The announcement is of course Good News — because once the PCeU is up and running next Spring, it should plug (to the limited extent that £2 million a year can plug) the “level 2″ eCrime gap that I’ve written about before. viz: that SOCA tackles “serious and organised crime” (level 3), your local police force tackles local villains (level 1), but if criminals operate outside their force’s area — and on the Internet this is more likely than not — yet they don’t meet SOCA’s threshold, then who is there to deal with them?

In particular, the PCeU is envisaged to be the unit that deals with the intelligence packages coming from the City of London Fraud Squad’s new online Fraud Reporting website (once intended to launch in November 2008, now scheduled for Summer 2009).

Of course everyone expects the website to generate more reports of eCrime than could ever be dealt with (even with much more money), so the effectiveness of the PCeU in dealing with eCriminality will depend upon their prioritisation criteria, and how carefully they select the cases they tackle.

Nevertheless, although the news this week shows that the Home Office have finally understood the need to fund more ePolicing, I don’t think that they are thinking about the problem in a sufficiently global context.

A little history lesson might be in order to explain why.

Back in 1930’s, Bonnie and Clyde and other US bank robbers were using the new-fangled automobile to flee across state lines — creating jurisdictional problems as a result. The US solution was to make bank robbery (along with auto-theft and other related offences) into federal offences rather keeping them as state-specific infractions. In particular this meant that the FBI could provide federal level policing (tracking down and killing John Dillinger for example).

We have the same jurisdictional issues dealing with cyberspace, with criminals in one country fleecing consumers in another while using systems hosted in a third. The Convention on Cybercrime addresses part of the problem by trying to ensure international consistency where eLaws are specifically needed (which of course is only the case for small parts of eCriminality, fraud is fraud whether eEnabled or not). However, there is limited inter-jurisdictional co-ordination for eCrime investigations — for example Interpol (often incorrectly perceived to be international police force) merely keeps a large database and passes faxes from one place to another.

In practice, most cross-border investigations are done as “joint operations” and the jointness is usually very limited — one force does all the legwork and a liaison officer in the other country deals with local paperwork. There’s usually a quid pro quo element to these joint operations, for budgeting reasons if no other.

What isn’t happening, or at least only in a handful of very specialised areas, is any international co-operation in setting priorities or selecting cases to pursue. Every country is doing its own thing about eCrime, and there’s a widespread impression that any criminal who can operate from “across the state line” is essentially immune from serious investigation.

We identified this problem last year when we (Ross Anderson, Rainer Böhme, Tyler Moore and myself) wrote a report on Security Economics and the Internal Market for ENISA. It’s not an easy one to fix whilst politicians (and populaces) are unwilling to see “foreign” police officers operating in their country, and the establishment of a truly international “cyber police force” seems equally unlikely.

Our policy proposal to tackle the issue harks back to WWII’s SHAEF, which has morphed into similar arrangements within NATO. In essence liaison officers from multiple forces would sit around a single table, working with a central coordinator, to set policy and decide which investigations to pursue. They would then communicate back to their own countries, who have specifically budgeted to provide appropriate assistance. So it’s very like “joint operations”, but the scheme is multi-laterial, and has a true command and control function in the centre — who will quickly learn to shy away from politically sensitive topics and make a real impact on eCriminality.

To summarise then, a welcome to the Home Office for finally finding a small amount of funding for some country-wide ePolicing; but it’s well past time to be working on world-wide initiatives.

NEW (TO ME) BLOG
I had somehow missed it, but my friend Dr. Jeremy Ward of Symantec has an IT Risk Management weblog up.    The RSS feed is not self-evident, however, and you’ll have to dig around and copy and paste the link and such…

NEW CONTENT - ECONOMICS AND SECURITY
ENISA, The European  Network and Information Security Agency has released a report on the economic barriers to Information Security, pdf here.

OLD BLOG - GOOD, NEW CONTENT (ECONOMICS, SECURITY, & COMMUNICATION)
Speaking of economics and security…   Amrit covers the topic of security budgets very well in his piece, “Why Should We Spend on Security?“.  He’s not inherently advocating a risk-based approach, but when you think about the conclusions he draws, using risk is the most probable answer to the problem.

 MORE COMMUNICATION
Speaking of communication, Junk Charts weblog has a great article on how people use data visualization (graphs) to lie.  Not that you’re going to lie, but if you’re building dashboards with your KPI’s for InfoSec - be sure to invest time into getting the visualizations right.

MACS CAN DO ANYTHING
It’s finally getting to be spring here in the US - and that turns my eye towards baseball.  I like following the discussions between those who quantify player production and create projections based on probability - and those who claim it’s folly.  Mostly because the structure of argument has some parallels that interest me (hmmm).  So here’s the attack and rebuttle from the weblog firejoemorgan.com that caught me funny.  The exchange is between Rick Morriessey, the long-time Chicago Tribune beat writer who hates quantitative analysis, and Michael Schur, a writer and producer for the US version of The Office who goes by “Ken Tremendous” on the weblog.  Turns out Michael is big on the “Moneyball” Quants and the new class of metrics they use:

Chicago Tribune:  The cold, hard facts might back up Baseball Prospectus’ opinion that the Mets will beat the Cubs in the NL Championship Series. New York acquired Johan Santana from the Twins, shifting the balance of power eastward in the weak-by-comparison National League.

But …

Ken Tremendous:  …Johan Santana has a heart condition? The Mets (have the backbone of) earthworms? Your knees ache, portending humidity? The entrails of the goat you just slaughtered say that the Gods are upset and we should move our armies West through the mountain pass? Poseidon may take vengeance upon the Greek fleet because Athena zzzzzzzzzzzzzzz.

Chicago Tribune:  Do feelings count? Or hunches?

Ken Tremendous:  Not really, no. I mean, they’re fun. They’re fun to toss around and stuff. But they don’t “count” when you are trying to scientifically project a team’s performance. That is kind of the point of scientifically projecting a team’s performance.

Chicago Tribune:  Computers have no use for heart, or least they can’t quantify it. They can’t analyze what’s inside an athlete, for example. They can’t tell you who has the heart of a lion or the backbone of an earthworm.

Ken Tremendous:  Actually, the new MacBook Air has a program called iGrit, where you can enter a player’s physical attributes, family history, propensity for diving, and which college he punted for, and it will give you a % by which his stats should increase next year. Macs can do anything.

Disclaimer: This is another nothing to do about security article.  Today's Super Bowl Sunday so lets write about baseball. The other shoe has finally dropped on the biggest deal in baseball this off-season.  They NY Mets have won the Johan Santana sweepstakes.  The deal costs the Mets dearly. 4 young prospects, including 3 pitchers and 137.5 million over six years. What did they get for all that? Maybe the best pitcher in baseball today. A sturdy 2 time Cy Young award winner, Santana will anchor the Mets rotation for years to come.  The Mets beat out the Yankees and the Red Sox to win the prize.

Here is the funny thing though.  I think both the Yankees and Red Sox are happy the Mets got him. If you look at the Red Sox they are coming off of a World Series season. Their pitching appears solid and though you can never have enough pitching, the price to the Sox would have been either Jon Lester, a great pitching prospect or Jacoby Ellsbury or both.  A steep price to pay, not to mention the big fat contract on top of that.  And who knows how the other Sox players would have reacted to another big contract. It could have upset their whole payroll order  On the other hand, the Yankees would have had to deal one, if not two of their big three baby arms.  Hughes, Kennedy and Chamberlain.  These three could be the rock the Yankees build their next dynasty on.  The Yankees are finally going to let the young arms develop on the Yankees. Plus even the Yankees have to worry about yet another big contract.  I think one of the things driving both the Yanks and Sox quest for Santana was to keep their arch rivals from getting him!  Now the Mets have come in and taken that problem off the table. Yankees and Sox fans know that the only time they will have to regret this trade is if they meet the Mets in the World Series. If so, I am sure they will take their chances.

Here is hoping the deal works out for the Mets, it already has for the Yankees and Red Sox!