Criminality is most likely one of the oldest professions. But the criminals' activities have evolved. Most of us remember the organized crime movies and tv shows of the 90s and 2000s where Omerta's rules and loyalty were unbreakable. But, in 2023, the reality is very different. So, let's talk about it.
Criminals used to be known as being impulsive, violent, and sometimes even irrational. The image that this conjure is often Tony Soprano or Jax Teller. Nowadays, online crimes showcase a different type of criminality that is often surprising. One of the phrases we often hear is, "they are just a nerd; how they can be so dangerous. They look like a pale 12 years old". The new criminal is often just that or at least one type. Someone who has learned to code, to understand computers inside and out. Potentially lacks offline social skills. These threat actors are often not violent, not impulsive, and often they are not irrational. Launching a good attack takes time, patience, planning, and follow-through which some street criminals do not have.
From learning how to code, learning how to hack, to be welcomed into a group, to learning how to create malware or 0-day, the learning curve is long. The process takes patience and skills. The type of skills that do not require brute force unless it does… for a password.
Money drives the world, and the same goes for criminals to push the envelope more to obtain more gains. Cybercrime has become a sort of Silicon Den where criminals are entrepreneurs. Some cyberattacks can be scaled up to create a massive influx of cash. In the works of Anderson, R., Clayton, R., Böhme, R., & Collier, B. (2021)1, the researchers discuss factors to grow these cyberattacks into well-fueled revenue machines. Cyberattacks are business ventures. A way to make money using skills they have or want to obtain. The main point is that we are moving far away from this original idea of a criminal. Another side of this new criminal brought forth in scientific research by Collier, B., Clayton, R., Hutchings, A., & Thomas, D2. In 2020 was that cybercrime is often boring. Most criminal activities are maintaining infrastructures. Some of these boring tasks include "Running bulletproof hosting services, herding botnets, or scanning for reflectors to use in a denial-of-service attack is unglamorous and tedious work and is little different in character from the activity of legitimate sysadmins" (Collier et al. 2020, p.1). This work facilitates crime but is not glamorous. It's not the dangerous idea of what a criminal looks like. This type of maintenance requires patience, not impulsivity. The money most of them make is not as much as we would assume. Sure, the Lockbit of the cyberworld makes millions but those are the tops ones. Most will have cybercrime as a side hustle alongside their legitimate job. This idea that working in cybercrime is boring does not uphold the mythology of computer crimes where the dark web is exciting and dangerous. Now it is dangerous, but exciting? Not really. The reality is significantly less impressive than the movies portray.
They are often exceptions to this. Organized crimes, in the "traditional" sense of the term, also use online crimes to increase their profits, do surveillance and facilitate other crimes. So, it's essential not to forget about them, even if they want us to do so.
The question is often are technologically savvy users turn criminals or are criminals turning technologically savvy? There is no right answer nor is there one answer only. Of course, crimes did adapt to the online reality and shifted towards dark markets for illegal drug trade and human exploitation. However, new crimes also emerged that required different technological skills such as ransomware, spyware, or malwares in general. When various opportunities arise, many people with the skills or willing to learn the skills can take these opportunities.
With this new idea of what a cybercriminal looks like in 2023, it could be any of us: from the quiet computer enthusiast who plays video games to the extrovert woman who wears too much pink, to the quarterback at university to a businessman in a suit working on fifth avenue. The point is wearing a hoodie is not the equivalent of a kutte. So long are the days that you can point to a hoodie and thinking you know.
1Anderson, R., Clayton, R., Böhme, R., & Collier, B. (2021, June). Silicon den: Cybercrime is entrepreneurship. In Workshop on the Economics of Information Security
2Collier, B., Clayton, R., Hutchings, A., & Thomas, D. (2021). Cybercrime is (often) boring: Infrastructure and alienation in a deviant subculture. The British Journal of Criminology, 61(5), 1407-1423.
