********************************************
Following is a question by the Hon Sin Chung-kai and a written reply by the Secretary for Security, Mr Ambrose SK Lee, in the Legislative Council today (November 5):
Question:
It has been reported that there were 454 crimes involving information technology (IT) in the first nine months of this year, representing an increase of 67 per cent over those of the same period last year. Most types of these cases were on the rise whilst the detection rate was only three per cent. As for the cases referred to the Technology Crime Division of the Commercial Crime Bureau (TCD) of the Police for investigation, 12 out of 15 cases were cracked down. Moreover, the Police had requested individual network operators to keep records on the server log of their customers to facilitate investigation and advised that if the record-keeping by network operators was not satisfactory, legislation might need to be introduced to require them to keep such records. In this connection, will the Government inform this Council:
(a) of the reasons for the relatively low detection rate of crimes involving IT;
(b) why only 15 cases had been referred to TCD for investigation in the first nine months of this year, representing only 3.3 per cent of related cases during the same period;
(c) of the criteria adopted by the Police for determining which criminal cases involving IT should be handled by TCD or other investigation divisions of the Police; and
(d) of the situations under which the Police require network operators to keep records on the server log of their customers; and the number of such requests made by the Police over the past three years?
Reply:
Madam President,
(a) "Technology crimes" or "computer crimes" generally refer to the following types of crimes:
(i) crimes directly targetting computers or computer systems (e.g. illegal intrusions into computer systems, commonly known as hacking);
(ii) crimes committed through the use of computers (e.g. copyright piracy on the Internet); and
(iii) crimes where computers were merely incidental to the offences (e.g. placing of advertisements on the Internet to attract customers to buy child pornographic articles).
The detection rates of technology crimes handled by the Police in the past three years are tabulated below:
Year Total number of technology Overall
crime cases detection rate
---- -------------------------- --------------
2001 235 20 per cent
2002 272 21 per cent
2003 451 12 per cent
(Jan-Sept)
The overall detection rate of technology crimes remains at double digits. The detection rate of the serious cases (19 cases) handled by the Technology Crime Division from January to September 2003 was 73.7 per cent (14 cases).
The circumstances surrounding a particular type of crime would affect to a varying degree the search for leads, gathering of evidence and the progress of investigation; the detection difficulties and rates do vary. As far as technology crimes are concerned, the following circumstances may have a bearing on the difficulties in their detection:
(i) the Police rely on the cooperation of Internet Service Providers (ISPs) to provide relevant technical information in the search for leads. For example, in hacking cases, it is common for perpetrators to make use of victims' Internet accounts for dial-up Internet access. This makes it difficult for the Police to follow up;
(ii) many victims are not aware of the necessity to preserve the evidence in their computers. They often reset or update their computers immediately after their computers have been hacked into, thus destroying evidence useful to investigation; and
(iii) the cases may involve acts committed or property located outside Hong Kong, and imposed technical difficulties in investigation, gathering of evidence, enforcement and exercise of jurisdiction. For example, for the technology crime cases handled from January to September 2003, the majority (about 200 cases) involved on-line game participants alleging to be deceived. However, the computer servers concerned were located outside Hong Kong, and Hong Kong may not have jurisdiction over such cases.
The Police attach great importance to improving the detection rate of technology crimes. The Technology Crime Division has issued investigation guidelines to various investigation units. Training of front line investigators has been strengthened to enhance their professional capability in investigating technology crimes.
(b) and (c)
Investigation of crime cases is handled by the Police Headquarters, Regional Headquarters and District Police Stations, depending on the nature, circumstances and severity of the cases. Clear guidelines on investigation of technology crimes have been drawn up. In general serious technology crimes are handled by the Technology Crime Division of the Commercial Crime Bureau where:
(i) there is no precedent;
(ii) new methods of committing crimes are involved;
(iii) the criminal acts require relevant professional knowledge, technology or equipment;
(iv) technical support from local or overseas experts is required;
(v) large network systems, infrastructure facilities or sensitive information are involved;
(vi) overseas offenders are involved and their identity has to be affirmed by overseas law enforcement agencies or witnesses;
(vii) offenders make use of special equipment; or
(viii) a few jurisdictions are involved.
Other technology crime cases are dealt with by respective Regional Headquarters or District Police Stations.
From January to September 2003, the Technology Crime Division handled 19 serious technology crime cases.
(d) The Police have maintained good cooperative relations with ISPs. For cases involving log records, the Police will seek assistance from ISPs as may be necessary in the circumstances of the cases. The Police do not keep statistics on the number of requests made to ISPs.
Ends/Wednesday, November 5, 2003
NNNN
