The 5 Challenges Involved in Cybercriminology: An Explainer

Nick Sauer, a Republican state representative from Illinois, resigned from his office in August of 2018 after his ex-girlfriend Kate Kelly filed a “revenge porn” complaint against him. Kelly alleged that Sauer created a fake Instagram account using her likeness. The account, she claimed, used nude pictures of her to bait men into online sexual conversations. The Huffington Post reported on August 2nd, 2018:

“Kelly’s complaint reportedly says a man she did not know reached out to her on July 12 via her personal Instagram account to say he’d ‘been communicating for 4 months with someone pretending’ to be her. After that, Kelly says, she wrote to Instagram, who disabled the account, and talked to Sauer about it. Sauer allegedly admitted to everything.”

This is a relatively small story about a state congressman who may not be known outside of Illinois. However, the story illustrates many of the challenges associated with cybercrime and those professionals who write about, legislate, investigate, and study it. I list and discuss five below:

Defining and describing cybercrimes. Kelly filed a complaint with the local police under Illinois’ revenge porn laws. Revenge porn is publicly displaying or sharing sexually explicit photographs of a current or former intimate partner. Revenge porn does not need to be about revenge per se, although it often is. One could share private photos to deceive another person, as Sauer allegedly did.

But a search of the media attention placed on the case shows that revenge porn is not the phenomenon that the media has focused on the most, although it is the actual crime he has alleged to have done. Instead, media attention has been placed more on the catfishing done by Sauer — using a false online identity to lure people into relationships. I was even asked by the Independent to write my opinion on catfishing…not revenge porn.

Identifying, defining, and describing phenomena is a common hurdle in discussions surrounding cybercrime and it cannot be understated. As with the Sauer case, the media has great influence on framing issues. They need the appropriate vocabulary and concepts in order to frame cybercrime phenomena appropriately for the public.

Although there are many definitions out there, we use one from criminologist Majid Yar:

“…cybercrime refers not so much to a single, distinctive kind of criminal activity, but more to a diverse range [emphasis in original] of illegal and illicit activities that share in common the unique electronic environment (‘cyberspace’) in which they take place”.

This definition implies that that the activity itself matters less than in what environment it takes place. Any activity that is deemed criminal or deviant that is mediated with computer technology or the Internet is cybercrime or cyberdeviance. An example of this is stalking. Stalking someone is a traditional crime. Depending upon the state, this crime encompasses the perpetrator generating fear in the victim and presenting him or herself as a credible threat to the victim. When this stalking is done via social media — in cyberspace — stalking becomes cyberstalking, and thus a cybercrime. Similarly, theft is a crime. When that theft encompasses the stealing of data on a computer, this becomes a cybercrime — usually falling under the broad rubric of hacking.

Navigating a rapidly changing legal landscape without overstepping. The legal system has been scrambling to keep up with changes in technology. Kelly could not have made her complaint in 2013, as Illinois did not have a revenge porn law. The state of Illinois passed their revenge porn law in 2014. Under the current law, someone convicted of revenge porn is subject to one to three years in prison and up to a $25,000 fine. While changes in laws are necessary to keep pace with changes in technology and social patterns, one can question the appropriateness of state and federal laws. On the one hand, a revenge porn law is meant to protect people who have been justly victimized. On the other hand, some may question the harshness of the punishment. Is a sentence of one year in prison necessary for Sauer’s actions? In other words, does the punishment fit the crime?

Another aspect of this issue is that legal reactions to new types of cybercrimes can be overly aggressive or misplaced. As mentioned above, much media attention has been placed on the catfishing aspect of the story. Currently, catfishing is not illegal, but some have called for it to be criminalized. But being anonymous online is a valued aspect of the digital environment. Consider a young person who may be considering a change of identity — gender, religious, political. They may wish to explore this identity away from their current social networks. They may want to connect with and interact in online forums that explore aspects of this new identity. They will need the freedom to create a new persona and interact with others without obligating themselves. Or, consider a whistle-blower who wants to share sensitive information about government misconduct without revealing their identity. Speaking truth to power may require creating a fake Facebook or Twitter account. Thus, laws that are too aggressive, such as a catfishing banning false identities, may end up doing more harm than good.

Developing investigative techniques for a rapidly changing criminal landscape. The perpetrators of cybercrime come from different backgrounds and social contexts than perpetrators of crimes society usually focuses on. The Federal Bureau of Investigations releases a yearly report entitled the Uniform Crime Report (UCR). The UCR is a compilation of what is colloquially called “street crimes”. The UCR records four types of violent crime — murder, rape, robbery, and aggravated assault, and four types of property crime — burglary, larceny, motor vehicle theft, and arson. The individuals who are more likely to commit these types of crimes are young, in poverty, and male. They are disproportionately people of color who have historically lived in segregated and impoverished neighborhoods. They are also likely to come from challenging home environments where there is addiction or domestic violence. Cybercrime scholars are still coalescing on the profiles of cybercriminals, but we can be confident that cybercriminals do not fit the profile of someone who would commit a street crime. Cybercriminals are more likely to be educated. They are more likely to be white and come from less challenging social and family circumstances.

Cybercrimes also require different investigative techniques, and law enforcement has responded accordingly in at least three general ways:

  1. Law enforcement has had to learn how and when to request evidence from intermediaries (through court order, subpoena, and warrant). In the Sauer case, Instagram is a third party that potentially holds inculpatory or exculpatory evidence and at the minimum a subpoena will likely be needed to attain relevant evidence.
  2. Law enforcement has developed strategies for following the bread crumbs of a person online — their digital trail. People are fairly loose about what they put on their social media. This public information — the posts, tweets, and images are often enough to place a suspect at a scene or connect the suspect to the victim.
  3. Specially trained professionals can identify and extract digital evidence at the binary level on a hard drive — digital forensics. With a warrant they can acquire Sauer’s computing hardware and examine it for potential evidence (my guess is that this case is, as they say, “open and shut” — but some cases may require this level of investigation).

Despite the new techniques developed, cybercrimes can be much more difficult to investigate and solve than street crimes. This is because of the unique properties of cyberspace, one of which is the ability to form connections across time and space. This property creates new opportunities for criminals. Kelly was in some ways fortunate that she could contact the local police in which the alleged, Sauer, lived. In many cases, local police struggle to investigate cybercrimes because the perpetrator lives in a state or country different from the victim. For many cybercrimes such as hacking, ransomware, or direct denial of service attacks, this means that federal agencies conduct the investigations. However, even federal agencies can run into difficulties when a suspect is in another country. Agencies in other countries may not wish to share information Or, the laws in the perpetrators country are different than the laws in the victims country.

Understanding the cultural context and thinking about deviance as well as crime. In 2017 film producer Harvey Weinstein was charged with several counts of sexual misconduct. Weinstein’s case was high profile, with many well-known actresses alleging they were sexually assaulted by Weinstein. In October of that year, the hashtag #MeToo spread via social media as many other celebrities and non-celebrities wrote posts describing their experiences and included the hashtag. The “#MeToo Movement” has been instrumental in publicizing sexual misconduct. By February of this year 71 men holding positions of power had been fired or forced to resign because of sexual misconduct. These include Jerry Richardson, former owner of the Carolina Panthers National Football League team, Matt Lauer, former co-host of the Today Show, and Russell Simmons, co-founder of Def Jam records.

Sauer’s reactions to the allegations cannot be understood without taking into account the current cultural climate towards power imbalances and sexual misconduct. Sauer’s resignation is as much about informal norms of sexual behavior in cyberspace — cyberdeviance, as it is about formal violations of law — cybercrime. In decades past, Sauer may have been able to withstand the negative press associated with Kelly’s complaint. In 2018, these allegations are impossible to dodge. Indeed, in his resignation letter, Sauer wrote that his job would be affected by the “distraction of addressing these allegations.”

Understanding the “hows” and “whys” of cybercrime. Theory can be a rather dull subject for those interested in cybercrime. However, if we are to understand how and why cybercrimes theoretically informed scholarly research must be conducted. These “hows” and “whys” form the foundation for almost all insights into cybercrime phenomena:

  • Effective laws and social policies come from rigorous, non-partisan scholarship that accurately defines and describes cybercrime phenomena
  • Knowing root social causes of cybercrime and developing accurate profiles of cybercriminals can aid law enforcement in anticipating and preventing cybercrime
  • Scholarship on victimization can help social workers and other victim assistance professionals treat those who have been hurt by cybercrimes

Cybercrime scholarship is growing but is in its infancy. To date, social scientists have been able to use traditional criminological and sociological theories to explain cybercrime patterns. After all, whether it is cyber or not, it is still human behavior. For example, many forms of cyberbullying are functionally the same s revenge porn. People can post nude images of a former intimate partner in order to humiliate them — cyberbullying through revenge porn. Research on cyberbullying has used strain theory to predict why someone would cyberbully. The rationale behind strain theory is that people who are facing challenging or stressful circumstances — “strains”, may respond to those strains by lashing out at others. Young people are especially subject to strains, the theory goes, because they face so many new challenges in their lives, from dating to fitting into new peer groups to finishing high school or college, to witnessing family breakups. Studies have shown that strain increases the likelihood of a young person bullying another. Strain may be, then, a predictor of many instances of revenge porn. However, the scholarship is scant in this area, illustrating the newness of the phenomena and the need for more research.

Image from the FBI’s Internet Crime Complaint Center’s Annual Report in 2017. The center fields complaints about various types of cybercrimes. The amount of complaints to the center and the losses reported continue to rise. https://pdf.ic3.gov/2017_IC3Report.pdf

To close, I used a rather mundane case of revenge porn to illustrate these five challenges. These were(1) defining and describing cybercrimes, (2) crafting appropriate laws punishing cybercrimes, (3) developing effective investigative techniques, (4) understanding the cultural context that impacts reactions to crime, and (5) generating fruitful research. As the degree of criminal activity slowly but inevitably shifts from the physical to the digital, the media, the police, lawyers and judges, and above all social scientists will need to devote more resources to addressing cybercrime.