Cyber-crime Science
Pieter Hartel
The Course
 Goals
» Study cybercrime from a social perspective
 Organisation
» Teams of three
» Do an experiment
» Write a paper
» Review other papers
» Present the paper at a conference
 http://www.ewi.utwente.nl/~pieter/CCS/
2
Cyber-crime Science
Team
 Lecturers
» Pieter Hartel (course organisation, computer science)
» Marianne Junger (social science)
 Teaching assistants
» Lorena Montoya
» Jan Willem Bullée
» Elmer Lastdrager
» Inés Carvaljal Gallardo
3
Cyber-crime Science
Contents
 Theory
» What is Crime and Cyber-crime?
» Technology (ICT) creates opportunity
» Crime Science
» Opportunity reduction works
 Practice
» How to do an opportunity reducing experiment in this
course?
4
Cyber-crime Science
Crime and Cyber-crime
 Crime
» Behaviour commonly considered harmful, serious
 Disorder
» Lack of order, broader than crime
 Cyber-crime
» ICT used as a tool, target or place
[New09] G. R. Newman. Cybercrime. In M. D. Krohn, et al, editors, Handbook on Crime
and Deviance. Springer, Nov 2009. http://dx.doi.org/10.1007/978-1-4419-0245-0_25
5
Cyber-crime Science
Porn on video billboard
6
Cyber-crime Science
Cyber-crime is big business
Estimate (B$)
Year
Anti-virus
3.4
2012
Patching
1
2010
ISP clean-up
0.04
2010
User clean-up
10
2012
Defence firms
10
2010
Law enforcement
0.4
2010
[And12] R. Anderson, C. Barton, R. Böhme, R. Clayton, M. J. G. van Eeten, M. Levi, T.
Moore, and S. Savage. Measuring the cost of cybercrime. In 11th Workshop on the
Economics of Information Security (WEIS), Berlin, Germany, Jun 2012.
http://weis2012.econinfosec.org/papers/Anderson_WEIS2012.pdf
7
Cyber-crime Science
ICT creates opportunity
 Offenders know that they run little risk
 Targets often don’t understand the risks
8
Cyber-crime Science
Crime Science
 Five principles of opportunity reduction
1. Increase effort
2. Increase risks
3. Reduce rewards
4. Reduce provocation
5. Remove excuses
 Measure the effect of the intervention
9
Cyber-crime Science
Opportunity reduction works
Clicked
on link
(%)
[Kum09] P. Kumaraguru, J. Cranshaw, A. Acquisti, L. Cranor, J. Hong, M. Blair, and T. Pham.
School of phish: a real-word evaluation of anti-phishing training. In 5th Symp. on Usable Privacy
and Security (SOUPS), page Article 3, Mountain View, California, Jul 2009. ACM.
http://dx.doi.org/10.1145/1572532.1572536
10
Cyber-crime Science
10
Practice
11
Cyber-crime Science
Question
 Is an intervention as coursework feasible?
» Yes, but it’s hard work
» … and it can be a lot of fun
 Check out what 43 teams have done in
previous years
[Har12] P. H. Hartel and M. Junger. Teaching engineering students to "think thief". Technical
Report TR-CTIT-12-19, CTIT, University of Twente, Jul 2012.
http://eprints.eemcs.utwente.nl/22066/
12
Cyber-crime Science
Interactive trash cans, N=24
13
Cyber-crime Science
Social Sports leak, N=308
[Sto14] B. Stottelaar, J. Senden, and A. L. Montoya Morales. Online social sports
networks as crime facilitators. Crime Science, 3:Article 8, 2014.
http://dx.doi.org/10.1186/s40163-014-0008-z.
14
Cyber-crime Science
Course Schedule
PII form
team+
topic
Ethical committee
Draft
research
proposal
Final
proposal &
slide
Present ideas
(5 weeks)
APA paper writing
Present again
(9 weeks)
Experiment & draft paper
Research Methods
final paper
Reviewing
review &
slides
(6 weeks)
Presentations
15
Cyber-crime Science
Help is at hand
 What?
» Clinics: get feedback or discuss
» F2F in Enschede or via Skype
 When?
» Sign up via the doodle to get a 20-minute timeslot
» 12 and 19 September, 3 October and more
 More details on website
16
Cyber-crime Science
Examination
 By coursework only
» Quality of the paper
» Quality of the reviews
» Quality of the presentations
 You will be marked by your peers
» And you may not like it…
» But the lecturers and TAs are the moderators
17
Cyber-crime Science
FAQ
 Team topic (week 1)
» What is the crime/disorder and how will you prevent it?
 Draft proposal (week 3)
» What are the risks for the researchers and the subjects?
» What is the control group?
 Final draft proposal (week 5)
» Does my design work? Do a pilot!
 Draft paper (week 14)
» Can someone else repeat the experiment?
 Final paper (week 18)
» Are the results statistically significant?
18
Cyber-crime Science
What to do next?
1. Sign up via the site
2. Complete and sign the PII form now
3. Social science training : 0.5 bonus point
4. Write 1 A4 Research proposal with:
» Background
» Method
» Three key references
» Appendix: Checklist Ethical Committee
5. For the forms and deadlines see:
http://www.ewi.utwente.nl/~pieter/CCS/
19
Cyber-crime Science
Project ideas
 Elmer (e.e.h.lastdrager@utwente.nl)
» Phishing on Facebook
» Phishing puzzles
 Lorena (a.l.montoya@utwente.nl)
» Socio-physical differences in the compliance to a
request to surrender credentials
 Jan-Willem (j.h.bullee@utwente.nl)
» Social engineering for software updates
» Dynamic digital interventions
20
Cyber-crime Science