Düsseldorf University Hospital was hit in 2020, Münster University of Applied Sciences two years later. And last fall, more than 70 municipalities in North Rhine-Westphalia were (largely) put out of action by an attack by cyber criminals. The large-scale attack on public infrastructure in NRW in October 2023 was without question one of the most far reaching hacker attacks ever in Germany. Picking up a new ID card, registering a car or getting a certificate from the citizens' office - this was not possible for weeks and months, especially in southern and eastern North Rhine-Westphalia, but also in individual municipalities in the Ruhr region.
In fact, according to the Federal Office for Information Security (BSI), an average of two municipalities or municipal companies fall victim to attacks from the internet every month. According to the industry association Bitkom, the theft of IT equipment and data as well as industrial espionage and sabotage cause more than 200 billion euros in damage to the German economy every year. All of this shows: The challenges in combating and preventing cyberattacks have steadily increased in recent years. Consequently, the NRW Ministry of the Interior is focusing even more strongly on this form of crime. The most visible sign of these efforts: A whopping 94 (in some cases very well-paid) new positions have been created for the new "Digital Crime Scenes" task area, which is dedicated to finding digital traces after cyberattacks on critical infrastructure and combating these attacks.
The order to set up this unit landed on the relevant desks at the State Criminal Police Office in Düsseldorf in the summer of 2022. A good half of the positions have already been filled with internal and external staff. "The experts are essentially divided into three groups: new technicians who will take care of the hardware and software for the project, special AI developers and crime scene teams that will be stationed in the six large police authorities in Bielefeld, Dortmund, Düsseldorf, Essen, Cologne and Münster as well as in the LKA," explains Helmut Picko, project group leader for "Digital Crime Scenes".
These rapid response teams are to "move out" if the worst comes to the worst. "A small team will first investigate the facts at the scene of the crime and set up the technology," says Picko, who is also head of the Cybercrime Competence Center at the LKA. With the help of this technology, digital evidence is secured and then uploaded to the police cloud so that colleagues in the authorities (or even in the home office) can start investigating with their laptops. Thanks to the powerful computer system, joint virtual offices are created. Offices in which the various crime scene teams support each other, for example if the specialist for the cybercrime case at hand actually belongs to a different crew.
The truth is that there is currently a fierce battle for talent on the job market, especially when it comes to AI, i.e. artificial intelligence - with corresponding salaries. Without AI, however, large amounts of data simply cannot be mastered. "Of course, we can't pay as much as is sometimes offered in the business world. But we score points with an exciting job. This is very well received by AI specialists on the market," says Andreas Bruns, head of the new project office, with delight.
About the money. If you want to fight cyber criminals, you naturally have to invest heavily in high tech yourself and not only buy it, but also constantly develop it further. This includes their own emergency vehicles, powerful laptops and cell phones, special backpacks in which everything is stored and power banks the size of hand trucks. These batteries provide the all-important energy when the power grid has collapsed. "We also rely on technology from the military sector, which ensures, for example, that a connection to the Internet can still be established in the third basement of a hospital that has been attacked, with the help of which the data can reach the experts," says Detective Superintendent David Berners, who is in charge of equipment/procurement in the project office.
One of the "newcomers" to the crime scene teams is Burak Uslu. The 27-year-old came from the Federal Criminal Police Office in Wiesbaden in the fall of 2023. The young man, who has a master's degree in IT security, is part of the Dortmund group. "I was very interested in the areas of responsibility outlined in the job advertisement, such as the role of 'first responder' in the event of a cyberattack," reports the Wuppertal native. "Of course, the opportunity to come back home appealed to me." Uslu emphasizes that the "top-notch" technology now available to him makes it possible, for example, to get a good overview of data volumes of ten terabytes or more that are difficult to grasp. To put this into perspective for non-nerds: a hard drive with a capacity of one terabyte (!) can hold more than 200 HD films or 200,000 songs.
However, the quiet settling-in period in the BVB metropolis and the planned internships in the various departments of the Dortmund police authority came to nothing. Reality got in the way of the orderly onboarding process. Burak Uslu: "Right at the beginning, at the end of October 2023, we went out with the local experts to combat the cyberattack on the city of Siegen and the Hochsauerland district. That was a very exciting and thrilling start to the new job."
Uslu raises an important point. The police in NRW were already successfully fighting cybercrime before the new unit was set up. The new people are therefore not working in a "vacuum". Helmut Picko and his colleagues were on the road throughout the state before the launch and presented the project with all its different facets in detail at the six major police authorities in a kind of "roadshow". After all, a completely new, cross-agency ecosystem is being created here. A system that still has to find its place in the police organization in the coming weeks and months. This is a challenge for the existing structures. There will be jolts at one point or another, not everything will fit right from the start.
With the new initiative, NRW is undoubtedly playing in a cybercrime league of its own. No other federal state or even the federal government can keep up. "However, if this force then falters due to a lack of teamwork, jealousies or disappointed hopes, then all the money and strong manpower are of little use," says Helmut Picko. However, he is certain that this will not be the case. "We have been able to recruit many people with great skills who will take our fight against cybercrime to a whole new level. But it's only when we work together with the cybercriminalists and IT forensic experts who have been on the job for some time that we will be able to bring the full force to the streets." Or in this case, onto the internet.