Information Age: News, analysis & insight for IT & business leaders

The private companies that can help organisations crack down on cyber crime

Companies like New York-headquartered private security agency Kroll fill a gap left by police forces, which are often constrained by limited resources and ill-equipped to deal with the multinational nature of modern Internet-based crime.

“A complex financial crime can take weeks or months to investigate,” explains Kroll’s Benedict Hamilton. “And having forensic accountants pour through the accounts for days at a time costs a lot of money. The police often realistically know they won’t be able to justify the kind of resources that it takes.”

While investigators lack the powers of the police or intelligence agencies, they can use their investigative techniques to similar effect. “Anything prosecuting authorities can obtain through court orders we can obtain through civil orders, like search and seizure orders, orders to search premises and discovery orders.”

Contrary to general perception, that extends even to cases tracked to countries with less ‘holistic’ legal systems.

“Quite often, clients will say ‘Oh God, our property is now in Russia, there’s no point in going after it.’ But we’ve had very good results around the world in jurisdictions where one wouldn’t necessarily expect to get that kind of support from the judiciary. We’ve found judges to be very receptive to our arguments where there’s a strong prima facia case of wrongdoing. And that’s not just UK judges but Chinese judges, Russian judges, Indian judges and judges in the Gulf.”

Companies like Kroll are generally retained on a loss-percentage basis, particularly in cases of relatively straightforward theft. “Let’s say $500,000 has gone missing from the accounts and the CFO suddenly resigns and emigrates, which happens more frequently than you might suspect,” Hamilton illustrates. “The company will quite often agree to spend up to 10% of the monetary loss trying to get it back. It’s not a hard-and-fast rule, but 10% is a relatively widespread rule of thumb. On the other hand, we also get quite a few cases where the chances of recovering the money are very small, and it’s not really the recovery that’s motivating people to come to us but the deterrent factor: ‘catch them whatever it costs to stop them from picking on us ever again’.”

Still, the whims of the client can sometimes be “pretty frustrating.”

“We do a lot of work for major multinationals. One major electronics company came to us because they had suspicions about the operations of their Ukrainian subsidiary. We looked into it and believed we had strong evidence that the head of their Ukrainian operation had pocketed something like $2 million. We were able to identify a number of assets he’d bought with the money, including property in Spain. The company concerned didn’t want the publicity and found another way to get rid of the person involved.”