Britain’s cybercrime tsar will formally ask the government to set up a programme based on the controversial Prevent strategy to stop children as young as 12 becoming involved in sophisticated computer offences, the Guardian has learned.
Dr Jamie Saunders said training was needed to help spot teenagers at risk as many young internet users experiment with hacking or other cyber offences without realising that what they are doing is a crime.
Saunders, the director of the national cyber crime unit at the National Crime Agency (NCA), said he was proposing the scheme, known internally as Cyber Prevent, to ministers. It is modelled in part on Prevent, the official counter-radicalisation programme that has been dogged by controversy.
But instead of trying to divert aspirant jihadis away from terrorism, Cyber Prevent would aim to deter computer-literate youngsters from carrying out distributed denial of service attacks (DDoS) and other cybercrimes, such as hacking private details.
Saunders said the programme could also be used to recruit tech-savvy young adults. “We need education for schools on the [1990] Computer Misuse Act, on what it is and isn’t [a cybercrime]. A lot of kids don’t realise they are committing a crime,” he said.
“We don’t want them to go to prison, we want them to come and work for us.”
Demand for computer skills is forecast to grow in coming years. One core message at the heart of Cyber Prevent is that young adults with computer skills can earn good amounts of money legitimately, as opposed to perpetrating cybercrimes and being pursued by law enforcement.
“A lot of kids are stumbling into this crime. This activity has consequences for them and others. There are legitimate opportunities for their skills,” Saunders said.
The target group would be those aged 12 to 25. One major cyber-attack, which is currently subject to legal restrictions, was carried out by a teenager.
Analysis of investigations undertaken by the national cyber crime unit in 2015 found the average age of suspects was 17. The previous year, the average was 24.
Saunders said some cyber-attacks had been carried out by children who did not realise the harm they could do. “We are not dealing with serious criminals. Some are sucked in and damage their careers and do a lot of harm,” he said.
Research shows that some who end up committing cybercrime start by learning how to outwit games programmers. “One of the entry points is cheating on online gaming – you have to be quite clever to do that,” Saunders said.
Cyber Prevent would be relatively low cost, especially compared with the harm it aims to thwart, Saunders said. The scheme would hire a network of regional specialists and companies could contribute to the cost.
The programme would also target parents so they had a better chance of knowing what their children might be up to.
The sheer volume of online offending means only a fraction of offenders are likely to be caught.
Compared with other major types of crime, intelligence about cybercrime offenders is at a relatively early stage. “We keep finding clean skins, people we did not know about,” Saunders said.
The NCA said malicious software called remote access trojans (RATs) is popular among teenage computer users. It allows users to remotely take full control of another computer. An NCA-led operation targeting users of the Blackshades RAT found that the average age of the 22 people arrested was 18, with the youngest 12 years old.
Saunders became director of the national cyber crime unit in 2014, joining from the Foreign Office, where he was director of international cyber policy. Before that, he worked at GCHQ.