Yet while the hacks themselves are big news, we don’t hear as much about the arrest and prosecution of online criminals in the headlines. In fact, the recent arrests made in response to the M&S breach were particularly notable in June because they felt like a rarity.
Although sophisticated cyber security tools do help to reduce organisations’ risk of suffering a breach, the fact is that hackers often remain elusive and unpunished when they do manage to penetrate a company’s defences.
So, why is it so difficult to catch and prosecute them? Here are some of the key reasons:
Anonymity and elusiveness
It’s fair to say that tracing the whereabouts of hackers is incredibly difficult. With a toolbox that includes VPNs, proxy servers, the Tor network and hijacked devices (botnets) to mask their locations and identities, cybercriminals can protect their location and keep law enforcement guessing.
Many operate under pseudonyms, use disposable email addresses or spoof IP addresses, too, which makes it incredibly difficult to trace the digital breadcrumbs back to a real-world individual.
Jurisdictional challenges
Cybercrime doesn’t respect borders. But in most cases, law enforcement agencies do have to abide by the limitations of their jurisdiction. This means that a hacker based in one country can attack systems in another, often routing traffic through multiple jurisdictions. This cross-border complexity makes it hard for law enforcement agencies to collaborate. Differences in laws, legal processes, and cooperation agreements between countries can delay or even block investigations – so in truth they find themselves fighting their opponents with one hand tied behind their back.
Lack of evidence
Unlike physical crimes, digital crimes leave behind data rather than fingerprints and tangible evidence. Any hacker worth his or her salt will frequently delete logs, encrypt communications and use malware that self-destructs to prevent the accumulation of any evidence that can be used against them.
Even when evidence is found, it may not be admissible in court if proper procedures weren’t followed during the investigation. The technical nature of the evidence can also make it hard to present clearly in legal proceedings.
Resource constraints
Law enforcement agencies are often under-resourced and outpaced by hackers. Cybercriminals can innovate and adapt faster than many public-sector institutions, spending much of their time looking for new and innovative ways to cause damage that police and security forces may not have seen before.
Inadequacies in the legal system
Laws related to cybercrime vary significantly between regions and, in some cases, there are legal grey areas or no laws to cater for a crime that has never taken place before. Certain types of hacking activities may not be clearly defined in older legislation, or the burden of proof may be extremely high. In some countries, state-sponsored hackers may even be immune from prosecution altogether.
For example, the Computer Misuse Act offences attributed to the latest arrests in relation to M&S and the Co-Op feel light touch, given that the former anticipates a total loss of £300 million from the breach and the Co-Op have revealed that the private details of 6.5 million customers have now been exposed.
Fear of retaliation or exposure
Even when victims know they’ve been hacked, there are many instances in which they might not report it. Fear of reputational damage, regulatory consequences or additional attacks often discourage companies from involving law enforcement. This under-reporting can hamper investigations and gives hackers more room to operate undetected.
Of course, the preferred course of action is to take steps to prevent a cyber security breach in the first place. While this is certainly easier said than done, there are many steps that can be taken to mitigate risk and make your organisation more resilient.
Want to know where to start? Why not get in touch with our dedicated cyber security team and let us help you get your defences in place. Contact us.
