The Cyber Effect (40 page)

Okay, then, does this mean that an individual risks a higher chance of becoming involved with drugs due to all the aspects of the digital marketplace?

In my opinion, yes.

There were roughly 187,100 drug-related deaths worldwide in 2013, according to the UNODC, and some 27 million people worldwide had problems with drug use. Obviously, this is the biggest downside to easy illegal drug sales.

As tragic as those numbers are, there is another potential downside to the prevalence of drugs online that could have even greater ramifications. Buying drugs online, particularly in Darknets, requires an individual to enter a “neighborhood” where bad things can happen. There's actually a well-known criminology construct to explain it.

A famous Canadian criminologist, Kim Rossmo, found that
great white sharks and serial killers have common behavioral traits, in terms of how they hunt their prey. They both are focused killers, have a strategy, prefer their victims to be young and alone, and like to attack when light is low.

It would be interesting to consider the hunting patterns of cybercriminals in a place that's also dark, and where there are plenty of young victims, surfing all alone.

A number of interesting things can happen when a young individual enters a new society and culture, such as the ones that exist on the Darknet. To begin with, consider how the good manners and responsiveness of vendors may send distorted social cues. Like what?

This is a safe place.

This is a place where people are looking after you.

This is a place where they really care about your business—and getting that five-star good-vendor rating.

And this is a place where you could make cool new friends.

In an age when most young people spend so much of their time online, where they make and maintain their social contacts, wouldn't they wind up making some new acquaintances on Darknets?

In my own work investigating the evolution and behavior of the cybercriminal, I have been influenced by the pioneering work of David Canter, an investigative and environmental psychologist in the U.K. whose great book
Mapping Murder
is a fascinating read. Canter's main
areas of work are real-world offender profiling and geographical profiling. These theories can be used to demonstrate how environment can impact criminal behavior, and have helped me consider the impact of the cyber environment on crime.

As Canter states: “
Criminals reveal who they are and where they live not just from how they commit their crimes, but also from the locations they choose.” In my work, I consider how the cyber location reveals the criminal.

We actually know a lot about pathways into a life of real-world crime due to the abundance of academic work in this area. And I do mean
abundance
. In the field of criminology, there are biological theories, labeling theories, geographical theories, trait theories, learning theories, psychoanalytic theories, addiction theories, and arousal theories. But if you wanted to know how, specifically, a young person goes from curiosity about the Darknets to cybercrime, or being part of organized cybercrime, we are still putting those pieces together.

As an advisor to Europol, I am currently one of the principal investigators on a new research initiative that will look at how young people get drawn into cybercrime—and specifically what the pathway is from cyber juvenile delinquency to lone cybercrime to organized cybercrime. One of the established criminology theories that we will be experimenting with—and trying to apply to cyberspace—is
routine activity theory
, or RAT.

Many theories focus on the individual characteristics of criminal offenders, but RAT, which was first introduced by sociologists Lawrence Cohen and Marcus Felson in 1979, examines the environments where crimes occur. The theory maintains that
when motivated offenders and suitable targets meet in the absence of capable guardians, crime is likely to happen
(motivated offender + suitable target + absence of capable guardians = more crime).

What's helpful about RAT is that the absence of any of these three conditions can be enough to prevent a crime from happening.

The theory is based on human nature—and the patterns of everyday life that all of us fall into. As one criminological handbook puts it: “
Individuals have different routines of life—traveling to and from work, going to school or attending religious functions, shopping, recreating,
communicating via various electronic technologies, etc.—and these variations determine the likelihood of when and where a crime will be committed and who or what is the victim.”

Criminals have patterns too—places where they live, work, and play. We know, for instance, that if you enter a real-world neighborhood where more criminals live, you are more likely to be a victim of crime. Now, what if that neighborhood is not policed in any effective way? Crime goes up. Your chances of being a victim go up too.

Now let's consider this in terms of RAT—or what we might as well call cyber-RAT.

The criminal neighborhoods online—on the Deep Web. How many motivated offenders are there?

Hundreds of thousands.

Suitable targets?

Even more.

How about capable guardians?

You know the answer already.

In the real world, young people have friends, older siblings, parents, neighbors, shopkeepers, teachers, and police who will say, “Don't stand on the table!” or “Don't run with scissors!” or “Don't walk near that ledge!” or “Don't go to that neighborhood!”

But in cyberspace, authority is minimal and there is a perception that nobody is in charge.

Because nobody is.

Now let's consider this new bad cyberspace neighborhood, the sites on the Darknet. Imagine a boy who grows up in poverty, and in a real-world bad neighborhood that is populated by gangs. Very likely, that boy will grow up with lots of insights into criminal behavior—and have honed instincts or antennae about criminals. He'll have “street smarts.” And because of this, he'll have a pretty good understanding of gang culture and know the protocols and the rules. (Because there will always be rules.)

One of the rules of a gang is that once you are a member, you are a member for life. A boy who grows up in a gang neighborhood will know this, almost instinctively, due to the experiences and environment of his childhood.

Now let's think about a boy raised in a suburb of Tallinn, Estonia. He may be socially isolated, spending a lot of time online in the safety of his bedroom. He has superb tech skills but no street smarts. He knows nothing about gang life and gang culture. He will have no experience, no wisdom. And yet it will be as easy for him to wander into Darknets as any boy. The boy in suburban Estonia can virtually transport himself within minutes into a high-crime neighborhood, where his tech skills will be viewed as a commodity. And there he could be groomed, coerced, or tapped to join a community that is really a cybercrime gang.

Once he falls into this cybergang, can he get out?

There are hundreds of stories of kids such as I've described, and we know this because of the number of mules, or money launderers, that are used by cybercriminals. Sometimes they answer an online ad—or post on a university bulletin board—that offers an opportunity to “stay at home and earn money.” The job is described as a financial manager, an overseas representative, or a payment processor for a new online business.
No experience needed
. Even some well-known businesses have had their brands hijacked and misused in this way. The job entails receiving money from customers, deducting a commission, and then wiring the balance overseas, usually to a bank in Russia or Eastern Europe. The offer often seems almost too good to be true.

The term
mule
comes from the drug-smuggling trade. A mule is paid to transport drugs for a fee. A
money mule
, or
smurfer
, transports money, not drugs, acting as a money-laundering service. Because this kind of illegal action doesn't involve tangible illegal goods, it may seem less risky, and many are not aware they are doing anything illegal until the police knock on their door. When the crime operation goes down, the mules are often the only ones who get caught and punished. By then, the money is in the hands of the cybercrime ring.

Where does this money come from? Usually stolen credit cards. In the past decade, banks worldwide have lost billions of dollars to cybercriminals. Quantifying the amount of money, and the actual threat, has proven difficult. But one thing appears certain:
The incidence of teenagers turning to cybercrime is on the rise.

The world was shocked when
Crimebook, one of the world's largest English-language crime forums—which offered advice about how to wire funds anonymously, purchase illegal items online, and pay for other illegal services—turned out to be founded and operated by three teenagers in the U.K. In 2011, their forum had 8,000 members worldwide and was linked to a trading site, Gh0stMarket, that had embezzled £16.2 million by hacking into 65,000 bank accounts. When the teens were arrested and their computers seized, the details of 100,000 stolen credit cards were found.

Just do a search on the words
teenagers
and
cybercrime
and you'll see enough examples to convince you of an epidemic. In a survey done by Tufin, an online security company, roughly one in six teenagers in the U.S., and one in four teenagers in the U.K., were found to have tried some form of Internet hacking.

The explanation for this is demand. According to a recent Europol report, cybercrime has evolved from a few small groups of hackers into a thriving criminal industry that costs global economies between an estimated $300 billion and $1 trillion a year.

What does demand have to do with that? The Internet is where criminals buy and sell products and services, as well as hire and train. The underground economy relies on websites and forums for recruiting. As criminals network, they share experience and expertise, and meet cohorts. On various sites, there are forums to learn, step-by-step, the best ways to commit identity fraud, to steal credit card information, or to convince an elderly person to wire you, a perfect stranger, money overseas. There are even tutorials.

As the online criminal economy grows, it needs new accomplices and new victims. Frequently it's difficult to know which is which.

It's easy to see why a young person might believe that buying drugs in this environment is safer. As all the studies of piracy have shown, the first thing a person worries about when purchasing anything illegal is the risk of being caught by authorities—whether it's their parents or the police. And if you feel safe somewhere, you are likely to spend more
time there, whether you are buying drugs, looking at new sites, or just hanging out in a forum.

But it isn't safe. Effectively, these young people are entering a high-crime environment that's largely unpoliced (except by other criminals), where scams are rampant, and where many illicit things besides party drugs are available.

Not to mention it's where lots of nasty things can happen to your computer and personal data. By visiting a pirating site, you can become vulnerable to more than just viruses and malware. Because of the nature of file-sharing being peer-to-peer and decentralized, each user acts as a server for others. Many file-sharing sites recommend that users stick with program defaults, thereby making their folder shareable—and their device can potentially wind up becoming invisible storage sites for anything a cybercriminal needs to hide and find later, quickly, from lists of illegal credit card information or thousands of child abuse images. When anybody uses a p2p service site, they can unwittingly download encrypted files containing illegal content. This is called being a “storage mule.”

According to Adrian Leppard, the Commissioner of the City of London Police,
a quarter of organized crime in Britain involves online fraud, bringing in tens of billions of pounds in profit a year. “When many of the offenders are abroad and they are using the Internet, which is unregulated, it is very difficult to see how a traditional enforcement approach will solve the problem,” Leppard said in an interview with the
Telegraph
. “Even if we had ten times the number of police officers, I am not sure that would necessarily address the problem.”

Cybercrime isn't just escalating, though.

It has changed criminal culture.

We have always had an underworld, whether in mythology or in real life. In timeless fables, heroes are often forced to descend into underworlds and a psychic conflict ensues. The battles with demons and monsters are metaphors for the hero's own inner struggles and conflicts.
In psychology, it was Sigmund Freud who created the concept of the human unconscious as a dark realm that required special knowledge to access.

Freud believed that the antisocial elements inside us seek a dark place to hide, much the way underworld criminals look for covert environments—and will always find them. There will always be crime. There will always be criminals.

My question:
But do we have to make it so easy?

Whether the descent to the Darknets is to buy a stolen credit card number or pull off a
data breach of the IRS, it has never been simpler or easier to become a criminal. It used to require physical risk. It meant armed holdups, face-to-face encounters with real guns, and a need for outsmarting law enforcement. Now, for most cybercriminals, the risks are negligible. Only the poor mules—or teenagers from the Estonian suburbs—get caught.

As for victims, they're everywhere. Once upon a time, crime was visited upon you if you walked alone at night or walked in the wrong neighborhood, where your wallet or car keys could be stolen. Or it happened randomly. You were in the wrong place at the wrong time.

Now everywhere you go, it's the wrong place and time. With many of the greatest treasures you possess—your identity, your data, your account numbers and passcodes, your passport information, and the rest—now kept in cloud storage or available via your smartphone, the opportunities for theft are endless. With
more than 3 billion people worldwide online and an estimated 7 billion cellphone subscriptions, half of which also have broadband access. Mobile broadband coverage will continue to expand into rural areas. This means the number of victims will only escalate. In criminology this is described as a “broader attack surface.”