**********************
Following is a question by the Hon Sin Chung-kai and a written reply by the Secretary for Security, Mrs Regina Ip, in the Legislative Council today (March 12):
Question:
Regarding computer crimes, will the Government inform this Council:
(a) how the detection rates of computer crimes compare with those of other crimes in the past three years; if computer crimes had lower detection rates, of the reasons for that;
(b) of the respective numbers of staff responsible for the investigation of computer crimes in law enforcement departments, and the changes in the numbers over the past three years;
(c) of the criteria for selecting law enforcement officers for the investigation of computer crimes; whether pre-job training or relevant academic qualifications are included in the criteria; whether the authorities have assessed if these criteria can ensure the officers' capability in investigating crimes committed with computers and information technology; if they have, of the assessment results; and
(d) whether it has plans to provide additional resources to ensure that the knowledge of computer forensic examiners can cope with computer crimes; if it has, of the details of the plans and the resources required?
Reply:
Madam President,
(a)"Computer crimes" generally refer to the following types of crimes-
(i) crimes directly targetting computers or computer systems (e.g. illegal intrusions into computer systems, commonly known as hacking);
(ii) crimes committed through the use of computers (e.g. copyright piracy on the Internet); and
(iii) crimes where computers may merely be incidental to the offences (e.g. placing of advertisements on the Internet to attract customers to buy pornographic articles).
Computer crimes are mainly handled by the Police and the Customs and Excise Department. The detection rates of computer crimes and other crimes handled by the Police in the past three years are tabulated as follows -
Year Total number Overall Number of Detection rate
of cases detection computer of computer
rate crime cases crime cases
---- ------------ --------- ----------- --------------
2000 77 245 43.6% 368 23%
2001 73 008 44% 235 20.4%
2002 75 877 42.7% 272 21%
All the computer crimes handled by the Customs and Excise Department involve copyright piracy on the Internet. The numbers of this type of cases in 2000, 2001 and 2002 were six, three and five respectively, and they were all detected by the Department.
As the circumstances involved in each type of crimes may affect to a varying degree the search for leads, gathering of evidence and the progress of investigation, the detection rates of individual types of crimes may be higher or lower than the overall crime detection rate. As far as computer crimes are concerned, the following circumstances may have a bearing on the difficulties in their detection -
(i) Regarding the search for leads, the Police needs the cooperation of Internet Service Providers to provide relevant technical information. For example, in hacking cases, it is common for the perpetrators to make use of the victims' Internet accounts for dial-up Internet access. This makes it difficult for the Police to follow up relevant leads.
(ii) Regarding the gathering of evidence, many victims are not aware of the necessity to preserve the evidence in their computers. They usually reset or update their computer immediately after their computers have been hacked into, destroying the evidence useful to investigation.
(b) The Computer Crime Section of the Police is responsible for the investigation of computer crimes and operates a computer forensic laboratory to provide technical support for forensic examination of electronic evidence. The number of officers in the Section has been increased from 17 in 2000 to 42 in 2002.
The Anti-Internet Piracy Team of the Customs and Excise Department is responsible for investigating copyright piracy on the Internet. The Team had an establishment of seven members from 2000 to 2002. In November 2000, the Department set up a computer forensic laboratory staffed by three officers. They are responsible for providing computer forensic technical support for examining and verifying the electronic evidence contained in seized computer systems.
The Immigration Department set up a Computer Crime Unit in 2001 to handle immigration cases involving computer crimes. At that time, the number of officers in the Unit was six, and increased to eight in 2002.
The Computer Forensics and Research and Development Section of the Independent Commission Against Corruption is responsible for handling computer forensic matters and assisting in the investigation of crimes involving computers. There were seven officers in the Section from 2000 to 2002.
(c) Selected law enforcement officers for computer crimes ought to be holders of diplomas in computer studies, or possess basic knowledge in computer operation. They would receive basic training in the investigation of computer crimes. In addition, law enforcement departments will arrange for these officers to take relevant computer courses in suitable local or overseas professional institutes so as to enhance their computing knowhow and investigation skills of computer crimes. Regular assessments are made on their performance, including their investigation skills, knowledge and awareness of technological development. The selection, training and assessment arrangements can ensure that law enforcement officers are competent in the investigation of computer crimes.
(d) Law enforcement departments will reserve adequate resources every year for the purpose of training officers responsible for computer forensic work, so as to ensure that they have the knowledge to tackle computer crimes. The relevant training programmes include collaboration with overseas law enforcement agencies in designing professional training courses on the investigation of computer crimes, arranging for law enforcement officers to receive relevant overseas training, and enhancing the exchange of computer forensic knowledge and skills with local professional institutes and the industry.
End/Wednesday, March 12, 2003
NNNN
