One year on from the scrapping of the Confidentiality Charter that let businesses report IT crime in confidence directly to the police, new research by the organisers of the Infosecurity Europe event has revealed that a third of corporate IT security breaches in the UK currently go unreported.
Many of the respondents said they were unsure which crimes are worth reporting, while others chose not to alert the police for fear of brand damage. This concern is likely to have been heightened by the recent example of clothing retailer TK Maxx, which was obliged by US laws to reveal that the card details of almost 46 million customers worldwide had been compromised by a computer security breach.
Jonathan Coad, a media specialist at law firm Swan Turton, said newsworthy breaches are often leaked to the press. “Reporting crime to the police is a double-edged sword as invariably the press has found out about the incident within 24 hours,” he said.
Coad’s comments highlight the loss of the Confidentiality Charter, a consequence of the absorption last April of the National Hi-Tech Crime Unit into the Serious Organised Crime Agency (Soca). The charter was established to encourage more open IT crime reporting by guaranteeing privacy for businesses and offering them a direct link to the e-crime unit.
That was a very different approach to the one adopted by many US states, which have introduced legislation to force firms to go public with breaches affecting the safety of customer data.
Mark Watts, IT partner at law firm Bristows, said that firms might be wise not to disclose information on breaches too early. “In the US we are already seeing ‘breach fatigue’ where consumers are faced with so many notifications they find it difficult to weed out the important ones,” he explained. “Firms should look at the incident and decide if there is a real prospect of data theft. If there is not, why worry consumers?”
Ollie Ross, head of research at user group The Corporate IT Forum, said the reluctance of corporate victims to report IT crime means much of it goes unresolved. “But as the TK Maxx incident has demonstrated, the stakes are very high,” he added.
However, Maxine Holt of analyst firm Butler Group argued that corporate victims not reporting crimes “is of no use to anybody”.
Last week Computing highlighted dangerous gaps in the UK’s response to e-crime 01 Feb 2007
Computer crime policing needs to be demystified 02 Nov 2006
House of Lords Committee says a national cyber crime strategy is crucial 05 Apr 2007
Lower-value incidents overlooked by local forces, say businesses 01 Mar 2007
Fewer than one in four forces can generate computer crime reports 02 Nov 2006
CVs and personal data compromised 26 Oct 2009
Unit has wider crime-prevention role, says home secretary 15 Jul 2009
Another victory for the Met's central e-crime unit 16 Nov 2009
Government announces extra £4.8m to support offshore wind R&D 18 Mar 2010
Secretary-General and climate envoy cross swords over the extent to which UN talks should be supported by separate negotiations between top polluters 18 Mar 2010
Price collapses to €1 as previously surrendered CERs surface on European exchange 18 Mar 2010
More news
Andrew Williams casts his eye over some of the most popular green driving aids on the market 16 Mar 2010
From hydropower hot spots to record-breaking Texan winds, we run down the top stories from the past week 12 Mar 2010
Few debates cast the UK's business and political community in such an unedifying light as the never-ending row over skills.... 12 Mar 2010 More in-depth
Post your comment
Send an email to the Business Green editor at feedback@businessgreen.com
