Measuring Cybercrime Pieter Hartel

How? Victim reporting initiatives »FBI Internet Criminal Complaint Centre Population and business surveys »CBS (Statistics Netherlands) Technology based information »Verizon Risk team Meta analyses »United Nations Office of Drugs & Crime Police recorded crime statistics »Lecture 5 Cyber-crime Science 2

3

Victim reporting initiatives 2012 was the 13 th year Almost 300,000 complaints in M$ loss 91% US, 1.4% CA, 0.14% NL Numerous investigations, arrests Cyber-crime Science 4 [IC312] IC Internet Crime Report. Internet Crime Complaint center, Mar

Method Cyber-crime Science 5

Complaint form See Description of the actors »Target Information (name, …) »Offender information (name, IP…) »Witnesses (name, …) »Local police office (name, …) Description of the incident »Related to an online service? (mail, …) »Monetary Loss ($) »Means of payment (Cash, PayPal, …) Cyber-crime Science 6

Frequently reported crimes ComplaintFemaleMaleTotal Auto fraud6,28210,87717,159 Real estate fraud8,9295,50314,432 FBI impersonation 5,9118,23014,141 Intimidation/extortion5,1343,1908,324 Romance scams2,5491,9274,476 Scareware/Randomware6441,3251,969 Hit man ,354 Total30,07831,77761,855 Cyber-crime Science 7

Discussion And the other 240,000 complaints? Is this the tip of the iceberg? How effective is case matching? How many arrests? Cyber-crime Science 8

9

Population and business surveys 2012 was the 5 st year N=78,000, response 38% Uniform geographical distribution 95% confidence interval <2% Cyber-crime Science 10 [CBS13] CBS. Veiligheidsmonitor Centraal Bureau voor de Statistiek, Den Haag, veiligheidsmonitor-2012-pub.htm. veiligheidsmonitor-2012-pub.htm.

Method Random sample from NL population 15+ »First letter with link to online form »Second letter two weeks later with paper form »Phone reminder again two weeks later Cyber-crime Science 11

Question 13: Hacking During the last 12 MONTHS has it ever happened that somebody with malicious intent broke in or logged in on a computer, account, website or profile site (e.g. Hyves, Facebook, Twitter) of your own of anyone else in your household? a)Someone broke in / logged in on a computer b)Someone broke in / logged in on an account c)Someone broke in / logged in on a website Cyber-crime Science 12

Victimization in NL % of the population affected2012 Property crime13% Vandalism8% Violent crime3% Traditional Crime20% Hacking6% Cyber bullying3% E-commerce fraud3% Identity theft2% Cyber crime12% Cyber-crime Science 13

Crime drops Cyber-crime Science 14 [Far11] G. Farrell, A. Tseloni, J. Mailley, and N. Tilley. The crime drop and the security hypothesis. Journal of Research in Crime and Delinquency, 48(2): , May

Discussion Do the respondents understand the cyber questions? Should the cyber questions be integrated? Cyber-crime Science 15

Cyber-crime Science 16

Technology based information 2013 was the 9 th year 47,000 incidents Of which 621 confirmed data breaches Cyber-crime Science 17 [Ver13] Verizon. Data Breach Investigations report. Verizon Risk Team,

Method 19 partners First-hand forensic evidence Reviewed and validated Cyber-crime Science 18

Who? Threat actor categories trend Cyber-crime Science 19 N=621

What? Threat action categories Cyber-crime Science 20 N=47626

Discovery Late and by someone else! Cyber-crime Science 21

Discussion What does this say about the population? Why are incidents discovered so late and by others? Cyber-crime Science 22

Cyber-crime Science 23

Meta analysis 1 st year Global connectivity revolution Much of the Internet is privately owned Cyber-crime Science 24 [UNO13] UNODC. Chapter 2 of Comprehensive Study on Cybercrime. United Nations Office on Drugs and Crime, Feb crime/UNODC_CCPCJ_EG.4_2013/CYBERCRIME_STUDY_ pdf. crime/UNODC_CCPCJ_EG.4_2013/CYBERCRIME_STUDY_ pdf

Method Surveys from 69 countries, 40 businesses, 16 universities, and 11 organizations Caveat Cyber-crime Science 25 Number of specialised police per 100,000 Police recorded offence per 100,000

Cybercrime is increasing More in the news than homicide Law enforcement sees increasing trends Increasing use of ICT creates opportunity »More suitable targets online »Few opportunities for guardianship »Reduced self control Cyber-crime Science 26

Compared to conventional crime Cyber-crime Science 27 % respondents reporting victimization in last year, 2011 or latest available acc. hacked Phish- ing Iden- tity theft Online credit card fraud Burg- lary Rob- bery Car theft

Conclusions “Cyber” creates opportunity Cybercrime is increasing Measuring cybercrime correctly is hard Cyber-crime Science 28