Four black brick towers search upwards to an empty grey sky. Mounted security cameras watch on balefully. If it weren’t for all the cheery cyclists passing by, some with surfboards in hand, alleviating the unfaltering graveness of the place, Europol’s headquarters would strike any visitor as some post-apocalyptic Mordor.
The interior, though, is more modern art museum than Kafkaesque bureaucracy. Expressionist paintings line the walls, clean cut modernist marble and pane upon pane of glass reflect the white light pouring in from outside. It’s all very plush. I’m told there’s a sauna somewhere around too.
A charming PR officer takes me up one of the towers, having her palm scanned at the entrance of Europol’s European Cybercrime Centre (EC3). Troels Oerting, who heads up the unit, greets me with a heart pressure monitor disconcertingly attached to his hip. I daren’t ask. After all, we’re here to talk about EC3’s role in the global fight against digital crime, whilst getting a tour of the team’s vast facilities.
And vast they are, covering five floors where the EC3, founded just over a year ago, deals with three different kinds of illicit activity: online child exploitation, credit card fraud, and cyber crime services, traditionally offered by organised gangs offering hackers-for-hire or doing it themselves for their own profit.
We pass the rooms where those unenvious men and women trawl through hours of child abuse images and video footage online. Oerting, a former Danish police officer, doesn’t lead me through those darkened doors.
Then we head to the breakout rooms, where law enforcement agents from across the world come together, either in person or virtually, to tackle urgent cases. Souped-up workstations, mounted screens and videoconferencing gear fill the space. We interrupt three individuals having what appears to be a rather serious discussion in one of the meeting areas. “He’s a journalist,” Oerting says. “Thanks for warning us,” one of the team replies. We move swiftly on.
An “unbreakable” door protects the EC3’s data centre, where all the servers powering worker systems can be found, alongside storage systems holding valuable case data, hidden away from any potential crook who manages to get through the hand scanners and security guards at the front gate. A little lab, where malware and other illicit virtual goods are analysed, is protected by two reinforced doors.
There are bedrooms and shower facilities too, for when agents decide they need to stick around in case of any sudden call for action. Though they look like Ikea-funded prison cells, they’re useful for when investigations suck up officers’ time.
In this together
The forensics room, a Faraday cage where no outside interference can penetrate the walls, is a clinical little area, panels emitting light from almost every corner of the room, helping those tinkering with suspects’ hardware obtain evidence. “A lot of the times these criminals will stamp on their smartphones,” Oerting says, giving me a demonstration of how one might do just that. “But it doesn’t matter, we can still find stuff [on the devices].”
Amongst the 70 workers here, one is an FBI agent, whilst an officer from the UK National Crime Agency’s cyber unit will be joining the team soon. Oerting has a soft spot for the UK, largely because of its regimented approach to tackling all kinds of illicit activity. “What the UK is good at, and I think it's because they are an old empire, and what I admire about the UK, is that you sit down, you make a strategy and you follow it.
“The UK, even being EU-sceptical, knows that if there is one thing you can't border yourself from it’s cyber crime ... the UK has seen we need to do this together.”
Oerting wants to welcome police and other forensics investigators from across the world, as part of EC3’s mission to act as a hub for cyber sleuths looking into the most egregious of online crimes. One year into its existence, its efforts to foster collaboration have received plaudits from the industry.
“Not only has there been greater collaboration with law enforcement agencies worldwide, but the development of the advisory boards and their collaboration with the private sector shows the value of the public-private partnership. Building upon the collaborative nature of the centre is critical in the fight against cybercrime, and one that I feel EC3 has already demonstrated great success to date,” says Raj Samani, CTO for security firm McAfee in EMEA and a cyber crime adviser for Europol.
From Russia with little love
Yet it’s clear all is not well when it comes to cyber relations between nations. Working with non-EU members such as Russia, where digital crime is rife, is far from straightforward.
Collaborating with Putin’s cyber police is only going to get more difficult thanks to the standoff with Ukraine. Not only would Ukraine have been a useful addition to the EC3 membership, given the level of unlawful online activity in nations of the old Soviet Union, but Russia had started showing signs of greater cooperation, Oerting says. That progress looks likely to be put on hold, possibly indefinitely, especially with the sanctions being imposed by Europe and the US.
“Russia is going through some things that will probably not boost our cooperation,” he says. “85 per cent of our cases are Russian-speaking organised cyber groups, so we need to cooperate with these colleagues ... but that's right now a bit complicated.”
Countries where cyber criminals host their operations also tend to be those nations that do not have extradition agreements with Western powers. Trying to convince non-EU member states or those that don’t have information sharing agreements to make arrests is “very cumbersome”, Oerting notes.
The leaks of Edward Snowden are also causing EC3 grief. Companies are now less willing to share data, even if it clearly relates to criminal activity, as noted in a previous Guardian report. “We will of course see the unintentional downside of this,” the EC3 chief says. “Companies are much more cautious than they used to be.”
Cops losing to robbers
And despite all the money invested in digital policing, Oerting believes the criminals are still winning. The profits are high and the risk is low. Take Cryptolocker, one of last year’s most damaging threats. Known as ransomware, it encrypted users’ data and demanded money from users (usually around 0.3 Bitcoins, currently worth around £110) to unlock the infected system. It infected at least 250,000 machines in 2013. “It's a money machine. My experts tell me, ‘Troels, if you have 15,000 euros, you invest them here, in one week you will break even, in three months, you have 500,000 euros’.”
On the underground forums, where many of EC3’s agents operate undercover, it’s become apparent just how grand the spoils have become for successful cybercriminals. In one case, officers came across a competition: the person who obtained the largest amount of money through a particular scam would win a Ferrari.
Globally, police have not done a good enough job of deterring online crime, admits Oerting. Right now it is “too easy and risk free”. Legislative issues need to be overcome if law enforcement agencies are to offer real deterrents – a message Europol is spreading amongst European mandarins.
Oerting’s boss, Europol director Rob Wainwright, this month called on MEPs and national parliamentarians for "a fair deal from legislators in giving national and international police authorities the right tools to confront dangerous new forms of organised crime appearing online". Oerting and Wainright are concerned digital sleuths have not been given the same powers as their “real world” counterparts.
“In the physical world, I'm a cop, and according to Danish rules I am empowered to stop people, to frisk them, to arrest them and take away their freedom for 24 hours. I can take them without asking a judge. I can go to their home and [search] there. And I can eventually use force against them and in the end I can kill people,” Oerting says.
“But if I want just half the same powers on the internet, everybody screams.”
Time to hack back?
More aggressive measures may be required. Legislation should look at speeding up the process of cross-border obtaining evidence, Oerting adds. “Laws have a geographical limitation. If the Dutch or the Danes are looking at a case, they can only go to the border of this case if the server is in another country. How much will we allow this to be done? The security companies don't ask, they just penetrate and get the information, it doesn't matter where it is located. And if the door isn't open they will make sure it will open. We stop and say this server is not physically located on our territory, and we are not allowed to do anything."
“Our mutual legal assistance process is not sufficient anymore. There is a big need for speeding up the judicial cooperation. One thing is that police cooperation needs speeding up, but also the judicial because [I cannot obtain evidence].”
This may even stretch to “hacking back”, something Dutch politicians have been discussing. This would permit intrusion of servers across borders. Oerting believes this will one day become a reality, it’s just a matter of timing. “Now, when we have Snowden in fresh memory, how do you then persuade somebody that it's needed for someone in law enforcement to make intrusions?"
“I can see it will come ... but we will probably have to wait until there are bodies at the table.”
The concept of hacking back sounds a bit bellicose. Yet visitors to Europol will note the International Criminal Tribunal for the Former Yugoslavia just next door. That’s where Ratko Mladic is standing trial over orchestrating the massacre of more than 7,000 Bosnian Muslim boys and men. For all the current hyperbole around digital attacks, we should be thankful it has not brought about the horrors often delivered by real-world crime. Oerting and his team are hoping to keep it that way.
