Cybercrimes cover a wide category of offenses such as illegal access, interfering with data and computer systems, fraud and forgery, illegal interception of data, illegal devices, child exploitation, and intellectual property infringements.
What is common in all these offenses? They are all committed with the use of a computer, computer networks, or other information communications technology (ICT).
Cybercrimes are primarily directed against computers or network resources through malicious ways like spreading viruses or malware, hacking, and distributed denial-of-service (DDoS) attacks. Many factors contribute to creating a lucrative environment for cybercriminals and enable them to attack a vast population of potential victims.
1. Connectivity
Cybercrimes tend to increase when there are more individuals online with low levels of digital security awareness. There is a rapid increase in Internet users and a directly related uptake in mobile devices, e-commerce, electronic transactions, and electronic communication. The generally poor awareness of cybersecurity and cyber hygiene, particularly amongst vulnerable users such as the elderly, has led to a dramatic increase in cybercrime victims.
A 2018 study by an American research university showed that most home Internet users have poor cybersecurity awareness. The participants were unaware of the difference between antivirus software and firewalls and had poor cyber hygiene. More than 67% of survey participants did not have either updated antivirus software or, in some cases, any antivirus even installed. Many users also freely share passwords and are quick to share private information over social networks.
2. Mobility
Greater mobility and wider network access have led to a sharp increase in remote employees, including from home. As a direct result, more commercial and official communication and transactions are being conducted over less secure domestic or public computer systems and networks (e.g., people working from coffee shops). This has increased the vulnerability of corporate networks and thereby increased the attack surface for cybercriminals. A study released in August 2020 by INTERPOL revealed that phishing, online scams, fraud, and other cyber threats increased by as much as 59% following COVID-19.
3. Interconnectivity
The increased accessibility and miniaturization of computer components have led to the acceleration of smart devices or Internet of Things (IoT) devices, interconnected networks, and infrastructure, such as smart cities, smart homes, etc. This widespread interconnectivity expands the potential attack surfaces available to cybercriminals who target vulnerable smart devices. Common household items, such as door locks and refrigerators, have become Internet-capable devices, providing new options for cybercriminals to target.
In 2017, ransomware attacks such as WannaCry and NotPetya highlighted the threat these attacks can pose to interconnected networks, compromising many devices. In 2019, Kaspersky noted over 100 million attacks against smart devices in the first six months. The report says that cybercriminals prefer residential devices over corporate devices because they are usually easier targets. Unfortunately, many users of these devices fail to change default passwords or regularly update their software, making them easy targets for attack.
4. Under-reporting
Another reason is the reluctance to report cybercrime offenses. In many cases, companies and individuals who are victims of cybercrime do not report the incident to the authorities. This failure to report crimes means there is a lack of data on how cybercriminals operate and the technologies used to commit crimes. Besides, individual victims are often unaware of how or where to report cybercrime, believe that it is not worth reporting or are ashamed of having fallen victim to a scam. Corporate victims are frequently reluctant to report cybercrime as making the news public is bad for business and could erode investor or market confidence in the company. In some cases, victims of cybercrime may find the reporting process to be arduous or unclear, thus deterring them from reporting the incident.
5. Legislation and jurisdiction
Cybercrime frequently involves cross-border investigations as victims, offenders, and infrastructure can be in different countries. This challenges investigators as they often discover that other countries may not have the same laws that criminalize the offense. There are different elements needed to prove the offense has taken place or that there are varying data retention periods for subscriber data. In some countries, there may be a lack of legislation and therefore criminalization of cybercrime, which creates a situation where the country becomes a haven for cybercriminals.
In a limited timeframe, carrying out effective investigations across multiple jurisdictions includes partnering with counterparts in another country to further an investigation. This may include searching and seizing physical and/or digital evidence or serving judicial authorizations such as warrants to private sector entities, e.g., telecommunication companies and Internet service providers. These are some of the difficulties involved in carrying out effective investigations to successfully prosecute cybercrime across multiple jurisdictions.
