Walking Into a Police Station (Cybercrime, 2023)Archived

I wanted a part of tech that would force me to learn all the other parts.

Security is that. You cannot protect a system you do not understand, so the work keeps pushing you outward into networking, systems, web, mobile, whatever the thing in front of you is built from. That is why I picked it.

I was preparing for the CEH exam through all of this, and that was the problem. It was all reading and practice, and I wanted some of it to be real.

Six months of nothing

There is a national cybercrime volunteer programme. I applied, and on 19 August 2022 I got the confirmation.

Then nothing. No task, no contact, no next step. Six months of it.

By early 2023 I stopped waiting and walked into the II Town police station in Madanapalli.

I was not nervous, which surprised me later more than it did at the time. I knew exactly why I was there. I wanted to help with cybercrime work, and I could.

Siddu

The person who handles complaints there is a constable. I know him as Siddu.

I told him I had applied to the volunteer programme and heard nothing back. He explained why: the portals were under maintenance and being rebuilt, nothing was being processed, and verification would take a long time whenever it did resume.

Fair enough. So I asked the actual question instead.

Is there a complaint on your desk right now that I could help with?

He said yes.

What the work looked like

The first thing I did was show him what he was up against.

Phishing, mostly, because that is what most of the complaints were underneath whatever they looked like on the surface. I walked through how the messages get built, why people click, and what actually stops it. Not theory, using the patterns that were showing up in his own case files.

Then deepfakes started appearing. 2023 was the year that became a normal complaint at a small-town police station rather than something in the news.

A lot of what I ended up doing was takedowns. Someone's photos reposted, a morphed image spreading, a fake profile running. Getting that material off a platform is a process, DMCA and each platform's own reporting route, and it is tedious and slow and nobody at the station had the time to learn it. So I did that part.

The range of it

Through 2023 I was in on a lot of cases, across a wide range of things:

• Phone thefts, and tracing what happened to the device afterwards
• Credit and debit card fraud
• Scam calls and the accounts behind them
• Phishing campaigns hitting local people
• Deepfakes and morphed images
• Social media account takeovers

We did not catch many of the people doing it. That is the honest version. Cases like these run through borders, throwaway accounts, and mule networks, and a constable and a student are not going to unwind that.

What we could do was limit the damage. Get the material down. Get the account locked. Get the fraudulent listing removed before it caught somebody else. For the person who filed the complaint that is not nothing. It is often the only thing they actually wanted.

After

College was ending and I had to move on to other things, so I stopped going in.

That was the last day only in the sense that it was the last regular one. Siddu still calls when something comes up, and I still get into it.

And it spread past him. People in town found out, and started coming directly. A phone stolen and how to trace it. A morphed photo circulating. An account taken over. That kept going long after I stopped walking into the station.

The part worth saying

The programme I applied to never got back to me.