[comp.virus] Uk Computer Crime Unit

davidf@cs.hw.ac.uk (David J Ferbrache) (11/27/90)

Since the passing of the Computer Misuse act of 1990, the insertion of
viral material into computer systems has become an offence which may
result in up to 5 years imprisonment. The insertion of viruses is
dealt with under the offence of unauthorised modification of computer
data, and was a problem specifically addressed in the English Law
Commission report 186 (para 3.65 (2)).

The UK police have established a central "Computer crime unit" who are
interested in monitoring all infections by computer viruses within the
UK.  This unit is currently four strong and consists of a Detective
Inspector, Detective Sergeant and two Detective constables and is
located at New Scotland Yard, London.

They are keen for any person, organisation or company infected by a
virus to report the infection. This will allow the construction of a
picture of the damage caused by the virus infection, and provide
useful background material for a prosecution if the author is ever
located.

In this regard they have asked anyone in the UK experiencing a
computer virus infection to contact:

	Noel Bonczonzek
	Computer crime unit
	071-725-2409

- ------------------------------------------------------------------------------
Dave Ferbrache                            Internet   <davidf@cs.hw.ac.uk>
Dept of computer science                  Janet      <davidf@uk.ac.hw.cs>
Heriot-Watt University                    UUCP       ..!mcvax!hwcs!davidf
79 Grassmarket                            Telephone  +44 31-225-6465 ext 538
Edinburgh, United Kingdom                 Facsimile  +44 31-220-4277
EH1 2HJ                                   Cellular   +44 831-223120
- ------------------------------------------------------------------------------

stevedc@syma.sussex.ac.uk (Stephen Carter) (12/04/90)

davidf@cs.hw.ac.uk (David J Ferbrache) writes:
> The UK police have established a central "Computer crime unit" who are
> interested in monitoring all infections by computer viruses within the
> UK.  This unit is currently four strong and consists of a Detective
> Inspector, Detective Sergeant and two Detective constables and is
> located at New Scotland Yard, London.
>
> They are keen for any person, organisation or company infected by a
> virus to report the infection. This will allow the construction of a
> picture of the damage caused by the virus infection, and provide
> useful background material for a prosecution if the author is ever
> located.
>
> In this regard they have asked anyone in the UK experiencing a
> computer virus infection to contact:
>
> 	Noel Bonczonzek
> 	Computer crime unit
> 	071-725-2409

Eh?  Silly.  Surely if they are really serious about this they'd get a
feed off the net and read this newsgroup!

Anyway, can we really believe that 'they' take any computer crime
seriously when such a small unit is set up, in which BTW at least 3 of
the 4 officers by all accountsa only serve in it for a relativley
short period of time...

Stephen Carter, Systems Manager, The Administration,
The University of Sussex, Falmer, Brighton BN1 9RH, UK
Tel: +44 273 678203  Fax: +44 273 678335     JANET: stevedc@uk.ac.sussex.syma
EARN/BITNET  : stevedc@syma.sussex.ac.uk      UUCP: stevedc@syma.uucp
ARPA/INTERNET: stevedc%syma.sussex.ac.uk@nsfnet-relay.ac.uk

rtravsky@UWYO.BITNET (Richard W Travsky) (12/05/90)

From:    Stephen Carter <stevedc@syma.sussex.ac.uk>:
> davidf@cs.hw.ac.uk (David J Ferbrache) writes:
> > The UK police have established a central "Computer crime unit" who are
> > interested in monitoring all infections by computer viruses within the UK.
> ...
> > They are keen for any person, organisation or company infected by a
> > virus to report the infection. This will allow the construction of a
> > picture of the damage caused by the virus infection, and provide
> > useful background material for a prosecution if the author is ever
> > located.
> ...
> Eh?  Silly.  Surely if they are really serious about this they'd get a
> feed off the net and read this newsgroup!

They may have a feed.  Even if they don't, not every company or
organization that uses pcs/macs will have a feed.  Besides, reading
the list isn't the same as filling out a report to the police...
Consider also many do not report such things (for one reason or
another - such as not knowing who to report it to) and if nothing else
this will elicit the scope of infections.

> Anyway, can we really believe that 'they' take any computer crime seriously
> when such a small unit is set up, in which BTW at least 3 of the 4 officers
> by all accounts only serve in it for a relativley short period of time...

Sounds like first they'd want to gather statistics to see how much of
problem it is before justifying more people and resources.

P.S. Do they get to wear neat uniforms?

Richard Travsky                        Bitnet:   RTRAVSKY @ UWYO
Division of Information Technology     Internet: RTRAVSKY @ CORRAL.UWYO.EDU
University of Wyoming                  (303) 766 - 3663 / 3668

DEL2@phoenix.cambridge.ac.uk (12/05/90)

While I agree with Stephen Carter that the size of the Scotland Yard
team is derisory, there is some logic to their request to be informed
specifically; as I understand it, their hands are tied unless someone
explictly complains to them.  Our crazy legal system is definitely
biased in favour of the criminal...

XPUM04@prime-a.central-services.umist.ac.uk (Anthony Appleyard) (12/19/90)

I received this message from 'pandy <pandy@fi.hut.superman>':-

"The UK Computer Crime Unit hasn't got an email-address, nor do they
read these UUCP-news. Pandy

******************
pandy@spiff.hut.fi"

If they aren't in contact with the computing world, how  can  they  operate
effectively?  If  they  can't  email,  and have to rely on GPO mail and the
phone and personal visits, and can't get email circulars, they are going to
be way behind developments. Can't they afford a microcomputer and a  modem?
from {A.Appleyard} (email: APPLEYARD@UK.AC.UMIST), Wed, 19 Dec 90 09:46:20 GMT

herrickd@uunet.UU.NET (daniel lance herrick) (01/10/91)

ccx020@cck.cov.ac.uk (James Nash) writes:
> XPUM04@prime-a.central-services.umist.ac.uk (Anthony Appleyard) writes:
>>>"The UK Computer Crime Unit hasn't got an email-address, nor do they
>>>read these UUCP-news. Pandy
>>>pandy@spiff.hut.fi"
>>
>>If they aren't in contact with the computing world, how  can  they  operate
>>effectively?  If  they  can't  email,  and have to rely on GPO mail and the
>>phone and personal visits, and can't get email circulars, they are going to
>>be way behind developments. Can't they afford a microcomputer and a  modem?
>
> The reason why the UK CCU has such a small budget is because their
> superiors do not believe there is a problem. If more people in the UK
> actually reported viral infections as crimes then the police might be
> interested in solving those crimes. We are years behind America and
> other nations in this respect.

Is there a system manager geographically near them who reads this and
could invite them over to get acquainted?  Show them some of the
existing cooperative anti-vandal effort?  Give both you and them new
resources?  Offer them access to the net through your system, either
by phone or by coming to your facility to use a local terminal?

dan herrick
herrickd@iccgcc.decnet.ab.com

nigelm@ohm.york.ac.uk (Nigel Metheringham) (03/05/91)

Following last December's note about the UK computer crime unit, and a
pair of very minor hits here (Stoned & Joshi - both nipped in the
bud), I tried reporting the infections to the UK Computer Crime Unit.

They are basically in a position of trying to justify their
existance at the moment - if they do not get reports of viruses,
then the government will see no reason to consider viruses a
problem, and will not fund them.  It is therefore in our best
interest to ensure that all virus infections discovered in the UK
are reported to the unit.

The sort of information they want is:-
	Name, (company) address, phone etc.
	Type of virus (if known).
	Machines affected (number, type, sensitivity of data).
	Tools used to detect/remove.
	Source of infection (if known).
	"Live" copy.

The live copy is required for evidential purposes - they will
arrange for collection of a disk by one of the local police (or I
assume you could send it by post).  Most people who call them have
already cleaned their systems up, so they are not getting many live
ones yet!

The person to contact is:-
	Noel Bonczonzek
	Computer Crime Unit
	071 725 2490   (the number was incorrect in the Dec virus-l-digest).

They don't have a network connection (as far as I know), but if
there is a demonstrated need then maybe they would get one, so
report any virus hits - PLEASE!

	Nigel.

[ I asked Noel Bonczonzek if distributing this sort of information   ]
[ would be useful to them.  He said that it would be useful, but the ]
[ contents of this message are my interpretation of what he said to  ]
[ me, so I am responsible for any misinformation, not the UK-CCU.    ]

- --
% Nigel Metheringham, System Administrator, Department of Electronics     %
% University of York, Heslington, York, UK, YO1 5DD                       %
% Phone: +44 904 432374  Fax: +44 904 432335  Mail: nigelm@ohm.york.ac.uk %
% #include <std_disclaimer.h>      %     Keyboard error - fingers dumped! %