A Consultation on the development of a Cyber Resilience Strategy for Scotland

University of Stirling
School of Social Sciences
Colin Bell Building
Stirling

We note later issues around communicating with different audiences and this may need to be considered from the start as the title itself may not be meaningful to some. Plain language throughout to make all aspects accessible to all is essential. In the case of the title, perhaps a sub title that explains exactly what it refers to. Furthermore we would suggest the addition of the need to link with related strategies and consider cross overs. We especially see the need to develop a strong connection to the adult and child protection agendas.

We agree with the key objectives but would emphasises that effective communication in practice will mean communicating in different ways with different groups e.g. older people, people experiencing learning disability, children and also those less familiar technology and how its use and misuse impacts upon them

We agree with the stated focus and would suggest engaging people based around the stated groups on page 8 i.e. personal, organisations, economic and national. This would allow for those with similar issues to come together to inform the strategy.

We agree with the stated areas. The need to provide audience specific awareness is crucial especially given the comments around naïve online behaviour which can relate to the use of social media or the repose to email and online scams and the criminal activity that attempts to fraudulently obtain sensitive information (phishing) installation of malicious code on a personal computer or server (pharming) risks and their links to use of the telephone to solicit personal information (vishing) and use of mobile phone texting to obtain personal information or create extortionate charge (smishing).

In the work to date that we are undertaking on financial harm we have learnt that older people in one area have interpreted the risk of financial harm as meaning that the internet is dangerous and therefore avoid using it. This highlights the need to carefully consider any public messages and how they will be interpreted and acted upon based upon the individuals level of understanding. Our particular concern in this regard is ensuring that pubic messages for children and adults take into account a level of anxiety that may already exist or indeed a blasé approach due to a lack of accessible information.

We agree in large part with the stated areas of focus but in addition to those settings which target young people other settings need to be targeted. The internet is a tool used by many, not just young people. On this basis we would suggest targeting other places in which people come together e.g. community centres, lunch clubs, self-advocacy groups etc. In our work on financial harm in Scotland we have noted that several older people have lost thousands of pounds to internet fraud. This strategy therefore needs to take account of the issues highlighted by SCIE (2011) which may place people at heightened risk:
• Lack of capacity to know what’s happening
• Dependency on others to manage care or finances.
• Cognitive impairment having an impact on decision-making.
• Low levels of financial capability (ability to deal with financial products and services).
• Bereavement/social isolation/loneliness, which may provide an opportunity for exploitation.
• Gullibility/over-trusting nature.
• For older people in particular, potentially increased assets coupled with low cost lifestyles and a lack of awareness of the modern world may make them more susceptible.

SCIE (2011) SCIE Report 49 Assessment: Financial crime against vulnerable adults
http://www.scie.org.uk/publications/reports/report49.asp

We agree with the stated focus but would also add that research or scoping of effective training for different groups should be undertaken. We are aware of a training model developed by Quarriers for people experiencing learning disability and there are many models for children. The key component is to raise the awareness of those who lack insight into the risks and how to manage them.

We would also suggest liaising with the National Financial Harm Prevention Strategic Group with whom we can facilitate contact.

In our view there are several actions which would contribute to an effective strategy:

• Broad based public messages require to be developed with a consistent theme
• Audience specific messages are required for those noted in question 7.
• Audience specific training to ensure the message is translated into practice
• Utilisation of the third sector organisations to roll out the message and any training in order to access those at potential risk e.g. NSPPC, Alzheimer’s Scotland, Carers Groups, Advocacy Organisations, umbrella groups e.g. SCLD and Scottish Care, Service Providers e.g. Quarriers and The Richmond Fellowship etc.

We would suggest the specific addition of measurement around targeting those at higher risk as noted in question 7 e.g. ‘(Scotland) be a place where those at heightened risk of harm through the use of the internet are given information in a form they can access to increase their self-protection.’

Members of team have experienced attempts in this regard, receiving a notable number of phishing emails. Most recently we experienced vishing attempts on our business landlines.

Where Scottish Government is able to gather such stories from members of the public these may form the basis of an effective campaign and WithScotland could assist in locating those able to tell their stories. One issue we have noted in our work on financial harm to date is that many people are reluctant to come forward and report the issues in the first instance due to embarrassment. On this basis it may be difficult to obtain examples and in approaching those that have had such experiences it would be important to put in pace measures to prevent re-traumatising them.