Feeds

Study reveals gaps in UK system to track criminal and terror finance

Lots of data, but police can't or won't use it fully

  • alert
  • submit to reddit

Seven Steps to Software Security

As you prove your identity ("I'm sorry sir, but it's a legal requirement") to your bank for the umpteenth time, no doubt you wonder whether the mountain of data that money laundering rules produce is of the slightest use to the people with access to it. Well, wonder no more - the second critical study on the use of Suspicious Activity Reports (SARs) in two years concludes that SARs are under-utilised by most Law Enforcement Agencies (LEAs), and also reveals that pending the implementation of (uh oh...) a new database system, many of them aren't being used at all.

The study was commissioned by The Association of Chief Police Officers and funded by the Home Office, and although author Matthew Fleming, Research Fellow at the UCL Jill Dando Institute of Crime Science, appears to have completed it in June, for some strange reason it seems not to have been published until the other week. It reveals a system that LEAs are ill-equipped (and frequently disinclined) to use, and a growing mountain of data that really is not being dealt with systematically. And although Fleming is guardedly hopeful about the new database 'fix', there are enough caveats attached for one to doubt that use of SARs will improve dramatically in the near future.

Suspicious Activity Reports are sent initially to the National Criminal Intelligence Service, under anti money-laundering legislation, by companies in the financial sector. They're intended to provide LEAs, Customs and the Inland Revenue with signs of suspicious activity that might indicate laundering and/or terrorist financing operations. A lot of what comes through will of course be guff, but there will be good data in there as well which could flag up people and operations you didn't know about. If, that is, you're capable of sifting out the good data.

Government claims to be cracking down on, say, terrorist finance tend not to mention that the crackdown can be a little bit random and not particularly extensive. But that's about the size of it - the Government's thirst for data is running well ahead of Government technology's ability to deal with it (and one could reasonably speculate that this will apply equally to numerous other ongoing data grabs).

The handling of SARs has been through a couple of different regimes in recent years. Prior to the publication of the previous study on their use (by KPMG, in July 2003), they were given a preliminary sift by NCIS so that those likely to be of interest were sent to the interested LEA, and the rest sent out to the relevant LEA by postcode. The Inland Revenue, Customs & Excise and the Terrorist Finance had staff at NCIS combing the database, but the bulk of SARs were sent out by email in "LEA Packs" in .CSV form. So the system identified transactions by individuals it was already suspicious of, while transactions by people who hadn't already tripped a wire would be likely to go out in the big, general pile.

For the year after the publication of the KPMG study NCIS assessed all SARs on a qualitative basis and sent out those it deemed to be of interest to the relevant LEA. The raw data sent out should therefore have become more attractive to LEAs because a higher proportion of it was likely to be useful, and the volume of data received was smaller. SARs not thought to be of interest were not thrown away, but held in the database, Elmer, which could be searched by request.

Elmer seems likely to have influenced what happened next. In June 2004 NCIS, without consultation with LEAs, significantly reduced the volume of SARs sent out, and encouraged LEAs to submit Elmer search requests. NCIS said that "the reactive, one by one allocation process risked not revealing the most capable and most prolific of money-laundering suspects and not highlighting patterns and typologies."

But the move could also have been a reaction to the continuing failure of LEAs to use SARs effectively, and may have been made in anticipation of the rollout of the next version of Elmer. This had originally been planned for autumn 2004, a few months after the change in NCIS practice, but slipped into 2005. The system did go into pilot in February, and was scheduled to be rolled out in May 2005. It's not clear if this has actually happened, and if so to what extent, but at best this will mean that a year's supply of non-prioritised SARs will be of largely historical interest.

The Power of One Infographic

More from The Register

next story
You! Pirate! Stop pirating, or we shall admonish you politely. Repeatedly, if necessary
And we shall go about telling people you smell. No, not really
UK Parliament rubber-stamps EMERGENCY data grab 'n' keep bill
Just 49 MPs oppose Drip's rushed timetable
MPs wave through Blighty's 'EMERGENCY' surveillance laws
Only 49 politcos voted against DRIP bill
EU's top data cops to meet Google, Microsoft et al over 'right to be forgotten'
Plan to hammer out 'coherent' guidelines. Good luck chaps!
US judge: YES, cops or feds so can slurp an ENTIRE Gmail account
Crooks don't have folders labelled 'drug records', opines NY beak
Delaware pair nabbed for getting saucy atop Mexican eatery
Burrito meets soft taco in alleged rooftop romp outrage
LightSquared backer sues FCC over spectrum shindy
Why, we might as well have been buying AIR
prev story

Whitepapers

Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.