Vital e-crime evidence often destroyed

Companies that fall victim to computer crime may be inadvertently destroying evidence in their efforts to find the perpetrators.

Detective Chief Superintendent Len Hynds, of the National High Tech Crime Unit (NHTCU), said that its Confidentiality Charter, launched in December 2002, was encouraging more businesses than ever to report computer crime.

But there are sometimes problems with gathering evidence if preliminary investigations have been carried out before the police are called in.

Speaking at the Homeland and Corporate Security Summit in London DCS Hynds said: "There are examples of companies which wrestle with problems for months without calling us and that can lead to problems in the evidential trail.

"The private sector is going to be key to being even more effective in solving crimes. However, we need to develop common standards in terms of dealing with high-tech crime between the private and public sectors."

Cyber-criminals are becoming ever more sophisticated in their activities. Tactics include hiding files that are disguised as bad sectors on a hard drive, and using other PCs as mail servers to shield illegal activities.

Michael Colao, senior consultant at Dresdner Kleinwort Wassertein, said: "What we see is well-meaning IT professionals going in and doing what you see on every bad crime film: they muddy the waters.

"You only have one opportunity to collect the evidence you need to prove your case.

"Human resources send in well-meaning IT help desk staff who don't know what they are doing and ruin the evidence. You need a professional computer forensic team in there as soon as possible."