Interdisciplinary Centre for Finding, Understanding and Countering Crime in the Cloud

The Cambridge Interdisciplinary Centre for Crime in the Cloud (CICCC) will combine the diverse range of skills available in the Institute of Criminology, the Faculty of Law and the Computer Laboratory at the University of Cambridge. Our approach will be multidisciplinary, including researchers with expertise in computer science, criminology, cybersecurity, economics, psychology, forensics and law.
Our approach will be data driven. We have negotiated access to some very substantial datasets including large feeds of data such as spam email messages and technical information about the operation of cloud services from several major cloud providers and public bodies. Together, they will constitute the largest data resource available anywhere outside of classified systems on abuse online; we will have more, and more diverse, data than almost all service firms or law enforcement agencies, creating a unique opportunity for research to develop new tools for cloud crime detection and forensics.
We will mine and correlate these datasets to extract information about criminal activity. Our analysis will enhance our understanding of crime in the cloud, enable us to devise identifiers of such criminality, allow us to build systems to detect crime when it occurs, and ensure we collect evidence of wrongdoing to a high standard. We will work closely with law enforcement to ensure appropriate interventions can be undertaken.
Our overall objective is to create a sustainable and internationally competitive centre for academic research into cybercrime. The primary aim of the centre is to improve the security of users of cloud services, and to improve outcomes for those who would be affected by their misuse. We will develop a strong legal framework to operate in, and maintain high ethical standards in everything we do. We will incorporate this into APIs for abuse data sharing that support appropriate authentication, nonrepudiation and privacy mechanisms, and feed these back to the industry.
We aim to provide the police with an enhanced ability to search large amounts of data related to cybercrime in the cloud, improved forensics, better chain-of-custody mechanisms for evidence, additional training, and meaningful statistics on cybercrime. We have strong relationships with industry, and we will provide them with important data and insights on how, when and why criminality in the cloud occurs, thus enabling cloud providers to improve security for the users of cloud services by cracking down swiftly on abuse. We will also work closely with other academics, providing sanitised datasets to researchers generally, and enable trustworthy researchers access to our full dataset on the same basis as ourselves. This will solve the main problem faced by most academics who want to do research on cybercrime, namely the difficulty of getting access to real data on actual abuse.

Our project will have impact through four channels: law enforcement, industry, academia and to the public and policymakers generally.
We aim to develop better ways for academics and law enforcement to work together. We already have established relationships with UK and US law enforcement, having worked with SOCA in the past on tracking phishing, and with the Met on forensic tools to recover video from deleted files on mobile phones. We have an active collaboration with the US National Cyber-Forensics Training Alliance (which includes the FBI, Secret Service and various police forces).
One of the co-investigators directs the Cambridge Police Executive Programme, which has trained many chief constables and senior officers from forces worldwide. It attracts over 300 alumni and other participants to the annual Cambridge conference on Evidence-Based Policing and we will use this venue for impact. We will also disseminate our results through ACPO, whose cyber lead also heads up our regional cybercrime squad. From year three of the project, one of our research associates will focus on user engagement and will help the NCA, the Met and other police forces take on board not just our data but also the forensic tools and methodologies that we develop.
Industrial impact will be at least as important, and the service firms' big problems include how to share abuse data. At present some data is shared between key people on a basis of personal trust but this will not scale indefinitely. Our centre will start to fill that gap by providing a curated feed for sharing, rather than raw data; and by starting to develop the electronic infrastructure required. We will build on data-sharing APIs already under development by industry to provide, first, electronic signature mechanisms to assure the evidential value of data, and second, sanitized data based on a careful treatment of privacy issues, from the UK/EU, US and international viewpoints. We anticipate that this will be of sufficient value to the industry that by the end of year two we can start to attract serious industry financing and make the centre sustainable (independently of RCUK funding) by the end of year five. We will continue to work with industry security teams and the ad-hoc 'trust groups' as we have done for many years. We will continue to contribute data, code and intelligence to industry partners.
Cybercrime is moving rapidly up the political and news agenda with growing public concern that falling real-world crime is offset by rising crime online. This raises significant policy issues around the Home Office narrative of falling crime. It has also led to many media opportunities for the investigators, not just on UK TV and print media, but worldwide. Our public outreach and education activities will continue. If the grant is awarded to Cambridge we will have more results to talk about, and our media activities and expertise will enable us to maximise their impact.
Our earlier work on the costs of cybercrime demonstrated that most of these costs are indirect and stem from business foregone because of consumer reluctance to shop, bank or engage with government online, and because of defensive and clean-up costs, not all of which are appropriate. Better public appreciation of the real risks and costs is a public good, and it is also valuable to educate businesses generally about this topic. For example, our study showed that some 4% of offered transactions at UK e-commerce websites were declined because of alerts from fraud engines. Access by retailers to better fraud detection systems and methodologies can make a real contribution to the economy, not just by cutting rime, but by increasing sales.
Finally, we are active members of CSaP (Cambridge Science and Policy) which brings many senior civil servants to Cambridge on short visits. This will give us a channel to disseminate results to policy teams across Whitehall and in Brussels including to ministers.