A Microsoft Corp. security expert is calling for greater international collaboration, including increased technical and training support for law enforcement agencies, to seriously combat cyber crime.
While many countries have the necessary laws in place to aid the investigation and prosecution of computer criminals, it is important that there be “no safe haven” for them, according to Philip Reitinger, senior security strategist, Microsoft, based in Redmond, Wash.
Countries should foster better co-operation, either through treaties or bilateral agreements, to facilitate international investigation of cyber criminals making it difficult for them to seek refuge in certain countries, Reitinger said.
For instance, he said, if a hacker lives in a country that has no law criminalizing cyber crimes, he can launch an attack on a computer in another country and be essentially untouchable. Unless there is an extradition agreement, the hacker could remain unpunished as long as he stays in his country.
It is important that countries worldwide enact domestic laws that criminalize online crimes, as well as empower law enforcement agencies to investigate such cases in a way that also protects the privacy of its citizens, the security expert said.
Reitinger was among the keynote speakers at the recent InfoSecurity Canada conference and exhibit held in Toronto.
“That is actually one of the reasons why Microsoft has supported the Council of Europe Cyber Crime Convention, the first international treaty that somewhat comprehensively addresses cyber crime and cyber investigation,” said Reitinger.
The convention provides, among other things, a set of agreed-upon standards in enacting domestic legislation as well as appropriate investigation procedures for law enforcement agencies.
Reitinger also called for increased funding for law enforcement agencies specifically towards providing personnel with technical expertise on handling computer-related crimes.
“The difficulties…are not so much that there is no good co-operation between law enforcement (and private sector), it’s that law enforcement often lacks the resources, technical capabilities, and training it needs to get the job done,” he said.
The Microsoft security strategist, who is also a lawyer, even pitched the future possibility when “almost any case will involve some form of electronic evidence.”
Law enforcers must be trained on how to approach this kind of evidence, he said.
A suspected drug dealer, for instance, could be nabbed with a PDA or smart phone in his possession, which might contain data vital to the investigation. “Do (law enforcers) have the capability to pull that off? Do they even know that one of the first things they need to do is take this device away from the suspect so he can’t delete the data?” Reitinger said.
He stressed that hacking, over the years, has become highly sophisticated and the intentions have changed from bragging to attacking for profit.
While countermeasures are being developed against attacks, hackers are likewise building countermeasure against these defences, said Reitinger. “Migration to more secure software adds to security and I think vendors need to work closely with enterprises to help them…achieve the benefits that the new software provides.”
While he admitted such migration may be difficult for many companies, especially for those running a line of business applications that may or may not work well with the new system, he said vendors should “work closely with enterprises to help them get over that burden.”
