Reporting the crime The investingation

ØKOKRIM

Reporting the crime The investingation

Politiinspektør Berit Børset SolstadPolitiets datakrimsenter

20.10.04

ØKOKRIM

QuickTime™ og en TIFF (ukomprimert)-dekomprimerer kreves for å se dette bildet.

The police data crime center

• Opened15. mai 2003

• Address: Bryn by Kripos

• lawyers, police and technologists

• 21 employees

ØKOKRIM

• Scenarioet

Agenda

ØKOKRIM

How many are hit by hackers?

• 60 % of all organisations • 5200 attacks (datainnbrudd)• 2,7 mill attempts• 150 000 virus infections

ØKOKRIM

Consequences

• 70 % of companies had extra work• 38 % analysed security after the attack• 5 % - loss of business

ØKOKRIM

Difficult to estimate financial loss

• 25 % can estimate direct loss• 6 % indirect loss• 12 % have routines to estimate loss

• 5 billion kroner in loss

ØKOKRIM

Sikkerhetstiltak og –rutiner

ØKOKRIM

Number of cases reported 2001 - 2003

0 20 40 60 80 100 120

Misbruk av IT-ressurser

Tyveri av datainformasjon

Datainnbrudd

Dataskadeverk og -bedrageri

2001

2003

ØKOKRIM

This case• Financial motive• The employees background/skills• The results of investigation

– In the company – The employee’s home computer

ØKOKRIM

Investigation abroad

• Directly between countries• Interpol• Europol• G8-nettverk

ØKOKRIM

G8-network

• Bakgrunn for deltakelse– Convention on Cybercrime– Rask respons– Uavhengig av tidssoner/arbeidstid

• 24/7-nettverk• Stor antall land med ulike regelverk

ØKOKRIM

• The ISPs obligation to save traffic information – Few countries demand that ISPs collect traffic

information • The ISP’s obligation to freeze information

after police intervention – varies from a few days to several months