Yesterday, the UK government announced “the largest reforms to policing since […] it was founded 2 centuries ago”, significantly in response to the rapid growth of online and cyber-enabled crime.
“Crime itself is evolving. Criminals are operating with more sophistication than ever before, within this country, across our borders and in the online world,” Home Secretary Shabana Mahmood said in a statement.
Officials say roughly 90% of crimes now have a digital element, with online fraud accounting for 44%.
The existing model is shared across 43 local police forces and is seen as poorly suited to tackle digital crimes that are often international. Under the plans outlined, the UK would create a new National Police Service (NPS), to handle serious and complex crimes, including cybercrime and large-scale online fraud intended to centralize capabilities and improve coordination, intelligence sharing, and investigative capacity for tech-driven crime.
The government plans to expand specialist digital skills within policing and establish clearer oversight for the use of AI and data-driven tools.
The reforms also emphasize technology and digital forensics, with investments in AI tools and centralized forensic services to address large backlogs of seized devices awaiting analysis.
Michael Bell, Founder & CEO, Suzu Labs had this comment:
“The 43-force model made sense when crime was local. It makes less sense when ransomware operators in Russia are hitting hospitals in Leeds while coordinating on Telegram. Centralizing cyber capabilities is the right structural response but the real constraint going forward is talent, not org charts.
“That 20,000 device backlog won’t shrink through reorganization alone. The £115 million AI investment signals they’re planning to automate through the forensics debt rather than compete with the private sector for analysts.”
Denis Calderone CRO & COO, Suzu Labs adds this:
“Well it’s bout time, honestly. You can’t fight international cybercrime with 43 fragmented local police forces. Criminals operate globally while police operate by postcode. When 90% of crimes have a digital element and 44% is online fraud, a National Police Service focused on complex digital crime makes sense. Cybercrime doesn’t respect constabulary borders.
“That said, the 20,000 devices sitting in forensic analysis backlogs should terrify anyone. That’s not just a processing queue, that’s criminal cases going cold and victims waiting years for justice. Centralizing digital forensics could finally address this, but only if they actually fund it properly. Otherwise we’re just creating a bigger, more centralized backlog instead of 43 smaller ones.
“Here’s where I get skeptical though. They want cybersecurity experts to join as Special Constables, but special constable numbers are down 73% since 2012. Why would a cybersecurity professional making six figures work part-time as a volunteer police officer?
“The private sector pays better, offers remote work, and doesn’t require wearing a uniform. This recruitment strategy seems disconnected from the reality of the cybersecurity talent market. If they’re serious about bringing digital expertise into policing, they need to compete with private sector compensation, not rely on volunteerism.”
John Carberry, Solution Sleuth, Xcape, Inc. follows with this:
“The UK government’s launch of the National Police Service (NPS) signifies a much-needed shift from a fragmented, Victorian-era system to a centralized, “cyber-first” defense strategy. Virtually all crimes now involve technology and online fraud is rampant, so isolated local policing struggles to combat borderless, tech-savvy criminals.
“Establishing a National Police Service to consolidate cybercrime and major digital investigations promises enhanced coordination and intelligence sharing. This reform represents a significant technological leap, infusing £140 million in AI-powered forensics and suspect identification.
“By aggregating analysis to a central location, this new system aims to overcome the current backlog of 20,000 evidentiary devices that delay digital investigations. Moreover, the mandatory “license to practice” requires all officers to possess a fundamental level of digital proficiency, indicating that technological skill is now a universal law enforcement requirement.
“With 90% of all crimes leaving a digital trace, this restructuring enables the UK to combat crime at Internet speeds, rather than at the pace of local bureaucracy. Sustained investment, transparent governance, and the capacity to attract and retain cyber expertise are all necessary for this makeover to be successful.”
“When nine out of ten crimes are digitally enabled, a policing model that stops at a county border isn’t just outdated, it’s a gift to the modern criminal.”
This is a really good move to make sure that crime doesn’t pay. Because the opposite is happening and that’s not good.
Guest Post – Think Before You Scan: That QR Code May Be a Scam
Posted in Commentary with tags Planet VPN on January 28, 2026 by itnerdAt the start of January, the US Federal Bureau of Investigation (FBI) issued a warning against cyber attacks organised by North Korean cybercriminals who used fake QR codes to trick users into obtaining personal information. According to cybersecurity experts, similar attacks, also known as “quishing”, are on the rise not only in the US but in other countries, as cybercriminals look for new ways to profit.
Quishg (QR code phishing) is a phishing technique where cybercriminals try to trick users into scanning QR codes that lead to malicious websites. Organisations in several countries have issued warnings that bad actors place these QR codes on top of legitimate ones in public places such as kiosks, restaurants, or parking meters.
For example, last year, UK government institutions have warned users of fake QR stickers on parking machines, with victims being sent to spoofed payment pages. Meanwhile, the US Federal Trade Commission issued a similar warning about unexpected packages containing QR codes that led to phishing websites.
Such fake QR codes can also be shared online. For example, the FBI said that a North Korean state-sponsored cybercriminal group, called Kimusky, targeted employees of organizations by embedding malicious QR codes in an email. In one such instance, a QR code was presented as a way to download additional information.
According to cybersecurity experts at Planet VPN, a free virtual private network (VPN) provider, no matter where a fake QR code is placed, the scheme is similar. After scanning it, a user is often forwarded to a fake phishing website mimicking a legitimate one, such as a restaurant’s website, where cybercriminals may try to charge a user’s credit card.
According to Konstantin Levinzon, co-founder of Planet VPN, such scams can lead not only to financial losses but also to compromised devices.
“Quishing is phishing–just in a different wrapper. A QR code can lower people’s guard because this technology became ubiquitous only during the pandemic, and the threat still isn’t as widely recognized. It also shifts the “risky click” from a visible link to a quick scan, making the danger easier to miss. Attackers are refining these tactics every year and constantly finding new ways to trick users,” he says.
According to Levinzon, one reason why cybercriminals may favour QR codes in emails instead of regular phishing emails is that QR codes often bypass anti-phishing and scam filters, because these often analyze only text and links, but don’t analyze images.
And even if anti-spam filters in emails are equipped with QR code detection, cybercriminals often find new ways to bypass them, for example, by making QR codes in different colors.
Cybersecurity researchers at Proofpoint estimate that during the first half of last year, there were 4,2 million QR code-related threats. However, Levinzon says that the number is likely higher because many QR code scams are undetected.
When it comes to protecting against the growing threat, users are advised to be more deliberate about when and why they scan a QR code. If after scanning a QR code, a person is forwarded to a website that asks for payment or log-in details, this is a real warning sign.
Meanwhile, if a QR code is sent from an unknown sender via email, Levinzon advises contacting the sender directly before entering login credentials or downloading files.
“We recommend applying the same logic everywhere: stay skeptical whether you receive a message from a coworker or on your personal social media account. However, vigilance is only part of the story. To maximize security, users also need basic safeguards – use a VPN on public Wi-Fi, install updates promptly, use strong passwords, and enable multi-factor authentication on all accounts,” he says.
Leave a comment »