Proactive Law Enforcement for Cybercrime

1. The online Gambling WorkshopLaw Enforcement:“maintain an effective legal framework and enforcement capabilities to target and prosecute cyber crime” Glynnis Breytenbach Cape Town 2 March 2012

2. "Technology leaps, the law creeps.":

4. “Everybody has a plan until they get punched in the face” – Mike Tyson

5. Some general strategic objectives for cybersecurity and to combat online crime • Everybody is aware of cyber risks, secure their computers and take steps to protect their identities, privacy and finances online • Businesses operate secure and resilient information and communications technologies to protect the integrity of their own operations and the identity and privacy of their customers

6. Some strategic objectives for cybersecurity and to combat online crime • Threat Awareness and Response – improve the detection, analysis, mitigation and response to sophisticated cyber threats, with a focus on government, critical infrastructure and other systems of national interest • Cultural Change – educate and empower all South Africans with the information, confidence and practical tools to protect themselves online • Business-Government Partnerships – partner with business to promote security and resilience in infrastructure, networks, products and services

7. Some strategic objectives for cybersecurity and to combat online crime • Knowledge, Skills and Innovation – promote the development of a skilled cyber security workforce with access to research and development to develop innovative solutions • Legal and Law Enforcement – maintain an effective legal framework and enforcement capabilities to target and prosecute cyber crime I would like to focus on this aspect today

8. Pro-active vs. historical investigations “law enforcement is increasingly turning to proactive investigations where undercover agents seek out the individuals who are already engaging in computer crimes — attempting to record, in real-time, computer criminals while they are involved in the criminal act. The proactive approach bypasses some of the investigatory hurdles of anonymity, lack of records, and under-reporting inherent in computer cases. It also has the added benefit of potentially stopping the criminal before the damage is done. In order to do pro-active investigations you a need a task team who is 24/7 available to be operational”. Robert Strang US Attorney

9. Pro-active detection “Pro-active detection takes place where a law enforcement agency initiates an undercover investigation in order to pursue intelligence it may have received possibly from an anonymous source, another agency or perhaps from a telephone interception. The principal feature is that this form of detection is intelligence-based as opposed to being complaint-based.”.UN Handbook p49

10. Organised Crime Strategic Framework • “The South African Banking industry suffered a loss of R 1 billion due to organised white collar crime including cybercrime” – Susan Potgieter SABRIC 29 February 2012 Jhb regional court • Organised crime also causes great harm to individuals and the broader community. Organised criminal networks are flexible, innovative and resilient. These networks are profit driven, constantly looking for new opportunities and operating across state, territory and national borders.

11. NPA’s framework adequate • In my view our current structure is conducive to effectively address the crime threat • PGI successfully employed for more than a decade now • We have developed own capacity in cybercrime partnering SAP

12. HOW DO WE DO THIS?JOINT PLANNING & PROBLEM SOLVING • We work jointly with the police and other stakeholders, e. g. Banking Industry, Road Accident Fund, FIC, FSB, etc • We have procedural guidelines, accepted by all • We have scheduled strategic & operational meetings, attended by all

13. HOW DO WE DO OUR WORK? OUR FOCUS AREAS SPECIALISATION (Investigation & Prosecution of CC) COMMITMENT (Dedicated Focus) FOCUS AREAS EXPERIENCED PEOPLE (Capacity Building) EFFECTIVE PROCESSES (Optimal operational efficiency & effectiveness)

14. CASE PLANNINGSCOPE OF THE PROCESS AFU FORMAL WORKING RELATION- SHIP EXTERNAL SOURCES Eg. NDPP other Provinces,, etc. PROSECUTOR INVESTIGATOR Unit Commander allocates case to Investigator INITIAL investigation to enable Unit Cmdr to assess whether “there is a case” TEAM Investigates case and Prepares for Trial THE TRIAL The Post Trial REVIEW SCCU Cases Investigator + Prosecutor + External Spec Team Appt. PLAN Investigation & Delegate Tasks NEW CASES Cases Reviewed by Unit Mgt. CASES CLOSED NON-SCCU CASES CASES NOLLE PROSECUI MISSION ACCOMPLISHED

15. HOW DO WE DO THIS?TEAM WORK • A prosecutor and investigator are allocated right at beginning of a case • They work together as a team throughout the case • Co- location contributes to efficacy of relationship

16. HOW DO WE DO THIS?TEAM WORK • The Prosecutor guides the investigation • The Prosecutor and Investigator however operate independently and are functionaries in their own right • Involvement of prosecutors in the investigation not allowed • The Prosecutor does not lead the investigation

17. HOW DO WE DO OUR WORK?TEAM WORK Case plan: • The prosecutor and investigator jointly draft a case plan, setting out what needs to be done, by whom and when • They monitor progress by regular follow up meetings • The guidelines align target dates to tasks

18. HOW DO WE DO OUR WORK?MONITOR & EVALUATE • The process is monitored by supervisors on an electronic case register • Regular operational and strategic meetings with all stakeholders are held

19. NPA: Prosecution Policy “The NPA is a public, representative service, which should be effective and respected. Prosecutors must adhere to the highest ethical and professional standards in prosecuting crime and must conduct themselves in a manner, which will maintain, promote and defend the interests of justice.” Paragraph 9

20. the NPA/SCCU is undertaking a range of measures including: • providing additional resources for security and law enforcement agencies to enhance operational capabilities for combating cyber crime and other cyber security threats • ensuring that linkages are in place between cyber security and law enforcement efforts to combat specific related crime types, including organised crime, through the sharing of information and intelligence • To make continuous contributions to ensure our legal framework is robust and keeps pace with developments in technology and criminal behaviour. • providing prosecutors with access to information and resources to provide them with the requisite level of technological knowledge and understanding to effectively administer these laws, and • promoting international cooperation to facilitate information sharing and law enforcement cooperation across geographical borders.

21. Case study : Cybercrime example of cooporation between SAP and NPA Postbank case: R42 million