Digital forensics secure benefit fraud investigation efficiencies
Andrew Sheldon MSc, Chief Technical Officer at Evidence Talks, explains why digital forensics are set to revolutionise benefit fraud investigation, whilst providing greater data security. When the Department for Work and Pensions (DWP) published its 'Digital Strategy' in December 2012 it set out 16 actions under the following four sub-headings:
• delivering high quality digital services
• supporting people to use our services
• changing the way we make policy
• transforming how we work.
It went on to identify that whilst some DWP users were not yet online, “nearly 80% of future Universal Credit claimants use the internet and that increasing the scope and usage of digital services offers huge potential benefits for users for our staff and for the taxpayer.”
It also addressed the matter of data security. “We also need to consider the vital importance of keeping millions of people’s details secure and protecting taxpayers’ money from the risk of fraud… the level of assurance needed around identity and security is much greater to minimise the risk of fraudulent activity.”
At that time a number of services were already online, such as claims for Jobseekers Allowance, State Pension and Carer’s Allowance.
There is however, a branch of digital technology which is making an immediate and significant contribution to the DWP’s work and to the vexed question of identifying and successfully prosecuting those who would fraudulently deprive the taxpayer of funds.
Digital forensics are being increasingly adopted by the DWP in the fight against benefit fraud, whether that is an individual attempt to defraud or the work of organised gangs.
So what exactly are 'digital forensics'? Reduced to the basics, they form a branch of forensic science which specifically deals with the investigation, identification, recovery, analysis and processing of evidence on material found in digital devices, particularly in relation to computer crime.
They perform a significant and growing role in the work of government agencies, police forces and security services as well, as in the corporate and legal professions.
For the practitioner in this discipline, some of the key activities are:
• digital triage
• overt and covert forensic acquisition
• forensic email investigation
• remote forensics.
Here is a system that will:
• reduce backlogs and waiting time
• reduce workloads
• provide rapid progress with investigations
• enable front line staff to perform hitherto specialist tasks.
Furthermore, obtaining digital evidence is generally a 'low intensity' process for both the alleged offender and the investigator. It requires no face-to-face confrontations, is entirely objective and delivers evidence which is entirely ordered and clear. Offenders faced with such evidence are far more likely to admit their guilt, so the use of digital forensics speeds up the process both before and during prosecution.
For staff, there is the additional bonus of a job well done, a potential step change in success rates and a consequent uplift in job satisfaction.
The DWP is clearly adapting to the digital age in more ways than one. For example, it does now offer apprenticeships in cyber security. In a blog on the gov.uk site in January 2016, two apprentices reflected on the course, one year in:
“Thanks to our training we are also broadening our knowledge… since last year we have focused on subjects such as cryptography, malware analysis, digital forensics and penetration testing.”
Now, in a project featured on BBC television, the DWP has been conducting its own trials, using digital triage processes delivered via the SPEKTOR Drive, a USB3 thumbdrive or a Mac expansion card which turns a suitable laptop into a fully capable forensic intelligence device. Initially three units were 'road tested', available to DWP regional staff from three operational hubs across England and Scotland.
The project was orchestrated by the DWP’s Higher Investigations Leader Mick Laffey, operating from the DWP Fraud and Error Service Central Criminal Investigation and Intelligence Services, based in Newcastle-upon-Tyne.
The applications included high value organised benefit fraud cases where, for example, large scale high quality forged identity documents were produced to defraud DWP and Her Majesty’s Revenue and Customs (HMRC). In another operation, DWP investigators identified evidence of fake employment records in an organised fraud involving HMRC tax credits and DWP disability benefits.
Investigators have also been able to locate evidence relating to the 'support industry' surrounding benefit fraud, such as the production of false documentation, passports, doctor’s notes and the like.
Mick Laffey has been impressed by the results of the trial. “In the first three months of the programme we not only moved rapidly from investigation to successful prosecutions but we saved the equivalent of our digital forensics budget for the year. We increased the number of seized devices that we sent for forensic examination from 52 per annum, to examining 157 in house in the first six months - a threefold increase.”
So, if the initial trial were to be rolled out nationally, there appears to be an imminent step change in cost-effectiveness for this element of fraud investigation. The DWP has taken an initiative here which should please everyone - from the front line staff who have a powerful new anti-fraud weapon in their armoury to the budget holders and ultimately to the taxpayers.