In every aspect of our public and private life we have become dependent on the power of the internet and computing. That makes us vulnerable to those who would do us harm. You need proof . Well, look at the world wide spread of the ransomware known as wannacry, which shut down vital Computer Systems in businesses, in Public Institutions, Around The World. My guess is rob wainwright, head of the European Police agency, europol. Are the cyber crooks several steps ahead of the cyber cops . Hardtalk theme music. Rob wainwright, welcome to hardtalk. Thank you. For the last few days you have been somewhat preoccupied with wannacry, this ransomware which has spread across the world. How seriously should we be taking it . Well, it is one of around 200 high profile investigations europol is helping to co ordinate around the globe against cyber crime and including that there has been this trend of this growing threat from ra nsomwa re over the last couple of years, but we have never seen anything on this scale, spreading across 150 countries or more, over 200,000 victims. It is a unique characteristic of combining a ransomware with a wormlike function, which explains why its spreading Around The World. Its a step up in Cyber Crime Activity. Another very stark warning to many sectors that we have to take cybersecurity seriously. We have been aware of it for 48 72 hours, you and your team have been working on it extensively since then. But you just used the present tense you just said it is still spreading is it still spreading . We saw over the weekend, certainly it was spreading quite quickly. As we started the working week, some new infections, you know, in the tens of thousands, in parts of asia, in russia, but not that in europe. And i think what that shows is that those responsible for Information Security in companies have heeded our warning that we put out very strongly over the weekend, that they should patch their systems if theyre still sitting on vulnerabilities, so that when the working week begins again they dont fall victim to it. And i think it has been a very good exercise in Public Private partnership to get that message out. Youve got a cyber crime team, i think you call it ec3, youve got some, you know, really top quality Computer Experts on the case, so where is it from . We do not know yet, actually. A lot of the focus of the attention by National Agencies across the world have been really about disaster recovery, threat mitigation, at this stage. We are starting to piece together some of the malware samples around this and we are helping many of the authorities Around The World through the taskforce that exists at our Cyber Crime Centre now to look at what this looks like. It is interesting, im going to talk to you a lot in this interview about Co Ordination and Intelligence Sharing across europe but how about globally . Are you talking to The Americans, the china, the russians . We know the russians have been very badly hit by this. So how much global Co Ordination is there . Well, the global Co Ordination is absolutely needed. Our focus at europol, understandably, is on protecting the european space. To do that we have a huge tra ns atla ntic engagement. So The Americans are with us, the fbi, on cyber, on fighting terrorism. Many other us federal agencies. I specifically asked you about the russians advisedly because. crosstalk . Discussion about russia being a cyber threat but on this occasion it is, i think, fair to say it looks pretty clear this was not originated in russia. Are you working closely with the russians to try to find out who did it . We do not know where it originated and in answer to your question, no, we are not working closely with china or russia. Because you do not trust them . No, our relationship with them is not the same as it is with the United States, for reasons im sure your viewers will understand. There are other organizations like interpol that are helping to do that but it is true, that is the landscape that we are working with across the internet space. There isnt a single governments architecture, there isnt a single view about how to deal with cyber crime. Vladimir putin has gone on the record over the last 2a hours as saying he believes this is something that originated in the United States and hes pointed a finger at the us government. What we do know is that microsoft and we know that this malware, this Ransomware Attacks windows Operating Systems, particularly the older ones like xp microsoft say that, as far as they are concerned, this malware or at least the information behind the malware, was actually developed by the us nsa, National Security agency, and they were then hacked by the people whove propagated this as ransomware. Can you confirm that is what you understand happened . No, i have no independent evidence of that at all. But i have seen what microsoft have said, seen what Vladimir Putin has said as well. We have no independent confirmation of that. What we see is a massive exploitation of a flaw in the microsoft Operating System by the criminal groups. The question is, who developed that flaw . That is my question as well and were still looking at that. You have just told me what close ties you have with us Sister Agencies so you would know whether the nsa was indeed responsible for storing knowledge about the vulnerabilities in some Windows Microsoft Operating Systems. We are still working with many federal agencies, including the fbi, to get to the bottom of this. Today, i cant answer that question because we dont know for sure. If im going to Say Something like that, i better know my facts, and i dont yet. Are you telling me you cant tell me or you. Because it seems surprising to me you do not know, youve had days working on this now. We have had about 48 hours during a period of which our focus has been on stopping the spreading of this into other Public Services, for example. The investigation is a high priority but it will take some time before we get to the bottom of this. Let me ask you a slightly different point, which again comes from brad smith, the chief legal officer at microsoft said, he said State Security Agencies spent a lot of time actually working out the vulnerabilities of our Operating Systems but they do not tell us what they discover and they do not tell us what knowledge they are storing about flaws in our systems and it is about time to come clean about this, not least with us. Has he got a point . To be honest, and i am sorry to dodge the question, you really should be asking the Intelligence Agencies about that. They have a job to do, of course, as well, to protect our National Security as well. Myjob is to help Police Agencies Around The World do something about cyber criminal actors, not state sponsored actors, and im very clear about that. They can be both, cant they . State sponsored actors can be criminals. There is a blurring of the lines, absolutely, but our primary focus is on those that are in this business for illicit commercial gain, and thats what were focussed on at europol. Lets move on, if that is the limit what you can tell me right now about whats happening to your investigation into the ransomware that we have just seen spread Around The World. Lets look a little wider at cyber crime. There are people Around The World who look at the scale of it at the moment and its origins and they point the finger particularly at russia. At europol are you prepared to echo what has been set in the us, whats been said by the head of the National Cyber Security Centre at gchq in the uk, both of which institutions say russia is responsible for a huge surge in Cyber Crime Activity . We see cyber criminal actors originating from almost every country in the world but we do see a large proportion of them coming from russian speaking places. Not only russia itself. That doesnt mean its the cyber crime capital of the world but there are a number of regions of concern for us. The russian speaking world is one of them. And we are working, of course, where we can, with international Police Agencies top combat that. You made an interesting distinction just a minute ago between state sponsored Cyber Attacks and criminal Cyber Attacks but i come back to this point that you can often describe state sponsored activities as criminal. I suppose case in point would be the allegations The Americans made about russian Cyber Meddling in their election. Hacking into the Democratic Party emails, for example. Same allegation emerged in the macron campaign, in france. The germans are now saying that they are braced for russian activity in their election too. Is this something that you, particularly in france and germany, are actively looking at . No, it is not. I made it very clear im working against cyber criminal actors. In this case there seems to be concern of possible state sponsored activity against the National Security interests of those countries and so the Security Intelligence agencies of those countries are quite properly leading those investigations. I am much more concerned with the billion dollar Ransomware Industry that has grown up in the last two years which is propagated by Cyber Criminal Groups by the multibillion dollar hacking attempts on the Global Banking system by very sophisticated cyber crime groups as well, developing ever more sophisticated Banking Trojans and by many other aspects of the way in which Internet Technology has transformed the criminal underworld to be something much more dangerous than it has been. Tell me whether you think important institutions, both private and public lets talk about the private sector if were talking about outright criminality, whether they have made anything like the right sort of protective measures and actions to safeguard themselves from what you describe as the surge of Cyber Criminality . It depends on which sector youre talking about. For the Banking Sector which has been in the firing line of most Cyber Attacks in recent years, they have learnt through painful lessons that they should take this as a Top Level Executive Responsibility and so they have committed to the right kind of investment, to the right kind of strategic framework and they are still in the firing line and theyre still getting caught but their protection is much higher and that is why you saw over the weekend of this ransomware attack, there were very few banks in europe, if any, were caught up in it because their defences were quite high. In other sectors, including Public Services like the Health Sector, that is not the same case and i think there is a Learning Lesson here. Many of them are still using windows xp, which is many, many years old. Yes, and very often, we paint this picture of Cyber Criminals being these futuristic geeks that can hit us anywhere at any time. They prey on the fact that we have vulnerabilities that we do not fix, that we make stupid digital hygiene mistakes, and they recycle old cyber tools time and time again to catch us out. A lot of this is around awareness about getting the basics right. And that is 80 of the problem. How is your digital hygiene at europol . Well, um, i think it is strong. You had to think about that. I mean, that is slightly alarming in its own way, not least because you are an agency that is trying to persuade 28 european Member States to trust you and trust each other in terms of Co Ordination, Intelligence Sharing, particularly data sharing and i am just wondering whether, over all these fine words, your hygiene, as you put it, in this field of Data Collection storage is as good as it could be. I think it is. I did pause and thats because i will be honest, there is no organisation in this world, public or private, that can get the threat down to zero because of the nature of the cyber Criminal Activity depends on the highest possible technological advances, making sure that all your Staff Members are suitably aware of the threat and so on. For the moment we have had no breaches that are of concern to us. I think our defences are very, very strong. We take best practice reading from the uk and other governments so i think it is strong but i am not going to say were absolutely impenetrable, no. Do you think governments have tried to cut corners because they cannot afford or wont afford the investment it takes to seriously upgrade their cyber defences. I do not think in the end it is about money, it is about leadership responsibility. It does not take a lot of money to get systems off xp. It doesnt take a lot of money to patch older systems. It takes actually a recognition this is a top line Executive Responsibility, put in place a security framework, make sure youre getting the basics right, reach out to Law Enforcement and so on. There are institutions, like the National Cyber Security Centre in the uk, that give very good advice. Follow that and that is 80 90 . Patently many Public Institutions in the uk have not been following that, ijust wonder why you think that is . It is frustrating, frankly, because in the Health Sector there have been multiple Ransomware Attacks in the United States and europe for the last two years, long before wannacry came along. And so the lessons should have been heeded by now. I think there are complexities to the it systems in the Health Sector which i understand is not difficult to work around, i understand that, but in the end, this is really about taking Executive Responsibility and sorting this out in the way that most global banks have began to do in many respects. Do you think europol is capable of keeping up with the constant evolution and development of more sophisticated criminal, whether private or state sponsored, Criminal Activity on the internet . Its a challenge every day because we see the way in which the internet helps to conceal the identity and communication of the offenders, particularly on the dark net. We see these wonderful technological advances coming out of Silicone Valley and elsewhere which is fabulous for society, we all know that. But of course, being exploited by ever more enterprising criminals and to a certain extent, terrorists. We are in this difficult challenge, i have to say. But that is why yielding International Partnerships are so important. Is the gap between what you can do realistically to police the internet and you just talked about the dark web and i would like to talk about that some more, the gap between what you can do and what the bad guys are certainly right not able to do, is it getting wider . There is a gap of course, because we are working within legal constraints, of course we are, and theyre not. That said, we have the power of leveraging, if we do our work properly, the combined resources of some of the best investigators Around The World, not to mention some of the wonderful partnerships we have with the private sector. If we can get that right and exercise that kind of interconnection between those different communities, we have a lot of power and we are beginning to show that. A lot of power but whatever kind of torch youve got, there are places you cant shine it. Im quoting yourself, when you said of the dark web, it has become a huge underground criminal environment. You talk about the ways in which people, terrorists or straightforward criminals, can buy a british passport via the dark web, untraceable, for 750 british pounds, about 850 us dollars. You cant keep up, thats the problem. Well, we find it particularly difficult to do that, i will be honest with you, particularly on the dark web. It is transforming the nature of how criminal markets function. It has changed the way in which drugs are bought and sold in an illicit way because it protects the identity of the buyer and seller. In 2013, we found one major Crypto Market on the dark web. Today it is more like 20. Selling Something Like 100,000 different listings of drugs and other illicit commodities. It is growing and it is very difficult for us to track it. We have had a number of successes, most recently regarding a major Child Sexual Exploitation network that was working on the dark net. We are evolving our techniques as well. But yes, we are in a race with those guys. Is there anything you can see that governments can do collectively to close down this Criminalised Dark Net or dark web . Its difficult to legislate against the dark net. Not least to mention, there is a good part of it that is used for good purposes Around The World. Those People Living in some countries that are trying to exercise freedom of speech, for example. It is difficult to ban the dark net. I certainly wouldnt be in favour of that. We need to make sure that those responsible for our public security, the police services, have a better forensic capability to investigate this. This means especially having better partnerships with the tech sector. Are you a fan of governments, and am thinking of the British Government in the wake of the recent horrible westminster terror attack, are you a fan of governments that say, as a result of what we learn about the way terrorists communicate, trying to use, as they do, encrypted communications, which are offered to them very easily now via apps like whatsapp. The politicians response is, we need to make sure the people behind those services give us a state back door into their system so that when required we can survey people,even on these supposedly encrypted systems. Are you a fan of that . Im not sure the British Government asked for a back door but they do express some frustration that apps like that do not allow the security authorities, in the most urgent of situations, to monitor the communications of potential terrorists. Its very frustrating that we have a legislative technical means by which under lawful supervision, we can intercept a Telephone Call between two people but we cannot intercept their whatsapp messages. The same two people planning the same terrorist attack. So there is an inconsistency in the way in which weve legislated. So you want total surveillance . No, i dont want that, absolutely not. I want to balance security and privacy but i want to give Police Investigators Around The World, under the right kind of proportionate control and supervision, the right means by which to protect our public from acts of terrorism. But isnt the problem that the public dont trust state sponsored organisations, people, frankly, such as yourself, to actually find the right balance . It is too easy for state actors such as yourself to use what you might portray as a one off right to turn it into something which it looks very much like 24 7 surveillance, electronically, of everybody, all the time. Clearly, we need to avoid that. Not only the impression of it, but we need to avoid that. It is clearly not a proportionate way to manage the delicate balance between privacy and security in our democratic societies. My concern is that there is an inconsistency in the balance between what we do in some parts of society and not in the other. It is about a targeted, proportionate response. Very difficult to do in the internet because of the technological design of it. What are your relationships like with the bosses of the biggest, most successful Infotech Companies in the world . Im asking because the boss of twitterjack dorsey, said this recently, yeah, of course the Security Services need to be able to keep people safe but these disproportionate powers they are now seeking are straight out of an 0rwellian Nightmare and have no place in a democratic society. Yes, well, he will take that view, i understand that. He comes from a different angle, i respect that. What i will say is that twitter is one of those companies we have an Excellent Partnership with in removing Terrorist Content online. Europol is doing it through its Internet Referral Unit without exercising any new legislative powers. Its actually a voluntary code of conduct between us, twitter, facebook and many other social media partners, over 50 of them in fact, that have helped us more aggressively take away this terrible daesh related content in the online space. I applaud twitter for doing that. Not every social Media Company is doing that but most of the big ones are. It is an example of where sometimes, i think, public and private sector partners, even in this space, can come together and find their interests meeting in a way that supports the general publics good. Before we end, i must ask you about something that has happened since we last spoke to each other, a year or more ago, and that is brexit. Here you sit as the director of europol, as a brit. Frankly, youre going to be the last british director of europol, thats quite obvious. You said to me when we spoke more than a year ago, Fighting Crime and terrorism in the uk will be more costly and much less effective if the country leaves the eu. Are you still feeling that today . I still feel the uncertainty about what will happen, stephen. Because what i certainly see in the Ransomware Events of the last few days, Terrorist Incidents we have seen, make the point even more strongly than what i was making a year ago. Fighting crime and terrorism has become an international game. We need the closest possible collaboration in europe. The extent to Which Britain will continue to have access to tools has become rather dependent on, and depends upon the outcome of the negotiations. That sounds somewhat like theresa may when she presented that article 50 letter to her colleagues in europe and the commission, saying this, in security terms, a failure to reach an agreement would mean our co operation in the fight against crime and terror would be weakened. Many in europe saw that as a form of blackmail and you seem to be playing the same game. Im absolutely not. And i didnt read that letter that way and im not sure most of those in brussels read it that way. She was simply stating the reality that, as i said, Security Co Operation in europe is very important to counter these growing cross border threats. Why on earth would britain, for a minute, think of reducing its co operation, even if you couldnt get a deal on a Trade Agreement or anything else, why are you conflating and putting the two together . Im not here to be the prime ministers spokesman but the way i read her letter, she was simply setting out her strategic objectives under the article 50 process and she is quite rightly, in my view, putting security is one of those top line objectives alongside trade and others. Simply stating the facts that this is in the common interest of the uk and the rest of the eu to get the right kind of Security Deal because of the way in which what it takes these days to fight terrorism. Let me put it bluntly. Who loses out more if britain cannot do a full fledged Security Agreement with the 27 remaining members of the eu in the future . Who loses out more, britain or the eu Member States . This is not a zero sum game, this is about the collective security interests of europe and i think both sides understand that and well go into negotiations with that in mind. We have to end there. Rob wainwright, thank you for being on hardtalk. Hello there, good morning. Tuesday is probably going to be a day remembered for the high temperatures. Looking outdoors, we had some blue skies at times here in lossiemouth, in scotland, and more blue skies and some more humid air here in kent. Those two are significant, because in scotland it was the warmest day of the year so far, and with a temperature of 26 degrees at gravesend, the warmest day in the uk so far. But, in between this band of cloud, which didnt produce an awful lot of rain, but that cloud was beginning to give us a bit more rain today. And the warm air is going to get pushed ever so slowly away into the near continent. We are going to get into this cooler, fresher air, with sunshine and showers over the next few days. A chilly start, though, for scotland and Northern Ireland this morning. One or two showers in the north west, but by the morning, the rain more extensive across a large part of england and wales. Now, through the day we will enjoy some sunshine in scotland and Northern Ireland, but we will enjoy some showers, some of them heavy, coming into the north west. Whereas, for a large part of england and wales, it is going to be cold and wet all day, with some warmth, though, before that rain really gets going in east anglia and the south east. But temperatures will be a bit lower than they were on tuesday in scotland and Northern Ireland, and many eastern and southern parts of scotland staying dry, with some sunshine. But showers to the north west and across Northern Ireland, and if you are stuck underneath this rain across a good part of northern england, wales, and the south west, it really is going to feel quite cold. The rain is going to stick into the afternoon, but cold and wet all day through the midlands, central and southern england. Ahead of The Rain In East Anglia and the south east, it will be warm and humid. But once that rain arrives, Late Afternoon and into the evening, it could be very heavy and thundery across the east midlands, east anglia and the south east. The rain begins to clear away from areas further west. So that is the first soaking rain for the gardens we have had for some time towards the south east, but could lead to some difficult travelling conditions. By thursday, it is all gone. We are into sunshine and showers. Most of the showers out to the west, some heavy ones. It may well be a dry day across east anglia and the south east. That is where we are seeing the highest temperatures, but they are tending to slip away. Numbers are dropping, typically into the mid teens. And sliding in from the atlantic, slowly but surely, we have this area of low pressure, which isjust going to amplify the showers into longer spells of rain for Northern Ireland and for western scotland, closer to the centre of the low. 0therwise, some sunshine and some showers scattered about, some of them still on the heavy side, and temperatures typically 14 or 15 degrees, not getting any warmer over the weekend. Yes, there will be some sunshine at times, but some further heavy showers, and with clear skies at night, it will be on the chilly side. Im rico hizon in singapore, the headlines the white house rejects claims that President Trump asked the head of the fbi to end an investigation into possible links between a senior official and the kremlin. Following north koreas latest missile test, the Un Security Council meets Behind Closed Doors and the us vows to call out states backing pyongyang. Im kasia madera in london also in the programme. Is the jailing of a top indonesian politician a sign of the countrys growing religious intolerance . And ruined by rubbish the South Pacific island with more Plastic Waste than anywhere else in the world