- Email: [email protected]
Fraud investigation — A perspective on the role of the police
THE C O M P U T E R LAW A N D S E C U R I T Y R E P O R T
Accountant ensures that accounting and other investigative expertise is included in the team as appropriate. Police officers are allocated to the case and adequate support staff provided, including an experienced law clerk to act as Case Secretary. In addition, when it is felt necessary, outside expertise is sought (for example in banking or computer technology). Finally, Counsel may well be brought into a team at an early stage, if this seems desirable. Teams regularly exchange information on policies and practice, in order to ensure consistency, and pass on their experience to one another. Individual members will be encouraged to develop expertise in specific types of fraud. The SFO also maintains close working relationships with the Securities and Investments Board, the Stock Exchange, the Panel on Takeovers and Mergers and the Bank of England, among others. When such a body has an interest in a case, the Serious Fraud Office will normally keep it informed of progress, in order to help it in its own regulatory functions.
The role of the police The constitutional position of the police, their accountability and their command and control structure remain unchanged by the establishment of the SFO or by attachment to it. The responsibility for investigating serious or complex fraud is shared by the Director of the SFO and the police, but their respective powers are designed to complement each other rather than overlap. The police retain all their powers under the Police and Criminal Evidence Act 1984 and are subject to that Act's Codes of Practice. Warrants for search and seizure are executed by the police, although a member of the SFO accompanies the police where practicable, in order to help identify documents. Members of the Serious Fraud Office itself have no powers of arrest or search. Officers from the Metropolitan and City police forces who are attached to the Serious Fraud Office are located at the SFO. Officers from other forces may be attached to the SFO from time to time, either for general experience, or to work on specific cases that have arisen in their own force area. They will then be located in that area or in London as occasion demands. The powers of the SFO The Director of the Serious Fraud Office has extensive investigative powers. These may be delegated to others within or outside the SFO (other than the police) to investigate the affairs of any person. The Director, or any designated person, may serve a written notice to the person under investigation, or to anyone believed to have relevant information, requiring them to answer questions and/or produce documents. Copies may be taken of documents and explanations sought. The SFO can also apply to a magistrate for a warrant authorising a constable to enter and seize documents. It is a criminal offence to fail to comply with the SFO requirement, to give false or misleading statements, or to destroy or conceal relevant material. These offences are punishable by imprisonment or a fine or both. The Director of the SFO has considerable power to disclose relevant information to other bodies involved in the control of fraud, to disciplinary bodies and to enforcement agencies overseas. However, there are some statutory restraints on disclosure, and information will always be handled with discretion. Referral of cases to the SFO The police remain the primary channel for complaints of serious fraud. Members of the public who wish to refer a case,
1 CLSR
or pass on information on serious fraud, which they think may be of interest to the SFO should always notify the police in the relevant force area initially, and - if they wish - any appropriate regulatory body. Other agencies tackling fraud should also refer cases to the police, unless an official, direct channel of communication with the SFO has been set up. (This has already been arranged with a number of the major agencies dealing with fraud). Cases should normally meet one or more of the three fundamental criteria mentaioned above in the section on Selection of the cases. People who are in serious doubt about a particular case may telephone the SFO, or the police officers working with it, to ask for initial advice. They can then find out whether the case is likely to be taken on by the SFO before submitting the full papers for consideration by the Director. Given the importance of speed in tackling complex cases of fraud, the sooner any enquiries are made, the better.
The current address of the Serious Fraud Office is: Keysign House 421-429 Oxford Street LONDON WIR 2LA Telephone: 01-499 3355 Fax (non-secure): 01-629 4702 From the end of July 1988, the address of the SFO will be: Elm House Elm Street LONDON WCIX DBJ (Telephone and Fax currently unknown. Please use old numbers for the time being). Susan Street, Serious Fraud Office
o0o
FRAUD INVESTIGATION A p e r s p e c t i v e o n t h e role o f t h e P o l i c e It is an unfortunate fact that business as a whole has little confidence in the ability of the Police Fraud Squads to investigate and aid in the successful prosecution of those who are accused of computer fraud or abuse. This overall lack of confidence is hardly surprising when one considers the limited experience the Police have in such matters and the complexity of some of the crimes that undoubtedly occur. The victims of fraud or computer abuse also have only limited faith in the judicial system to comprehend the manner in which the alleged crime occurred and if proven, to enforce levels of sentence which reflect the seriousness of the matter. For example, the Scotland Yard Fraud Squad recently deployed significant ingenuity and manpower in trapping an ATMS fraudster whose targets were two building societies. The fraud itself was a simple operation that relied on a credit window being opened over Christmas and Easter holiday periods. The investigation and final arrest were not so easy and involved the use of computer technology and several arrest teams positioned to cover the whole of London. On conviction of the criminal on two charges of conspiring to steal the sentence imposed was 30 months imprisonment. The police were said to be "very disappointed and angry" with the penalty. Clearly they felt the seriousness of the crime has not been recognised by the court. In the United States it is estimated that for each $100,000 that
MAY - JUNE
is fraudulently obtained the convicted criminal will receive a prison sentence of one month. However, the same individual stealing $100 by holding up a drugstore armed with a gun will probably receive a minimum prison sentence of 10 years. The intricacies of a conventional fraud or embezzlement are difficult to explain, in detail that can be easily understood, to a judge and jury who are not qualified and experienced accountants. The complexities of an electronic crime are perhaps even more perplexing and incomprehensible to those who are unfamiliar with "Computerspeak", or with the operation of computers that may participate in a global network computing millions of transactions per hour. Even computer professionals could find themselves overwhelmed by the quantity of evidence submitted by prosecuting and defence counsel. Is it any wonder there is so little faith? Sir Frederick Lawton, a retired Court of Appeal judge, has called for an end to trial by jury in complex fraud cases. Sir Frederick told the International Bar Association conference in London: "The modern large scale swindle, with its field of
operation extending over many jurisdictions, is difficult enough for experienced judges to try, and probably impossible for a jury drawn at random from the electoral role." He said that trial by a single judge would probably not be acceptable to the British public, but three judges or one judge sitting with commercial assessors might be. Abolition of juries in complex cases was proposed by the Roskill Committee on fraud trials but shelved by the Government after bitter opposition. In many cases of fraud, be it computer or otherwise, Police called in to investigate are often regarded as a debt collection agency by the Company that has been defrauded. They presume that Police pressure will encourage the alleged culprit to pay back the proceeds of the illicit activity. This is clearly not the role that the Fraud Squads should be expected to play and neither will they do so. Their true role is to investigate to ascertain if an offence has been committed. Evidence will be collated and submitted to the Director of Public Prosecutions who will then decide whether a case can be brought against the alleged offender. It should be noted that some law is not defined by legislation in either civil or criminal law. The decision to prosecute will depend not only on the perception of a law being broken but also on the quality of the evidence that supports it. If the Police are unable to provide sufficient and satisfactory evidence then the probability of a successful prosecution is negligible. In a recent case heard in the Isleworth Crown Court the Judge ruled that the accused had no case to answer in respect of the four charges of criminal damage and one of attempted criminal damage. This case was one of the first of its kind to be heard in a Crown Court in which an act of criminal damage was alleged by the insertion of a code into a program and a disk. The Judge presiding instructed the jury to acquit the accused because the evidence against him was unsatisfactory. This decision was made by the judge after a four and a half week trial.
THE COMPUTER LAW AND SECURITY REPORT
individuals. The public also tend to imagine that those convicted of fraudulent crimes of any description are Robin Hood types who have taken on the "system" and won. Because violence is rarely used in cases of fraud and no material damage is perceived to be inflicted on an individual or property, the fraudster is imagined as being rather a "gallant" type of character. In cases of computer fraud it is normally the corporate entity that is the loser and not individuals. The fact that a company may cease to trade as a result of losses incurred by fraud and therefore its staff are deprived of their livelihood never crosses the mind of the man in the street. Even if such thoughts did occur the human trait of selfishness ("well it didn't affect me") would win the day. Computer crime is a new area of crime that our fraud squads are having to come to terms with. Historically they have had involvement with other types of fraudulent activity that include trading, advertising, international directory and charity frauds. Investigations into these illegal activities are conducted by very limited resources yet again. In many areas of the country no computer or information technology frauds have been reported for investigation to the Police though from the limited statistics available such crimes are experiencing very rapid growth in all business activities. We must accept that if such crimes continue to go unreported to the Police we can hardly blame them for their lack of experience in dealing with such events. Company management who use the excuse that have no confidence in the force's ability to bring about successful prosecutions are misleading themselves and others. The more likely reason for non-disclosure is that they cannot afford the corporate or individual loss of credibility that would result from the publication of details pertaining to the fraud. Directors and Officers could also be seen to be admitting their own loss of control and therefore could be the target for legal action brought by a shareholder who felt he had suffered a direct or indirect loss in the value of his investment due to weak management control. Companies and management that take the stance of nondisclosure are making rods for their own backs. They must realise that they cannot call the police in to investigate one instance of fraud and not another. The precedent they need to set would involve the police in all cases of suspicion of fraudulent activity. The boardroom power cells should view white collar crime, which most fraud is, in the same light as any other offence, eg stock theft, which would normally be a dismissable offence and lead to the involvement of a police investigation. Until such time as Company management and the general public alike recognise fraud to be a serious crime and the law is amended to remove some of the obstacles to obtaining prosecution of the culprit and recompense for the victim, we cannot expect our fraud squads to be able to support and protect us from the wave of information technology crime that is sweeping over us. Sir Yvo Henniker-Heaton, Report Correspondent
Manpower Resources The manpower resources and training facilities available to the Fraud Squads are limited to say the least. In one large British city we know of only one officer who has undergone even the most rudimentary training in computer fraud method and detection techniques. Resource allocation is largely governed by the fact that the public as a whole do not treat fraudulent crimes seriously and they feel that Police manpower should be directed to combating other areas of criminal activity which the public see as threatening them as
A FRAUD SQUAD OFFICER'S VIEW Whilst the policy of sentencing fraudsters generally has sometimes been regarded by the police with a jaundiced eye, vis-a-vis leniency versus investigative effort, other issues such as addressing the advancement of information technology are being tackled in a positive and innovative fashion. There has been a concerted effort towards the specialised training needs of fraud squad officers, some of whom attend a Computer Crime Investigation Techniques Course at the
Accountant ensures that accounting and other investigative expertise is included in the team as appropriate. Police officers are allocated to the case and adequate support staff provided, including an experienced law clerk to act as Case Secretary. In addition, when it is felt necessary, outside expertise is sought (for example in banking or computer technology). Finally, Counsel may well be brought into a team at an early stage, if this seems desirable. Teams regularly exchange information on policies and practice, in order to ensure consistency, and pass on their experience to one another. Individual members will be encouraged to develop expertise in specific types of fraud. The SFO also maintains close working relationships with the Securities and Investments Board, the Stock Exchange, the Panel on Takeovers and Mergers and the Bank of England, among others. When such a body has an interest in a case, the Serious Fraud Office will normally keep it informed of progress, in order to help it in its own regulatory functions.
The role of the police The constitutional position of the police, their accountability and their command and control structure remain unchanged by the establishment of the SFO or by attachment to it. The responsibility for investigating serious or complex fraud is shared by the Director of the SFO and the police, but their respective powers are designed to complement each other rather than overlap. The police retain all their powers under the Police and Criminal Evidence Act 1984 and are subject to that Act's Codes of Practice. Warrants for search and seizure are executed by the police, although a member of the SFO accompanies the police where practicable, in order to help identify documents. Members of the Serious Fraud Office itself have no powers of arrest or search. Officers from the Metropolitan and City police forces who are attached to the Serious Fraud Office are located at the SFO. Officers from other forces may be attached to the SFO from time to time, either for general experience, or to work on specific cases that have arisen in their own force area. They will then be located in that area or in London as occasion demands. The powers of the SFO The Director of the Serious Fraud Office has extensive investigative powers. These may be delegated to others within or outside the SFO (other than the police) to investigate the affairs of any person. The Director, or any designated person, may serve a written notice to the person under investigation, or to anyone believed to have relevant information, requiring them to answer questions and/or produce documents. Copies may be taken of documents and explanations sought. The SFO can also apply to a magistrate for a warrant authorising a constable to enter and seize documents. It is a criminal offence to fail to comply with the SFO requirement, to give false or misleading statements, or to destroy or conceal relevant material. These offences are punishable by imprisonment or a fine or both. The Director of the SFO has considerable power to disclose relevant information to other bodies involved in the control of fraud, to disciplinary bodies and to enforcement agencies overseas. However, there are some statutory restraints on disclosure, and information will always be handled with discretion. Referral of cases to the SFO The police remain the primary channel for complaints of serious fraud. Members of the public who wish to refer a case,
1 CLSR
or pass on information on serious fraud, which they think may be of interest to the SFO should always notify the police in the relevant force area initially, and - if they wish - any appropriate regulatory body. Other agencies tackling fraud should also refer cases to the police, unless an official, direct channel of communication with the SFO has been set up. (This has already been arranged with a number of the major agencies dealing with fraud). Cases should normally meet one or more of the three fundamental criteria mentaioned above in the section on Selection of the cases. People who are in serious doubt about a particular case may telephone the SFO, or the police officers working with it, to ask for initial advice. They can then find out whether the case is likely to be taken on by the SFO before submitting the full papers for consideration by the Director. Given the importance of speed in tackling complex cases of fraud, the sooner any enquiries are made, the better.
The current address of the Serious Fraud Office is: Keysign House 421-429 Oxford Street LONDON WIR 2LA Telephone: 01-499 3355 Fax (non-secure): 01-629 4702 From the end of July 1988, the address of the SFO will be: Elm House Elm Street LONDON WCIX DBJ (Telephone and Fax currently unknown. Please use old numbers for the time being). Susan Street, Serious Fraud Office
o0o
FRAUD INVESTIGATION A p e r s p e c t i v e o n t h e role o f t h e P o l i c e It is an unfortunate fact that business as a whole has little confidence in the ability of the Police Fraud Squads to investigate and aid in the successful prosecution of those who are accused of computer fraud or abuse. This overall lack of confidence is hardly surprising when one considers the limited experience the Police have in such matters and the complexity of some of the crimes that undoubtedly occur. The victims of fraud or computer abuse also have only limited faith in the judicial system to comprehend the manner in which the alleged crime occurred and if proven, to enforce levels of sentence which reflect the seriousness of the matter. For example, the Scotland Yard Fraud Squad recently deployed significant ingenuity and manpower in trapping an ATMS fraudster whose targets were two building societies. The fraud itself was a simple operation that relied on a credit window being opened over Christmas and Easter holiday periods. The investigation and final arrest were not so easy and involved the use of computer technology and several arrest teams positioned to cover the whole of London. On conviction of the criminal on two charges of conspiring to steal the sentence imposed was 30 months imprisonment. The police were said to be "very disappointed and angry" with the penalty. Clearly they felt the seriousness of the crime has not been recognised by the court. In the United States it is estimated that for each $100,000 that
MAY - JUNE
is fraudulently obtained the convicted criminal will receive a prison sentence of one month. However, the same individual stealing $100 by holding up a drugstore armed with a gun will probably receive a minimum prison sentence of 10 years. The intricacies of a conventional fraud or embezzlement are difficult to explain, in detail that can be easily understood, to a judge and jury who are not qualified and experienced accountants. The complexities of an electronic crime are perhaps even more perplexing and incomprehensible to those who are unfamiliar with "Computerspeak", or with the operation of computers that may participate in a global network computing millions of transactions per hour. Even computer professionals could find themselves overwhelmed by the quantity of evidence submitted by prosecuting and defence counsel. Is it any wonder there is so little faith? Sir Frederick Lawton, a retired Court of Appeal judge, has called for an end to trial by jury in complex fraud cases. Sir Frederick told the International Bar Association conference in London: "The modern large scale swindle, with its field of
operation extending over many jurisdictions, is difficult enough for experienced judges to try, and probably impossible for a jury drawn at random from the electoral role." He said that trial by a single judge would probably not be acceptable to the British public, but three judges or one judge sitting with commercial assessors might be. Abolition of juries in complex cases was proposed by the Roskill Committee on fraud trials but shelved by the Government after bitter opposition. In many cases of fraud, be it computer or otherwise, Police called in to investigate are often regarded as a debt collection agency by the Company that has been defrauded. They presume that Police pressure will encourage the alleged culprit to pay back the proceeds of the illicit activity. This is clearly not the role that the Fraud Squads should be expected to play and neither will they do so. Their true role is to investigate to ascertain if an offence has been committed. Evidence will be collated and submitted to the Director of Public Prosecutions who will then decide whether a case can be brought against the alleged offender. It should be noted that some law is not defined by legislation in either civil or criminal law. The decision to prosecute will depend not only on the perception of a law being broken but also on the quality of the evidence that supports it. If the Police are unable to provide sufficient and satisfactory evidence then the probability of a successful prosecution is negligible. In a recent case heard in the Isleworth Crown Court the Judge ruled that the accused had no case to answer in respect of the four charges of criminal damage and one of attempted criminal damage. This case was one of the first of its kind to be heard in a Crown Court in which an act of criminal damage was alleged by the insertion of a code into a program and a disk. The Judge presiding instructed the jury to acquit the accused because the evidence against him was unsatisfactory. This decision was made by the judge after a four and a half week trial.
THE COMPUTER LAW AND SECURITY REPORT
individuals. The public also tend to imagine that those convicted of fraudulent crimes of any description are Robin Hood types who have taken on the "system" and won. Because violence is rarely used in cases of fraud and no material damage is perceived to be inflicted on an individual or property, the fraudster is imagined as being rather a "gallant" type of character. In cases of computer fraud it is normally the corporate entity that is the loser and not individuals. The fact that a company may cease to trade as a result of losses incurred by fraud and therefore its staff are deprived of their livelihood never crosses the mind of the man in the street. Even if such thoughts did occur the human trait of selfishness ("well it didn't affect me") would win the day. Computer crime is a new area of crime that our fraud squads are having to come to terms with. Historically they have had involvement with other types of fraudulent activity that include trading, advertising, international directory and charity frauds. Investigations into these illegal activities are conducted by very limited resources yet again. In many areas of the country no computer or information technology frauds have been reported for investigation to the Police though from the limited statistics available such crimes are experiencing very rapid growth in all business activities. We must accept that if such crimes continue to go unreported to the Police we can hardly blame them for their lack of experience in dealing with such events. Company management who use the excuse that have no confidence in the force's ability to bring about successful prosecutions are misleading themselves and others. The more likely reason for non-disclosure is that they cannot afford the corporate or individual loss of credibility that would result from the publication of details pertaining to the fraud. Directors and Officers could also be seen to be admitting their own loss of control and therefore could be the target for legal action brought by a shareholder who felt he had suffered a direct or indirect loss in the value of his investment due to weak management control. Companies and management that take the stance of nondisclosure are making rods for their own backs. They must realise that they cannot call the police in to investigate one instance of fraud and not another. The precedent they need to set would involve the police in all cases of suspicion of fraudulent activity. The boardroom power cells should view white collar crime, which most fraud is, in the same light as any other offence, eg stock theft, which would normally be a dismissable offence and lead to the involvement of a police investigation. Until such time as Company management and the general public alike recognise fraud to be a serious crime and the law is amended to remove some of the obstacles to obtaining prosecution of the culprit and recompense for the victim, we cannot expect our fraud squads to be able to support and protect us from the wave of information technology crime that is sweeping over us. Sir Yvo Henniker-Heaton, Report Correspondent
Manpower Resources The manpower resources and training facilities available to the Fraud Squads are limited to say the least. In one large British city we know of only one officer who has undergone even the most rudimentary training in computer fraud method and detection techniques. Resource allocation is largely governed by the fact that the public as a whole do not treat fraudulent crimes seriously and they feel that Police manpower should be directed to combating other areas of criminal activity which the public see as threatening them as
A FRAUD SQUAD OFFICER'S VIEW Whilst the policy of sentencing fraudsters generally has sometimes been regarded by the police with a jaundiced eye, vis-a-vis leniency versus investigative effort, other issues such as addressing the advancement of information technology are being tackled in a positive and innovative fashion. There has been a concerted effort towards the specialised training needs of fraud squad officers, some of whom attend a Computer Crime Investigation Techniques Course at the