Note: Where available, the PDF/Word icon below is provided to view the complete and fully formatted document
Parliamentary Joint Committee on Law Enforcement
09/09/2014
Financial related crime

DICKSON, Mr Paul, Assistant Commissioner, South Australia Police

[09:57]

CHAIR: I now welcome Assistant Commissioner Paul Dickson from the South Australian Police. I remind committee members that the Senate has resolved that an officer of a department or agency of the Commonwealth or of a state shall not be asked to give opinions on matters of policy and shall be given reasonable opportunity to refer questions asked of the officer to superior officers or to a minister. This resolution prohibits only questions asking for opinions on matters of policy and does not preclude questions asking for explanations of policy or factual questions about when or how policies were adopted. Thank you for coming down today. I invite you to make a brief opening statement and then the committee will ask you some questions.

Mr Dickson : To give you some context, in my position I have portfolio responsibility surrounding major crime, major fraud, electronic crime—including the investigations of all things which are seized in relation to the analysis of electronic crime articles—as well as all gang related crime, serious and organised crime, drug crime, intelligence, sex crime and covert investigations. So there is a fairly broad range of different portfolios within that division.

What I wish to do today, if I can, is lead with an example which I think clearly illustrates some of the issues that we have when investigating matters of importance to this committee. Last year our drug and organised crime people commenced an operation into what we are referring to now as an online drug vendor store. Two offenders were purchasing drugs overseas and bringing those drugs into Australia. Once they had received those drugs they were then referring the drugs on to different parties. So they were drug dealing but hardly ever touching the drugs themselves. They were obviously using the internet and other electronic crime facilities to enable them to do that.

It came to light in September last year, when Customs identified some small packages of ecstasy tablets and prescription items which were going to a particular address in Adelaide. They advised us and we had a closer look at what was being sent to that address. Over time we identified that there were a number of packages which contained methylamphetamine and prescription medication—particularly Xanax—and ecstasy in tablet form.

In a very short period of time we were able to seize hundreds and hundreds of tablets of methylamphetamine. What we then did on a particular day is we went to the address that those individual items had been sent to. We arrested an offender and at that time we were able to locate on his computer approximately 80 consignments which had come in and which he had then sent out. The information we received at that address led us to another location where we identified a second offender, and this second offender was very well experienced in and had a great technical knowledge of computers. What we identified at that address was a further 500 transactions of drugs coming into the country and then being redistributed to not just South Australia but everywhere throughout Australia. Those 500 transactions all occurred within a fairly short period of time—just a couple of months.

In general terms, you may ask: how does that relate to financial crime? What we know is that they were able to set up their business, set up the Visa debit cards and set up false offices in the UK. To give you a bit more information there, Customs are aware that if a package comes from China, for example, or some other location such as that, there is a high degree of risk. What would happen is that, because of where some of the drugs were coming from, they would be sent from that location into the UK or the USA, where they were repackaged. Then they were coming into Australia from that location. So they were setting up these virtual offices in these locations, all on false identities or using as their contact numbers mobile phone numbers which had been purchased using false identities. They were using Visa cards which had been purchased with a false identity and all of their payments were done in bitcoins.

We know, as I said before, that over a 46-day period there were 700 sales of these drugs, all paid with bitcoins. They had acquired millions and millions of dollars worth of assets using bitcoin as their preferred payment option. As you may know, bitcoins can value anywhere between $500 and $1,000 for one bitcoin. The problem we have is that there is no regulation in relation to bitcoin whatsoever. It is very easy to get a bitcoin account. It is very difficult to identify who has that account and the value of the account. So there are a lot of issues there as well.

What is really interesting in relation to these to offenders is that both offenders were in their early teens and did not have any criminal history whatsoever. They did not fit the mould of the normal drug dealer. They saw a business opportunity using the commodity of drugs and they were able to make an awful lot of money within a very short period of time. Seizing some of their assets is quite difficult because of the way that they had set themselves up. They had alienated themselves by using all these false identities, so we could not go down the normal road of confiscations. We were unable to do that in this case. It is just an example of people who are very bright and use the commodity of drugs. And it could have been anything else—stolen tobacco, precursors—but they decided to use methamphetamine as the commodity of choice. They brought it into the country and then on-sold it to the people who had put their orders in, all through the darknet. We were unable to get to any of their customers because it was all on the darknet and then there is the onion router. Do people understand how the darknet operates?

Senator SINGH: No. tell us.

Mr Dickson : Basically, to keep it very simple, you have what is called the onion router. That is a piece of software that you download onto your computer. Once you download it, that allows you to go to the darknet sites. These darknet sites are predominantly around child exploitation material. There are drug sites. They had identified their own drug sites. It is a bit like Gumtree—you put an order in, say what you want, you give an address and then it will be sent to you. But because of the way the site operates, it uses your IP address because it comes through what is known as the onion router. There is no way of identifying who the person is. Because it comes in through that piece of software, the actual identity is stopped.

There have been other ones which have been in the darknet which have been closed down. But it is one of those things where it is a continual process. It is very difficult for agencies and in this case the FBI was able to close down a particular darknet site which related to drugs. They were able to create this particular darknet site that enabled people to purchase drugs online. It worked at both ends: they were able to order and they were able to disseminate the drugs.

Everyone is in this to make money. That is the purpose. These people were not doing it for any other purpose. They were not consumers of drugs. They did not lead a drug-type lifestyle. They were there to make money. They used the drugs as their commodity of choice. With the problems we have today, they were able to move themselves away and make it more difficult for investigators.

Mr WOOD: How can there be trust by the buyer? Is there some rating system?

Mr Dickson : There are rating systems. Usually you find that people make a small purchase first and then build up credibility. It is a very difficult concept for people from our generation to understand, to be frank, because we usually like to see something before we buy it. The younger generation are quite happy to work in this sort of environment and they probably prefer to work in this sort of environment where they build up trust. Because there is an anonymous factor to it, there is not much risk to them as individuals. When there is little risk but great gain most people take the opportunity.

CHAIR: Given that the key to these schemes is the financial aspect and you made the point that they had used false identities, what are the requirements for setting up a bitcoin account, and if they also had Visa debit cards et cetera, where were they sourcing those false identities from? Were you able to out and shut down that aspect of it?

Mr Dickson : There are two questions there. To set up a Bitcoin you could use a false name. It works on being anonymous. There are obviously passwords and those sorts of things that you can obtain. Within the bitcoin purchasers there are people that exchange and transfer bitcoin. You would not be able to go to the Savings Bank of South Australia and hand in your bitcoins. You cannot do that. It is more peer-to-peer. There are particular financial agencies where you can trade in your bitcoins. On a bitcoin account you might have 100 bitcoins, and that equates as being US$100,000 or whatever the case is. There is a financial number at the end of it and that varies almost on a daily basis, like a lot of exchange systems do.

In relation to the false accounts, the false identity, that is the same as any other problems that we have where people's identities are stolen. That is what they had done here. They had stolen other people's identity and got to their 100 points through stolen licences or statements—those sorts of things—which they had built up. There are criminal organisations which sell the identity. As to how they got that identity, I do not know.

CHAIR: You have not been able to backtrack that?

Mr Dickson : No, we have not. South Australia is the same as most other jurisdictions at the moment. We certainly need to look at legislative change. We can get a warrant to enter a house and search that house, looking for evidence. But the warrant does not allow us to get into the computer. If the computer is encrypted there is no way we can force a person to give us the encryption or the passwords or those sorts of things. That is a whole new issue that we need to look at. From my personal view in South Australia, I am going to look at whether we can get legislative change in relation to that. We are in a different world today. Before, when there was evidence of a criminal offence, you would go and search the house, looking for stolen property or documents or whatever. The warrant gave you the authority to do that. Today, most of the evidence is in the computer box and it has an encryption. It is no different to the analogy that we can use a warrant to go into a house; there is a safe, but if the person does not give us the key to the safe, we can break open the safe, because we have the power of the warrant to do that. But with a computer, it is not so much that we do not have the authority but that we do not have the ability to get inside a computer. The person has the password, and that is very difficult for us to get it. From a legislative perspective there are a lot of difficulties. The first one I can think of would be that you might have a two-year penalty of imprisonment for failing to give over the password, but the offence that you are dealing with, if it is a child exploitation type offence, could be 15 years. If I were in that position, I would not be giving up the password and I would cop the two years.

Senator O'SULLIVAN: What about an open contempt position, where they are left in contempt until—

Mr Dickson : That is another option. All I am saying is that the criminal environment has changed, and to some degree our legislation needs to catch up with it a bit so that we can enforce what I believe the warrant gives us the power to do. We cannot actually do it because of the problems that we have from the enforcement perspective. That is another issue that we need to deal with.

CHAIR: I know you have used the example of these guys with the drug trade, but what specific examples do you have in South Australia of financial related crimes and issues? I know you have significant Indigenous communities in remote areas in South Australia. We had some rather telling testimony yesterday in relation to financial fraud issues in Indigenous communities in particular. Do you have any evidence or examples of that in South Australia?

Mr Dickson : We have a couple of investigations we are running at the moment that relate to specific offending within Aboriginal communities. A lot of that offending is supported by not having really good policy positions, if you understand what I am saying. In most areas, strong policy and audit capability mitigates the opportunity to offend, especially if you have a strong audit process. If you do not have very strong policy positions it is about who has the authority to use that account or how much can be used and those sorts of things. If they are very weak, that creates issues and creates an opportunity to commit offences.

CHAIR: It lacks governance, in other words.

Mr Dickson : Yes, it does, because there is no real audit process. You do not have an independent auditor or manager coming in on a regular basis, saying 'Paul Dickson, why have you authorised that expenditure of $1,000 when your level is only $500?' or 'You do not have the ability to pay that account to that particular individual.' It is all those sorts of things. Then you get into conflict-of-interest issues, where there could be some relationship with the person settling the account and all those sorts of things. Where you have a weak governance position, that certainly allows opportunity to commit offences. That is one part of the issue. You have the government's relaxed policy position.

Then you have the difficulty, like with a lot of strong community groups, where you have people who do not like to inform on their peers, relations and so on. It can impact on them as individuals within the community, if they are talking to the police and providing information to the police. Those sorts of issues can be resolved, but it is difficult sometimes to resolve them.

You have the added problem, which is an important issue, from the investigation perspective, when you are now seeking to have bankers' orders to get the information you require from banks relative to those accounts. Sometimes that information takes an awfully long time to be provided to the investigating authorities. This delays the investigation. Sometimes it allows the offending to continue while you are investigating the matter.

We have examples where you might do a banker's order on a particular bank. You might get the information you need within two months but it takes another six months to get the checks you require. It is done on a check or other vouchers that relate to that offending. That is the evidence of proof you need, the vouchers and those sorts of things. If they are delayed another six or eight months, from an investigative perspective it becomes quite difficult.

On how we can fix some of these issues, in my view as a law-enforcement officer, we do need to have time frames for banks and other agencies to provide information. If we do not it becomes very difficult, from an investigative perspective. I am probably getting away from your question, somewhat, but there are other issues too.

When the information is provided to us, it is usually provided in a hard form. I have examples here. The investigator is looking at 30-odd bank accounts and the details of those 30-odd bank accounts have all been provided in hard form over five years. You can imagine the number of transactions. The police or law-enforcement agency, to make any sense of all these numbers, have to sit there and manually transfer all that information onto an Excel spreadsheet or accounting software. There is no ability that we have been able to come up with where there is a partnership between the law-enforcement agencies and the banks, where all this information can be provided in a particular electronic format that enables the format to be manipulated by the law-enforcement agency conducting the investigation. Predominantly, it is provided in hard copy, requiring someone to take those numbers from there into here. In 2014, that is somewhat ludicrous, I would say.

CHAIR: Yet I can go into my internet banking and download it into whatever software I want to use.

Mr Dickson : I have examples here. A particular fraud investigation might have taken 1,300 or 1,400 hours to manage, and 30 to 40 per cent of that time—from an investigative perspective—has been on the manual transfer of information into a spreadsheet, whether it be an accounting spreadsheet or an Excel spreadsheet, to assist with the manipulation so that we can understand what is happening. When you have a number of different bank accounts, the forensic financial accountants need to get all the information into a database to compare them and to make the most sense from it.

CHAIR: That is enormously time-consuming and costly as well.

Mr Dickson : Yes, it is.

Senator SINGH: We heard from the Bankers' Association this morning. I do not know if you were here, Commissioner, when they appeared before us.

Mr Dickson : I just came in at the end.

Senator SINGH: They said they have this financial crimes steering group across the various banks, where they share information relating to suspicious transactions and that sort of thing. Do you at all liaise with banks on that?

Mr Dickson : We do, but the difficulty we have is you have a number of different banks and their profit-making is not to assist law enforcement agencies. They are there for the stakeholders and shareholders, so it is very difficult for us to get the information in the way that we want it. If you look at it from a benefit analysis, it could cost them a significant amount of money to change their systems to provide it in a way that assists law enforcement. I would argue there is a crime-prevention aspect to this, coming from a law-enforcement perspective, but it is difficult to get all banks to think in the same way.

I will give some examples that I have been provided with here. The ANZ advised that they can only provide printed or scanned format, because the current programs do not allow export into a CSB or any other electronic format. The Commonwealth do not currently have the capability but have an IT project in place. ING bank can provide electronic format but refuse due to the evidence considerations. That has been provided by their legal advisers. Westpac, BankSA and St George provide printed scanned format only. Current programs do not allow export of CSV files.

Senator SINGH: I guess what they were saying was that they provide this information but it is a one-way street. They feel that—I do not want a verbal them; we can go back over the transcript later. They are on the ground; they are on the front-line. Obviously they have these heads of financial crime and group-security heads within their banks who become aware of these suspicious transactions. They share them between banks, through the steering group. But law-enforcement agencies just want that information. They do not actually get to share and be part of the crime-solving process, I think is what they were trying to say. Other than demanding the transactions in whatever format, do you liaise with them about their front-line evidence, these suspicious transactions, and what they are finding out on the ground?

Mr Dickson : We do. I suppose it is all about different states operating in different ways. We do in South Australia and I am sure other jurisdictions would, but it is all to get to the level of change which is required here. What I am talking about here is a significant policy change and significant dollars would need to be spent by the banks to create one way of actually providing this information. That is the difficulty. I think it would require some sort of software which all banks could link into and which is compatible between all banks and obviously compatible with the law enforcement agency as well. I am not saying it is easy, but it is something we need to move towards. We should try to do it through forming partnerships. To a degree we have, but we have not been very successful. That is the best way to achieve any outcome when you have got a number of different agencies involved. If that does not work, there may have to be some more governance around the actual requirements. That is an expectation. My personal view is that there is an expectation by the community that the information can be provided in a way that can be used. You are talking about the 1950s where some poor unsworn member of a law enforcement agency or a police officer has to get down there and go through, line after line—and there could be thousands and thousands of lines—and just start entering—

CHAIR: There are two different components to that, aren't there? There is the raw transaction data on the statements and it would be much more efficient if it were in an electronic format.

Mr Dickson : That is correct.

CHAIR: As I said before, it seems passing strange that they cannot provide that to you when they can provide it to me, through my internet banking facility, and most businesses. But then you still require the hard copy of cheques et cetera that are written out to verify signatures or whatever on those cheques.

Mr Dickson : I suppose the issuing of cheques is probably reducing. That is because people do not use cheques as much as they used to use them. Everybody would have had a chequebook 10 or 15 years ago. I have two daughters and neither of them have a chequebook. They do everything by internet banking.

That is a change in culture and a change in the business process. Probably in 10 years time, I would imagine nobody would have chequebooks. But there is still evidence within those cheques which, at the moment, we still require in some investigations. It does create some difficulties for us.

Mr WOOD: One question, Commissioner: with respect to this bitcoin, because it is international, is there any legislation you would recommend that we need to be looking at?

Mr Dickson : I think it is very difficult for that same reason. That is why people use it in the manner they do, because it is not one bank that has it. It is a peer-to-peer thing. There are particular agencies which do sell bitcoins, but they are not regulated us such. I am sure that if today we were able to regulate the bitcoin world, which I do not think we can, tomorrow there would be bitcoin mark 2. But we can do more to strengthen our endeavours to prevent the creation of false identities and those other issues and to talk about bankers orders, which I spoke about before, and the password issue because, currently, there is more and more information in that box and I think that is very important.

CHAIR: Thank you, Assistant Commissioner. I appreciate your time. A copy of the Hansard transcript will be provided to you for checking and will come back to us with any corrections. If we do have any other questions, we will certainly be in contact with you. We appreciate your time today. Thank you.

Mr Dickson : Thank you.

Proceedings suspended from 10:29 to 10:43