressing how to counter this threat Commissioner Colvin feels that law enforcement needs to be ‘..as innovative as its adversaries. (It) must continue to adapt technologies, increase and import skills and enhance partnerships – but must do this at a faster rate than currently occurs.’

In many respects, the agencies are playing catch-up in multiple areas, especially in trying to apply laws that aren’t nationally or internationally tailored to combating cybercrime, however, ASPI’s three recommendations for Government to help raise cybercrime capability include:

1. Invest in technology: cybercriminals are well funded, can invest in latest technologies and operationalise them quickly, governments struggle to purchase and operationalise new technologies fast enough to give them an edge. Agencies should include technology forecasting in their strategy work, and reach to the private sector to understand the latest technology trends.
2. Build a sustainable skills base: without an appropriate skills base it will be impossible for law enforcement to respond. Upskilling law enforcement staff so they are ‘cybersavvy’ is essential. Agencies need to recruit, develop and retain staff with specialist skills. Creating career paths involving international placements into partner organisations, and secondments into the private sector will assist in understanding problems from multiple angles.
3. Build international partnerships: most cybercrimes involve linkages across international boundaries. Increased cooperation and coordination across borders is essential. As a signatory to the Council of Europe Convention on Cybercrime Australia benefits from the partnerships it provides, but in the Asia-Pacific it’s one of only three signatories, making it tougher to coordinate with regional nations.

It’s a certainty that cybercrime, malicious darknet activity and cryptomarkets will continue along their current trajectory and increase in size and scope. The benefits for cybercriminals far outweigh the costs, and the increased use of encryption and vetting of those people using darknet services create a blanket of security that law enforcement will have to again break through. What has been proven through recent law enforcement take-downs is that the developers of these sites, the vendors of illicit goods and the technology itself are resilient to law enforcement efforts. Far from being put off by police actions, users are increasingly attracted to the darknet as a result of publicity about those actions.

If law enforcement doesn’t innovate, keep up with and occasionally overtake emerging trends, it will lag behind cybercriminals. Government policymakers would do well do set the wheels in motion quickly, in an effort to keep up with or overtake the criminals. It’s no good being purely reactive in such a rapidly evolving space.

Tobias Feakin is a senior analyst at ASPI and director of ASPI’s International Cyber Policy Centre. Image courtesy of Flickr user Leigh Anthony DEHANEY ^[4].