A Police force's computer system has been crippled by a virus.
Officers at Greater Manchester Police have been unable to carry out their own computer checks on criminals and suspect vehicles for over three days because of the attack by the Conficker virus.
The virus may have been introduced by a member of staff plugging a personal memory stick into a computer.
All officers have now been warned against using 'unauthorised memory sticks' as investigators try to isolate the damage caused by the virus.
The bug began affecting systems at GMP on Friday evening and quickly spread through the force, knocking down internet connections and email accounts.
It led to GMP being disconnected from the Police National Computer (PNC), which is used to check names, criminal records and suspect vehicles against a national database.
Officers had to call colleagues in neighbouring forces to ask them to carry out PNC checks.
The force's incident log, which is used to record crimes, was not affected by the virus.
IT experts worked around the clock to fix the problem and eventually succeeded in clearing most of the computer systems by yesterday afternoon.
However, GMP was still not connected to the Police National Computer last night while analysts completed further checks.
Checks
Police do not believe the force was deliberately targeted by the virus, which has hit a string of computer systems across the world since it first appeared in November 2008.
The Conficker virus, also known as Downup, Downadup and Kido, is a computer worm which strikes Microsoft Windows systems and leaves systems open to hackers.
Manchester Council was struck by the Conficker worm in February last year and the bug ended up costing the taxpayer £1.5m.
The authority had to strike off parking tickets and pay £600,000 to consultants to fix the damage, which included drafting in experts from Microsoft.
Town hall staff were banned from using memory sticks and all USB ports into council computers were disabled to stop the virus regaining control of systems.
Other organisations reportedly hit by the virus include the Ministry of Defence, the House of Commons, the French Navy and government departments in Germany.
It is not yet known how much it will cost Greater Manchester Police to repair the damage caused to its systems.
Assistant Chief Constable of Greater Manchester Police Dave Thompson said the public had 'not experienced any difference in the service they received' as a result of the virus outbreak.
Not destructive
He added: “The virus is not destructive and no data has been lost but due to the speed it has spread we have temporarily cut off our access to the Police National Computer and other Criminal Justice systems to prevent further infection.
“A team of experts is now working on removing the virus, and will not reconnect until we are sure there is no further threat.
“We have systems in place to ensure this does not affect our service to the communities of Greater Manchester.
“At this stage it is not clear where the virus has come from but we are investigating how this has happened and will be taking steps to prevent this from happening again.”
A notice circulated to all staff about the computer problems included advice on not using any “unauthorised memory sticks”.
But a GMP spokesman said it was not certain that a memory stick was to blame for introducing the virus.
Greater Manchester Police has issued its own advice on computer security.
The guidance includes a list of pointers and states: “As a rule the weakest link in the security chain is user error.”
To combat “viruses, worms and trojans”, the force advises:
a) Purchase a leading anti-virus software package, one that will scan incoming mail messages and files on-access automatically.
b) Update anti-virus software definitions weekly, if not more often (ideally, the AV software should update the virus definitions automatically.) Updates are available at the vendor's Web site and are very simple to perform.
c) Use the anti-virus software to run full disk scans (i.e. scan the entire computer) monthly, if not more often. Full disk scans should also be scheduled to run automatically.
d) Learn how to identify virus hoaxes from real threats. Over-reaction to hoaxes can cause unnecessary panic and overload network bandwidth. To determine whether or not a virus warning is legitimate, visit one of the following sites: F-Secure, McAfee's Virus Information Library, Trend, or Vmyths.
e) Install a firewall, such as ZoneAlarm, which is free to home users, to protect against Trojans and other unauthorized access to a machine.
f) Scan all floppies, CDs, or other external media that have been used on external systems or that you receive from others (including friends and family.)

Showing comments 1 to 22 and replies | View All
Dave (02/02/2010 at 08:31)
It doesn't say much for the service we usually get...
Dave the Rave from the Grave, Manchester (02/02/2010 at 08:53)
Marquis de Sade et la petit monge tout (02/02/2010 at 08:53)
Jay B, oldham (02/02/2010 at 09:21)
if they cannot maintain the current one then what hope have they got with a better one? they'll still get the viruses!
Edina Clouds, GREAT Manchester (02/02/2010 at 09:29)
Black Flag (02/02/2010 at 09:49)
j John (02/02/2010 at 10:09)
Seriously though, why the hell must you always say stupid staff? Viruses happen, why does this open the door to all the ridiculous comments?
Marquis de sade, I am afraid they will not have lost your caution :), the virus is a pain in the.... in the fact that there is so much you cannot TEMPORARILY access and it slows you down, but it DOES NOT destroy anything. sorry. :))
Hamish Macbeth, Whitefield (02/02/2010 at 10:11)
Perhaps information that it might have been prudent not to release?
Buzz Killington, Somewhere over the rainbow (02/02/2010 at 10:13)
David Thomas (02/02/2010 at 10:15)
Technology today can protect from Day Zero viruses & attacks (one's where there is no virus definition or signature because it's never been seen before), but Conficker is not new, and GMP having already been impacted in 2009 should have had mechanisms already deployed to identify and quarantine this.
Public sector organisations need to place greater emphasis on risk exposure and automated mitigation techniques, and knowing the insider employee threat is the greatest to most organisations, publishing guidelines & polices, issuing training and having in place penalties for breaches is not enough, especially if you don't have in place the tools and techniques to police user activity and behaviour.
Looks like GMP needs to police it's own staffs computer usage.
David Thomas - CCIE, CISSP
s2s Security Consultant, Manchester
Buzz Killington, Somewhere over the rainbow (02/02/2010 at 10:16)
Data protection issues? Maybe they could prosecute themselves.
Mark,Radcliffe. (02/02/2010 at 10:20)
thoughtful, East of Manchester (02/02/2010 at 10:54)
Why on earth would someone be plugging a USB pen into a Police PNC system, other than to download data? and would the system even allow a remote user to run & install software? This is basic security stuff and again it all comes back to the door of the IT department.
It seems that GMP is riddled with incompetence from top to bottom.
Almighty God, Salford - vote Green (02/02/2010 at 11:15)
kelbag, Clayton (02/02/2010 at 11:17)
Believe it or not, but the IT department is often the LAST set of people to decide on what the security procedures will be. Having worked for a large company on a major government contract, I can safely say that anything you do say will go in one and out the other.
Any security measures we suggested had to be approved by the customer before we were allowed to implement anything, disabling USB ports would have been the first to have been suggested.
Don't blame IT, blame the decisions made by whoever procures GMP's IT for not listening.
Mark smith (02/02/2010 at 12:47)
The Pope, Rome (02/02/2010 at 13:03)
Laura Norder, Didsbury (02/02/2010 at 13:28)
Horatio Dogsbody, Flixton (02/02/2010 at 13:49)
Now why would they be doing that?
happy2behere, South Manchester (02/02/2010 at 17:35)
Rob Wilson (02/02/2010 at 18:36)
Alan Ashton (04/02/2010 at 15:12)