Keeping ahead of internet criminals

Coming up with ways to predict crime is the Holy Grail for police officers and it is especially difficult when it comes to the internet.

Now, a Teesside-led team is well on the way to cracking the problem, having gone back to the theories of investigation into more terrestrial crimes such as serial murders.

Their work is based on the idea that all online use leaves a trace and analysing the resulting patterns can lead investigators to predict incidents before they happen.

This is becoming increasingly important because organised crime gangs use the internet to run lucrative rackets including child pornography, money laundering, drug dealing, fraud and identity theft.

Leading the 15-month £150,000 project – funded by the Engineering and Physical Sciences Research Council and involving the Universities of Hull, Sheffield and Teesside, the Office of the Information Commissioner, Humberside Police and North Yorkshire Trading Standards – is Teesside senior lecturer in forensic science Angus Marshall.

He specialises in digital evidence and said, 'At the moment, we have to wait for internet activity such as computer viruses to become a noticeable problem. What we have done is devise mathematical ways of analysing patterns of behaviour so that we can work out when things are happening in their earliest stages’.

Viruses are a case in point. Public perception is that these are written by lone teenage hackers, hiding in their bedrooms. The reality is very different. Mr Marshall's team is convinced that organised crime gangs are posting online 'kits' which help novices, known as script kiddies, to create new attacks.

‘We think organised crime is doing this to create background noise which masks their own activities and distracts attention away from what they are doing’, he said. ‘What we want to achieve ultimately is to create a system that detects patterns of such criminal activity before it becomes too much of a problem.’

And to do that meant going back to basics. ‘We took a step back and looked at the way investigators deal with conventional crime such as serial rapists or murderers’, Mr Marshall said. ‘It is possible to predict what kind of person is likely to commit the crime and the sort of geographical area they prefer. It is similar with the internet, except we have hundreds and thousands of possible suspects in an ever-changing landscape. We can never get to the point where we can say “it is Joe Bloggs from 53 Acacia Avenue” but we hope to be able to detect unusual patterns of behaviour on the internet and say what kind of person we are dealing with.’

The team, which is now seeking funding to develop its work further, is also working on a system which would allow police hi-tech units to analyse seized computers much more quickly. ‘At the moment, police can take weeks examining computers without even knowing what’s there’, Mr Marshall said. ‘We hope our disc profiling tool will be able to analyse within minutes what kind of evidence is present and what kind of crime it relates to.’

---