MODULE 4

Understanding the People on the

Scene
 Introduction
• The cybercriminal is usually not the only
person (in body or presence) at the scene of
the cybercrime, however.
• Some cybercrimes appear to be victimless,
such as a network intrusion that occurs
without anyone knowing about it, in which no
files are harmed and no information is
“stolen” or misused.
• These victims might be workers who lose productive
time due to a denial-of-service (DoS) attack or have to
redo their work because of cybervandalism.
• They might be company shareholders who lose money
due to extra charges for the bandwidth that a hacker
uses.
• They might be managers who lose “brownie points” in
their bosses’ eyes because of the impact on their
budgets.
• They might be IT administrators who lose their jobs for
“allowing” the attack to happen. In most cases of
cybercrime, if you look hard enough, you’ll find a victim
• When cybercrimes are reported to the police
or other enforcement agencies, more people
get involved. The investigators who collect
clues to discover the identity of the
cybercriminal and build up the evidence can
spend days, weeks, or months on a single
case.
• When cybercrime occurs in the business environment,
management personnel inevitably become involved as well.

• As we’ve mentioned in earlier chapters, the law enforcement

personnel and the information technology (IT) professionals who
need to cooperate in the investigative process often find
themselves at odds.

• Managers, who know that cybercrime is hurting the company’s

bottom line and have a vested interest in minimizing the damage
and seeing the cybercriminals brought to justice, are often in a
unique position to facilitate cooperation among the other players.
 Understanding Cybercriminal

• A number of scientific disciplines are devoted to gaining a better

understanding of criminals and criminal behavior.
• Criminal psychology is the study of the criminal mind and what
leads a person to engage in illegal or socially deviant behavior.
• You can think of criminal psychology as a subcategory of
forensic psychology, which concerns itself with emotional and
behavioral issues that pertain to the law and legal systems and
includes police psychologists (who address emotional and
behavioral issues with police officers), social psychologists (who
study group behavior and broader societal implications of
psychological issues), and others.
• The job of the criminal psychologist may also overlap with that of the
criminologist, who studies criminals, crime, and the effect of the criminal
justice system and societal factors on criminal behavior and crime rates .
• A new psychological specialty has evolved over the past few decades: that
of the investigative psychologist. Investigative psychology involves
applying knowledge of psychological principles to police work and
criminal investigation
 Profiling Cybercriminals
• Criminal profiling is the art and science of developing a description of a
criminal’s characteristics (physical, intellectual, and emotional) based on
information collected at the scene(s) of the crime(s).
• A criminal profile is a psychological assessment made before the fact—
that is, without knowing the identity of the criminal. The profile consists
of a set of defined characteristics that are likely to be shared by criminals
who commit a particular type of crime.
• The profile can be used to narrow the field of suspects or evaluate the
likelihood that a particular suspect committed the crime.
• It’s not quite that easy or certain in real life, but criminal profiling is a
valuable tool that can give investigators many clues about the person who
commits a specific crime or series of crimes.
• It’s important to understand that a profile—even one constructed by the top
profilers in the field—will provide only an idea of the general type of person
who committed a crime; a profile will not point to a specific person as the
suspect.
• Although good profiles can be amazingly accurate as to the offender’s
occupation, educational background, childhood experiences, marital status,
and even general physical appearance, there will always be many
individuals who fit a given profile.
• Profiling is just one tool among many for conducting an investigation and
building a criminal case. A profile is not evidence; rather, it is a starting
point that can help investigators focus on the right suspect(s) and begin to
gather evidence.
 Understanding How Profiling Works

Profilers draw inferences about the criminal’s personality

and other characteristics based on the following
indicators:

• Their observations of the crime and crime scene

• The testimony of witnesses and victims
• Their knowledge of human psychology and criminal
psychology
• The existence of patterns and correlations among different
crimes
• There are two basic profiling methods:
inductive and deductive.
• Each is based on a particular method of
reasoning or logic.
• Generally, inductive reasoning works from the
specific to the general,
• whereas deductive reasoning works from the
more general to the more specific.
 Inductive Profiling

• The inductive profiling method relies on statistics and

comparative analysis to create a profile. Information is
collected about criminals who have committed a specific type
of crime.

• The information can take the form of formal studies of

convicted criminals, informal observation of known criminals,
clinical or other interviews with criminals known to have
committed certain crimes, and data already available in
databases.
 Deductive Profiling
• The deductive profiling method relies on the application of deductive reasoning to
the observable evidence. Investigators collect general information about the crime,
and the profiler draws specific conclusions about the criminal’s characteristics, based
on the profiler’s experience, knowledge, and critical thinking.
• Victimology, the crime scene, forensic evidence, and behavioral analysis are all
components of the deductive process.

The deductive method involves several distinct steps:

• 1. A problem is stated.
• 2. Information is collected.
• 3. A working hypothesis is formulated.
• 4. The hypothesis is tested.
• 5. Results of the test are examined.
• 6. One or more conclusions are reached.
 Uses of the Criminal Profile

• A profile cannot, by itself, solve a criminal case. However, the

profile can be used for several purposes:

• To narrow the field of suspects

• To link related crimes
• To give investigators valuable leads to follow
Reexamining Myths and Misconceptions about Cybercriminals

Some of the most common misconceptions regarding cybercriminals include

the following :

• All cybercriminals are “nerds”—bright but socially inept.

• All cybercriminals have very high IQs and a great deal of technical
knowledge.
• All cybercriminals are male, usually teenage boys.
• All teenage boys with computers are dangerous cybercriminals.
• Cybercriminals aren’t “real” criminals because they don’t operate in the
“real world.” Cybercriminals are never violent.
• All cybercriminals neatly fit one profile
 Recognizing Criminal Motivations

Common motives for committing cybercrimes

include:
• For “fun”
• Monetary profit
• Anger, revenge, and other emotional needs
• Political motives
• Sexual impulses
• Serious psychiatric illness
 Categorizing Cybercriminals

This role generally breaks down into two broad

categories:
• Criminals who use the Net as a tool of the crime.
• Criminals who use the Net incidentally to the crime
Criminals Who Use the Net As a Tool of the Crime

• Many types of cybercrime depend on the use of a computer network to

accomplish the criminal act. This doesn’t mean that the same offense
couldn’t be committed without computers and networks; it means that
in this instance, the network was directly used to commit the crime .
• A network can be used as a crime tool by different types of
cybercriminals. Most frequently, a network is used as a tool by:

• White-collar criminals
• Computer con artists
• Hackers, crackers, and network attackers
 White-Collar Criminals
The term white-collar criminal is derived, of course, from the image of the
office worker or professional who traditionally wears business attire
(white shirt and tie) to work. White-collar cybercrimes can include
many different offenses, such as:

• Changing company computer records to provide the criminal with an unauthorized

pay raise or to eliminate or change bad employee evaluations or pad expense accounts
.
• Accessing and using insider information for purchasing stocks or securities, which are
U.S. Securities and Exchange Commission (SEC) violations
• Selling company information to outsiders; using insider information to obtain
kickbacks from clients, business partners, or competitors; or using confidential
information for blackmail purposes
• Manipulating electronic accounts to appropriate the company’s or clients’ money or
property for oneself
Studies of white-collar crime have shown that these offenders can fall into several
subcategories, based on their underlying motivations:

1)
• The resentful white-collar criminal cheats the company
because he or she feels cheated by the company. This is
often a long-time employee who has been passed over
several times for a raise or promotion or has received a
negative employee evaluation that, in the employee’s
eyes, is undeserved.
• These cybercriminals adopt something of a Robin Hood
mentality, convinced that they are merely taking from
the rich company—which can afford the loss and even
deserves it—and giving to the poor (usually themselves).
2)
• The deliberate white-collar criminal has no personal ethics that
would prohibit stealing. Unlike the previously described
offender, there is no period of building anger or resentment; this
type begins criminal activity as soon as the opportunity arises.
• These cybercriminals can be quite bright and plan their crimes
meticulously. They often have a timeline or monetary goal in
mind; the master plan is to put the stolen money away in a safe
place (such as an offshore bank account).
• After a certain number of years or after a specific amount of
cash is built up, they plan to retire and live in luxury someplace
beyond the jurisdiction of the law. They are often very
disciplined and careful, taking only small amounts of money at a
time so as not to be noticed
• The desperate white-collar criminal steals in response to
serious personal financial problems. These problems can be
unpredictable, such as a medical or legal crisis in the family.
• More often, though, they are the result of bad judgment:
gambling, alcohol, or drug problems, losing money in bad
business investments, or living beyond their means to
impress others. These cybercriminals are often careless,
becoming more blatant as their situations worsen. Thus,
they are the most likely type of white-collar cybercriminal to
be caught .
White-collar criminals often give themselves away
by leaving clues that arouse investigators’
suspicions, such as:
• Unexplained income, property, or lifestyle that is
far greater than the person’s job makes feasible
• Many large cash transactions
• Multiple bank accounts in different banks,
especially banks in different cities or countries
 Computer Con Artists
• Con artists use the Internet as a tool, to reach “marks” (their terminology for victims) that they
could never reach otherwise. E-mail, Web sites, and chat rooms can all become tools for
scammers to propagate their fraudulent schemes.

Some of the most frequently reported online scams reported to the FTC include:

• Internet auctions Bidders send their money but do not receive the promised product, or they
receive property that is not what it was represented to be.
• Internet service scams Customers prepay for access services and then companies fold and
disappear, or customers are enticed into paying for services they don’t want (for example, by
official-looking notices that imply that you will lose your domain name registration if you don’t
send money to the scam artist).
• Identity theft The top consumer complaint to the FTC for years has been identity theft, in which
the personal or financial information of another person is obtained by a criminal, who then
poses as that person.
• Credit card fraud This type of fraud involves individuals and shady companies that pretend to
(or actually do) sell a service or product via credit card, for the purpose of collecting the victim’s
credit card information and using it to make fraudulent purchases.
• Web “cramming” This crime involves offers for free services such as Web
hosting for a trial period with no obligation, after which users are charged
on their phone bills or credit cards, even though they never agreed to
continue the service after the trial period.
• Multilevel marketing (MLM) and pyramid schemes Con artists play on
users’ greed and desire to get rich quick by signing recruits—for a hefty
fee—and promising them huge profits if they recruit others. The chain
letter is a variation on the pyramid scheme
• Travel and vacation scams These are the Internet-age variant of a time-
honored telemarketing con. Travel “bargains” and “free” vacation scams
(that include all manner of hidden costs) abound.

• Business and investment “opportunities” These range from work-at-

home scams that require you to purchase an expensive starter kit and
don’t provide actual jobs to day-trading programs and solicitations for
investment in worthless real estate .
• Scams involving healthcare products and services These include weight
loss, antiaging, and alternative health products that are marketed under
false or unproven claims; online prescription drug sales that don’t require
the patient to be seen by a physician;
Hackers, Crackers, and Network Attackers