third Cyber Security Assessment Netherlands - NCSC

Detailed section » 1 Cyber crime
»
1 Cyber crime
Cyber criminals are a relevant cause of cyber security
incidents. Organisations are affected by attacks, for
example executed using malware or DDoS. This creates
the impression that society is vulnerable in terms of IT.
Furthermore, individual citizens are increasingly falling
victim to cyber crime.
1.1 Introduction
Recent surveys on cyber crime in the Netherlands show that citizens
nearly as often fell victim to ‘hacking’ as they did to bicycle theft.
[47: Stol 2013]
The latter is so wide-spread in the Netherlands that it is
considered more of a nuisance than something the police can
effectively counter. This development means that the trust in safe
internet usage itself is in danger of being compromised. Therefore,
law enforcement is becoming increasingly important on the
internet. This is especially the case in areas where we see a shift
from the physical world to the cyber domain, such as digital
banking fraud replacing physical bank raids.
In the past year, there has also been a lot of media coverage
concerning cyber crime, i.e. criminal acts where IT is both means
and target of the crime committed. A few sensational cases attracted
a lot of attention. For example, the Groene Hart hospital suffered
great difficulties because a hacker was able to download patients’
medical records. During the reporting period, we saw a wave of
public attention for DDoS attacks on vital infrastructures. The press
also noticed that ransomware is becoming more professional and
intimidating. Even on mainstream media the Pobelka outbreak
spawned many a headline.
In the police domain the Dutch National High Tech Crime Unit
(NHTCU, or THTC in Dutch) is tasked at the national level with
combating complex, innovative and/or undermining forms of
cyber crime, often with a high impact on citizens or companies.
The NHTCU also houses the Electronic Crimes Taskforce (ECTF, see
box). The vast majority of cyber crime is not considered to be high
tech crime, therefore law enforcement in these cases is assigned
to the ten regional police units.
Electronic Crimes Taskforce – collaboration to combat digital
banking fraud
The Electronic Crimes Taskforce (ECTF) is a collaboration
between (among others) the four major banks in the country,
the Dutch Association of Banks (NVB), the National
Prosecutor’s Office (OM) and the police. This ‘banking team’
brings together information and expertise to prevent and
detect crime patterns. The team was formed to combat digital
banking fraud more effectively, specifically phishing and
banking malware. At the time of writing, ECTF was involved in
fifteen investigations into digital banking fraud. Since ECTF’s
start in 2011, more than one hundred suspects have been
arrested, including press gangs, money mules and corrupt
company employees.
1.2 Criminal actors
One distinguishing quality between cyber criminals is the level
of their knowledge and skills. The driving force behind new
developments in the area of cyber crime is a relatively small group
of specialists within the entire collection of perpetrators. They have
an exceptionally high level of knowledge and expertise, enabling
them to develop sophisticated attacks.
Closed criminal networks include increasing numbers of hardened
professionals. Today’s cyber criminals operate internationally and
appear to be increasingly associated with organised crime offline.
Because concealment is paramount to their activities, it is impossible
to estimate the number of cyber criminals that are active.
Cyber criminals do not generally act alone: they communicate,
mostly online, in order to exchange tactics and to use one another’s
expertise and tools. This collaboration also enables criminals
to specialise in a specific aspect of the criminal process. More and
more, criminals are using tools like Tor, allowing them to surf the
internet anonymously, and for payment they utilize virtual
currencies that do not require identification, such as bitcoins.
Besides professional cyber criminals, so-called script kiddies are
increasingly causing damage to society. These unskilled hackers,
who have limited technical knowledge and no realistic insight into
their actions, are generally using techniques and tools devised and
developed by other people.
A final group of relevant actors are the facilitators, who are
intentionally or unintentionally providing the services that are
being used to commit cyber crime. Thus, these facilitators contribute
to the Netherlands having become a transit country for cyber
crime. As regards facilitators, the NHTCU primarily aims at hosting
providers and virtual payments processors. Legitimate providers
55