Original URL: http://www.theregister.co.uk/2005/10/13/uk_sars_report/
Study reveals gaps in UK system to track criminal and terror finance
Lots of data, but police can't or won't use it fully
As you prove your identity ("I'm sorry sir, but it's a legal requirement") to your bank for the umpteenth time, no doubt you wonder whether the mountain of data that money laundering rules produce is of the slightest use to the people with access to it. Well, wonder no more - the second critical study on the use of Suspicious Activity Reports (SARs) in two years concludes that SARs are under-utilised by most Law Enforcement Agencies (LEAs), and also reveals that pending the implementation of (uh oh...) a new database system, many of them aren't being used at all.
The study was commissioned by The Association of Chief Police Officers and funded by the Home Office, and although author Matthew Fleming, Research Fellow at the UCL Jill Dando Institute of Crime Science, appears to have completed it in June, for some strange reason it seems not to have been published until the other week. It reveals a system that LEAs are ill-equipped (and frequently disinclined) to use, and a growing mountain of data that really is not being dealt with systematically. And although Fleming is guardedly hopeful about the new database 'fix', there are enough caveats attached for one to doubt that use of SARs will improve dramatically in the near future.
Suspicious Activity Reports are sent initially to the National Criminal Intelligence Service, under anti money-laundering legislation, by companies in the financial sector. They're intended to provide LEAs, Customs and the Inland Revenue with signs of suspicious activity that might indicate laundering and/or terrorist financing operations. A lot of what comes through will of course be guff, but there will be good data in there as well which could flag up people and operations you didn't know about. If, that is, you're capable of sifting out the good data.
Government claims to be cracking down on, say, terrorist finance tend not to mention that the crackdown can be a little bit random and not particularly extensive. But that's about the size of it - the Government's thirst for data is running well ahead of Government technology's ability to deal with it (and one could reasonably speculate that this will apply equally to numerous other ongoing data grabs).
The handling of SARs has been through a couple of different regimes in recent years. Prior to the publication of the previous study on their use (by KPMG, in July 2003), they were given a preliminary sift by NCIS so that those likely to be of interest were sent to the interested LEA, and the rest sent out to the relevant LEA by postcode. The Inland Revenue, Customs & Excise and the Terrorist Finance had staff at NCIS combing the database, but the bulk of SARs were sent out by email in "LEA Packs" in .CSV form. So the system identified transactions by individuals it was already suspicious of, while transactions by people who hadn't already tripped a wire would be likely to go out in the big, general pile.
For the year after the publication of the KPMG study NCIS assessed all SARs on a qualitative basis and sent out those it deemed to be of interest to the relevant LEA. The raw data sent out should therefore have become more attractive to LEAs because a higher proportion of it was likely to be useful, and the volume of data received was smaller. SARs not thought to be of interest were not thrown away, but held in the database, Elmer, which could be searched by request.
Elmer seems likely to have influenced what happened next. In June 2004 NCIS, without consultation with LEAs, significantly reduced the volume of SARs sent out, and encouraged LEAs to submit Elmer search requests. NCIS said that "the reactive, one by one allocation process risked not revealing the most capable and most prolific of money-laundering suspects and not highlighting patterns and typologies."
But the move could also have been a reaction to the continuing failure of LEAs to use SARs effectively, and may have been made in anticipation of the rollout of the next version of Elmer. This had originally been planned for autumn 2004, a few months after the change in NCIS practice, but slipped into 2005. The system did go into pilot in February, and was scheduled to be rolled out in May 2005. It's not clear if this has actually happened, and if so to what extent, but at best this will mean that a year's supply of non-prioritised SARs will be of largely historical interest.
The new-look Elmer should give LEAs remote read-only, semi-searchable access to Elmer. This improves the previous regime in that some LEAs reported that the search request process was laborious and time-consuming, but also means that SAR data will have to be pulled by the LEAs rather than pushed by NCIS. A further phase of Elmer was scheduled for early 2006, and is intended to include advanced data mining. Fleming comments that this "places the onus on the use of SARs squarely on LEA shoulders. LEAs - particularly the MPS (Metropolitan Police Service) - will need to devise ways to find those SARs which represent a priority. The one-by-one manual evaluation of SARS upon receipt may forcibly become a thing of the past."
LEAs will therefore have moved from a position where they were given to large pile of data to sort through, but generally didn't, through a period where the pile was smaller and more targeted, to a point where the pile is central, and it's largely up to them to access it remotely and maximise its value. All LEAs will have online access to all SARs (with the exception of terrorism-related ones, which raises the question of how you define a terrorism-related SAR), but what we have here, although a picture of the new-look Elmer, is really only half of a system.
Fleming's ability to conclude that SARs are under-utilised was impeded to some extent by woeful management and record keeping by LEAs. There's very little data available on how effectively and extensively they use SARs, so it's not particularly practical to attempt a precise measurement of their performance.
As Fleming observes: "Few carrots or sticks drive the use of SARs, no performance indicators encourage LEAs to make proactive/reactive use of SARs (and only things which are measured appear to get done)." Which is not a climate wholly unfamiliar to many other Government employees. In the absence of carrots or sticks, SARs drop down the priority list. They're difficult to "sell" to operational teams (presumably pushing forms back and forward isn't sexy enough), the request process (the one Elmer ought now to be abolishing) is laborious and time-consuming, and there's little automation of cross-checking.
That last one's particularly interesting, in light of Fleming's view that manual checking will forcibly become a thing of the past. Many LEAs are using Word or Excel to track their SARs, and it's therefore not entirely surprising that there's not a lot of tracking data available from them. Either app is perfectly tolerable as something that allows you to look at a .CSV somebody's sent you, but if you want to check that data against a database then there are clearly a few other things you're going to have to do. LEAs' case management capabilities are limited (kind of makes you wonder, given their line of work), and Elmer is not a case management system. One of Fleming's recommendations is for greater use of case management, and he reports that many LEAs feel that the production of a uniform, nationwide case management system would make the regime far more effective.
Which one way or another will mean more expense, simply to get SARs to function with any great degree of effectiveness. A number of Fleming's "critical" recommendations will be familiar to students of Government IT disasters. The SARs regime should be given a clear owner (likely NCIS/SOCA). The regime's aims objectives and principles should be set down, and LEAs should make "constant, unwavering use of the Elmer database" (tricky one this, if you're just peering at a terminal and wondering what to do with your search results). LEAs should have clear performance targets and (here we enter tech challenge territory) "NCIS/SOCA should ensure that Phase II of the Elmer rollout - with its advanced analytical capabilities - is delivered on schedule." And even more challenging "database cross-checks between Elmer and relevant national databases (e.g. PNC, JARD [Joint Asset Recovery Database]) should be automated, such that database hits are highlighted when looking at a SAR or series of SARs on Elmer; this should be handled by NCIS/SOCA, perhaps in conjunction with the Police Information Technology Organisation."
There's clearly more expense associated with that last one, which sounds well on the way to being a more extensive and comprehensive national system, and it reminds us that the ability of police systems to talk to one another is still pretty limited. Overall, you could call it an everyday story of tech-happy Government, all data-ed up but nowhere to stick it. More and more data is scooped up in the name of greater efficiency, enhanced crime fighting ability, combating terror, whatever, but scant attention is paid to what will actually be done with the data until people start wondering why the system isn't working, loudly enough. Then, just maybe, the decision-makers will start to contemplate paying for the kind of joined-up system they should have commissioned in the first place.
Fleming's study is not obviously available on the Home Office's pretty ('Now with added dysfunctionality!') web site, but can be obtained here. ®