By Andy McCue, 7 March 2005 17:25
NEWS The cost of forensically examining the computers seized during the UK police's Operation Ore investigation into online child pornography will total £15m, according to the National Crime Squad (NCS).
Operation Ore was launched after the FBI smashed an illegal pornography ring in the US. The FBI passed UK police a list containing the details of over 7,000 UK citizens who had given their credit card details to gain access to child pornography websites run by the gang.
The operation was launched in 2002 and as of December 2004 police have raided 4,283 addresses and charged 1,846 people leading to 1,451 convictions and 493 cautions. There are also still 870 related investigations still ongoing.
But the investigation has been a huge drain on police resources. A spokeswoman for the NCS revealed that the cost of forensically examining the computer hard drives seized during all the raids alone is £15m.
Neil Barrett, visiting professor in the centre for forensic computing at Cranfield University and a regular expert witness in cases of hacking, paedophilia, fraud and murder, said examining each hard drive is a costly and lengthy process.
"Each one takes the thick end of 15 days of computer forensic analysis and you are talking about multiple tens of thousands of pounds just to complete the computer investigation on a case that is prosecuted in court," he said.
He acknowledged the strain on police budgets but said it is "absolutely" worth it to combat this kind of crime and warned that those currently being prosecuted are just the "stupid" ones who still visit child pornography websites and can be traced easily.
"A lot now are using file-sharing, which is much more difficult to track," he said.
The quadrupling in arrests for online child pornography over the last two years led children's charity NCH to last week call for a special police unit to be set up but this has been met with a muted response from the police, who claim the rise in arrests is as a direct result of Operation Ore.
Jim Gamble, deputy director general of the NCS, said on BBC radio last week: "Figures released today of a 400 per cent increase in this type of crime are merely reflecting the success of Operation Ore. It put a tremendous amount of pressure on forces around the country."
Comments
There are 15 comments. Join the discussion
1. anonymous
There will certainly be one group of people making a tidy profit from this little witch hunt. How do I train in computer forensics?
2. anonymous
What do they do that takes as long as 15 days to examine a drive?
3. Johnny Marr
In answer to the chap above's question, I should imagine (and I hope) that the Police have to do the forensic searches of the drives in a very, very careful and systematic way, After all, they are gathering evidence that could send someone down for years. I bet the drive searches have to be validated and witnessed in a very painstaking way. Also, don't forget, a modern 200Gb drive can contain....oh...loads of images, which might all need to be classified individually. One hears of these people amassing quite literally millions of horrid photos.
4. anonymous
In a previous employment I used to forensically examine computers, looking for evidence of mobile-phone cloning fraud (pre-GSM days).
I can tell you that the only reason anyone would take 15 days to examine a HDD is to justify his ludicrously exhorbitant fee. It takes one day - two at most.
I am prepared to prove this, under oath. Perhaps someone should investigate these 'experts' and their £15m fees...
5. anonymous
Anonymous, you quite clearly don't understand how long it takes to even search a Gb of data, these people don't just leave evidence lying around.
6. Rob
£15m my ****, what the hell are they doing to the drives that'll cost that amount, sounds more like they have outsourced and the company that is doing it for them is fleecing them royaly.
7. anonymous
15 days might also have to include the time taken to decrypt the 200gb drive which might have multiple layers of encryption on it! 7000 people each having two disks each taking 15 days soon adds up to £15m!
8. anonymous
I do know how long it takes. And yes, they do just leave stuff lying around.
These people get caught becuase they aren't sensible enough to delete things properly and cover their tracks.
Don't lecture 'til you've done it.
I stand by my comments. The tax payer is being ripped-off big-time by these 'experts' because the police don't understand the technology, and have to rely on 'advice' from third-parties with a vested interest.
9. anonymous
£15 million only represents the cost of the forensics. The total policing cost is nearer £50 million and the overall cost around ? £200 million after you add in social services, court costs, legal costs ....
For this they have managed to find around 40 actual abusers, instead of the 2000+ they predicted. They would have identified as many cases by targetting men with size 8 shoes.
10. Kevin
The work would have been outsourced to some "jobs for the boys" organisation. I don't know why anybody pays taxes in this country because it is just distributed to the pigs round the trough. Read orwells animal farm to understand capitalism, government waste, keeping rich people rich etc.
Sorry to rant, wisdom is a horrible disease.
11. anonymous
£15M – suggests the processing is automated, and very heavily so.
First they have to copy the drives under controlled environment/supervision.
Then the copy of the drive has to be examined - and remember they are not just looking for open .bmp or .gif files -
There are many viewers for the many image formats - including those imbedded in encrypted files - and the more paranoid people are about the content of their system being available to others (not only the Police, but your local burglar) the more likely they are to have developed their own encryption programs.
Basic process may start off looking for files by file type - but then there are multiple layers of images to consider - layers 1 - 90 could contain separate images with layer 91 being opaque, and 92 - on containing innocuous images - then the examination has to go on to verify that every file, and unallocated sector on the drive is verified to be NOT what is being looked for -
Some drives can even be configured to not only hide the end of the drive from the allocation processes but, with a low-level formatting process you can even hide the last few sectors on each track from the normal partition/file management systems..
And you don't even have to have all sectors the same size - so you could 'hide data in say, bytes 530-1020 of sectors 1-63 of a 'track' and use the whole of sectors 64-93, if the partitioning descriptor says there's only 63 sectors on a track
Then the police have to be able to show to the court that the 'located' data is present on the actual seized drive, and not just on the 'image' they examined.
Credit card charging details and ISP records of traffic are probably far easier to use than images from a 'secured' system – so be very sure your PC is not being used as a gateway along with the credit card details that you recorded on it in your accounts package.
12. Dr Paul Margerison
Say we got a gas installer to do the job @ £500 ex vat to install a boiler in a day or £50 to connect a cooker in half an hour. 500 x 15 = 7500 x 4283 h/ds' assuming one h/d per household = £32122500 ex vat. No scientist just an nvq + corgi ratification. All us scientists, engineers, doctors, etc wasted all those years of educashion. I think the only people earning more are barristers and the PM.
13. anonymous
Everyone seems to assume the whole drive has to be examined. Why not prosecute when you have found 10 or 20 images and forget the rest of the drive? What difference does it make if there are more instances of the same offence? I do not believe the sentence will be proportional to the number of images so it looks as though an awful lot of time and money is being wasted, rather than moving on to the next case.
14. anonymous
The previous writer was right and wrong...
The Courts are happy that, having found more than 1 offence committed, the miscreant has proved 'motive and method'.
However, the Police and CPS generally ,I have found, want everything... Perhaps they can explain why, because I don't know.
15. Joe Whitehead
Because it leads to other convictions... There's information on OTHER users. Will be funny to see the people find out that all the deleted emails aren't so deleted.
I'll bet the prosecution's laughing it's head off if it wasn't so much work all at once.