A FORENSIC APPROACH TO DIGITAL SECURITY

Professor Deb Leary OBE, CEO of Forensic Pathways

Professor Deb Leary OBE, revolutionised the stepping plate after witnessing a police conference in Toronto, and this preservation of physical data developed into a forensic approach to the integrity & security of digital data. She founded Forensic Pathways for the development of innovative technologies for the criminal and threat intelligence arena. She has a famous forensic saying, ‘You can only do what is reasonable’, and she applies this to businesses of all sizes. It’s about getting the foundations right, not overengineering security but keeping it realistic and safe.

Listen above, on any podcast platform you choose, Spotify and Apple Podcasts, or watch the in studio video below on YouTube by clicking the image:

Transcription
Prefer to read along? No problem. We've transcribed the episode below for you:

Dom: Hello, I'm Dom Wetherall, your host of the F5 podcast brought to you by Intercity.

Today I have the big privilege of being joined by Professor Deborah Leary OBE. Welcome to the podcast Deborah.

Deb: Thank you for the invite I'm looking forward to this.

Dom: Thank you very much really appreciate you spending some time with us.

So Deborah is the CEO of Forensic Pathways an international company developing innovative products software and consultancy in the criminal and business intelligence market.

Deborah, would love to hear about day one experience obviously you created and invented the stepping plate as seen on screen in some of your most favoured criminal dramas like what have we got we've got CSI New York and Silent Witness.

We'd love to hear about your journey your career and how the stepping plate was born.

Deb: It's a bit long now I'm getting old!

Yeah I mean it was a journey I didn't mean to take let's just put it like that.

It goes back to 2001 and I'm not going to go year by year because we'll be here all day but it goes back to 2001 and I've always been a PA administrator I'd working in a school a large large school in Sutton Coldfield but I was doing my degree part-time English Language and Lit and it was part because it was part-time it was five years and I got my first job coming up for teaching which is what I wanted to do and I got three weeks off before I started that new job and my husband was in the police force in Westmids and he was going to speak at a conference in Toronto he said you know what why don't you come for a holiday you've got three weeks before you start your new job come along and just go around Toronto and shop so I went with him but I got nosy and I thought no I'm going to go and see what this conference is all about.

The keynote speaker was a guy called Dr Henry Lee and Henry was involved in the OJ Simpson case and he was talking about the mismanagement of the crime scene and I started writing notes about because it was very much focused on the story of what a crime scene looks like and how it's managed and the personalities and how it's read and the hypothesis that's put together so I ended up writing a paper on the art of storytelling in investigation from that bizarrely, but it was when I was in the bar where all the best ideas come.

In the bar, it's either the bar or the shower isn't it?

Dom: I agree.

Deb: When I was in the bar I overheard a conversation between two police officers one from UK one from Canada and the one from the UK said that all major crime scenes were used as stepping plates and the Canadian guy said don't know what a stepping plate is and for some bizarre reason I scribbled down on the hotel note paper find out about stepping plates, stroke shoes, found open markets, set up company.

My thought process I think at the time was doing my teaching job and flogging some stepping plates on the side makes me extra money.

Dom: Do you still have that note if you framed it?

Deb: Yeah I've got the note still.

When we got back home I said to my husband you know what's the stepping plate and he said oh you put them down so you can walk through walk and work within the scene without contaminating it so I said what can I can you get me a hold of one and he sort of raised his eyebrows and thought what’s she on now and he arranged for me to go and pick one up from Bromford Lane police station and I was expecting a scientific piece of equipment and what I got was a reactive product it was a reaction to a need rather than proactive design it was made from aluminium it was you couldn't stack them you if you stood on them you'd skid on laminate flooring they were difficult to clean but most importantly you couldn't see the crime scene when you put them down.

So I thought well this bound to be another version so I went onto Google cranked up the internet on dial up, told people to keep off the phone, and look for lightweight transparent stepping plate and basically there wasn't one so there was a company in Liverpool who were exhibiting at that conference in Toronto I went to see them clutching a confidentiality agreement and thought they can make them I'll take a role to happy days they said no they couldn't because it was plastic injection moulding and they introduced me to two guys from another company who were material specialists so I had a very dodgy meeting on the junction 13 of the M6 these guys were into plastic and rubber so it could have gone a different way, I could have made lots more.

Dom: But I'm glad it worked out for you.

Deb: I'm glad it worked out in the right way I mean my mother's proud!

I described what I wanted lightweight stackable boards rubber pads so you could peel them put them on take them off so you could you know work within the crime scene. They came back and said oh you know it's going to be £250 000 for three tools I said you've got to do better and I sent them off I said I got no money but sort it out lads and in the meantime I sent out a marketing flyer to every police force in the country with a mock-up stepping plate piece of plastic and four screwing feet sent it out it was horrendous marketing.
 
Two weeks later I got a phone call from police up in Scotland saying they wanted to buy 50, I put them on hold and pretended to have a sales department, and um and I thought I've got to be honest so I just said well that's really great that you want to buy them but they don't exist and uh give me 18 months and I'll deliver. They did actually wait 18 months.

Then two weeks after that I got a call from the people who made the aluminium ones and they said I was wasting my time so that that was the impetus I needed.

Dom: And the fact that they've called you suggests that you're a threat.

Deb: So I got a SMART award uh to do it, do a prototype, I then went to the bank and asked the guys came back and said to make the plates it was £60 000. Gave up teaching in about August 2002 opened an office, I can't believe I signed for an office I got no clients, um I moved into that office in the December 2002 and the tooling arrived in the in the January 2003 and my first client was the national police training college but that's how it started but it wasn't ever going to be how it finished.

Dom: For sure, what I've picked up there though is and I'd love to hear about your drive for innovation but not letting the fundamentals on almost the practicality of how you're going to deliver it get in the way of driving that idea forward 

Deb: Yeah I think when something's glaringly obvious and you've still got to do your research I mean although I've got a very high risk appetite I still do my research and you know along that journey you know the plates the one element about the plates because it was polycarbonate was that they flexed a little and I had to design that flex out and when we did that it went wrong and I got a market I couldn't service so I had to start again and now I mean it's years later the you know they take you know a weight a significant weight and oh gosh I went to one police force and they called a guy they called a guy called Bill to come in and Bill was a man mountain, size 14 feet and I thought was really trying to test me. No they're fine.

Dom: You mentioned obviously the story never ended so talk to me about you know the creation of forensic pathways and what that looks like now as a business.

Deb: Yeah you know obviously gone through this process of developing the plates but for me that was just one product and you can't live by one product alone you've got to continually keep being having the Madonna effect and keep reinventing yourself almost so it was really fortunate and timing comes into things timing opportunity and taking action so at that time when the stepping plates came out it was the time when CSI New York and all those shows were coming and all the kids wanted to be CSI people and the universities hadn't got the skill base they got the science but not the process so I recruited investigators to deliver courses to the universities so they could teach the kids and then another example was okay what's the forensic market going to look like and we got clues and clues the universe talks to you I believe and I remember going to this police force to to sell them the plates and I walked into this guy's office and his office was surrounded by boxes and I said you look like you're in a warehouse I said what's going on he said oh don't even ask me he said the procurement has spent thousands of pounds on digital cameras and you know you're talking about probably 2005 something like that and he said who's going to use digital cameras nobody so I said well I'll quote you for a digital forensic course, not that I've got on, so I've got to find one make one up and and that was the impetus really because I thought where we all thought by that time I've got other people working in the company including my son that's that's where it's going it's going to be about data it's going to be about connectivity.

So we started developing technologies around image analysis mobile phone data ballistics analysis what happened then and I'll tell you it'd be about 2007 2008 was that corporates were coming to us and saying you know we've heard you're really good with data can you can you start looking and doing due diligence and background investigations for us we've got these data sets can you bring them together can you can you give us some intelligence so from that time on we started doing open source intel and forward investigation due diligence and then it came to 2016 and we I said you know we're doing all this open source intel but what's going on on the other side of the coin what's going on with the dark web.

So we started developing a platform called at that time it was called dark search engine which has now become clarifyi and we monitored that platform monitors the dark web 24/7 we set up alerts for clients so that they can know whether their data is being sold or any anything with its data whether about their client base their IP and we monitor and alert them up to now, moving forward in 2004 we've indexed around 65 million URLs we can get behind capture on the dark web so we can do get into the marketplaces and the forums we're currently monitoring oh we would say about 95 percent of the ransomware groups and we can see who has been attacked for ransomware who's been involved in that and our latest thing that we haven't released yet if we can map those out and sell it by sectors and country so it's come on a long way now one of the things that I get asked about a lot is the fact that people say well hold a minute you're doing stepping plates here due diligence there cyber there how does it all fit together see say it's all about people. People and behaviors, that's all it's about it's nothing complicated it's just people and behaviors.

Dom: We talk about the human side of tech.

Deb: Yeah exactly.

Dom: The technology is the enabler yeah but it's the people exactly so with with the chamber of commerce and the united nations global compact UK network you'll have had loads of exposure to many many different organisations. What do businesses in your view underestimate when it comes to cyber security? 

Deb: I think they underestimate the importance of their people um I think they underestimate that the the other world that goes on that's beyond their comprehension they think that the other world are either the dark web is somehow there's the different people they're not they're the same people as you they just find a different way of making money.

Dom: These companies have hr departments.

Deb: Yeah well it's true I mean we did a large piece of work for Hewlett Packard wolf security with big piece of research and you know they've got they've got arbitration networks that people can take their trust rating with them to different marketplaces and forums I mean this is a professional network and I’m sure when people would if they've never been on the dark web will be very disappointed because it looks like google really in another way um so i think people underestimate what what's going on behind the scenes and they underestimate the power of their people have in order to keep them safe.

Dom: What are the common mistakes you think people are making then? Obviously they're underestimating things but what would you say is a common mistake.

Deb: I think the common mistake is that they probably talk about it in the boardroom and do nothing about it and they think they don't understand the risk the risk and reputational damage if it goes wrong and also if it does go wrong the importance about the messaging ownership at board level.

Dom: Yeah not just passing it over to the IT.

Deb: Oh gosh the amount of time somebody says to me oh um well I will put you in contact with the IT department please please don't put me in IT this is about board level representation it's about risk and reputation you built you spent all that time and effort and money and and passion to build up your brand and you're not protecting it in the right way in the fundamental way.

Dom: AI has got a huge part and it's such a broad broad topic and we've chatted before about how many presentations I’ve been exposed to some are great some are generic some deliver the wrong level of of understanding of AI to the audience how do you see that playing its part in in the cyber threat landscape.

Deb: Well it's a it's a race to the top and the top never finishes does it I think that's the thing but I mean with us with the clarifyi the platform we've introduced AI into it it's it's there we wouldn't be without it it's fantastic it's pushing us forward far quicker and making new inroads into all the things that we want to do but the criminals are doing that as well.

Dom: So deb when you were president of the chamber of commerce how were you supporting businesses and how do you continue as a as the scale up director?

Deb: Working for the chamber of commerce was a great privilege I enjoyed every minute of it I ate far too many dinners drank far too much wine it was brilliant but the key the key to that journey really was about in supporting businesses it was about hearing the business voice so it was going into the businesses hearing about the challenges and the opportunities and also feeding that back to the map to the chamber to say these are some of the challenges that businesses have got when we had uh lockdown and all the troubles that the restaurant and hospitality industry went through it was about helping them get their voice heard and support them and that's one of the benefits of being in the chamber um you know is having that voice I really enjoyed it made me have a real good perspective on what the challenges that business has in the in this region and beyond really so well getting out to the businesses hearing their voices and feeding that back.

Dom: We massively understand that at Intercity as well being patrons of the chamber of commerce.

Deb: Yeah well Forensic Pathways we're patrons of the global chamber so you know it's it's a valuable space to be in it really is recently I’ve been appointed as a scale up director for innovate uh innovate growth UK. I operate out of the chamber for for that role um and that's that's a fascinating role the the point of that is um people apply to the scale up program and um they have to identify three challenges that are holding them back from scaling up they've got to be turning over roughly a million they've got to be in disruptive technologies if they get through to the program then there are 40 odd scale up directors across the country all with the specialisms in the challenges that they've got and those those scale up directors who are chosen to work with them work with them for 12 to 18 months in no charge it's i mean it's like having a board that you can't afford really and i think it's uh powerful it's very very powerful but what's interesting about the program is that it's not just about the person that's sitting in front of them as a scale up director the scale up directors have all got networks so it's about access to networks.

Dom: I think that's really powerful Deb I'm going to end on one final question. If you could see someone else on this podcast someone that's inspired you or or influenced you who is it?

Deb: That's easy.

Dom: I love that it's easy it's great.

Deb: Well apart from my family members who are just blooming awesome and I wouldn't be without them because they get me through a lot of stuff and they know their business world uh my fellow director Ben included um the one person I do uh get in front of you is definitely Wendy Merricks uh Wendy Merricks of Jumar uh her story is phenomenal um she's my role model as far as I’m concerned and she's a great woman.

Dom: Amazing thank you, Deb, I've luckily had the privilege of witnessing one of Wendy’s talks at a chamber of commerce event so Wendy we’ll be reaching out. So Deb thank you very much for joining us today it's been a pleasure very very grateful it's been really interesting to hear about the stepping plate story how that was born and then your journey into the technical world of forensic pathways inspiring story and the work and support you've given to the local community with the chamber of commerce is incredible as well but thank you very much.

Deb: Thank you it's been a pleasure as always thanks.

Dom: Thanks Deb.