Cybercrime may result in social harms through embarrassment and nuisance and, in more serious cases, physical or emotional harm. In the Sony pictures hack in late 2014, large quantities of personal and commercial data were stolen and publicly released (in addition to triggering an international debate on freedom of expression in the digital age). Finally, while the financial losses from cybercrime can be small in an individual instance, the effects on public trust and confidence may be corrosive over time. THERE IS NO COMPLETE PICTURE OF CYBERCRIME IN NEW ZEALAND 83% of New Zealanders have experienced a cyber breach. We are only seeing the tip of the iceberg. Research commissioned for Connect Smart Week 2014 found that 83% of New Zealanders had experienced a cybersecurity breach.5 This is not yet reflected in reporting, as New Zealand does not have a single, central point of reporting and breach disclosure is not mandatory. Even if they want to, victims do not always know where to report. Different agencies are responsible for different types of cybercrime, so some incidents will be reported to multiple places, while other victims may be passed from one agency to another in an effort to find the best place for a resolution.6 Responses may also vary within each service. As a result, no one has a consolidated picture of cybercrime in New Zealand. As the threat picture develops, we will gain a better understanding of what is required to effectively combat cybercrime, including the full ramifications of rapid technological change and emerging trends such as the rise of online or ‘crypto’ currencies. Related legislative reforms are already underway but further amendments are likely to be required to ensure New Zealand’s legal framework is future-proof and facilitates an effective response to cybercrime. IT IS DIFFICULT TO DETECT, INVESTIGATE AND PROSECUTE CYBERCRIME Cybercrime produces high returns at a low cost and reasonably low risk to the criminal. Thousands of spam emails may generate small losses for each victim, but a much greater loss for New Zealand as a whole. The two most common techniques – social engineering (where a victim is tricked into granting access) and vulnerability exploitation (taking advantage of programming issues) – do not require much investment by criminals, due to the low marginal cost between one victim and thousands of victims. Cybercrime can also be distinguished from ‘traditional crimes’ by the challenges its global nature presents for law enforcement. Individuals and groups overseas can operate wherever an Internet connection is present. The perpetrators are overwhelmingly based overseas and are highly organised – one United Nations report estimates that 80% of cybercrime is a part of organised criminal activity.7 Traditional organised crime groups are migrating to this environment for greater profit at less risk. Connect Smart “Understanding Public Perceptions Toward Cyber Security” (July 2014). Last accessed 30/09/2014. http://www.connectsmart.govt.nz/assets/Uploads/Perceptive-Research-Understanding-Cyber-Security-PublicPerceptions-2014.pdf 5 6 Police NIC, 2014. United Nations Office on Drugs and Crime “Comprehensive Study on Cybercrime: Draft.” (February 2013). Last accessed: 24/09/14. http://www.unodc.org/documents/organized-crime/UNODC_CCPCJ_EG.4_2013/CYBERCRIME_STUDY_210213.pdf 7 National Plan to Address Cybercrime 2015 5