Oxford duo seek to unmask the human face of cyber crime
Image credit: Dreamstime
In a new paper published in the journal Policing, Professor Federico Varese and Jonathan Lusthaus argue that a relentless focus on computer science misses the offline and localised elements of scams and hacking attacks that target the vulnerable and net millions for crooks.
Government strategies for fighting online scams have become so wedded to the idea that technological fixes can stop the villains that they are routinely ignoring the “human element” behind many forms of online crime, a respected criminologist believes.
Professor Federico Varese, a University of Oxford academic who has authored several books on the Russian and Italian mafias, spent time in Râmnicu Vâlcea, a notorious Romanian town dubbed “Hackerville” on account of its reputation as a hub for organised criminals who use the web to net millions in ill-gotten profits.
Nicolae Popescu, one of the FBI’s most-wanted fugitives who made around £3m selling fictitious cars on eBay, is just one product of a Romanian cyber-crime industry that has flourished in places like Râmnicu Vâlcea and the small city of Alexandria in the south of the country.
Fake holiday lets advertised through legitimate-looking websites by organisations purporting to be based in the UK are another favourite scam orchestrated from the eastern European country.
Successful Romanian gangs typically run their operations just like businesses, with analogous management structures, clandestine offices and even teams based overseas to handle the money.
British police are understood to be investigating several UK bank accounts believed to have been used to launder funds and wire them back home via Western Union or MoneyGram as part of a large-scale Romanian cyber-crime operation.
Varese and his Oxford colleague Jonathan Lusthaus have now published a paper, ‘Offline and Local: The Hidden Face of Cybercrime’, which appears in the most recent issue of the scholarly journal Policing.
They put forward a somewhat counterintuitive thesis: that, far from being the preserve of disparate and anonymous computer whizzes operating alone, the bulk of cyber crime is actually highly localised and offline in nature and does not require special technology like artificial intelligence to be stopped.
They argue it is vital to acknowledge the “offline, human and contextual element” and say bolstering law enforcement in countries such as Romania would be as, if not more, important a means of achieving cyber security than target-hardening potential victims.
Varese told E&T the business of cyber crime was emphatically not “randomly distributed” but emanates largely from particular localities in countries including Romania, Russia, Vietnam and China. In certain towns or communities, particular types of behaviour had become normalised and were actively encouraged as a way of making ends meet – examples being the fake news factories in places such as Macedonia or live streaming of child abuse from countries in south-east Asia. In some cases, at the local level, there was little attempt to hide the criminal behaviour or its effects, meaning offenders could theoretically be easily spotted.
He called for a broader focus on the factors behind cyber crime, arguing: “In universities a lot of cyber crime is dealt with in computer science departments, and as good as they are, which is very good, they have a technical approach to the problem. We argue there is a human dimension. These are social problems which cannot be solved by a technical solution alone.
“We wanted to highlight the fact that cyber criminals often know each other, they meet and they have a life offline. We often forget that: these are people who live in a specific place. Our general point is you cannot separate cyber crime from the offline dimension of the phenomenon.”
He insisted he did not deny some cyber criminals operated alone and without indicative social ties, but he said: “If you look at the numbers, the vast majority of cyber attacks come from very small and specific places.
“Yes, of course there is the model of the teenager in his bedroom doing hacking, but I expect that’s actually easier to police… and the authorities are penetrating big time the forums where they operate and where they get their information. So I think they, in a sense, are not the big problem; the big problem remains these hubs which seem to be beyond the reach of the authorities.”
No amount of technological innovation would solve the problem for as long as there remain nurturing, safe havens for cyber criminals in towns and villages overseas, he said, adding that the UK and US were well placed to work with international partners to bolster the rule of law where this was lacking.
Varese told E&T historical context was also relevant.
“Romania under the dictatorship of Ceausescu encouraged internet and computer science as one of the most important subjects,” he said. “When the dictatorship ended, it turned out that Romania had one of the highest degrees of connectivity in the world. There were a number of ready-made internet networks and a huge competence of young people. Many found a job in the US and also Bucharest where there are many hi-tech companies.
“However, the situation economically generally is quite backward and there is a high degree of unemployment. This combination of a high level of expertise and unemployment led most of the people who were very good at computer science to be legally employed, but it also gave a platform to people who wanted to engage in criminal activities on the net to draw upon expertise.”
The level of police corruption in particular areas of Romania affected the prevalence of cybercrime emanating from there, he added.
However, he also said the situation in Romania was not nearly as bad as it was in some other countries, adding that Râmnicu Vâlcea was “very much on the radar” of the Romanian authorities as well as of journalists, meaning a major crackdown was probably imminent.
Bizarrely, this attention and the consequent demand for “fixers” – insiders who can introduce curious outsiders to police officers, cyber criminals and other local players for the purposes of research and interviews – has spawned a spin-off cottage industry that is itself replete with scams.
When Lusthaus and Varese visited Râmnicu Vâlcea, they were approached by a self-styled fixer who promised to introduce them to significant cyber criminals in return for a large fee. Cursory investigations revealed his claims were fake, however – a revelation that Varese described as “postmodern – a scam about a scam”.
Further research on the subject is planned.