Cybercrime , Cyberwarfare / Nation-state attacks , Fraud Management & Cybercrime

Police Say Data Sharing Alternatives 'Will Not Be as Efficient or Effective'(euroinfosec) • February 12, 2019    London Metropolitan Police headquarters at New Scotland Yard

British law enforcement officials say they're doing their best to cope with the possibility that the U.K. will crash out of the EU in 45 days.

See Also: Live Webinar: Building Secure Delivery Pipelines with Docker, Kubernetes, and Trend Micro

Police officers will be able to use Britain's new International Crime Coordination Center, a national unit that authorities on Monday said has become fully operational. But policing chiefs warn that the center will not be as effective as the existing arrangements that the U.K. enjoys as a member of the European Union, including access to the EU's law enforcement intelligence agency, Europol.

The ICCC has been training a network of officers across the country who will be assisting police on a local level to use new tools.

"We have been working closely with the Home Office to prepare for all eventualities including losing access to current EU law enforcement tools. We have contingencies in place for each of the EU tools but they are not like-for-like replacements and will not be as efficient or effective as the tools we currently use," says Deputy Assistant Commissioner Richard Martin, the London Metropolitan Police's chief lead on international policing.

Nation-state divorce was bound to be messy. But the full extent of what U.K. police will forfeit looks to be substantial. All told, British police could lose access to 40 tools when the U.K. exits the EU.

To help cope, the IPCC was launched in September 2018 with £2 million ($2.6 million) in funding from the Home Office. It's been tasked with creating the very British-sounding "alternative mechanisms" that the country will require when it leaves the EU, losing access to such crime-fighting tools as the European Arrest Warrant.

Plans for the ICCC call for it to have about 50 police and civilian employees drawn from the National Crime Agency - the U.K.'s sister domestic law enforcement agency to the FBI - and national Criminal Records Office. A spokesman for the National Police Chiefs' Council, which coordinates national police operations, tells Information Security Media Group that the center is now fully staffed and continues to train officers to help on a local level. "The network of officers will be fully ready by the end of this month or start of next month - though many already are," he says.

The original plans for the office were drawn up with a "hard Brexit" in mind, in which the U.K. would leave the single market and the customs union via a 21-month transition. During that time, the country would, in theory, negotiate new agreements, potentially including the ability to access some existing police resources, albeit likely in a reduced capacity (see: Brexit: What's Next for Privacy, Policing, Surveillance?).

Two Years Later

Last month, however, after two years of negotiations, including British threats to cancel security arrangements unless the EU gave it what it wanted, the House of Commons rejected by a historic margin Conservative Party Prime Minister Theresa May's deal with the EU.

Instead of a hard Brexit, the U.K. now continues to teeter on the edge of a no-deal Brexit.

If no deal is in place on March 29, "the U.K. would leave the EU and everything associated with that would come to an end," Simon Usherwood, a reader in politics at the University of Surrey, told i news.

"[No deal] doesn't stop the U.K. leaving but it means there is absolutely no clarity about what happens," he said.

May this week has returned to Brussels to continue the Brexit negotiations, demanding that the EU put a time limit, or "backstop," on a transition arrangement that would avoid a hard border between the Republic of Ireland and Northern Ireland.

But the EU's chief negotiator, Michael Barnier, says the EU will not renegotiate piecemeal the agreement and political declaration that has already been made, and he said that something must give on the U.K. side.

Meanwhile, Brexit remains scheduled to occur on March 29, whether or not May's government secures a deal that passes Parliament's muster.

Fallback Arrangements Are Manual

In the event of no deal, the EU will fall back onto existing Interpol arrangements, which are manual and would lead to a dramatic change in the speed of information access. For example, running criminal background checks on foreign nationals - to see if they have committed crimes in other countries - would jump from six days to an estimated 66 days.

"We are prepared for the worst-case scenario, as the public would expect," Martin says. "Forces will be ready to respond to the challenges a no-deal EU exit would bring but we continue to hope a deal that protects vital data-sharing and cooperation is reached - it is in the interests of both U.K. and EU citizens."

Tools at risk when the U.K. exits the EU include:

Schengen Information System: This EU-wide IT system enables member states to share real-time information about wanted or missing people. U.K. law enforcement officers accessed the database 539 million times in 2017. European Arrest Warrant: The EAW framework facilitates the extradition of suspects between EU member states to face prosecution. In 2017 and 2018, more than 1,400 suspects were arrested in the EU on an EAW and about 180 were returned to the U.K. Barnier has said the U.K. will lose all access to the EAW following Brexit. European Criminal Records Information System: ECRIS enables EU member states to exchange criminal conviction information. "Currently criminal record checks with member states take six days on average, whereas the average outside the EU is 66 days," according to the Met. Europol: The U.K. currently works closely with the other 27 EU member states via the EU's law enforcement intelligence agency, Europol, as well as its European Cybercrime Center, or EC3. Europol has coordinated a number of operations, including those related to cybercrime gangs and disruptions, and has notched up some impressive arrests in its relatively short existence. In 2017, the U.K. shared more than 47,000 messages with Europol and helped support over 130 investigation teams.

Martin has said that 70 percent of "transient organized crime groups" operate in three or more countries. But post-Brexit, cross-border policing operations would also be interrupted or operate at reduced capacity (see: Police Arrest €10 Million IOTA Cryptocurrency Theft Suspect).

Post-Brexit Policing Challenges

While these warnings might seem stark, they are not new.

In 2016, Steve Peers, a professor of law at the University of Essex who specializes in European Union law and human rights law, noted that in a best-case scenario, "Brexit is very likely to lead to a significant reduction on cooperation in criminal and policing matters between the U.K. and the EU." (See: Brexit Referendum: 5 Cybersecurity Implications)

With a Brexit deal, the U.K. would likely continue to work with Europol at a downgraded status, participating as an associate. In theory, it could also negotiate agreements with the EU that still allowed it to exchange data on alleged terrorists and other criminals, extradite suspects arrested in Europe to the U.K. and collaborate on cross-border arrangements.

In the event of a no-deal Brexit, however, it looks like few if any of those capabilities would be in place or at least accessible in a rapid manner. Whatever alternatives the ICCC creates also remain unproven.