Bundesamt für Polizei FEDPOL Dienst für Analyse und Prävention Bundesamt für Polizei FEDPOL Dienst für Analyse und Prävention Eidgenössisches Justiz- und

Eidgenössisches Justiz- und Polizeidepartment (EJPD)

Bundesamt für Polizei FEDPOLDienst für Analyse und Prävention


CYCO and MELANI – SwiNOG Meeting 2007

Marc HenauerHead of Unit

MELANI/Cybercrime

[email protected]




SCOCI – KOBIK – CYCO

• Open-Up Synergies

MoU between Cantons and Federation• Proportional Distribution of Costs• Competences stay the same• Clients: Police, Justice, ISP, Public




Organisation

Organisation

fedpol

DAP

CYCO

Monitoring OSINT

Clearing / AnalysisMELANI

fedpol KSBS KKJPD KKPKS

Governing Board CYCO




1) Reception, Viewing, Securing and first Analysis of an Anouncement

2) Active Research = Monitoring

In both cases CYCO produces a file, showing criminal intent and sends it to the judicial authorities of the cantons.

How does Cyco work ?




KSBS KKJPD

KKPKS

Governing Board

fedpol

Announcements Monitoring

Criminal FilesProducts

Clients

Services

Mission

Prevention, Analysis

FederationCantonsPublic

Means InternetCLEMONA

Lawyers, Developers, Network Specialists, Police,Journalist, IT-Security Experts,….

InterpolFL




High Resonance

Total Announcement 2003 - 2006

0

100

200

300

400

500

600

700

800

900

1000

Jan. Feb. März April Mai Juni Juli Aug. Sept. Okt. Nov. Dez.

2003

2004

2005

2006




Example - Grooming




www.heil-helvetia.ch




What is getting reported?

Selected Announcement GroupsComparison 2003/2004/2005/2006

(in relation to annual total announcements)

0

5

10

15

20

25

30

35

40

45

Hard Pornography Pornography Question Spam EconomicCriminality

2003

2004

2005

2006




CYCO Cases 2006

913 15 15 12

8 62 0 1

84

3220

27

3

1919 20

16

42

23

31

7

0

5

10

15

20

25

30

35

40

45

aus Monitoring

aus Meldung

Forwarded CYCO Announcements 2006(Cantonal and Federal Authorities)




Does it Work ?

~ 90% Investigation are opened and a

house search is made.

~ 80% Illegal material is seized.

Problems: Time, Cybercafé, Chat

~ 85% Lead to a conviction

Problems: Chat, Intent




• 400 – 600 Announcements per Month

• Clear Necessity for an active Monitoring

• Clients are Happy – But also Demanding

• Key to Success• Motivated Team • Cooperation• Innovation

So Below the line…




MELANI




MELANI – A PPP for the Protection of the NCII

MELANI – Melde- und Analysestelle Informationssicherung

Situation and intelligence centre of the Federal Government for the protection of the critical information infrastructure

Provides operators of critical infrastructures, such as

• energy suppliers

• banks

• telcos

• and so forth...

with information and resources coming from

• intelligence

• law enforcement

• national CERT (Computer Emergency Response Team)




MELANI: Functionalities – Co-operation Partners

Intelligence – Service for Analysis and Prevention (SAP) with the Federal Office of Police (fedpol)

• cybercrime (Cybercrime Co-ordination Unit, CYCO)

• politically motivated hacking and national security

• well established co-operation with the private sector

CERT – Swiss Education & Research Network (SWITCH)

• experience in running a CERT

• access to the world-wide network of CERTs (FIRST, ...)

Supervision – Federal Strategy Unit for IT (FSUIT)

• active in CIIP since 1997

• relations to relevant CIIP organisations abroad




MELANI: Organizational Model

Head MELANIRuedi Rytz

Information

Scientific Staff

SWITCH

FSUIT

fedpol

Head SWITCH-CERTSerge Droz

MELANI Analyst

Head Situation CentreMarc Henauer

MELANI




European Government CERTs (EGC)Task Force CSIRT (TF-CSIRT)Forum of Incident Response and Security Teams (FIRST)

MELANI-Network: National Contact Point

CERT (SWITCH)

Intelligence(fedpol: SAP)

„Club de Berne“Intelligence Community

High-Tech Crime(fedpol: CYCO)

High Tech Crime UnitsEuropol, InterpolCyber Crime Convention (Council of Europe)

CIIP-Network / Policy Makers (FSUIT)

Federal Office for Information Security (BSI)National Infrastructure Security Co-ordination Centre (CPNI)Department of Homeland Security (DHS)

ME

LAN

IO

per

ato

rs o

f C

riti

cal I

nfr

astr

uct

ure

s

Switzerland World-Wide Co-operation




Services for MELANI open

Daily business• Announcement of warnings, and information („tips“) in „appropriate

form“ (language D, F, I, technical details)

• Publication of material for incident prevention (e.g. good practices e.g. for e-banking, operating systems, …)

• Possibility to report incidents and attacks

In case of an incident • Hints on problem resolution

• Expert advice on law enforcement

www.melani.admin.ch




Closed Constituency (Mai 2007)

Critical Infrastructure # Companies

Telecommunications: 5

Energy Supply: 4

Finance: 12

Transportation: 2

Health Care: 1

Public Administration: 4

Total: 28 (~ 70 people)




Services for the CC - Example: Espionage – Trojan Horse

Seemingly useful program containing hidden functions.

Such functions can be used for the purpose of espionage, for the remote control of the PC, for sending spam, and so forth.

Trojan horses may find their way to the PC by

• „voluntary“ installation• exploiting vulnerabilities




Warning for the Closed Constituency

As an example, the warning of January 2007

The advisory contains pieces of information on detected attack vectors.

System administrators may use them in order to verify whether they are affected.




MELANI-Net: Incident handling

Adding comments incl. file attachments

Description of the incident (Visibilty depends on the user)

Comments

Documents

Bundesamt für Polizei FEDPOL Dienst für Analyse und Prävention Bundesamt für Polizei FEDPOL Dienst für Analyse und Prävention Eidgenössisches Justiz- und