Firms trying to crack down on cybercrime

Last week, an e-mail entitled "account suspension" appeared in my inbox

Last week, an e-mail entitled "account suspension" appeared in my inbox. The e-mail was from my bank, or so it seemed, informing me that my online account had been suspended as it "may have been compromised".

I was invited to click on a link to the bank's website to reactivate my account. Instead, I rang my bank's helpline. They insisted they never sent e-mails of this nature to customers and warned me not to click on any links or attachments.

It turns out I was the target of a "phishing" attack - where the e-mail recipient is directed to an elaborate fake website, designed to capture the person's confidential information (such as their PIN) so criminals can access their account and withdraw money.

Luckily, the "phishers" didn't get this far in my case, but the incident was a sharp reminder of, as Minister for Justice Michael McDowell put it last week, "the dark side of the internet".

READ MORE

Most Irish firms are reliant on computer systems and the internet to conduct their business, and they too are susceptible to cybercrime. While the term may sound futuristic and a bit sci-fi, cybercrime is a growing problem and one that businesses can no longer afford to ignore.

The boundaries are expanding all the time, as cyber-criminals devise more and more sophisticated scams, but essentially cybercrime refers to the use of computers and networks to carry out criminal activities.

Until now, international studies such as the CSI/FBI Computer Crime Survey in the US have been relied on to draw conclusions on the extent of cybercrime activity in Ireland. Now, for the first time, a survey of Irish businesses has been carried out by UCD, providing hard evidence of the impact of cybercrime on them.

It turns out it is a problem for nearly every Irish business, with 98 per cent of respondents indicating that they have experienced cybercrime.

Computer viruses were found to be the most common issue, while more than half of the respondents experienced phishing.

Other common crimes included asset theft (for example, laptops being stolen) and confidential data being leaked.

Bullying and harassment by e-mail and other messaging systems also featured strongly and can constitute a criminal offence.

However, in this study, the researchers also classed the misuse of computer systems as a form of cybercrime. This includes activities such as employees surfing the web at work, even though this clearly isn't a criminal activity.

Most people would be of the opinion that spending a few minutes of company time online researching holiday destinations, booking flights or e-mailing friends is pretty harmless.

But according to this study, almost 90 per cent of companies complained about the loss of productivity as a result of cybercrime, including such misuses of their computer systems.

The survey states clearly that cybercrime has become a costly problem for Irish organisations.

More than one in five companies estimate that their most serious cybercrime incident so far has set them back more than €100,000.

Despite the potential costs of cybercrime, however, it seems that companies here have not yet got to grips with detecting incidents of security breaches, relying more on luck than a formal detection strategy. Many respondents indicated that accidental detection and reporting by non-IT employees were the most common means of detection, rather than proactive measures such as routine IT checks or internal audits.

What should companies do if and when they discover a security breach or misuse of their computer systems? It is up to the employer to decide, and many have been cracking down harshly on any incidents of cybercrime.

For example, investment bank Merrill Lynch fired 13 Irish employees last year who were found to be transmitting offensive e-mails.

Indeed almost 40 per cent of respondents said that they had fired employees, or that staff had resigned, as a result of an internal cybercrime investigation.

Very few companies actually report cybercrime incidents to law enforcement bodies, even in cases where employees are breaking the law, for example downloading illegal content from the internet.

This reluctance to report cybercrime could be due to concerns surrounding confidentiality and negative publicity. But in the long run, involving the computer crime unit of the Garda may be necessary to win the war against cybercrime.