Report cyber crime, urge police

By Leon Engelbrecht, ITWeb senior writer

Johannesburg, 02 May 2007

People must report cyber crime, says police senior superintendent Beaunard Grobler. He says the first port of call is the local police station.

"All police are trained in dealing with cyber crime while at college. There is also information on the police intranet on how to handle such investigations," Grobler, commander of the police's national cyber crime unit, told an Information Security Group meeting just before the long weekend. "They also have cellphones and can call for advice."

Grobler told his audience there is no difference between investigating a burglary and, for example, a hacking attack. "A virtual crime has been reported, but we handle it like a real crime. I don't consider myself a cyber inspector; I'm an ordinary cop investigating crime."

His unit supports detectives in two ways - reactively, through computer forensics that allows for the time-stamped recovery of incriminating data without altering the original files or documents in any way, and proactively, through "evidential operations" to trace or entrap paedophiles and phishers.

He says his unit has a portable laboratory for reactive operations and to help trace the associates of online criminals. "You always leave traces of yourself on a computer," Grobler says. "Phishing is one of my daily tasks, and we are hunting them. We recently took down a site and could collect forensic evidence and ID their local helpers."

A major obstacle to investigating phishing is breaks in the evidentiary chain, Grobler says. He urges businesses that discover phishing sites duplicating their own not to "take down" the copycat's site until police have done a forensic trace. If nothing else, businesses and consumers who fall victim to phishers should take a photograph of the site. "At least take a snapshot of the URL. That's evidence; that's the starting point of any investigation."

Grobler also warns that business disaster recovery plans should include provision for detectives taking PCs and even servers for the evidence they contain. "Police can confiscate and hold [these] for an unspecified time."