EXPLORING CYBERCRIME USING CRIMINOLOGICAL THEORIES Chair: Thomas Holt Chair: Thomas Holt

and illness rather than on health and wellbeing. Critical reviews of prison mental health services in England have been described as reactive and inefficient which remains focused on physical and psychiatric morbidity and mortality (De Viggiani, 2006a). However, a settings approach to health promotion as advocated by the World Health Organisation and endorsed by the UK Government (Leger, 1997; Whitehead, 2006) aims takes on an ecological viewpoint which shifts the focus from what makes individuals ill towards a ‘salutogenic’ perspective, focusing on factors that support human health and well-being (Antonovsky, 1996). Most prison health literature however, focuses on the notion of illness, rather than on the agency and resilience demonstrated by prisoners through their efforts to survive adversity and cope in the disempowering environment. Prisoners often develop innovative ways to cope with the environment and master and take control of their own health and wellbeing. De Certeau (1984) considers how people develop ‘strategies’ to assert some control over particular settings. This involves the use of certain ‘tactics’ or smaller everyday acts through which people adapt. Tactics are what people do despite not being able to fully control their environments. In other words, tactics involve ‘making do’ despite the constraints evident in a place. By drawing on the work of De Certeau (1984), we emphasise the agency of prisoners, a point which is largely missing from the literatures on health in prisoners. The insights gained will also inform the development of health and wellbeing promotion programmes which attempt move away from 'technocratic solutions' which are developed by individuals and staff with difference life experiences but utilises the resilience and learning’s from prisoners themselves.

1.5 EXPLORING CYBERCRIME USING CRIMINOLOGICAL THEORIES

35 to address this gap in our knowledge using a comparison of threads and advertisements for data in a sample of both open web forums and Tor-based forums and shops. The implications of this study for our understanding of both environments and law enforcement practice will be considered in depth.

0019 - THE CYBERCRIMINAL LIFE-COURSE: A CRIMINOLOGICAL ‘ZERO-DAY’. A FIRST EMPIRICAL COMPARISON OF THE EFFECTS OF LIFE-COURSE FACTORS IN CYBERCRIME VERSUS NON-CYBERCRIME.

Marleen Weulen Kranenbarg (Netherlands)¹; Stijn Ruiter (Netherlands)¹; Jean-Louis Van Gelder (Netherlands)¹; Wim Bernasco (Netherlands)¹

1 - NSCR, Netherlands Institute for the Study of Crime and Law Enforcement

Cybercrimes emerge in a new digital world that does not only require us to change the way we protect ourselves against crime, but also challenges established theories and explanations of crime. In this paper, we examine the applicability of one such established theory, social control theory, to cybercrime. Does having strong social bonds also reduce cybercrime in ways similar to non-cybercrime? This is the first study to compare the applicability of social control theory for non-cybercrime with cybercrime. We focus on three important aspects of social control theory: employment, education and household composition (living with partner, parent(s) and/or child(ren)).

We use panel-data of all Dutch citizens that have been a suspect of a crime for the period 2000-2012. For both cybercrime and non-cybercrime suspects fixed-effects models are estimated to examine the effect of employment, education and household composition on the chance that a person commits a (cyber)crime. Subsequently, both models are compared to examine to what extent there are differences in the effects of these life-circumstances on the chance that people commit cybercrimes versus non-cybercrimes.

0020 - COME OVER TO THE DARK SIDE: UNRAVELLING CRIMINAL ACTIVITIES ON THE DARKWEB

Rolf Van Wegberg (Netherlands)¹; Mark Van Staalduinen (Netherlands)¹ 1 - TU Delft and TNO, Cybersecurity & Resilience

The dark side of the internet can be easily accessed, and it is getting more and more popular amongst (cyber) criminals to deploy criminal activities. Using the TOR-protocol (The Onion Router) anonymous browsing is available for the general public, and increasing amounts of criminals see the advantages of moving their activities to the DarkWeb. Ranging from drugs- and weapon trade, to professional hitman-services and cybercrime-as-a-service, the DarkWeb is the new anonymous, place-to-be for an increasingly large group of criminals. Recent

examples of these online marketplaces are Silk Road (2.0), which was seized by the FBI, and the Black Market Reloaded marketplace, which was hosted in the Netherlands and was infiltrated by the Dutch National Police.

With innovative techniques, criminals’ set-up entire business models and create a whole new, online underground economy. This underground economy is based on buying and selling criminal techniques and services, instead of learning and/or executing them yourself. We gain insight into this underground economy with a DarkWeb MoniTOR, a method to crawl data on the DarkWeb. This technique provides a solid basis for both exploratory and longitudinal research, as the data is collected over a longer period of time and is independent of the hidden services being still online. Using this method, we have discovered over 2000 marketplaces and a total of more than 15.000 hidden services, i.e. DarkWeb-sites.

This presentation covers concrete examples of both (novel) criminal activities as well as new criminal business models on the DarkWeb. Next, trends and patterns in DarkWeb-facilitated crime are identified using big data approaches and new insights on emerging ‘threats’ are presented. Finally, the question arises: are the lessons-learned of tackling (traditional) crime still valid when analysing this new platform wherein anonymous criminal marketplaces exist and entirely new criminal business models are used.

0021 - CYBERCRIMINAL NETWORKS IN THE NETHERLANDS Rutger Leukfeldt (Netherlands)¹

1 - Open University of the Netherlands, NHL University of Applied Sciences and Dutch Police Academy

Little empirical research has been done into organised cybercrime. Anecdotes, unsubstantiated assumptions and unverifiable reports from technology companies dominate the view on organised cybercrime.

The few case studies which have been done show that cybercriminal networks can have totally different characteristics. The crime scripts of phishing networks described in literature, for example, are often similar: the formation of a criminal core group, contacting other capable criminal facilitators, capturing login details from victims and transferring funds to money mule accounts. However, the origin, growth and criminal opportunities of these networks – and thus the possibilities for situational crime prevention – can be completely different. Case studies show that for some networks – just as for traditional criminal networks – social ties are of great importance (e.g. recruitment through social contacts, encounters on the streets of big cities, etc.), while for other groups, technology plays a major role (e.g. a forum as offender convergence setting to meet new criminals, contacts between offenders primarily online, spam emails used to recruit money mules).

37 Dutch police known phishing cases in the period 2004-2014 are analysed. This gives more insight into the different types of cybercriminal groups that are involved in phishing and helps to develop effective situational crime prevention methods.

Eighteen Dutch police files have been analysed to gain insight into the structure of the networks (e.g. pyramid or fluid), the composition (e.g. roles and functions within networks, ties between members), the use of offender convergence settings (e.g. online or offline) and criminal capabilities of networks (e.g. main activities, working area, use of technology and shielding methods). These police files provide unique knowledge about cybercriminal networks and their members thanks to special investigative powers such as wiretaps (telephone calls and internet traffic), observations, infiltrations and house-searches.

1.6 RESTORATIVE JUSTICE AND CRIMINAL JUSTICE: THEORETICAL DEVELOPMENTS