The global element makes it difficult to find the perpetrator and access related evidence. Information exchange and cooperation between different countries can be poor and even where strong cooperative relationships exist, mutual legal assistance treaty processes can be very slow and cumbersome. Cases may require a disproportionate amount of investigative effort, reducing the availability of resources to deal with other demands. The country where a perpetrator is based may also not have the necessary skills or capacity to conduct a suitable investigation or preserve evidence.8 Investigation is further complicated by the ability to operate near-anonymously on the Internet. Attribution in cyber incidents is very difficult, particularly when an attack originates overseas. This makes cybercrime challenging not only to investigate but also to prosecute. Proxies and channels like The Onion Router (TOR) and peer-to-peer (P2P) networks can be exploited by criminals attempting to hide their identity under layers of encryption. Those networks are frequently used to facilitate criminal activity and pose challenges for law enforcement. One wellknown example was the use of the now-closed ‘Silk Road’ site on the TOR network for drugs trading. The fastest growing is a market called ‘Evolution’ – advertising Dark markets are selling guns, stolen credit card data, stolen medical information cybercrime as a service: and fake identification – which offers highly secure hackers for hire or transactions.9 Increasingly, such sites and dark markets are also selling cybercrime as a service, such as hackers simple toolkits. for hire or simple toolkits. These developments lower the barriers for entry into cybercrime.10 Accordingly, a growing group of unskilled actors can have a relatively damaging impact. At the other end of the spectrum, the lines are blurring between criminal actors and state actors (some of whom may also act with criminal intent) as activity proliferates and techniques become increasingly sophisticated. As technology and detection strategies evolve, so too do the actors, making it difficult for responders to keep pace.11 New Zealand offenders are not averse to using anonymising technology, including the use of TOR to attempt to hide sites providing child exploitation material and drug dealing. NEW ZEALAND’S RESPONSE TO CYBERCRIME IS SHARED BETWEEN GOVERNMENT, NGOs, THE PRIVATE SECTOR AND INDIVIDUALS A range of government agencies have policy and operational responsibilities related to cybercrime. Those roles have largely evolved organically rather than by design. At present, these include: • New Zealand Police: overarching responsibility for crime prevention, detection and investigation in New Zealand, the Police Cybercrime Unit, Online Child Exploitation Across New Zealand (OCEANZ), Organised Financial Crime Agency New Zealand (OFCANZ). • Ministry of Business, Innovation and Employment: Scamwatch and fraud awareness. • Department of Internal Affairs: Electronic Messaging Compliance (anti-spam), Censorship Compliance Unit. Calum Jeffray and Tobias Feakin “Special Report: The Underground Web: The Cybercrime Challenge” (Australian Strategic Policy Institute, March 2015). 8 6 9 Jeffray and Feakin, 2015. 10 Police NIC, 2014. 11 Police NIC, 2014. National Plan to Address Cybercrime 2015