Skip to main content

Advertisement

Log in

Organised crime groups in cyberspace: a typology

  • Published:
Trends in Organized Crime Aims and scope Submit manuscript

Abstract

Three categories of organised groups that exploit advances in information and communications technologies (ICT) to infringe legal and regulatory controls: (1) traditional organised criminal groups which make use of ICT to enhance their terrestrial criminal activities; (2) organised cybercriminal groups which operate exclusively online; and (3) organised groups of ideologically and politically motivated individuals who make use of ICT to facilitate their criminal conduct are described in this article. The need for law enforcement to have in-depth knowledge of computer forensic principles, guidelines, procedures, tools, and techniques, as well as anti-forensic tools and techniques will become more pronounced with the increased likelihood of digital content being a source of disputes or forming part of underlying evidence to support or refute a dispute in judicial proceedings. There is also a need for new strategies of response and further research on analysing organised criminal activities in cyberspace.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Similar content being viewed by others

Notes

  1. Interested reader is referred to a recent article of Galeotti (2008) for an excellent overview of the history of organised crime.

  2. The definition of “organised criminal group” from Article 2 of the UN Convention on Transnational Organized Crime is adopted in this article: a group having at least three members, taking some action in concert (i.e., together or in some co-ordinated manner) for the purpose of committing a ‘serious crime’ and for the purpose of obtaining a financial or other benefit. The group must have some internal organization or structure, and exist for some period of time before or after the actual commission of the offence(s) involved.

  3. In this article, traditional organised crime groups refer to crime groups known to be involved in traditional criminal activities that took place in the physical world (e.g. murder, extortion, money laundering and drug trafficking).

  4. Organised cyber crime groups refer to online crime groups that may exist only in cyberspace such as hackers groups.

  5. Although many organised crime groups now aim at making money, several traditional ones (e.g. Italian and Italian American mafia), as pointed out by one of the reviewers, may still aim at exercising political power as well.

  6. Interested reader is referred to a recent article of Sein (2008) for an excellent overview of one major human smuggling case in the USA—the case involving “Sister Ping”.

  7. It is not the intention of this article to discuss whether the use of technology by traditional organised criminal groups (e.g. the triads in Hong Kong, the secret societies in Singapore and the Japanese Yakuza) is a generalised phenomenon although recent incidents suggest that traditional organised criminal groups are increasingly involved in technology-enabled crimes such as intellectual property offences.

  8. Refer to the United States Securities and Exchange Commission on “Pump and Dump Schemes” for more information—http://www.sec.gov/answers/pumpdump.htm

  9. Malware, also known as malicious software, is designed to install itself on a computer without the computer owner’s informed consent, particularly if it does so in a way that may compromise the security of the computer. Malware includes Trojans, viruses and worms.

  10. In such scams, the perpetrators often pretend to sell something that they do not have while requesting for the payment in advance. Recent cases include the arrest of a group of 419 scammers by Dutch police in February 2007 (Libbenga 2007) and the February 2008 arrest of a Nigerian citizen in Perth, Australia who was alleged to be a an international A$1 million internet scam syndicate (AAP 2008).

  11. Recent statistics (NW3C/FBI 2007) indicate that online auction fraud is the most prevalent offence type reported to the Internet Crime Complaint Center. Out of 207,492 complaints between 1 January and 31 December 2006, online auction fraud accounted for 45% of the 86,279 cases referred to US law enforcement agencies and 33% of the total reported dollar loss. It is important to recognise, however, that in comparison with the total volume of online transactions the number of complaints remains relatively small.

  12. In a recent case, a defendant who is one of 17 individuals indicted on charges including Conspiracy to Commit Offenses Against the United States, Fraud in Connection with Access Devices; Fraud in Connection with Identification Documents, Authentication Features, and Information; Aggravated Identity Theft; Conspiracy to Commit Money Laundering, and aiding and abetting these offenses, allegedly obtained stolen credit and debit card account information by visiting Internet Relay Chat rooms and forums run by cybercriminals. The defendant then allegedly encoded these fraudulently obtained credit card information onto plastic cards with magnetic strips and used the plastic cards to withdraw money from automated teller machines and automated cashier machines. Several other individuals were reportedly recruited by the defendant to repatriate the proceeds of crime overseas—money mules. On 10 August 2007, the defendant was sentenced to 84 months in prison and was ordered to make restitution to the victim banks, forfeit property which represented both the means used to commit these offenses as well as the proceeds of the offenses, and serve a 3 year term of supervised release (US DoJ 2007g).

  13. A botnet is a network of individual computers infected with bot malware. These compromised computers are also known as zombies or zombie computers. The zombies, part of a botnet under the control of the botnet controller, can then be used as remote attack tools to facilitate the sending of spam, hosting of phishing websites, distribution of malware, and mounting denial of service attacks. Among the three botnet communication typologies identified by Cooke et al. (2005)—centralised, distributed P2P and random—the most commonly used are the centralised and distributed P2P. Building botnets requires minimal levels of expertise (Ianelli and Hackworth 2005). A brief two-step overview on how to build a botnet is outlined by Choo (2007).

  14. Money mules are individuals hired by organised criminals to perform international wire fraud (AIC 2007) or to purchase prepaid cards, and the mailing or shipping of prepaid cards out of the country without regulators being aware (Choo 2008). A recent example of individuals being recruited by organised crime groups to repatriate criminal proceeds includes the example case reported in the 2005–2006 Asia/Pacific Group on money laundering yearly typologies report (APG 2006:9).

  15. In the Federal Trade Commission complaint, it was alleged that ‘TJX, with over 2,500 stores worldwide, failed to use reasonable and appropriate security measures to prevent unauthorized access to personal information on its computer networks. An intruder exploited these failures and obtained tens of millions of credit and debit payment cards that consumers used at TJX’s stores, as well as the personal information of approximately 455,000 consumers who returned merchandise to the stores. Banks have claimed that tens of millions of dollars in fraudulent charges have been made on the cards and millions of cards have been cancelled and reissued’ (US FTC 2008:unpaginated). Several media articles further suggested that between 45 and 90 million payment card accounts were, in fact, compromised as a result of the data breach incident involving The TJX Companies Inc.’s (Abelson 2007; Goodin 2007; Vijayan 2007). On 27 March 2008, the US Federal Trade Commission announced that ‘discount retailer TJX and data brokers Reed Elsevier and Seisint have agreed to settle charges that each engaged in practices that, taken together, failed to provide reasonable and appropriate security for sensitive consumer information. The settlements will require that the companies implement comprehensive information security programs and obtain audits by independent third-party security professionals every other year for 20 years’ (US FTC 2008:unpaginated).

  16. Bot malware, a malicious program, allows attackers to remotely control vulnerable computers and form virtual networks of zombies—botnets. Botnets can be leveraged to orchestrate concerted attacks against other computing resources, for example, distributed denial of service (DDoS) attacks against targeted networks (Choo 2007).

  17. Distributed denial-of-service (DDoS) attacks are targeted attacks against specific website(s) by flooding the web server(s) with repeated messages, tying up the system and denying access to legitimate users.

  18. The MPack toolkit is allegedly being sold between US$700 (PandaLabs 2007) and US$1,000 (Keizer 2007).

  19. Keyloggers (also known as keylogging programs) are designed to monitor user activity including keystrokes. They can be used by cybercriminals to steal passwords or credit card details, which can then be used for malicious purposes such as identity/online fraud.

  20. According to a recent media release by the FBI, ‘[t]he ring, in fact, was run very much like a business, with various players handling different roles, direction coming from the top down, and the sadistic images serving as currency. Again, a sophisticated operation’ (FBI 2008a:unpaginated).

  21. For example, see US DoJ (2008a, 2008b, 2008c).

  22. Known politically motivated hacker groups include ‘Hacker Union for China’ and ‘ChinaHonker.com.’

  23. Computer forensics can be defined as the science of identification, collection, examination, and analysis of data while preserving the integrity of the information and maintaining a strict chain of custody for the data (NIST 2006).

References

Download references

Acknowledgments

The author is most grateful to the two anonymous referees and the editor-in-chief for their constructive feedback. Despite their invaluable assistance, any errors remaining are solely attributed to the author.

Author information

Authors and Affiliations

Authors

Corresponding author

Correspondence to Kim-Kwang Raymond Choo.

Additional information

The views expressed in this article are those of the author alone and not the Australian Government or the Australian Institute of Criminology.

Rights and permissions

Reprints and permissions

About this article

Cite this article

Choo, KK.R. Organised crime groups in cyberspace: a typology. Trends Organ Crim 11, 270–295 (2008). https://doi.org/10.1007/s12117-008-9038-9

Download citation

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s12117-008-9038-9

Keywords

Navigation