The “New” Private Security Industry,the Private Policing of Cyberspace and the Regulatory Questions

The Background Changes

The way that most people shop, play, bank, and date, to name some, is very different to 20 years ago, as is the way many organizations offer services. Central to this transformation has been the growth of the internet and the growing ubiquity of devices offering easy access to it. In Great Britain in 2006 the number of adults who used the internet daily was 36%. This had risen to 86% in 2018, and in that same year 78% of adults used mobile smartphones to access the internet (Office for National Statistics [ONS], 2018b). Such changes have been occurring across the globe. Central to the growing use of the internet has been its use for social networking, shopping, banking, and gaming.

Facebook (2018), for instance, has 1.47-billion daily users and 2.23-billion monthly users. The users of Facebook communicate with one another, share insights, photos, and videos to name some. It is also used by corporations, nongovernmental organizations (NGOs), and political groups to campaign and share ideas. On average, a user spends 50 min of their day on Facebook (New York Times, 2016). In the course of using Facebook and its platforms, a wide range of crimes and deviant acts can take place including sexual abuse, uploading illegal images, bullying, fraud, and the use of offensive language. There are also extensive rules of conduct set by Facebook in their terms and conditions that need to be policed.

Consider Xbox Live which has over 57-million active players across the world playing video games (Statista, 2018a). It has been estimated the average child in the United Kingdom aged 12 to 15 years plays 12.2 hr of video games per week and an 8- to 11-year-old 10 hr (Statista, 2018b). Players in the course of gaming have multiple opportunities to commit crimes and engage in deviant acts. These range from abusing children, using pirated games, using racially or other offensive language, bullying players, to simply cheating at games (Gray, 2012). Amazon, founded in the mid 1990s, has grown to one of the largest companies in the world with global revenues of US$177 billion, and over 2.4-billion visitors per month to the Amazon website (Statista, 2018c). It typifies how the nature of shopping for most has changed from a visit to a mall or high street, to an online retailer such as Amazon.

Crime has also changed as consequence of where people do things (Wall, 2007a). There has been a long debate over whether the real rates of crime against individuals are falling (Farrell et al., 2011). In England and Wales, successive data from the Crime Survey for England and Wales (CSEW) showed a decline in crime, particularly volume property crimes such as burglary and theft. The CSEW had shown a peak in crime of around 20-million crimes in 1995 with a gradual decline to around 6 million in 2016. However, when questions regarding fraud and computer misuse–related offenses were added in June 2017, the 5.8 million was doubled to 10.7 million, illustrated in Figure 1 (ONS, 2018a).

OPEN IN VIEWER

Figure 1.

Estimated crime in England and Wales according to the Crime Survey for England and Wales, year ending December 1981 to year ending September 2018 (thousands).

The End of Public Police Dominance

Debates about the public police and private security have often focused upon the growing size of the latter and the growing networks or nodes of which private security form an important part (Cunningham et al., 1990; Dupont, 2006; Johnston & Shearing, 2003). There can be no denying the substantial growth of the “old” private security industry in many countries and the eclipsing of the public police in terms of size (see Small Arms Survey, 2011; Van Steden & Sarre, 2007). However, the public police are still at the center of this policing web (Brodeur, 2010). They are essential to most criminal investigations that go to court, are the most important in the vast majority of policing partnerships, are who most turn to when serious criminal incidents occur, and often have the best knowledge: in terms of intelligence and know-how. When the highly important act of prevention through patrolling is also considered, they are also still seen as the key leaders (Wakefield, 2006).

In the cyberworld they are much more clearly minor (but important) players (Wall, 2007b). Other state bodies outside the police structures have also been created such as the computer emergency response teams (CERT) of many countries (FIRST, n.d.). There are very few resources dedicated to preventive policing in this sphere by the state police. The mirror of the physical world of preventive patrol is virtually nonexistent, and their contribution to policing in terms of investigation hardly scratches the service. Take the example of computer misuse offenses (hacking, computer viruses, denial of service attacks, ransomware, etc.) in England and Wales. The CSEW estimated in year ending June 2018 there were 1.1-million offenses, of which around 22,000 were recorded by Action Fraud (the state reporting agency for fraud and cybercrime offenses) (ONS, 2018a). It must also be noted the CSEW data exclude organizations who are victims of this crime of which there are many thousands too (see Finnerty et al., 2018). In most years since 2007, however, there have been less than 50 prosecutions each year for these offenses by the state (ONS, 2018c). Although some of this attrition can be accounted for by other more serious offenses, such as frauds, becoming the offense that is counted (because of the Home Office counting rules), the marginal place of the public police in dealing with this offense is starkly illustrated. Also when an organization suffers a major cyber incident, they are more likely to turn to specialist consultants, such as RSA (n.d.), to deal with it and any subsequent investigations.

New Corporate Security Roles and Cyber Police

Organizations have sought to protect themselves from the growing problem of cybercrime by developing their own cybersecurity structures and purchasing the services from the “new” private security industry to better protect themselves. In most large organizations, there are cybersecurity structures led by what are generally called chief information security officers (CISOs) (Karanja, 2017). These run departments of various functions whose role is to prevent and deal with most cybercrimes against the organization. Rashid et al. (2017) have identified 19 knowledge areas, from five broad categories of cybersecurity. The Tech Partnership (2017) estimated there were 58,000 cyber security specialists working in the United Kingdom and globally. Silensec (2017) cite a report that globally there will be 6-million jobs in cybersecurity (with a gap of 1.5 million).

Beneath the CISO a wide range of new specialist cybersecurity roles have emerged. Some of the most prominent include the following: security architects, who design cybersecurity systems; security software developers, who develop the software for online security systems; cyber-incident responders, who deal with security incidents; security auditors, who check compliance with systems; and penetration testers (or ethical hackers), who test systems to see if they can hack them. There are many other specialist roles (see Tech Partnership, 2017).

The growing online space that people use has also led to new forms of private policing to deal with the deviance that takes place online. Facebook has created the “Community Operations Team” who investigate complaints and moderate the content placed on it (The Independent, 2015). Their work is supported by technology via automated tools which both facilitate automatic actions and highlight riskier areas for their attention. Microsoft has built a system of private policing and justice to police this online community called “Xbox Live Enforcement.” There is an extensive system of private justice where gamers can have their accounts suspended through to outright bans for breaching their terms and conditions. Indeed, it was revealed in 2009 over one-million users had been banned from Xbox Live for using pirated games (CNET, 2009).

One role, however, which deserves slightly more consideration as it is often neglected in the cybersecurity literature are the moderators. Like security guards police access and behaviors on private space in the physical world, moderators are assuming similar roles online (Wall, 2007b). They also share some common traits such as low pay, high labor turnover, and having to deal with incidents that lead a psychological toll on them (“Content Moderators for Tech Giants Like Facebook and YouTube Reveal,” 2017; Vanheule et al., 2008). The Sunday Times in 2019 reported Facebook had increased the number of moderators contracted to it from 4,500 to 15,000 in the previous 18 months with thousands more used by other tech companies such as YouTube, Google, and Twitter (Bleach, 2019).

Moderators are employed (or volunteer) to regulate the content which is posted on them. This can include removing posts, images, and videos containing illegal, disturbing, or inappropriate content through to less policing roles of facilitation (Wright, 2009). Websites use a variety of models including employing their own staff, using specialist companies, and sourcing volunteers. The nature of the web means that some moderators will be removing content from a website based in the United States, with users from the United Kingdom and moderators from another country, such as the Philippines (“When the Internet’s ‘Moderators’ Are Anything But,” 2015). There has been very little insight or research into their role. An article in the Guardian highlighted the work of one moderator policing the discussion forum of the television show “This Morning,” working from the comfort of her own home contracted by a company called Emoderation (now renamed “The Social Element”). It illustrated she had tools that highlighted certain keywords and could use these to delete inappropriate posts. Content removed could include racist comments, through to unacceptable remarks on a presenters’ appearance or those appearing on the program. Some comments may highlight the need for help such as suicidal feelings, requiring the moderator to report such posts (“A Working Life: The Website Moderator,” 2012).

There have been other reports on moderators that have illustrated the very difficult job they face. Many have suffered having to watch videos from warzones of beheadings, gutting of soldiers and child soldiers engaged in killing. Gross acts of cruelty against animals, bestiality, and very offensive comments are some of the other content they have to observe. There has been critique that many are not adequately supported for the content they have to view (Newton, 2019). The consequences of this is that many do not last in the job and there is high labor turnover (“Content Moderators for Tech Giants Like Facebook and YouTube Reveal,” 2017).

The “New” Private Security Industry

The needs of organizations and individuals to deal with the growing cybersecurity problems has spawned a wide range of new companies to offer such services as well as some traditional security companies and others moving into this area too. Some of the companies have emerged from the “old” security industry, offering the full range of services, including G4S which has a Risk Consulting arm that offers these services. There have been companies from other sectors that have moved into this area, such as the traditional consultants. For example, PWC offers cyber security services among all the other extensive services offered. BAE Systems has also developed such services coming from a largely defense manufacturing background and mainstream IT services providers like IBM. Others are new, and like the tech giants have grown rapidly: for example, Checkpoint Security Technologies, Symantec, RSA, and Kaspersky. Like the “old” industry, there are large players, catering predominantly for big organizations, down to petite companies focusing upon smaller firms. There are also many companies, such as Bulletproof (see https://www.bulletproof.co.uk), operating in niche areas like penetration testing. The supply of moderators has also spawned companies such as the Social Element (https://thesocialelement.agency/).

This is a new and expanding sector which is very dynamic as technology evolves and threats change. There has been very little research on this sector from a policing perspective, so below in Figure 2 is a list of some of the key segments of the “new” private security industry.

OPEN IN VIEWER

Figure 2.

Activities of the “new” private security industry.

The size of this sector globally is huge and growing. Market reports (which must be considered carefully as many do not reveal their methodology and are often predictions) show a sector that is beginning to catch up if not eclipse the “old” private security industry. MarketsandMarkets (2017) estimated the global cyber security market was worth US$137.85 billion in 2017, predicted to grow to US$231.94 billion in 2022, and Allied Market Research (2016) estimated the same sector would be worth US$198 billion by 2022. These can be juxtaposed to reports on the “old” private security industry which have estimated a global security market worth US$70.02 billion in 2016 (Grand View Research, 2017) to US$244 billion estimated by Freedonia (2013).

New Openings for Voluntary Participation in Policing

The technological changes have also fueled new opportunities for people to voluntarily participate in policing (Chang et al., 2018; Huey et al., 2013). These opportunities span a wide range of potential activities. The internet creates opportunities for open source research such that anyone with the time and skills can engage in desk-based investigations. For example, in one famous case in the United Kingdom a woman using Google images was able to show a man who had been presumed dead in a canoeing accident, whose wife had claimed the life insurance policy, was clearly a fraudster. She did this by finding an estate agent’s brochure online from Panama, with a picture of them both after his presumed “death,” and then alerting a national newspaper who informed the police, who had not yet discovered this (“How Google Helped Solve Canoeist Mystery,” 2007). There are even websites offering those with the time the ability to watch CCTV cameras and report potential problems (see https://www.insecam.org/).

Most controversially, however, it has facilitated a new form of vigilantism. The world of scams and particularly cyber-frauds has also spawned a variety of more organized online vigilante action, “digilantism” or “netilantism,” which is based upon websites and/or official groups. Some of these are linked to countries, others are more globally based. One prominent website http://www.419eater.com/ seeks to engage in “scambaiting,” which is simply engaging with scammers to waste their time.

The 419eater website is focused upon 419 scams but encourages action against other types too. The site provides news on scams and tips on how to waste the scammers’ time. There are a variety of other websites which can be found that fit this genre such as http://baita.mugu.co.uk/, http://www.ebolamonkeyman.com/, and http://www.romancescambaiter.com/. Another such as http://www.scamorama.com/ with a focus more on showcasing the variety and comedy value of some attempted scams, rather than baiting them. YouTube also provides a powerful resource for scambaiters too, where many examples of scammers placed on this website by some of the websites already noted as well as individuals. Some “scambaiters” have not only wasted the time of the scammers and exposed them, but effectively implemented amusing and shaming punishments on them sometimes involving racism (Byrne, 2013).

These types of vigilante action tend to be facilitated online and are open to the global (English-speaking) community, although there may be a bias to particular countries. Little research has been conducted upon them, and the extent and deeper analysis of their contribution and effectiveness is in need of further research. Such vigilante action, however, is rarely officially supported by the state police and is often viewed negatively.

The most contentious form of internet vigilantism that has emerged is the so-called “paedophile hunters.” Most of these groups pose as children online in chat rooms with the aim of exposing the pedophiles in varying ways. The most prominent groups in the United Kingdom are “Letzgo Hunting,” “Pedophile Hunter,” “Daemon Hunter,” “Dark Justice,” and “Hunters 24/7,” and it has been estimated there are 75 groups operating in the United Kingdom alone, described as a “cottage industry” (“Paedophile Hunters Like a ‘Cottage Industry,’” 2018b). The groups justify their acts on the basis of exposing pedophiles and passing the information they gather to the police (Hill & Wall, 2015). The actions of these groups have clearly helped the police and led to the exposure of real pedophiles who have subsequently been charged and convicted. For instance, in 2018 a man was jailed in the United Kingdom after engaging in explicit messages with what he believed was a 12-year-old girl, among others. He had actually been targeted by at least three groups of pedophile hunters (The Telegraph, 2018). In 2018, it was also revealed that many police forces in England and Wales have used the evidence gathered by such groups, with 150 persons charged as a result of their evidence in the previous year (BBC News, 2018).

However, some groups have live streamed exposures, and confrontations have occurred. There has been a concern innocent people could be exposed, and the humiliation for some has led to suicide. In 2014, it was claimed the suicide of one man exposed by the pedophile hunter “Stinson Hunter” was attributed to his public exposure (“Man Killed Himself After Stinson Hunter ‘Pedophile Trap,’” 2014). There has also been concern on the suitability of some for conducting such “justice,” as “Stinson Hunter” had been jailed in the past for 10 years for arson (“Online Crime Fighter Stinson Hunter Comes Clean to Telegraph About Checkered Past,” 2014).

Responding to the “New” Private Security Industry and Policing

The rationale for regulating the “old” private security industry has generally been built upon removing criminals, raising standards, and making the sector more accountable (Palmer & Button, 2011; United Nations Office for Drugs and Crime [UNODC], 2014). There have been very few scandals in the United Kingdom of criminals securing roles in the “new” private security industry and for some roles, such as penetration testers/ethical hackers, some organizations actually want to hire “reformed” past criminal hackers because of their proven skills. Not all “new” private security roles require such past experience, however, and the lack of scandals does not indicate there isn’t a problem or an issue. There is, however, clearly some evidence of past criminals becoming involved in pedophile hunting (see, for example, Stinson Hunter), and although such voluntary activities are not part of the private security industry, as a broader form of private policing that is growing and having a real impact of many people’s lives, perhaps there is a debate to be had over the regulation of who can engage in such activities? Just because a pilot is flying for herself and not being paid by an airline would not negate the need for regulation of such activities.

To which the next issue of standards is also an important issue. Much of the regulatory control aimed at private security is directed at the standards of operatives and to a lesser extent companies. The major exceptions are the aviation and maritime sectors where there are extensive standards on how security should be undertaken (Button, 2008). The low pay, long hours, limited training and consequently poor quality of security officers, has culminated in compulsory minimum standards been introduced in many jurisdictions to address these problems (UNODC, 2014).

There is, however, a limited base of evidence of poor standards of the growing number of providers and staff operating in the “new” private security sector. There would seem to be some evidence of low standards in terms of training, support, and pay among moderators (Bleach, 2019; Newton, 2019). The regular cyber and data breaches of corporates losing the data of their staff and customers may also indicate not all is well, as poor standards might be contributing to such breaches (see Finnerty et al., 2018). Much of the “new” private security industry is dominated by higher barriers to entry, and there is less of a “grudge cost” mentality dominating decisions in comparison to some of the “old” private security industry (Goold et al., 2010). Indeed, such are the barriers to entry; in terms of skills, there is much evidence of a substantial skills gap (Silensec, 2017). The economics of much of the “new” private security industry are different, although some subsegments such as moderators and their global supply may indicate something different. This does not mean there are no problems in the “new” sector. It just means we need to investigate this more to determine if there are issues which may require policy solutions.

The roles and accountability aspect to the regulation debate has not been one of the most prominent arguments in the regulation discourse, but it is one of the most important, if not the most important. Perhaps the exception to this are private investigators and door supervisors, which have attracted more interest in this aspect of the debate (Button, 1998; Lister et al., 2001). Primarily, this is because of the breaches of privacy and excessive force associated with these occupations. Excessive force is not an issue to be concerned with in the “new” sector, but privacy and a wide range of others are. The “new” private security industry activities and the voluntary contributions to the broader range of private policing activities raise a variety of issues that illustrate the need to consider greater controls to ensure accountability for some of the decisions that are taken by such operatives and the data they have access to.

Moderators in their role policing what goes online may have access to illegal pornography, sensitive information, and images that should not be in the public domain to name some. Alongside these, even more powerful roles such as CISOs, security architects, and penetration testers may also warrant the need for licensing as many other “old” security roles already are.

There has been huge concern raised by companies operating big data-related services in the political sphere, such as the activities of some such companies in the election of Donald Trump and the U.K. Brexit referendum (Christl, 2017; House of Commons Digital, Culture, Media and Sports Committee, 2018). There is a large industry offering data-related services to reduce the risk of cyber-related financial crime to organizations, among many other areas (Button et al., 2016; Christl, 2017). The designation of a person as higher risk in a financial decision can have implications for whether a person secures a loan, mortgage, or even keeps a bank account, and many of these companies operating in this area are making judgments about persons on an industrial scale with little public scrutiny of their processes or effectiveness.

For example, in one quarter, the company ThreatMetrix assessed over 8.3-billion transactions for their legitimacy based upon hundreds of attributes. They found over 151-million attacks and 1.6-billion bot attacks (ThreatMetrix, 2019). Many of the prevented attacks will involve the effective designation of the customer as a fraudster, without reference to formal criminal justice structures. There are many other data companies offering such services around the world designating individuals and data associated with them as potential fraudsters (see Christl, 2017). Some private entities also have access to cyber-tools as potent as the state’s which are used to engage in corporate espionage and other acts of damage against competitors (see Maurer, 2018; Zilber, 2018).

Designation as a fraudster based upon false or inadequate decisions might be bad, but pales in significance to been outed as a pedophile. The activities of the online hunters despite the condemnation of the police have been used extensively. The instant justice and shaming by some groups have led to serious harm and even suicides by some they have exposed. As already noted, there is evidence of unsuitable persons operating in such groups, with some with convictions for violence or criminal motives. For example, the Times recently exposed gangs of criminals using such groups as means to rob and blackmail pedophiles (Hamilton, 2019). The primary motives of some “hunters” might seem more directed toward feeding their desire for violence against one of the most despised groups in society, rather than dealing with the problem. The implications for someone wrongly publicly outed as a pedophile could be huge. There clearly is a role for some activities in this area, but the restriction and regulation of this would seem to be one of the more obvious areas of intervention. Some scambaiters have been implicated as engaging in racist practices (Byrne, 2013). These all suggest the need for more controls to be investigated for these activities.