Digital Futures

The COVID-19 crisis is driving changes in the routines of institutions and individuals, as businesses, educational institutions and other organisations recommend or require employees to engage in social distancing in a collective attempt to minimise the spread of the virus. As well as having global socioeconomic effects, these changes in routine create opportunities for crimes. Dr David Buil-Gil, Professor Nicholas Lord, Professor Emma Barrett, Professor Daniel Dresner and Brian Higgins  examine what these new crime opportunities might be, and how we might mitigate the impact of digital security issues.

The move towards home working is affecting a large proportion of the population, and we can expect residential burglaries to decrease and domestic violence to increase in the coming weeks.

The number of cyber security incidents is likely to increase in the coming months, given the growing number of employees working from home.

Organisations asking employees to work from home should make sure they alert employees to the risks they may face when conducting their activities from home.

Individuals and small businesses need to be aware of attempts to entice them into parting with their cash.

The UK Government needs to identify and disavow attempts to target businesses and individuals – especially as some have done so by masquerading as UK Government departments or agencies.

Home working, routine activities and cyber-victimisation

The move towards home working is affecting a large proportion of the population. Those directly affected by the virus are encouraged to self-isolate, and many companies are asking employees to work from home. This has obvious impacts on citizens’ offline and online routine activities. For instance, many people will now be using their personal computers to access business information and web conferencing will be taking the place of in-person meetings. The number of people out on the streets will decrease dramatically and online shopping will likely grow as a way to purchase products and services. Businesses will most likely remain empty while homes will be occupied most of the time. All these changes are already affecting opportunities for crime.

The volume of residential burglaries will probably decrease in the following weeks, given that many will remain at home throughout the day and serve as guardians of their households. Pickpocketing is also likely to decrease around tourist attractions with fewer people to target. Nevertheless, the COVID-19 crisis may have the opposite effect on burglaries at businesses, since shops and companies may be targeted by criminals given the extended time that these remain empty, and domestic abuse rates are likely to grow.

The fact that many employees will begin using their personal computers and laptops to conduct business-related activities from home is also likely to increase digital vulnerabilities and cyber-victimisation. Many personal computers suffer from poor software protection, whereas office-based business-owned computers tend to be better protected against computer viruses. For instance, our preliminary analyses of the UK Government’s Cyber Security Breaches Survey suggest that companies that allow employees to use their personal computers to conduct business activity increase the likelihood of suffering cyberattacks by more than 20 percent. So we can expect the rate of cyber security breaches to increase in the coming months. But there are other cyber crime-related issues that are also likely to arise.

Online frauds and phishing

The internet allows for an increased visibility and accessibility to crime targets due to the absence of online guardians and the frequency and variety of everyday activities that users conduct online. If the COVID-19 crisis multiplies the number of users of e-commerce systems, either because persons with symptoms are self-isolating or because citizens spend more time at home to prevent contagion, it is also likely that new opportunities for online fraud will arise.

One may expect that the more online shopping there is, the more opportunities for cyber-criminals to target victims online. Moreover, the growing concerns about the spread of the virus create new opportunities for the selling of fraudulent coronavirus-related products. UK Action Fraud (the UK’s reporting centre for financial cyber crime) has so far identified more than 20 scams directly related to the pandemic, with victims’ losses greater than £800,000. The most prevalent example is the selling of disposable dust or surgical masks instead of recommended protective equipment, or the selling of masks that are never delivered. Other examples are the selling of bogus coconut and kale ‘cures’. Amazon has already removed more than one million fraudulent products. Moreover, cryptomarkets, which are typically used to pay for drugs, computer viruses and credit card details, are now being used to sell surgical masks and even coronavirus-infected blood.

Cybercriminals abuse public concerns about coronavirus in phishing campaigns, with bogus emails (see Figure 1) deployed to harvest login details from victims. Offenders also exploit the altruism of those who want to help: Kaspersky has reported fraudulent emails asking users to donate Bitcoin to support the finding of a vaccine. There are also reports of online ‘coronavirus maps’ designed to disseminate malware and steal passwords.

And criminals will entice victims with almost-credible promises in forged government notices, such as the one below in Figure 2.

Figure 1. Fraudulent email

Source: Proofpoint

Figure 2. Forged Government notice

Source: Yorkshire and Humber Regional Cyber Crime Unit

What can organisations do?

The most effective strategy to prevent cyber crime is to develop training and awareness programmes specific to internet exposure risks. So, organisations asking employees to work from home should make sure they alert employees to the risks they may face when conducting their activities from home. Point them towards reputable sources of guidance. For instance, Action Fraud, the Financial Conduct Authority and National Cyber Security Centre (NCSC) have published tips to prevent fraud and phishing scams during the coronavirus crisis.

Ideally, organisations should also provide equipment and software for employees to work from home, but in these extreme circumstances, many employees will need to use their own devices. NCSC has published guidance for organisations on developing a ‘Bring Your Own Device’ policy, much of which will be relevant to people working from home.

What can individuals and small businesses do?

Individuals and small business owners should put in place short-term measures such as taking snapshot backups and assuring access to the work of colleagues who may need to take time off sick. Doing this without messy password-sharing is essential.

In addition, they need to be aware of attempts to entice them into parting with their cash. When buying goods, they should use reputable suppliers to avoid supply frauds. It is essential to be cautious when dealing with emails asking for money or to authorise a financial transaction. In such circumstances, a quick phone call to a reputable number to check the request is genuine might save you losing money to criminals.

What can the Government do?

The UK Government needs to move quickly to identify and disavow attempts to target business and individuals. The cooperation with e-commerce providers will be key to prevent fraudulent products from being advertised, and UK Government agencies should establish dialogue with insurance companies to ensure that these can manage the impact of COVID-19 on their operations while protecting consumers’ rights.

It is key that agencies such as Action Fraud, the Financial Conduct Authority and NCSC keep updating their guidance on this. To reduce offline risks, businesses will no doubt be reviewing the security measures at premises that will be left empty.

In order to mitigate the impact of social isolation on women and children experiencing domestic abuse, many charities offer opportunities for support via online methods, but they need resources to continue, and local governments and police must also play their part. At a time when council and emergency service resources are stretched to their limits, responding to intimate partner violence could easily be forgotten. The government must ensure that it is not.

Originally published 19 March 2020

During the COVID-19 pandemic, mental health services are providing support remotely.  Dr Warren Mansell, Reader in Clinical Psychology, discusses the positive ways that services have adapted and how they can be sustained in the future.

Prior to the crisis, and despite over a decade of government initiatives, demand has outstripped supply. Now during the crisis, particularly during lockdown, there has been a recognition of the increased mental health needs for issues such as domestic violence and abuse, traumatic grief, and addiction.

On top of the increased demand, the crisis has revealed that mental health services rely on procedures that make normal services impossible to deliver at the necessary scale and urgency during lockdown. These include:

·      Screening patients to check that their problems are severe enough to warrant any support;

·      Diagnosing patients to triage them for one of dozens of therapies known to have an evidence base for their specific condition – such as post-traumatic stress disorder, obsessive compulsive disorder, and social anxiety;

·    Appointments being set for people by services, often weeks ahead, and limiting the appointment to a specific number (e.g. six sessions in primary care);

·      Written materials such as questionnaires, thought diaries and activity schedules that patients are expected to complete before, during and after therapy, and storing clinical notes of what patients reveal during therapy and keeping these confidential.

Adapting to a new normal

However, the crisis has also provided the kernel of a solution. Many mental health services are adapting to remote working. There is a new normal emerging for many therapists during the crisis. This could be the model going forward.

Firstly, therapists (eg clinical psychologists, cognitive behavioural therapists, counselling psychologists) in mental health services should provide an array of slots for their clients to book to video call or telephone with them – potentially at home. The informality of this arrangement is potentially a benefit rather than an issue.

Services should provide a talking therapy (counselling, psychotherapy or cognitive behavioural therapy) that is directed by the client’s own immediate priorities, and the therapy should draw upon therapeutic principles for dealing with distress that are universal to everyone – to include people without a diagnosable mental health disorder.

A talking therapy of this kind – focusing just on enhancing the process of recovery within the client – would not require the huge degree of screening, diagnosis, extensive note-taking and confidentiality requirements that are commonplace at present – and that have proved so burdensome to manage during the COVID-19 crisis.

The effect would be to greatly increase the capacity for psychological therapy so that the existing unmet need can be met. Also, because people would book sessions when they needed them, this would ensure that the service is used efficiently, with greater support for those in greater need. By removing the requirement for much of the paperwork, the whole system would be more efficient. Such a vision may seem idealistic. Yet our research group has been accumulating evidence for such an approach for the last decade.

Universal approaches

The changes in mood, thinking and behaviour used to assess the severity of a psychiatric disorder are extremes of experiences in the wider population. For example, the majority of university students report some of the symptoms of bipolar disorder; and many people in religious movements value hearing voices (known as auditory hallucinations). Conversely, the sources of distress in people with severe mental health problems are often nothing to do with their psychiatric symptoms. All of this evidence suggests that people don’t need to have a ‘disorder’ to deserve and benefit from talking therapies. Without the stigma and often extensive referral procedure, therapies are much more accessible. It also opens the door for professions – health professionals, emergency staff, armed forces, teachers, prison officers – to get help to deal with their challenging work and be supported before their problems get more serious.

The changes in mood, thinking and behaviour that are targeted in talking therapies are largely the same, whatever the diagnostic label that a person is given; they are ‘transdiagnostic’. A series of studies we carried out consistently found the same ‘core process’ across a wide range of different mental health diagnoses. We are testing whether this core process is the restricted awareness of chronic goal conflict. Evidence of this kind indicates that there is little scientific case for requiring a lengthy diagnosis to establish different therapies for different disorders.

Control and self-direction

When people can choose their own appointments, they are more likely to attend, they choose a modest number of sessions (averaging three to four) to suit their own needs, and together this greatly increases the efficiency of the therapy. Moreover, in mental health services, and even in counselling in high schools, we have found that people prefer to book their own appointments and choose the topic for the session themselves. People thrive when given control.

In our in-depth interviews with people who have achieved long-term recovery from long-term mental health problems, they consistently tell us that they are ‘the directors of their own recovery’. We have evidence that the active ingredient of change during talking therapy may be a process that improves when a person can express their problems openly and freely. The therapist can enhance this through their questioning rather than requiring homework, psychoeducation or sharing of information. This process may even be carried out by trained novices, or enabled by an automated system that encourages the exploration of a problem. It may even work through instructions to write about one’s difficulties – expressive writing or journaling.

There is an opportunity now, to keep the new normal, and to make headway in supporting all those in need of psychological help, by providing user-led, remote, informal and universal talking therapies.

Originally published 18 May 2020

With special thanks to our contributors:

Emma Barrett is Professor of Psychology, Security and Trust and The University of Manchester Strategic Lead for Digital Trust and Security. She is also Director of SPRITE+, the EPSRC NetworkPlus for Security, Privacy, Identity and Trust.

David Buil-Gil is a Research Fellow in cyber crime at the Department of Criminology of The University of Manchester. His research interests cover environmental criminology, crime mapping, emotions about crime, new methods for data collection and open data.

Daniel Dresner is Professor of Cyber Security at The University of Manchester. Danny is also a founder and director of the IASME Consortium which champions cyber security for small businesses and runs a cyber security programme for neurodiverse individuals, employing them in a community security operations centre offering security oversight for charities, SMEs, and vulnerable people.

Pete Duncan is an incoming PhD Criminology candidate at The University of Manchester. For his PhD, Pete has been awarded a full ESRC scholarship to research financial crimes – including fraud, tax evasion and money laundering – in professional football.

Terry Hanley is the Interim Director of Social Responsibility for the School of Environment, Education and Development (SEED) and the Programme Director of the Doctorate in Counselling Psychology within the Manchester Institute of Education. He is co-editor of ‘The SAGE Handbook of Counselling and Psychotherapy’ and regularly presents at national and international conferences on therapeutic issues relevant to children and young people. He currently volunteers as a Football Therapist with the charity ‘Freedom from Torture’ in Manchester.

Graham Haughton is Professor of Urban and Environmental Planning at The University of Manchester. Graham's research interests include sustainable urban development, urban regeneration, regional development, and water conflicts.

Brian Higgins is Project Manager for the Cyber Foundry programme at The University of Manchester and the UK security spokesman for Comparitech.com. He has previously served as an Officer of the Serious Organised Crime Agency from 2008 until 2013, completing his time in law enforcement in what is now the National Cyber Crime Unit.

Nicholas Lord is Professor of Criminology in the Centre for Criminology and Criminal Justice at The University of Manchester with research expertise in white-collar, financial and organised crimes, such as corruption and fraud, and their regulation and control.

Warren Mansell is Reader in Clinical Psychology at The University of Manchester. He researches, trains and practises universal psychological interventions for mental health problems and wellbeing. He also uses a theory known as perceptual control theory to develop and test new approaches to experimental psychology, mental health, dementia, human action control, and robotics.

Nuno Pinto is Lecturer in Urban Planning and Urban Design at The University of Manchester. His research interests focus on the use of quantitative methods in urban planning and their integration in decision-making processes.

Michael Prentice is a research fellow focusing on digital trust and security within the Digital Futures initiative. His research focuses on the impact of securitisation on office life and culture in the UK and Korea.

Iain White is Professor of Environmental Planning at the University of Waikato. He researches issues connected to the interface between science and decision-making.

@UoMPolicy

The opinions and views expressed in this publication are those of the respective authors and do not necessarily reflect the views of The University of Manchester.

August 2020

The University of Manchester

Oxford Road, Manchester

M13 9PL

www.manchester.ac.uk