1. Limitations and Possibilities of Estimating the Costs of Cybercrime Thomas J. Holt, Ph.D. Associate Professor School of Criminal Justice Michigan State University holtt@msu.edu 1-517-353-9563

2. This project was supported by Award No. 2010-IJ-CX-1676, awarded by the National Institute of Justice, Office of Justice Programs, U.S. Department of Justice. The opinions, findings, and conclusions or recommendations expressed in this publication are those of the authors and do not reflect those of the Department of Justice. Data Breach Threats

3. Limitations in Existing Data At present, there are few statistical sources available to estimate the costs of cybercrime – Data is absent from the UCR, NIBRS – NCVS conducted a supplemental survey in 2012 – IC3 provides limited information – Industry reporting sources have limitations and biases

4. Data Sales Threats

5. The Sales Process Seller Posts an Ad in Forum The sales process involves mutual association and participation RULES: (please read the rules carefully and follow all the steps, anyone breaking this rules shall expect to be fully ignored by service) 1. Contact with one of the our supports and choose dumps u want. 2. Calculate total price and submit your order. 3. Send us money and your e-mail. 4. We have 24 hours (maximum) to complete your order.(LR [Liberty Reserve Payment] INSTANT DELIEVERY ) 5. We replace only Pickup/Hold Call Dumps with in 24 hours after time period we are not responsible PAYMENT INFO: LIBERTY RESERVE Support Icq: [removed]

7. Sales Process and Risk Seller Posts an Ad in Forum Sales Occur Via ICQ/Email/ Jabber The sales process involves mutual association and participation Buyers place orders and pay for services electronically – Liberty Reserve, WebMoney (WM), BitCoin (primarly Tor) – Western Union/MoneyGram – Escrow payments incorporating other forum users

8. Stolen Data Markets The markets are driven by feedback provided by buyers regarding the quality of sellers and their products – Ripping Markets – Legitimate Insulated Markets Hidden transactions make it difficult to know the validity of data or sellers – Potential for false feedback also complicates process for sellers

9. Sales Process and Risk Seller Posts an Ad in Forum Customer Feedback in Forum Sales Occur Via ICQ/Jabber/E- mail The sales process involves mutual association and participation Yazov: TS [Thread Starter] laundered $300, the speed is comparable to the second cosmic speed. Everything was magnificent, I’ll go back Avatar: I did some laundering of money from a female partner, everything was quick and excellent and he [the TS] takes a small percentage, which also makes one happy.

10. Extrapolating Economic Data Cybercrime markets provide a unique opportunity to estimate the profits of offenders – Total scope of market – Success of sellers – Limited measures for buyers

11. Estimating Seller Revenue Total Sellers’ Revenues = total feedback X lot size X advertised price X probability of success – Interprets all positive and negative feedback – Estimate total number of piece goods in a lot – Advertised min, max, mean, median – Condition by likelihood of accuracy

12. Estimates of Dumps Seller Profits Non-Ripping Forums Price50 Dump Lot100 Dump Lot 25%50%75%100%25%50%75%100% $2.00$4,750.00$9,500.00$14,250.00$19,000.00$9,500.00$19,000.00$28,500.00$38,000.00 $60.00$142,500.00$285,000.00$427,500.00$570,000.00$285,000.00$570,000.00$855,000.00$1,140,000.00 $104.47$248,116.30$496,232.50$744,348.75$992,465.00$496,232.50$992,465.00$1,488,697.50$1,984,930.00 $7,000.00$16,625,000.00$3,325,000.00$49,875,000.00$66,500,000.00$33,250,000.00$66,500,000.00$99,750,000.00$133,000,000.00 Ripping Forums Price50 Dump Lot100 Dump Lot 25%50%75%100%25%50%75%100% $0.04$33.50$67.00$100.50$134.00$67.00$134.00$201.00$760.00 $25.00$20,937.50$41,875.00$62,812.50$83,750.00$41,875.00$83,750.00$125,625.00$475,000.00 $101.34$84,872.25$169,744.50$254,616.75$339,489.00$169,744.50$339,489.00$509,233.50$1,925,460.00 $8,000.00$6,700,000$13,400,000.00$20,100,000.00$26,800,000.00$13,400,000.00$26,800,000.00 $40,200,000. 00$152,000,000.00

13. Estimating Buyer Revenue Total Buyer Profits= (positive feedback X lot size X average losses to victim X probability of success) – advertised price of data – Only positive feedback to increase accuracy – Estimate total piece count – Average loss or equal measure – Likelihood of accuracy – Subtract appropriate value to constrain offender outlay

14. Credit Cards Non-Ripping Forums 50 Dump Lot100 Dump Lot Probability: 255075100255075100 300351,000702,0001,053,0001,404,000702,0001,404,0002,106,0002,808,000 11481,964,9123,929,8255,894,7377,859,6503,929,8257,859,65011,789,475 15,719,301 Ripping Forums 50 Dump Lot100 Dump Lot Probability: 255075100255075100 300 82,500 165,000 247,500 330,000 165,000 330,000 495,000 660,000 1148 403,998 807,9961,211,994 1,615,992 807,9961,615,9922,423,988 3,231,984 Estimating Profits for Dumps Buyers

15. Debit Cards Non-Ripping Forums 50 Dump Lot100 Dump Lot Probability: 255075100255075100 200 204,750 409,500 614,250 819,000 409,500 819,000 1,228,500 1,638,000 551 654,5121,309,025 1,963,537 2,618,050 1,309,025 2,618,050 3,927,075 5,236,101 Ripping Forums 50 Dump Lot100 Dump Lot Probability: 255075100255075100 200 52,500.00 105,000.00 157,500.00 210,000.00 105,000.00 210,000.00 315,000.00 420,000.00 551 135,198.00 270,396.00 405,594.00 540,792.00 270,396.00 540,792.00 811,188.00 1,081,584

16. Limitations There are myriad limitations observed in this type of estimation – Formula does not recognize sellers without feedback Sampling strategies – No recognition of costs to offenders generally – May misrepresent actual cost of data or services – Victim costs may also not be well reflected

17. Future Research Further study is needed to validate this equation – Develop estimated costs based on various data from forums – Examine differences in scope of harm across communities – Better survey and statistical data collection among criminologists and criminal justice system agencies in general

18. Questions? Please contact the PI: Dr. Thomas J. Holt Associate Professor Michigan State University holtt@msu.edu 517-353-9563 18