Cloud floats through cybercrime legislation: Crime Commission

The chief executive of the Australian Crime Commission has warned current law enforcement isn’t properly equipped to respond to attacks on cloud computing services, which is poised to be the next frontier for organised crime gangs to expand their syndicates.

Speaking this morning at the International Serious and Organised Crime Conference 2010 in Melbourne, John Lawler said traditional policing methods can't effectively access data hosted on remote computers or data centres which physically reside in overseas jurisdictions in environments such as cloud or grid computing.

"Our existing law enforcement approach is that data is stored on a computer system," Lawler told conference attendees. "With cloud computing, where is the computer system? Where is the data? How do we gain access? How do we deal with cross-jurisdictional issues? Where is the victim, and where were they when the crime was committed?"

"It's no surprise these questions are of no interest to organised crime. They operate in a borderless virtual world, using such technologies to cherry pick opportunities from across and through jurisdictions and to access information.”

He said the risks of people suffering cyber attacks are growing because of the rising popularity of web-based services like Gmail and Hotmail.

“It seems to get instant gratification people are prepared to accept a level of risk they never would have before, or is it they're unaware of the risks?”

“The information that people provide when they purchase goods or services online, sign up to membership, donate to charity, answer surveys or enter competitions, is now raw material for economic activity; it has value, it is data that can be analysed, augmented, used, sold on, rented, not just locally but globally."

University of Technology (UTS) director of Communications Law Centre, Professor Michael Fraser, used his keynote at the Australian Federal Police’s (AFP) annual High Tech Crime Conference earlier this year to commend Australia for its efforts in closing the gaps in legislation required by local authorities to police cybercrime. However, his comments harmonise with those from Lawler, in pointing to continuing gaps in the key areas of theft, fraud and trespass.

Lawler's comments were also reinforced by a researcher at the Australian Institute of Criminology who told attendees at the Melbourne conference this week that cybercriminals had gained the ability to “map” the infrastructure that supports a cloud service in order to specifically target the servers where specific user information is being held.

Dr Raymond Choo said that while companies like Google have strong security credentials, the same couldn’t be said for other operators in the market. The problem was exacerbated because consumers primarily make decisions based on price, with security often a secondary concern.

“Cybercriminals are very innovative, so when they see a new technology they will exploit it,” Dr Choo said.

“Just because they're offering the same features at a lower price, most of us would not take into consideration whether the security of cloud service A is better than cloud service B, and there's no way to find out.”

There is no security certification or benchmark for cloud services, he said, although groups such as the cloud security alliance are working in this area.

Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.

• Bookmark this page
• Share this article
  •  
  • facebook
  • slashdot
  • digg
  • Reddit
  • stumbleupon
  • linkedin
  • twitter
• Got more on this story? Email CIO
• Follow CIO on twitter

• Share
  Share this article

  •  google+
  • facebookfacebook
  • slashdotslashdot
  • diggdigg
  • RedditReddit
  • stumbleuponstumbleupon
  • linkedinlinkedin
  • twittertwitter
• print
• email
• Bookmark