1. Modus Operandi Marianne Junger Cyber-crime science 1 [Mon13] A. L. Montoya Morales, M. Junger, and P. H. Hartel. How 'digital' is traditional crime? In European Intelligence and Security Informatics Conference (EISIC), Uppsala, Sweden, Aug 2013. IEEE Computer Society. http://eprints.eemcs.utwente.nl/23423/http://eprints.eemcs.utwente.nl/23423/

2. Origins of CRIME Why do people commit crimes? What aspects play a role? https://www.youtube.com/watch?v=RmQZ 9RzZa00 https://www.youtube.com/watch?v=RmQZ 9RzZa00 Cyber-crime science 2

3. Background Crime Science »Crime is the product of the environment »Independent of personal characteristics Fact »Since WWII increase in wealth, more leisure time, higher education. »But what happened to crime? Cyber-crime science 3

4. Development of registered crime 1960-1995 in NL (CBS) Cyber-crime science 4 4

5. Why did crime increase? More targets Less supervision Increased mobility Aim of Crime Science = prevention Cyber-crime science 5

6. Issue today Does digitalization lead to increase in crime? Cyber-crime science 6

7. Digitalization in he Netherlands 93% of Dutch population is connected to the internet (CBS) 50% also accesses internet via mobile device (smart-phone: 43%, laptop: 21%) 53% is active on social media 79% shop online, 55% are frequent online shoppers Cyber-crime science 7

8. First expectation Cybercrime is increasing as a result of increasing use of ICT Cyber-crime science 8

9. Not supported by previous work [Dom09] concluded that cybercrime is ‘at most 1% of all reported crime’ Hollands-Midden: 0.32% of all crime Zuid-Holland-Zuid: 0.54% of all crime Cyber-crime science 9 [Dom09] M. M. L. Domenie, E. R. Leukfeldt, M. H. Toutenhoofd-Visser, and W. Ph. Stol. Werkaanbod cybercrime bij de politie. een verkennend onderzoek naar de omvang van het geregistreerde werkaanbod cybercrime. Cyren rapport, NHL Hogeschool, Leeuwarden, 2009.

10. Previous work [Dom09] followed special methodology [Dom09] measured prevalence in Zuid Holland Zuid and Hollands Midden »Definition: “the use of IT for committing criminal activities against persons, property, organizations or electronic communication networks and information systems” »Operationalization: Searched for keywords associated with cybercrime, such as "computer", "cyber" or “digital“, using a digital search protocol »Findings: 0.32 - 0.54% of all crime reported to the Dutch police constitutes cybercrime in 2 police regions. Cyber-crime science 10

11. Aim UTwente study Check these figures following new methodology Check manually into the digital modus operandi (MO) of traditional crime Cyber-crime science 11

12. Second expectation Changes in technology affect characteristics of crime, type of offenders and type of victims Cyber-crime science 12

13. Previous work does not support this expectation Cybercriminals are younger but basically the same as offenders from traditional crimes [Leu11] Cyber-crime science 13 [Leu11] E. R. Leukfeldt and W. Ph. Stol. De marktplaatsfraudeur ontmaskerd. internetfraudeurs vergeleken met klassieke fraudeurs. Secondant, 25(5):26-31, 2011. http://www.hetccv.nl/binaries/content/assets/ccv/secondant/2011/secondant2011-6.pdf. http://www.hetccv.nl/binaries/content/assets/ccv/secondant/2011/secondant2011-6.pdf

14. Characteristics of cybercriminals 14 AgeBetween 18 and 30 – up to 79% younger than 30 SexMales: 80% or more Technical skill Not especially skilled vs very skilled Role criminal organizations Cybercrime requires high degree of organization and specialization, in financial-driven crimes Organized crime involvement = 90% Geographical location Groups may still be located in lose geographical proximity, even if their activities are transnational. Cyber-crime science [ UNO13] UNODC. Comprehensive Study on Cybercrime. United Nations Office on Drugs and Crime, Feb 2013. http://www.unodc.org/documents/organized- crime/UNODC_CCPCJ_EG.4_2013/CYBERCRIME_STUDY_210213.pdf.http://www.unodc.org/documents/organized- crime/UNODC_CCPCJ_EG.4_2013/CYBERCRIME_STUDY_210213.pdf

15. Expectations Cybercrime should increase as society goes online »Check figures [Dom09] with new methodology? Digitalisation should affect the characteristics of the type of crime and the type of offenders »Do we see changes in cybercrime corresponding to the [UNO13] findings? Aim present study not measure ‘cybercrime’ but penetration of Information and Communication Technology (ICT) in traditional crime Cyber-crime science 15

16. Method Careful reading of police records (Proces Verbaal) using a tailor-made checklist Random selection of 900 incidents in Gelderland and Overijssel Crime types: »Residential & commercial burglary (n=300) (link to cybercrime is unknown) »Threats (n=300) (suspected link to cybercrime) »Frauds (suspected link to cybercrime) (n=300) Cyber-crime science 16

17. Method (Contd.) Crime script Amount of ICT used during »Commission of crime (i.e. modus operandi) »Criminal investigation »Apprehension Cyber-crime science 17

18. Method (Contd.) Socio-demographic variables, age, sex, place of birth Organized crime measured indirectly: organized crime implies – in the present study »Having a criminal record »More than a single offender »Not having a legal occupation »Geographic location: international crime Cyber-crime science 18

19. Question How much ICT is there in traditional crime? Selection: all cases September 2011Cyber-crime science 19

20. ICT is important for threats and fraud * #24 Unsolicited email sent #30 Threat digital #34 Forgery digital #39 Burglary prior to the offense in digital form Cyber-crime science 20 * Significant p <.001 Burglary: 1.5% takes place after the commission of the burglary (theft of money via stolen bank cards)

21. ICT is important for threats and fraud Threat digital »Verbal threats via SMS, MSN Whatsapp, email or on social media »Also: denigrating messages or films on YouTube, personal, or business (bad publicity) Digital Fraud »Online shopping; ‘E-Bay (Marktplaats) fraud »Internet banking: skimming or hacking of bank system Cyber-crime science 21

22. Characteristics of digital crime Offense Offenders »Selection of threats and fraud Cyber-crime science 22

23. Age: % 34 and younger [UNO13] up to 79% younger than 30 Offender: offenders of digital crimes are older – for fraud (but ns) Cyber-crime science 23

24. Sex: % female offenders [UNO13] Males: 80% or more Cyber-crime science 24

25. Role criminal organisation: % cases with only one suspect [UNO13] Cybercrime requires high degree of organization and specialization, at least in financial- driven crimes, up to 90% organized (financially motivated crime) Cyber-crime science 25

26. Role (contd).: % cases with suspects with a criminal record Cyber-crime science 26

27. Role (contd.): % cases with suspects with a paid job Cyber-crime science 27

28. Role (contd.): % cases suspects born in NL Cyber-crime science 28

29. Geographical distance between the offender and the victim at the time of the crime, in % Cyber-crime science 29 Threats Fraud ** Tradi- tional Digi- tal Tradi- tional Digi- tal Both were in Eastern region 88.180.6 57.519.4 Either the victim or the offender were in eastern region, the other elsewhere in the Netherlands 7.919.4 27.463.9 International (either the offender or the victim were abroad) 1.7- 12.313.9 Both were outside Eastern region 2.3- 2.72.8 N 17731 7336 ** p < 0.01

30. Geographical distance between the offender and the victim at the time of the crime, in % Cyber-crime science 30 Threats Fraud ** Tradi- tional Digi- tal Tradi- tional Digi- tal Both were in Eastern region 88.180.6 57.519.4 Either the victim or the offender were in eastern region, the other elsewhere in the Netherlands 7.919.4 27.463.9 International (either the offender or the victim were abroad) 1.7- 12.313.9 Both were outside Eastern region 2.3- 2.72.8 N 17731 7336 ** p < 0.01

31. Suspect-victim relationship among traditional and digital crimes Significant: p <.05; ** Significant: p <.01; *** Significant: p <.001 science 31 Threats Fraud TraditionalDigital TraditionalDigital Business partners5.22.224.047.3*** Family8.28.91.20.9 acquaintances13.413.37.01.8* Neighbours9.12.20.61.8 Ex-partners15.528.93.5-* Partners3.96.7-- Criminal contacts0.9--- Social networks0.4-1.2- Game-friends---- Chat-friends-4.4**0.60.9 Other relationship7.813.35.30.9* N23245 171112

32. comparison of traditional & digital crime -> normalization Cyber-crime science 32 O = Offender V = Victim Digital threats are characterized by Digital fraud is characterized by SexO & V more often femaleV more often female AgeO are olderV & O are younger Country of birthV more often Dutch V & O are Dutch Paid work (at 18 years and older) O More often employed V less often employed O More often employed V less often employed Criminal recordO has less often a criminal record O has more often a criminal record Committed crime alone O more often alone

33. Criminal Investigation (%)* Cyber-crime science 33 * % not mutually exclusive

34. Importance of tools for apprehension Cyber-crime science 34 * Significant: p <.05; ** Significant: p <.01

35. Conclusion 1: More digital crime than expected Prevalence: most digital crime: »Fraud 41% »Threats16% More often digital traces »Fraud: 29% »Commercial burglary: 29% »Threats: 18% »Residential burglary: 13% Cyber-crime science 35

36. Conclusion 2: Security is integrated Criminals don’t mind legal or other disciplinary borders Physical social and cyber are all part of ‘security’ Cyber-crime science 36

37. Conclusion 3: Digital crimes are – partly - different In contrast with [Dom09] findings show – some -departure form traditional offenders »Age and sex: no sign differences but trends: towards ‘normalization’ for digital crime In contrast with [UNO13] no indication that ‘digital’ means ‘organised crime’. Instead ‘normalization’ of offenders »digital crime more often single offender (fraud), less often a criminal record (threats), and more often legal paid job (threats). ICT brings the modus operandi of crime into the homes Cyber-crime science 37

38. Limitations Generalisation across crime types is a bad idea Extrapolation of results to other areas of the country probably not a good idea »Lower crime rate in smaller urban areas »Lower internet use in rural areas Cyber-crime science 38

39. Thank you Cyber-crime science 39

40. Modus operandi (1) Cyber-crime science 40 Residenti al Burglary Commer cial burglary ThreatsFraud Was the threat digital? On forehand***0.0 3.50.0 During***0.0 12.71.1 Afterwards0.0 0.40.7 Total***0.0 14.71.5 Was the forgery in digital form? On forehand ***0.70.00.49.5 During***0.70.0 38.7 Afterwards*1.50.0 2.9 Total***2.90.00.440.1 Was the burglary digital? On forehandn.v.t.0.0 During***0.0 5.1 Afterwards n.v.t.0.0 Total***0.0 5.1 N136140259274

41. Modus operandi (2) Cyber-crime science 41 Resident ial Burglary Commer cial burglary ThreatsFraud Was there a threat of disclosure of information On forehand0.0 0.80.0 During*0.0 1.50.0 Afterwards n.v.t.0.0 Total*0.0 1.90.0 Where there unwanted emails On forehand0.0 0.81.1 During*0.0 3.92.6 Afterwards a0.0 1.20.0 Total*0.0 4.23.6 Total *** N136140259274