Modus Operandi Marianne Junger Cyber-crime science 1 [Mon13] A. L. Montoya Morales, M. Junger, and P. H. Hartel. How 'digital' is traditional crime? In European Intelligence and Security Informatics Conference (EISIC), Uppsala, Sweden, Aug IEEE Computer Society.

Origins of CRIME Why do people commit crimes? What aspects play a role? 9RzZa00 9RzZa00 Cyber-crime science 2

Background Crime Science »Crime is the product of the environment »Independent of personal characteristics Fact »Since WWII increase in wealth, more leisure time, higher education. »But what happened to crime? Cyber-crime science 3

Development of registered crime in NL (CBS) Cyber-crime science 4 4

Why did crime increase? More targets Less supervision Increased mobility Aim of Crime Science = prevention Cyber-crime science 5

Issue today Does digitalization lead to increase in crime? Cyber-crime science 6

Digitalization in he Netherlands 93% of Dutch population is connected to the internet (CBS) 50% also accesses internet via mobile device (smart-phone: 43%, laptop: 21%) 53% is active on social media 79% shop online, 55% are frequent online shoppers Cyber-crime science 7

First expectation Cybercrime is increasing as a result of increasing use of ICT Cyber-crime science 8

Not supported by previous work [Dom09] concluded that cybercrime is ‘at most 1% of all reported crime’ Hollands-Midden: 0.32% of all crime Zuid-Holland-Zuid: 0.54% of all crime Cyber-crime science 9 [Dom09] M. M. L. Domenie, E. R. Leukfeldt, M. H. Toutenhoofd-Visser, and W. Ph. Stol. Werkaanbod cybercrime bij de politie. een verkennend onderzoek naar de omvang van het geregistreerde werkaanbod cybercrime. Cyren rapport, NHL Hogeschool, Leeuwarden, 2009.

Previous work [Dom09] followed special methodology [Dom09] measured prevalence in Zuid Holland Zuid and Hollands Midden »Definition: “the use of IT for committing criminal activities against persons, property, organizations or electronic communication networks and information systems” »Operationalization: Searched for keywords associated with cybercrime, such as "computer", "cyber" or “digital“, using a digital search protocol »Findings: % of all crime reported to the Dutch police constitutes cybercrime in 2 police regions. Cyber-crime science 10

Aim UTwente study Check these figures following new methodology Check manually into the digital modus operandi (MO) of traditional crime Cyber-crime science 11

Second expectation Changes in technology affect characteristics of crime, type of offenders and type of victims Cyber-crime science 12

Previous work does not support this expectation Cybercriminals are younger but basically the same as offenders from traditional crimes [Leu11] Cyber-crime science 13 [Leu11] E. R. Leukfeldt and W. Ph. Stol. De marktplaatsfraudeur ontmaskerd. internetfraudeurs vergeleken met klassieke fraudeurs. Secondant, 25(5):26-31,

Characteristics of cybercriminals 14 AgeBetween 18 and 30 – up to 79% younger than 30 SexMales: 80% or more Technical skill Not especially skilled vs very skilled Role criminal organizations Cybercrime requires high degree of organization and specialization, in financial-driven crimes Organized crime involvement = 90% Geographical location Groups may still be located in lose geographical proximity, even if their activities are transnational. Cyber-crime science [ UNO13] UNODC. Comprehensive Study on Cybercrime. United Nations Office on Drugs and Crime, Feb crime/UNODC_CCPCJ_EG.4_2013/CYBERCRIME_STUDY_ pdf. crime/UNODC_CCPCJ_EG.4_2013/CYBERCRIME_STUDY_ pdf

Expectations Cybercrime should increase as society goes online »Check figures [Dom09] with new methodology? Digitalisation should affect the characteristics of the type of crime and the type of offenders »Do we see changes in cybercrime corresponding to the [UNO13] findings? Aim present study not measure ‘cybercrime’ but penetration of Information and Communication Technology (ICT) in traditional crime Cyber-crime science 15

Method Careful reading of police records (Proces Verbaal) using a tailor-made checklist Random selection of 900 incidents in Gelderland and Overijssel Crime types: »Residential & commercial burglary (n=300) (link to cybercrime is unknown) »Threats (n=300) (suspected link to cybercrime) »Frauds (suspected link to cybercrime) (n=300) Cyber-crime science 16

Method (Contd.) Crime script Amount of ICT used during »Commission of crime (i.e. modus operandi) »Criminal investigation »Apprehension Cyber-crime science 17

Method (Contd.) Socio-demographic variables, age, sex, place of birth Organized crime measured indirectly: organized crime implies – in the present study »Having a criminal record »More than a single offender »Not having a legal occupation »Geographic location: international crime Cyber-crime science 18

Question How much ICT is there in traditional crime? Selection: all cases September 2011Cyber-crime science 19

ICT is important for threats and fraud * #24 Unsolicited sent #30 Threat digital #34 Forgery digital #39 Burglary prior to the offense in digital form Cyber-crime science 20 * Significant p <.001 Burglary: 1.5% takes place after the commission of the burglary (theft of money via stolen bank cards)

ICT is important for threats and fraud Threat digital »Verbal threats via SMS, MSN Whatsapp, or on social media »Also: denigrating messages or films on YouTube, personal, or business (bad publicity) Digital Fraud »Online shopping; ‘E-Bay (Marktplaats) fraud »Internet banking: skimming or hacking of bank system Cyber-crime science 21

Characteristics of digital crime Offense Offenders »Selection of threats and fraud Cyber-crime science 22

Age: % 34 and younger [UNO13] up to 79% younger than 30 Offender: offenders of digital crimes are older – for fraud (but ns) Cyber-crime science 23

Sex: % female offenders [UNO13] Males: 80% or more Cyber-crime science 24

Role criminal organisation: % cases with only one suspect [UNO13] Cybercrime requires high degree of organization and specialization, at least in financial- driven crimes, up to 90% organized (financially motivated crime) Cyber-crime science 25

Role (contd).: % cases with suspects with a criminal record Cyber-crime science 26

Role (contd.): % cases with suspects with a paid job Cyber-crime science 27

Role (contd.): % cases suspects born in NL Cyber-crime science 28

Geographical distance between the offender and the victim at the time of the crime, in % Cyber-crime science 29 Threats Fraud ** Tradi- tional Digi- tal Tradi- tional Digi- tal Both were in Eastern region Either the victim or the offender were in eastern region, the other elsewhere in the Netherlands International (either the offender or the victim were abroad) Both were outside Eastern region N ** p < 0.01

Geographical distance between the offender and the victim at the time of the crime, in % Cyber-crime science 30 Threats Fraud ** Tradi- tional Digi- tal Tradi- tional Digi- tal Both were in Eastern region Either the victim or the offender were in eastern region, the other elsewhere in the Netherlands International (either the offender or the victim were abroad) Both were outside Eastern region N ** p < 0.01

Suspect-victim relationship among traditional and digital crimes Significant: p <.05; ** Significant: p <.01; *** Significant: p <.001 science 31 Threats Fraud TraditionalDigital TraditionalDigital Business partners *** Family acquaintances * Neighbours Ex-partners * Partners Criminal contacts Social networks Game-friends---- Chat-friends-4.4** Other relationship * N

comparison of traditional & digital crime -> normalization Cyber-crime science 32 O = Offender V = Victim Digital threats are characterized by Digital fraud is characterized by SexO & V more often femaleV more often female AgeO are olderV & O are younger Country of birthV more often Dutch V & O are Dutch Paid work (at 18 years and older) O More often employed V less often employed O More often employed V less often employed Criminal recordO has less often a criminal record O has more often a criminal record Committed crime alone O more often alone

Criminal Investigation (%)* Cyber-crime science 33 * % not mutually exclusive

Importance of tools for apprehension Cyber-crime science 34 * Significant: p <.05; ** Significant: p <.01

Conclusion 1: More digital crime than expected Prevalence: most digital crime: »Fraud 41% »Threats16% More often digital traces »Fraud: 29% »Commercial burglary: 29% »Threats: 18% »Residential burglary: 13% Cyber-crime science 35

Conclusion 2: Security is integrated Criminals don’t mind legal or other disciplinary borders Physical social and cyber are all part of ‘security’ Cyber-crime science 36

Conclusion 3: Digital crimes are – partly - different In contrast with [Dom09] findings show – some -departure form traditional offenders »Age and sex: no sign differences but trends: towards ‘normalization’ for digital crime In contrast with [UNO13] no indication that ‘digital’ means ‘organised crime’. Instead ‘normalization’ of offenders »digital crime more often single offender (fraud), less often a criminal record (threats), and more often legal paid job (threats). ICT brings the modus operandi of crime into the homes Cyber-crime science 37

Limitations Generalisation across crime types is a bad idea Extrapolation of results to other areas of the country probably not a good idea »Lower crime rate in smaller urban areas »Lower internet use in rural areas Cyber-crime science 38

Thank you Cyber-crime science 39

Modus operandi (1) Cyber-crime science 40 Residenti al Burglary Commer cial burglary ThreatsFraud Was the threat digital? On forehand*** During*** Afterwards Total*** Was the forgery in digital form? On forehand *** During*** Afterwards* Total*** Was the burglary digital? On forehandn.v.t.0.0 During*** Afterwards n.v.t.0.0 Total*** N

Modus operandi (2) Cyber-crime science 41 Resident ial Burglary Commer cial burglary ThreatsFraud Was there a threat of disclosure of information On forehand During* Afterwards n.v.t.0.0 Total* Where there unwanted s On forehand During* Afterwards a Total* Total *** N