INTERPOL s Role and Effort in Combating Cybercrime Kunwon YANG Assistant Director, DFL, IGCI

Transcription

1 GLOBAL COMPLEX FOR INNOVATION INTERPOL s Role and Effort in Combating Cybercrime Kunwon YANG Assistant Director, DFL, IGCI

2

3 VISION Connecting police for a safer world

4 MISSION Preventing and fighting crime through enhanced cooperation and innovation on police and security matters

5 Advanced police cooperation Vision : Connecting police for a safer world Mission: Preventing and fighting crime through enhanced international police cooperation This is done by: Facilitating international police cooperation Ensuring secured communication Providing operational support Organizing training to build crime-fighting capacity

6 A global presence EU OFFICE IPSG LYON UN OFFICE LO RB SAN SALVADOR RB ABIDJAN RB NAIROBI BANGKOK IGCI RB BUENOS AIRES RB YAOUNDE RB HARARE SINGAPORE

7 An NCB in all 190 member countries General Secretariat NCBs Specialised Law enforcement agencies Airports Ports Borders Police stations

8 INNOVATION? For What?

9 Economic impact of cybercrime II, Center for Strategic and International Studies June 2014 The 2013 Cost of Cyber Crime Study, Ponemon Institute, 2013 Norton Report 2013 Cybercrime in Numbers 378 M Victims/Year +1 M Victims/Day 12 Victims/Second Attacks per Company in $400 BN ANNUAL COST TO GLOBAL ECONOMY RESULTING FROM CYBERCRIME Average time to resolve incident 32 days Attack costs per Company in 2013 USD11.6M USD $298 AVERAGE COST PER VICTIM

10 Challenging Landscape for Police Transnational nature of cybercrime Slowness of MLAs Restrictions in information sharing Time-lag in jurisprudence Fast evolving technology Resources Lack of resources

11 Challenging Landscape of Globalization Global Internet Service Global IT Company Globalization of Cyber Threat Organized and Global Structure of Criminals Increasing Needs for Global Alliance and Global Supporting System

12 What can INTERPOL do about this?

13 INTERPOL AND CYBERCRIME INTERPOL is establishing the INTERPOL Global Complex for Innovation (IGCI) in Singapore in 2014 in response for the cybercrime concerns

14 IGCI : INTERPOL Global Complex for Innovation INTERPOL Global Complex for Innovation INTERPOL Digital Crime Center Cyber Innovation & Outreach DCIS Digital Investigative Support DFL Digital Forensic Lab S&O - Strategy & Outreach R&I Research & Innovation CFC Cyber Fusion Center

15 How can IGCI work?

16 Working Together with Partners Academia UNODC EC3 G8 ICANN IMPACT ITU Private Sector Global IT Company Internet Security Company Digital Forensic Company

17 Cooperation with TREND MICRO Intel Repor Monitor Detect Analyse Compile Forward Action Member Countries

18 INTERPOL Regional CyberCrime Working Group Americas Eurasian Middle East and North Africa Africa

19 Multidisciplinary Implementation Approach Awareness Training for Executive LE Officers Introductory Digital Awareness Training Specialized Digital Crime Training Cyber and Forensic Unit Setup Cyber Fusion Center Subscriber Details Screening Phishing Data Consolidation 24/7 Cyber Network Cyber Threat Taskforce Capacity Building INTERPOL Cyber Alert National Cyber Review Harmonisation Operational and Forensic Support Cyber Security Strategy Development International Advocacy on Cyber Standards Research and Innovation Digital Forensic Lab Crimeware Analysis Mobile Device Forensics Testing Forensics Tools Digital Forensic Training

20 Operational Support Activities Investigative support 24/7 Cyber Network Cyber Threat Taskforce INTERPOL Cyber Alert

21 Cyber Fusion Center Real-time monitoring Analysis of malicious Internet activity Providing the intelligence and expertise to member countries

22 Cyber Fusion Center in Action Private Sector Academia Intelligence Monitoring Trend Analysis Intelligence Report/Alert IDCC Member Countries Action Crime Case Analysis Evidence collection Coordination Investigation Support Outcome Alert/Notice Prevention Investigation

23 24/7 Cyber Network Cyber Points of Contact Information and Cyber Alerts sent to Cyber contacts 24/7 Cyber Network Cyber Fusion Center Issued Cyber Alerts

24 Cyberthreat Taskforce Private Sector Academia Police Neutralized Threat New threat is identified Assembling a cyberthreat taskforce Performing the in-depth analysis Creating an action plan

25 The Deep Web is the set of information resources on the World Wide Web not supported by normal search engines. This data is not reachable through normal web indexing and employs anonymity to operate on this part of the web. Deep Web Intelligence Gathering

26 Deep Web Intelligence Gathering Surface Web R&I will monitor the Deep Web for Intelligence Gathering Research & Innovation Information sent to Internal departments and MCs Deep Web Private Sector IDCC Academia R&I forwards intelligence to IDCC **Private Sector and Academia will share any Open Source Intelligence related to the Deep Web with R&I

27 Digital Forensic Support Digital Forensic Lab A technological think-tank for digital forensic technology focusing on a practical approach of the digital forensic field.

28 What Part Can DFL Play? Malware Forensics Mobile Forensics Forensic Tool Testing Commercial Companies LEAs Handset Manufacturers Training Service Suppliers R + D Advanced Casework MOUs + Partnerships

29 Malware, Mobile Forensics Digital Forensic company Mobile Forensic company Internet Security company Institute Academia 29

30 Tool Testing, Research & Development Tool Testing Identifying commercial and non-commercial Forensic Tools Developing Forensic procedures on new Technology Coordinate R&D projects across multiple LEAs Facilitate working groups and solution to tackle forensic challenges

31 Digital Forensic Training Develop and Provide training courses on the latest tools and techniques Cohost training courses with vendors Operating a Knowledge Bank of training materials

32 INTERPOL Operation Cases Operation UNMASK Operation Strikes Back

33 Operation UNMASK Results 47 house searches in 19 cities in 5 countries IT equipment, mobile phones, payments cards seized 34 arrested /under investigation

34 Operation Strikes Back

35 What is Cyber Sextortion? Cyber Sextortion is a term used to define online blackmail in which sexual images/videos of the victims acquired through online chats are used to extort money from the victims, with demands ranging between USD 500 and USD 15,000. The scale of these sextortion networks is massive, and run with just one goal in mind: to make money regardless of the terrible emotional damage they inflict on their victims.

36 Impact of Sextortion The average blackmail demand is USD 500, however demands of up to USD 15,000 have been reported. There was also one UK teenage boy who committed suicide after being a victim of sextortion.

37 Timeline of Operation Strikeback combating Sextortion NOVEMEBER 2013 During the 1 st Eurasian Working Group Meeting in Singapore, IDCC invited some Organizations to share about the growing numbers of sextortion cases. Following that, IDCC coordinated a meeting with representative from Hong Kong Police, Singapore Police Force, Philippines National Police to form a joint investigation task force. DECEMBER 2013 The PNP identified and shared information about Bicol group in Naga city being involved in the sextortion cases, with more than 100 suspects linked to this syndicate. JANUARY 2014 The Hong Kong and Singapore Police provided more information to identify a second syndicate, the Bulacan group. Victims of this group identified to be from Hong Kong (China), Singapore, UK and US.

38 Timeline of Operation Strikeback combating Sextortion FEBRUARY 2014 Police Scotland joined the cybercrime task force, and it led to the identification of another small group possibly linked to the death of Scottish teenager. MARCH 2014 IDCC coordinated a 2 nd operational meeting in Singapore involving representatives from police and judicial authorities from the Philippines, Scotland, Hong Kong, Singapore and Australia. Information of the identified syndicates were shared among the representatives. APRIL/MAY 2014 After months of preparation and shared intelligence among involved law enforcement agencies, IDCC coordinated with PNP, HKPF, SPF Police Scotland and US HSI to mount Operation Strikeback in the Philippines on 30 th April and 1 st May 2014.

39 5 COUNTRIES PLAYED A ROLE IN THE ACTION 87 SUSPECTS ARRESTED 250 PIECES OF LECTRONIC EVIDENCE SEIZED

40 Harmonization Activities National Cyber Review Cyber Security Strategy Development International Advocacy on Cyber Standards Research and Innovation

41 Research and Innovation INTERPOL Academia LEAs Private Sector INTERPOL ResInn Network (IRIN)

42 Capacity Building and Training INTERPOL will provide capacity building services, calibrated and customized according to the needs, requirements and competency of the different levels of national law enforcement officials.

43 Capacity Building and Training Awareness training for executive law enforcement officers Introductory Digital Awareness Training Specialized Digital Crime Training INTERPOL Certified Courses Virtual / Hybrid Delivery of Training Cyber Unit and Forensic Unit Setup Awareness raising against Cybercrime Objectives of Awareness Training National Legislation Creation of Cybercrime Units Best Practice-led Cyber Investigations

44 Now Operational TSO office is operating Handing Over Ceremony in 2014 Inauguration in 2015

45 نشكركم جزيل الشكر على انتباهكم Thank You-Merci-Gracias Kunwon YANG