London cop illegally used police database to monitor investigation into himself A serving Metropolitan police officer who illegally accessed a police database to monitor a criminal investigation into his own conduct has pleaded guilty to crimes under the UK's Computer Misuse Act. Sergeant Okechukwu Efobi, of Byron Road, Wealdstone, Harrow, was ordered to complete 150 hours of community service and pay a …
Because maybe he was under investigation without his knowledge, and taking away the tools used to do his job would have been a dead giveaway?
There's a fine balancing act with law enforcement systems, between giving people the tools they need to follow leads, and them being able to use them to look into things that don't concern them. It's hard to completely stop the second without hampering the first. Decent monitoring systems may help, but then they end up being a pool of data in their own right, and the question then arises about who should see them, and who watches those people, ad infinitum. In the end, the entire system has to be based on trust at some point.
At the end of the day it comes down to professionalism vs temptation - you know you shouldn't be looking, but it's just sitting there asking you to take a peek. There are a lot of people working for the various police organisations across the country, many of them not officers, but civilian staff. They need the access to the databases to do their jobs, but they are all also human, and like all humans, can be good 'uns or bad 'uns.
I'm sure rules and procedures are in place, and it may well be the procedures that are in place that means the number of people being caught is going up. Just think what it would have been like in the '70s and '80s when any safeguards that there would have been probably consisted of a password written on a post-it.
That's garbage, all access should be limited to strict identification and authentification so that all access is easily traceable and that goes double for access from non police organisations.
Access should be tracked at all times and records of access kept for a minimum time period, if silicon valley does it routinely, I am sure it's not beyond the wit of police forces to do it.
That's garbage, all access should be limited to strict identification and authentification so that all access is easily traceable and that goes double for access from non police organisations.
Who says it isn't? He got caught didn't he?
My point is that it's difficult to limit what police can access if the thing theya re accessing is a tool they need to do their job. It's obviously not practical to lock it down so much that they can only access a single case, because that would mean that when they need to access anything else, such as previous convictions for a suspect, or another case that they suspect may be related, they need someone to grant that access. In practice, that would likely mean rubber-stamping of each request, because there would be far too many to actually get reviewed by a human.
The obvious solution (which I'm sure is applied) is to log all access, and if someone suspects something dodgy is going on, look at those logs. Hence what happened in this case, which was almost certainly a case of that.
You could go all clever and write some sort of system to look for suspicious patterns and flag them up for human review, but who's to say that doesn't exist either?
That's garbage, all access should be limited
I completely agree.
Even in "normal" companies, access is (or at least should be) strictly limited to what a person needs to access for their job. Police officers do NOT need access to the entire database to do their job. Access should always be limited to the cases they are currently working on, with limited access to other info (probably just meta or search) with the possibility of requesting more access. All access to info, and all searches, should be logged and audited.
I know someone who was actually kicked out of the police because he was found to have used the police database to check out his stepdaughter's new boyfriend. However, it was only investigated because his stepdaughter reported it, even though other cops and higher ups knew it had occurred. Misuse of the criminal databases should, IMHO, be cause for immediate sacking. Police should be held to a higher standard than others (as they are in a position of authority and trust), and I (as a developer) would lose my job if I misused the much less sensitive information I have access to.
Lots of criminals have not been found or crimes have been solved much later than they should have because connections between different cases were not made. It might be reasonable to have a same name restriction (like officer Jenkins needs to ask a colleague to look up information about suspected car thief Jenkins), but that wouldn’t stop a police officer from looking up info about a robbery that he committed until his name is added to the case.
And it doesn’t stop the jealous police officer illegally checking out the new boyfriend of their wife, ex wife, ex-girlfriend etc. The only way to stop this is harsh punishment when detected.
Why would a person being investigated still have access to the database?!?
Also, in addition to my previous post, in the actual article (my emphasis):
A serving Metropolitan police officer who illegally accessed a police database to monitor a criminal investigation into his own conduct has pleaded guilty to crimes under the Computer Misuse Act
I read this to mean that he didn't have access to the database, but either used someone else's access, or otherwise hacked into it. The CMA, as far as I understand it, covers unauthorised access to computer systems.
What I don't understand is why he hasn't been sacked - the Met should take this sort of misconduct seriously, especially since it will have been made abundantly clear to him what access officers have to the various police databases, and what they are allowed to use them for.
I would assume he was on restricted duties while the court case took place and now he would be subject to internal disciplinary processes which will probably see him dismissed.
Crude oversimplification I know but if he was alleged to have done this, sacked before the case reached court and then found to be innocent by the courts then the Met would have been up the effluent creek without sufficient rowing equipment for unfair dismissal.
As an aside working with police as I occasionally do they actually do require quite broad access as connections are often made by looking at similar cases which can allow them to create patterns of behaviour to ID suspects.
Its far from a perfect system but the highly restricted and siloed access some are suggesting has the potential to be just as damaging as the current system, particularly in time sensitive cases.
> A serving Metropolitan police officer who illegally accessed a police database to monitor a criminal investigation into his own conduct has pleaded guilty to crimes under the Computer Misuse Act
Why do I come away with the distinct feeling that he has admitted this in order to be dismissed for a relatively minor offence so that whatever it was he was being investigated for stops and then he is not prosecuted for potentially much more serious offences?
(Or is he really that stupid wrt understanding how IT works, which begs the question of how he got through the recruitment process in the first place?)
(Or is he really that stupid wrt understanding how IT works, which begs the question of how he got through the recruitment process in the first place?)
I daresay that 90% or more of all users don't understand how IT works. The ones that try to get around things are usually the worst as to having a clue but then they think they "know" what they're doing.
"Why do I come away with the distinct feeling that he has admitted this in order to be dismissed for a relatively minor offence so that whatever it was he was being investigated for stops and then he is not prosecuted for potentially much more serious offences?"
In that case, he neither understands IT or the law. If it's a criminal investigation and there is enough evidence, then it won't matter if he's already left/gone sick/retired. Those are the methods used to get out of disciplinary hearings that might lead to losing their pensions.
What a stupid law. I definitely would investigate any plot against me, if I could get away with it without being detected. [ Although I certainly am uninterested in finding out other people's opinions on me, particularly as eavesdroppers etc. etc.. ]
Life is not meant to be handled with kid gloves.
Indeed There are some interesting shenanigans going on in various forces that don't get reported (such as fiddling speed measurement stats to lower reported speeds and set camera trigger points lower as a result and/or not take action on dangerous residential roads because the fiddled stats show speeds aren't dangerous)
Was the person not entitled to have access to this data on her/him under the GDPR ?
If so, then the person saved us ££££ tax payer moneys by accessing the data without asking others to provide said data.
As long as that person did not interfere with the data or the investigation, I do not see a problem.
There are plenty of people who would not have criminal records if the police had been so kind as to notify them of an investigation a couple of weeks prior to obtaining/executing those search warrants!
A less sarcastic answer would probably be to reference Data Protection Act 2018 section 3.3.45.4 (a+b)
It was a while ago, but I have worked with a couple of UKI police forces to implement information databases. It was made clear to me, and I was told it was always made VERY clear to database users, that every user interaction would be logged. If you search for yourself, anyone you know, or anyone else that you cannot justify as part of an ongoing case then you will be in trouble. At that time, I don't believe there was a mechanism to trawl through the logs to actively look for improper access. There may be some process to do that now, but even if there isn't, all access is logged and will be used in court as evidence against you.
Having worked for the Gov in the past they I know that before you start work they collect up any data they hold on you and lock it up, now this might have changed since my day but I for one cannot understand why.
From this article it is clear that the police are allowed access without what used to be reasonable restrictions and that is something that needs addressing after so many stories of access abuse in the police/judicial system.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
