Chamber and committees

I welcome this opportunity to discuss cybercrime and the devastating impact that it can have on people and businesses. I thank the Criminal Justice Committee clerks for all their work to arrange the evidence sessions and compile the committee’s report.

As was made clear throughout the evidence sessions, this problem is not going away—in fact, it is getting worse all the time, and more people are doing it. The technology that they are using is becoming more advanced. The criminals have more resources behind them—either from serious organised crime gangs, which always get themselves involved when they think that there is easy money to be made, or because of the increasing role that bad states such as Russia, Iran and North Korea are playing in this area.

This is a global problem, of course, but even the statistics for Scotland paint a grim story. According to official recorded crime data, there were an estimated 7,710 cybercrimes in Scotland in 2019-20. By 2024-25, the figure had almost doubled to 14,120. That equates to 38 incidents a day, which cover everything from fraud and extortion to sexual abuse and exploitation. We know that many such crimes are never reported, so the true picture is likely to be far worse.

The question that MSPs face is what to do about that. In the first instance, we must look to Police Scotland and the Scottish Government. I do not believe that this hugely complicated and difficult subject should be the source of an intense political blame game. Even if not a single person in Scotland was guilty of a cybercrime, the problem facing ordinary Scots from international threats would still be considerable. My contribution to the debate is therefore intended to be entirely constructive.

The police do great work in this area, but they need more support. The difficulties that the force faces when it comes to officer numbers and resources—not to mention the impossible environment in which the police work—have been well documented in the chamber. They have a specific ask on this topic, which I urge the Scottish Government to deliver in full.

Chief Constable Jo Farrell has said that Police Scotland needs £105 million just to stand still, in effect, when it comes to officer numbers, and that a further £33 million would enable her to strengthen the workforce. That includes £6 million specifically for tackling cybercrime. She has cited cybercrime as a major problem, while the Scottish Police Federation has said that the response to cybercrime is being weakened by a lack of cash.

When she delivers her budget in the new year, the Cabinet Secretary for Finance and Local Government must give the police every penny that they need. That money is important, because it has been proven that, when the justice authorities are supported, they can make an impact.

The banking protocol, whereby police work with bank staff to spot potential fraud in customer transactions, helped to save Scots £750,000 in the first three months of this year. Hundreds of incidents were prevented—often ones that would have involved elderly and vulnerable customers transferring money or handing over sensitive data to people who wanted only to exploit them and cause them harm.

The Edinburgh-based Cyber and Fraud Centre Scotland, which is headed by Jude McCorry, has done some great work to raise awareness and encourage businesses to work together to avoid themselves and each other being scammed. Its cyber and fraud hub has helped more than 500 victims over the past year, has prevented hundreds of thousands of pounds from being lost and, in some cases, has helped people to recover what was lost.

The organisation has also done great work on encouraging women to get involved in cybersecurity. Recent events brought together about 200 women and girls in the hope of guiding them towards a career in that area. We, in the chamber, are all well aware that, if we want the very best people to be involved, we cannot afford 50 per cent of the population thinking that it is not a subject area for them.

Cybercrime targets the most vulnerable people in our society. The despicable criminals who indulge in it do that on purpose. Their merciless exploitation of elderly people—taking advantage of the possibility that they are not up to date with technology or that they may be susceptible to being tricked—is inexcusable. Similarly, those who target young girls online in the hope of exploiting them sexually deserve the most severe punishments. We, in this country, can only do our bit while hoping that international agencies and foreign Governments step up, too.

Police in Scotland require more specialist skills, digital forensics and sustained investment. The Scottish Government must match its words with actions, to ensure that we have enough officers and capability in the wider justice system to hold to account those who are responsible.

Nobody is safe from cybercrime: from huge companies such as Jaguar and Marks and Spencer to small Scottish businesses; from major Government agencies, such as the Scottish Environment Protection Agency, to our smallest local authorities; and from wealthy individuals who are robbed of thousands to vulnerable people who lose everything that they own. That is why the problem deserves our utmost commitment and attention.

The cabinet secretary has acknowledged the importance of preserving records and information that are relevant to the review, yet instructions to review and retain documents are being issued only today. Given the concerns about the loss of evidence in historical abuse cases that have been raised repeatedly by victims, experts and the Parliament, why were those safeguards not put in place at the outset of the process? What assurance can the cabinet secretary give that relevant records have not already been lost during the delay?

I condemn the horrific antisemitic attack on the Jewish community at Bondi beach, in Australia.

England uses a digital general practitioner marker in firearms licensing, which means that doctors get an automatic flag if a patient with a mental health illness has access to firearms. Can the First Minister explain why Scotland does not currently have an equivalent digital system, and can he say whether that has been considered?

You want there to be a higher threshold. Even if people who have committed such serious offences do not plead guilty in advance, would there not be more evidence in those cases to get a guilty verdict?

So, there needs to be more detail on how it would work.

Should the register have only the top 3 per cent of offenders in it, or should it be opened up to more people? I thought that you were suggesting in your submission that you wanted the register to include more people.

If you had more detail on how the proposed system would fit in with the current structures, do you think that it could be beneficial?

I want to ask about the reporting requirements under section 1, on which there are differing opinions. In its submission, COPFS said that restricting the definition of people who would be on the register to those who had been sentenced to

“12 months or more in prison or … a community payback order … is potentially confusing and is inconsistent with the importance placed by criminal justice agencies and third sector organisations in Scotland of a consistent definition of domestic abuse.”

However, would the bill not mean that being put on the register would become a deterrent to somebody who had a lesser charge—perhaps somebody who was a first offender? COPFS said that it wants more people to be involved, but that might lead to more bureaucracy, whereas the bill is intended for high-level offenders.

Meanwhile, the Law Society said:

“We consider that the proposed provisions in Part 1 could create a real risk of labelling people as inherently dangerous … In our view, a higher threshold for registration would produce a more meaningful register”.

Should the bill ensure that only those who pose a higher level of risk would go on the register, as opposed to what it proposes at the moment?

Finally, Police Scotland said:

“On review of Part 1 to the bill, we are not of the opinion that the significant investment of budget and resources needed to meet its requirements are proportionate”.

If you had the resources required, would what is proposed in the bill fill a gap in the system, with the result that you would be more supportive of the bill?

Yes—thank you.

Has the Official Report been corrected yet? If it has not, why not?