---

Internet: Personal Security (S&T Report)

My Lords, I welcome the noble Lord, Lord Brett, to the first debate to which he will respond from the Dispatch Box. The whole House will be grateful for this well researched report in which the committee makes constructive recommendations. We particularly thank the noble Lord, Lord Broers. Your Lordships will be well aware that in 2007 nearly two households in three had the internet and 53 per cent of adults purchased goods and services on it. The latest fraud figures published by APACS show that plastic card fraud losses are up by 14 per cent year on year in the first six months of 2008. We all have our pet stories. One sophisticated scam involves inviting, with a very plausible story, a user to part with her Paypal code number. I have no doubt that I am not alone in experiencing a current plague of phishes, supposedly from the major UK clearing banks, designed to obtain clients’ account numbers. However, the noble Lord, Lord Birt, chillingly reminded us that this is child’s play compared with what we can expect in the near future, and that organised crime is becoming increasingly involved. The Committee recommended a cross-departmental group involving internet security experts to develop a co-ordinated approach to collecting data on internet crime and classifying the offences. We are pleased to note that the Government have acted on this recommendation and I am sure the House will be interested to hear more from the Minister about the role of the new police central e-crime unit, announced two weeks ago, which will work with the National Fraud Reporting Centre and the National Fraud Intelligence Bureau. I hope the Government will also take account of my party's suggestion that there should be an e-crime specialty within the Crown Prosecution Service. I hope that when the Government read this debate they will note particularly the eloquent vision of the noble Lord, Lord Bhattacharyya, regarding the duties and challenges which lie ahead of us in fighting cybercrime. The committee’s report made the further related point that there was insufficient research in this area and that one or more interdisciplinary research centres needed to be set up. Several noble Lords have made it clear that the Government’s response was inadequate and has been very badly received. However, I am pleased to note the intervention of the two new Ministers, which I hope will rectify the situation. These Benches have made a number of criticisms of the Government's approach. In your Lordships' debate on 20 March this year, I made the point that in our view, "““the Government do not consider cybercrime to be a serious offence””.—[Official Report, 20/3/08; col. 384.]" Indeed, that sentiment has run through this debate. I make no apology for repeating our criticisms here. The National Hi-Tech Crime Unit, which was set up in 2001 in response to the threat of online crime, provided a good link with police forces and business. In early 2006 it was absorbed into SOCA, despite widespread criticism that it would leave a yawning gap between local forces and national policing. In April 2007, ring-fenced funding for computer crime units in individual police forces was cut off. Furthermore, financial fraud can no longer be reported to the police directly. That important point was made by the noble Lord, Lord Broers. It must first be reported to the financial institution concerned, which then decides whether the matter should be reported to the police for further action. He was particularly critical of that. All these issues still very much concern noble Lords on this side of the House. This all emphasises the disconnect between the police and the increasingly electronically sophisticated public. It is hardly surprising, therefore, that nine out of 10 offences go unreported because the victims believe that the police are unable or unwilling to investigate. This view is reflected by the police, who in January 2007 reported to the Metropolitan Police Authority—I am sure that the noble Lord, Lord Harris, will be familiar with this—as follows: "““There is an issue of under-reporting across the UK. There is an unspoken public perception that e-crime is so pervasive that the police service does not have the capacity to investigate each ""individual allegation. The public have reported difficulties in reporting e-crime to the police. Also many organisations may be unaware of their computer being compromised, making it difficult to establish definitive annual financial harm””." It has been our view for some time that a police national cybercrime unit should be set up, with adequate specialist support. That is why we very much welcome the setting up of the new e-crime unit, which I hope will go a considerable way towards addressing the deficiencies to which I have referred. We would also like to see the industry working towards a common standard, with the establishment of a kitemark. That was a key recommendation of the committee, which again got a very disappointing reaction. I hope that can be rectified. The noble Lord, Lord Broers, made a point about the responsibility of the banking industry. I have had sight of a letter from Angela Knight, chief executive of the British Bankers’ Association, to my honourable friend James Brokenshire MP, in which she states that under the revised banking code, "““customers do not have any liability for losses suffered through their online banking service unless they have acted fraudulently or without reasonable care. The burden of proof always lies with the bank to provide evidence that a customer has acted fraudulently or unreasonably””." That is refreshingly unequivocal, especially in view of the fact that I am assured by my son that a substantial proportion of online banking and credit card fraud is caused by the failure of customers to keep their passwords or PINs secure, for example, by leaving them in the vicinity of the relevant cards. The computer press recently featured articles on the steps that the clearing banks are taking to counteract cybercrime, so we can say that the banking industry is playing a responsible part in the fight. However, I entirely agree with the noble Lord, Lord Broers, that statutory control of the banks in this respect is required and that we cannot rely on the voluntary code. We must be aware that cybercrime extends beyond fraud. I refer to denial of service, to which the noble Lord, Lord Harris of Haringey, referred, in which an external source hacks into a computer system and swamps it with incoming messages, thus making it impossible for the victim to exercise its proper functions. As the noble Lord said, that was spectacularly used in Russia’s dispute with Estonia and, more recently, during the short Russia-Georgia war. This can clearly be a problem of international proportions, especially when practised, as it clearly was in that recent incident, at government level. Theoretically, it is outwith the scope of this debate, but there can be no reason why this particular scam or operation could not be used just as easily against individuals. Are there any plans to address this potentially very large problem? I have a number of specific questions, of which I have given notice to the Minister. First, there is the matter of ratification of the code. In their response to the committee’s recommendations, the Government stated that they were implementing changes to the Computer Misuse Act, following which they would proceed with ratification of the Council of Europe Convention on Cybercrime. That was in April, and it is now October. What is the present position, and when will the Government be in a position to proceed with ratification? Allied to that is the lack of effectiveness of the Computer Misuse Act. A record of an average conviction rate of 15 per annum for computer fraud cases is derisory, and I hope that the Government will address the apparent anomaly that 25 offences under the Computer Misuse Act are not categorised as ““serious”” under SOCA. The fact that salmon poaching is categorised as ““serious”” is passing into folklore. My third point—I emphasise that this is based on hearsay only from within the police service—is that inquiries and action on computer fraud are being hampered by inadequate forensic resources, which has resulted in a backlog of cases. I hope that we can have an assurance from the Minister that this subject is being addressed. This has been a most interesting and constructive debate. I repeat the thanks from these Benches to the noble Lord, Lord Broers, his committee and staff. I look forward to the Minister’s reply.