Limitations and Possibilities of Estimating the Costs of Cybercrime Thomas J. Holt, Ph.D. Associate Professor School of Criminal Justice Michigan State University

This project was supported by Award No IJ-CX-1676, awarded by the National Institute of Justice, Office of Justice Programs, U.S. Department of Justice. The opinions, findings, and conclusions or recommendations expressed in this publication are those of the authors and do not reflect those of the Department of Justice. Data Breach Threats

Limitations in Existing Data At present, there are few statistical sources available to estimate the costs of cybercrime – Data is absent from the UCR, NIBRS – NCVS conducted a supplemental survey in 2012 – IC3 provides limited information – Industry reporting sources have limitations and biases

Data Sales Threats

The Sales Process Seller Posts an Ad in Forum The sales process involves mutual association and participation RULES: (please read the rules carefully and follow all the steps, anyone breaking this rules shall expect to be fully ignored by service) 1. Contact with one of the our supports and choose dumps u want. 2. Calculate total price and submit your order. 3. Send us money and your We have 24 hours (maximum) to complete your order.(LR [Liberty Reserve Payment] INSTANT DELIEVERY ) 5. We replace only Pickup/Hold Call Dumps with in 24 hours after time period we are not responsible PAYMENT INFO: LIBERTY RESERVE Support Icq: [removed]

Sales Process and Risk Seller Posts an Ad in Forum Sales Occur Via ICQ/ / Jabber The sales process involves mutual association and participation Buyers place orders and pay for services electronically – Liberty Reserve, WebMoney (WM), BitCoin (primarly Tor) – Western Union/MoneyGram – Escrow payments incorporating other forum users

Stolen Data Markets The markets are driven by feedback provided by buyers regarding the quality of sellers and their products – Ripping Markets – Legitimate Insulated Markets Hidden transactions make it difficult to know the validity of data or sellers – Potential for false feedback also complicates process for sellers

Sales Process and Risk Seller Posts an Ad in Forum Customer Feedback in Forum Sales Occur Via ICQ/Jabber/E- mail The sales process involves mutual association and participation Yazov: TS [Thread Starter] laundered $300, the speed is comparable to the second cosmic speed. Everything was magnificent, I’ll go back Avatar: I did some laundering of money from a female partner, everything was quick and excellent and he [the TS] takes a small percentage, which also makes one happy.

Extrapolating Economic Data Cybercrime markets provide a unique opportunity to estimate the profits of offenders – Total scope of market – Success of sellers – Limited measures for buyers

Estimating Seller Revenue Total Sellers’ Revenues = total feedback X lot size X advertised price X probability of success – Interprets all positive and negative feedback – Estimate total number of piece goods in a lot – Advertised min, max, mean, median – Condition by likelihood of accuracy

Estimates of Dumps Seller Profits Non-Ripping Forums Price50 Dump Lot100 Dump Lot 25%50%75%100%25%50%75%100% $2.00$4,750.00$9,500.00$14,250.00$19,000.00$9,500.00$19,000.00$28,500.00$38, $60.00$142,500.00$285,000.00$427,500.00$570,000.00$285,000.00$570,000.00$855,000.00$1,140, $104.47$248,116.30$496,232.50$744,348.75$992,465.00$496,232.50$992,465.00$1,488,697.50$1,984, $7,000.00$16,625,000.00$3,325,000.00$49,875,000.00$66,500,000.00$33,250,000.00$66,500,000.00$99,750,000.00$133,000, Ripping Forums Price50 Dump Lot100 Dump Lot 25%50%75%100%25%50%75%100% $0.04$33.50$67.00$100.50$134.00$67.00$134.00$201.00$ $25.00$20,937.50$41,875.00$62,812.50$83,750.00$41,875.00$83,750.00$125,625.00$475, $101.34$84,872.25$169,744.50$254,616.75$339,489.00$169,744.50$339,489.00$509,233.50$1,925, $8,000.00$6,700,000$13,400,000.00$20,100,000.00$26,800,000.00$13,400,000.00$26,800, $40,200, $152,000,000.00

Estimating Buyer Revenue Total Buyer Profits= (positive feedback X lot size X average losses to victim X probability of success) – advertised price of data – Only positive feedback to increase accuracy – Estimate total piece count – Average loss or equal measure – Likelihood of accuracy – Subtract appropriate value to constrain offender outlay

Credit Cards Non-Ripping Forums 50 Dump Lot100 Dump Lot Probability: ,000702,0001,053,0001,404,000702,0001,404,0002,106,0002,808, ,964,9123,929,8255,894,7377,859,6503,929,8257,859,65011,789,475 15,719,301 Ripping Forums 50 Dump Lot100 Dump Lot Probability: , , , , , , , , , ,9961,211,994 1,615, ,9961,615,9922,423,988 3,231,984 Estimating Profits for Dumps Buyers

Debit Cards Non-Ripping Forums 50 Dump Lot100 Dump Lot Probability: , , , , , ,000 1,228,500 1,638, ,5121,309,025 1,963,537 2,618,050 1,309,025 2,618,050 3,927,075 5,236,101 Ripping Forums 50 Dump Lot100 Dump Lot Probability: , , , , , , , , , , , , , , , ,081,584

Limitations There are myriad limitations observed in this type of estimation – Formula does not recognize sellers without feedback Sampling strategies – No recognition of costs to offenders generally – May misrepresent actual cost of data or services – Victim costs may also not be well reflected

Future Research Further study is needed to validate this equation – Develop estimated costs based on various data from forums – Examine differences in scope of harm across communities – Better survey and statistical data collection among criminologists and criminal justice system agencies in general

Questions? Please contact the PI: Dr. Thomas J. Holt Associate Professor Michigan State University