The first component, cybercrime offenders, focuses on those who commit cybercrime. Our work to date includes a critique of the popular narrative of a “sophisticated attack”, explaining how incentives align to misrepresent very run-of-the-mill events in this manner. Furthermore, we research the link between autism and cybercrime, for which prior evidence is scant and conflicting. We find that compared to a matched sample, actors who self-declare as autistic on an underground cybercrime forum post more frequently but are less likely to discuss cybercrime-related matters.
For the second component, cybercrime types, we analyse how cybercrime changes in response to externalities, as well as new and emerging aspects of cybercrime. We analyse web defacement and DDoS attacks before and after the Russian invasion of Ukraine. We found the conflict briefly but significantly caught the attention of the low-level cybercrime community, with notable shifts in the geographical distribution of both attack types. We have also investigated the evolution of investment scam lures and scam-related keywords at scale longitudinally (over 13 years) and across multiple platforms. We used NLP approaches to classify threads into four categories: overt scams, potential scams, scam comments and not investment scam related. During the COVID-19 pandemic we find scam invitations increased, as well as the type of strategies used to lure victims.
The third component uses place as the unit of analysis. We have researched the use of argot, or slang, within cybercrime communities. We apply signalling theory to explore how argot (slang and jargon) is used to signal trust in untrustworthy environments. Our findings indicate forum users are using argot to overcome the cold start problem, a conundrum faced by new entrants to markets with feedback systems. We also analyse music shared on underground forums. While we find little evidence of the glamorisation of cybercrime, lyrics often depict a ‘gangster’ lifestyle, including the promotion of violence.
In the fourth component, cybercrime responses, we evaluate the effects of cybercrime responses. We measured the impact of the community-led disruption of a hate and harassment forum. This intervention resulted in the forum becoming unavailable for some time, although it has since re-emerged. The campaign raises issues about how the industry deals with coordinated abuse. We have also evaluated the anti-stalking features of tracking devices using a naturalistic quasi-experimental gamified design. We find that most users are not aware of anti-stalking features, and even when users were aware of them and would benefit from their use, if not enabled by default they were rarely used.
