When it comes to fighting cyber crime, the odds are against state and local law enforcement agencies. In an era of increasing computer-based crime, agencies are struggling to keep up while facing a lack of resources and limited training opportunities.
"The problem is how local law enforcement can cope with this type of crime in terms of training and equipment," said Jim Polley, director of government affairs of the National District Attorneys Association. "The bad guys can use the latest technology and they dont have to go through the government procurement practices, among other things."
By most accounts, law enforcement is not coping well. The equipment is expensive; $4,000 will get you one forensic machine, but thats just the beginning. All but the richest jurisdictions tend to be ill equipped to fight computer-related crime. And even with the resources, experts say, the training necessary to use the tools properly is scarce. One solution is to turn to the private sector for help. There are pros and cons to this approach, but it is working in Wayne County, Mich., and is in the future for North Carolina.
"With the lack of government resources, law enforcement needs to turn to private business for help with computer technology," said North Carolina Attorney General Roy Cooper. "Its clear that the criminals are outracing us in the technology area."
Cooper is in the process of forming public/private partnerships with North Carolina businesses to help local law enforcement, and specifically the State Bureau of Investigation (SBI), with the computer forensics equipment and training needed to help track these crimes.
"Were going to use public/private partnerships, not only to glean resources from private industry, such as help with training and computer software and hardware, but also - to train local law enforcement on the rudimentary aspects of how to deal with the computer (as evidence) when they find it, who to call and how to preserve it until an expert gets there," Cooper said.
Kathleen Barch, deputy director of the Ohio Bureau of Criminal Identification and Investigation (BCI), said computer crime is everywhere. With no state police in Ohio, the BCI is the only agency with state authority. It was one of the first jurisdictions in the country to build a high-tech crime unit. "I got out the old 88-county map and tracked all the cases that weve had in the last four years," said Barch. "Out of 88, we only had one county that hadnt asked for our assistance in the area. Thats what has a lot of people perplexed -- it isnt just a large-county crime."
Affording the Pursuit
The nature of computer-related crimes runs the gamut from financial crimes, including identity theft and the sale of nonexistent merchandise on the Internet, to violent crimes, such as rape and murder. Barch said that 65 percent of BCIs caseload now involves physical injury. One of the big concerns is with child predators. "Child predators dont cruise the playground as much as they cruise the Internet now," Cooper said.
But tracking and catching perpetrators is an expensive proposition, as Ohios BCI found when it began forming its five-member crime unit in 1997. The cost was more than BCI bargained for back then and, not surprisingly, the price tag has continued to rise.
Barch has a recommendation for agencies planning to form a high-tech crime unit: Plan on spending $20,000, minimum, per person as a start-up cost, which doesnt include costs such as printing, upgrades and evidentiary maintenance.
In Ohio, evidence in a criminal case has to be maintained for six to seven years. If it has blood on it, that is increased to 20 years. If it involves a homicide, its maintained forever. The courts have yet to rule on some issues regarding hard drives and evidence, so just about everything is replicated. "As a result, we have a whole mess of drives in storage, and that gets very expensive," Barch said.
The training is expensive, too. "Astronomical," Barch said. "I just shake my head. Ive seen two days of training for $1,200."
Barch recently saw a posting for a six-week forensics course that would have provided "a fairly good foundation" for a student upon graduation. The cost was $25,000. "Who in the public sector can afford to send a person to training, have them gone for six weeks, and be charged $25,000?" asked Barch.
The National White Collar Crime Center and the National Crime Training Partnership provide training for law enforcement in this area and used to provide aide for travel expenses, which left agencies paying only the cost of administrative time. But budget cuts have eliminated that aide and a weeklong course now runs from $1,200 to $2,000, according to Barch. There are few alternatives for this type of law enforcement training.
Partnering for the Cause
Thats why the Wayne County, Mich., Sheriffs Department turned to the private sector for help. "I think it would be extremely difficult to do without the private sector," said Ralph Kinney, Wayne County deputy chief of staff. "Thats where all these computer programmers are employed. Microsoft can tell us a whole lot more about Internet crime than, say, the Michigan National Guard can."
Wayne County has enlisted the help of nearly 20 private corporations, including Electronic Data Systems Corp. (EDS), General Dynamics Corp., Ameritech, Xerox, Bank One and Novell Inc. The corporations donate resources and training.
EDS has been involved with Wayne County on investigations of network intrusion, and members of the banking industry have helped the county with credit fraud issues and identity theft issues. "They understood the need," Kinney said. "I think its incumbent on us as police administrators to realize that task forces of the 21st century are going to consist of these private/governmental partnerships."
But Kinney cautioned that such a relationship on a federal or even state level might smack of conflict of interest. "These partnerships probably work best at the local level," he said. "We are not in a regulating capacity or in a policing capacity over [the companies]."
"There are pros and cons of doing it," Barch said. "The pro is that [the corporations] are state of the art. Theyve got a lot of money. The con is we -- the Attorney Generals office -- have the responsibility to the state of Ohio that if there is a problem with a company or corporation, we support the state in suing them. How do you accept money from a corporation, and then turn around and sue them? Thats a problem."
Ohio has enlisted the help of private enterprise in training. "Theyre more than willing because they want to demonstrate to us how, down the road, we might have to help them in case they are subject to some kind of criminal activity," Barch said. She said there are several companies in Ohio with which the state shares information.
"Id like to be able to accept funding from private sources but thats not the whole story," Barch said. "I have to look long range. Its complicated -- thats the bottom line in a field like this."