Cybercrime Organizations

Chapter Opening

In the spring of 2021, executives at Colonial Pipeline, a company that supplied roughly forty-five percent of the fuel consumed on the United States East Coast, discovered that their computer networks had been seized. The attackers, a cybercriminal organization known as DarkSide, had encrypted the company's data and demanded payment in cryptocurrency before they would release it. Colonial Pipeline shut down its operations preemptively while it assessed the damage. Within days, fuel shortages spread across the southeastern United States. Gas stations ran dry. Airlines scrambled to reroute. State governments declared emergencies. The company ultimately paid a ransom of approximately 4.4 million dollars, a portion of which federal investigators later recovered through blockchain analysis. It was not the most destructive cyberattack in history, nor the most expensive. But it demonstrated, with unusual clarity, that criminal organizations operating through computers could now bring critical infrastructure in the world's most powerful nation to a standstill, extracting money, disrupting lives, and challenging governments, all without firing a single shot or crossing a single physical border.

The Colonial Pipeline attack was not an isolated incident. It was one moment in a much longer and more complex story about how organized crime adapted to the digital age. That story begins not with billion-dollar ransomware gangs but with the early culture of computer hacking that emerged in university laboratories and hobbyist communities in the 1970s and 1980s, when a small number of technically sophisticated individuals discovered that digital systems could be probed, manipulated, and exploited in ways their designers had not anticipated or prevented. Those early hackers were motivated by curiosity, intellectual challenge, ideological conviction, and sometimes simple mischief. Most were not criminals in any conventional sense. But the skills they developed, the techniques they pioneered, and the underground communities they built created the infrastructure from which organized cybercrime would eventually emerge.

By the 1990s, as the internet expanded from military and academic networks into commercial and eventually mass public use, criminal possibilities multiplied. Fraud, theft, and deception, activities as old as human commerce, could now be conducted at global scale, across international boundaries, from anonymous locations, against millions of victims simultaneously. What had once required physical presence, local knowledge, and personal risk could now be accomplished from a laptop in any city in the world. The transaction costs of crime fell dramatically. The barriers to entry dropped. The potential profits rose. And law enforcement, built around the assumptions of territorial jurisdiction, physical evidence, and nationally bounded institutions, found itself profoundly ill-equipped to respond.

This chapter examines the history of cybercrime organizations as a distinct phenomenon within the broader history of organized crime. It traces their emergence from hacker subcultures, their professionalization into sophisticated criminal enterprises, their diversification across multiple criminal industries from ransomware to identity theft to financial fraud, and their complex relationships with states, particularly the states that have used criminal hackers as instruments of foreign policy while sometimes tolerating or even encouraging their domestic criminal activities. It asks how these organizations resemble and differ from the traditional organized crime groups examined in earlier chapters of this textbook, and what their existence reveals about the relationship between technology, markets, states, and crime.

The history of cybercrime is, in important respects, a history of institutional lag. Criminal entrepreneurs, motivated by the prospect of profit and unconstrained by regulatory frameworks or legal accountability, consistently move faster than the institutions designed to govern or police them. This pattern is not unique to the digital age; it recurs throughout the history of organized crime, from Prohibition-era bootleggers exploiting the gap between a new law and its enforcement, to money launderers using offshore banking systems that regulators had not anticipated, to drug traffickers exploiting trade routes that customs services could not adequately monitor. What is distinctive about cybercrime is the extraordinary speed at which new criminal possibilities emerge, the global scale at which criminal organizations can operate, and the degree to which the technical complexity of digital systems creates informational asymmetries that favor attackers over defenders.

Understanding cybercrime as organized crime also requires confronting some uncomfortable realities about the political economy of digital crime. Several of the world's most active cybercriminal environments exist in countries whose governments have, at various times, tolerated, protected, or actively recruited criminal hackers for state purposes. Russia, North Korea, Iran, and China have all been identified by law enforcement and intelligence agencies as home to criminal hacking operations that simultaneously conduct profit-motivated crime and state-directed espionage and sabotage. The line between criminal organization and state instrument is often blurry, and sometimes deliberately so. This blurring has profound implications for law enforcement, for international diplomacy, and for the sovereignty of states that find themselves targets of what might be called criminal statecraft.

The victims of cybercrime are not abstractions. They are hospitals that cannot access patient records during ransomware attacks and are forced to divert emergency patients. They are individuals whose financial accounts are drained, whose identities are stolen, whose private information is sold on underground markets. They are small businesses whose operations are paralyzed and whose survival may depend on whether they can pay a ransom they often cannot afford. They are local governments whose public services are disrupted and whose citizens bear the cost. They are schools, universities, utilities, and healthcare systems. They are, in sum, the fabric of daily life in modern digital societies, and the organized criminal groups that target them represent one of the most significant threats to the security and welfare of ordinary people in the contemporary world.

This chapter approaches cybercrime organizations historically, asking how they developed, what conditions enabled them, what internal structures they have adopted, how they relate to states and markets, how law enforcement has attempted to respond to them, and what their continued growth reveals about the persistent and adaptable nature of organized crime as a human institution. The digital frontier is not a departure from the history examined in the rest of this textbook. It is its latest chapter.

Learning Objectives

Guiding Historical Questions

Historical Context

To understand cybercrime organizations historically, students must first understand the technological and social environment from which they emerged. The digital revolution of the late twentieth century was not primarily a criminal phenomenon. It was the product of decades of publicly funded research, academic collaboration, entrepreneurial innovation, and global commercial expansion that transformed the way human beings communicate, store information, conduct commerce, and organize their lives. But every major transformation in communications technology, from the printing press to the telegraph to the telephone, has also created new opportunities for those willing to exploit it for criminal gain, and the digital revolution was no exception.

The internet's origins lie in ARPANET, a research network funded by the United States Department of Defense in the late 1960s and designed to allow computers at different research institutions to communicate with each other. From the beginning, the network was built around principles of openness and interoperability rather than security and access control. The engineers who designed it were solving problems of redundancy and communication, not anticipating a future in which billions of people would use connected systems to store financial information, medical records, personal correspondence, and commercial secrets. Security was an afterthought, and the architectural decisions made in those early years created vulnerabilities that persist, in modified forms, to the present day.

By the 1970s, a subculture of technically sophisticated individuals, mostly young men at universities and technical institutions, had begun exploring the capabilities and limitations of computer systems, including ways of gaining access to systems without authorization. This culture, which came to be known as hacker culture, was characterized by deep technical curiosity, a certain disdain for conventional rules and gatekeeping, and a shared ethic that valued the free flow of information and the demonstration of technical skill. The hacker ethic, as articulated by writers like Steven Levy, held that information should be free, that computers should be accessible to all, and that the clever manipulation of systems was a legitimate form of intellectual exploration. This ethic was not primarily criminal; it was, in its own way, a kind of digital libertarianism that viewed access restrictions as arbitrary impositions on the free exercise of intellect.

But hacker culture also contained the seeds of criminality, because the techniques used to explore systems without authorization were the same techniques that could be used to steal information, disrupt operations, and extract money. The boundary between authorized and unauthorized access was often unclear, and the culture's disdain for rules provided a convenient rationalization for crossing it. As commercial computer systems, banking networks, and eventually personal computers proliferated through the 1980s, the criminal possibilities of hacking became increasingly apparent, and a subset of the hacker community began to exploit them for personal gain.

The 1990s were a pivotal decade. The development of the World Wide Web, the commercialization of the internet, and the rapid growth of e-commerce created both enormous opportunities and enormous vulnerabilities. Online banking, electronic payment systems, and digital stores of personal and financial information became targets for criminals who recognized that the same skills used to explore computer systems could be used to steal from them on an unprecedented scale. At the same time, the global nature of the internet created a fundamental problem for law enforcement: criminal activity could now cross national borders instantaneously, while law enforcement remained bounded by the territorial jurisdictions established in the predigital era.

By the 2000s, what had been a relatively fragmented landscape of individual hackers and small criminal groups had begun to consolidate into something that more clearly resembled organized crime. Criminal underground forums, operating initially on the open web and eventually migrating to encrypted networks, provided marketplaces where hackers could buy and sell stolen data, malicious software, and criminal services. Specialization and division of labor emerged: some criminals wrote malware, others deployed it, others laundered the proceeds, others converted stolen financial credentials into cash. The organized crime model, with its characteristic division of labor, hierarchical structure, and protection of key participants from law enforcement exposure, was being reinvented for the digital environment.

Several geopolitical developments accelerated the growth of cybercrime organizations in the 2000s and 2010s. The collapse of the Soviet Union had left hundreds of thousands of highly educated technical workers, including many with computer science and engineering backgrounds, in countries with collapsed economies and few legitimate employment opportunities. Some of these individuals turned to cybercrime, and the tolerance or active protection of certain Eastern European governments, most notably Russia, created safe havens in which criminal hacking organizations could operate with relative impunity as long as they directed their activities at foreign targets. North Korea, facing severe economic sanctions, developed state-sponsored hacking capabilities that were used both for espionage and for criminal revenue generation, blurring the line between state intelligence operations and organized crime in ways that had no real precedent in criminal history.

The development of Bitcoin in 2009 and the subsequent proliferation of cryptocurrency provided cybercrime organizations with a payment infrastructure that combined the pseudonymity of cash with the global reach of digital transfer, allowing ransom payments and criminal proceeds to flow across borders with a degree of difficulty for law enforcement that traditional banking had not provided. The emergence of the dark web, accessed through anonymizing software like the Tor network, provided hidden marketplaces where criminal goods and services could be bought and sold with reduced risk of law enforcement detection. By the 2010s, cybercrime had become one of the most profitable criminal industries in the world, generating estimated annual revenues that some analysts placed in the hundreds of billions of dollars, though precise figures were, by the nature of criminal activity, impossible to verify.

This chapter examines this history in detail, moving from the early hacker subcultures through the emergence of organized criminal networks, the professionalization of ransomware, the vast industry of identity theft, the sophistication of online fraud, and the complex entanglement of criminal organizations with state power. It situates cybercrime within the longer history of organized crime examined throughout this textbook, arguing that digital criminal organizations are not a departure from that history but its contemporary expression.

Chronology Preview

Major People, Groups, and Places

Core Vocabulary Preview

The following key terms appear throughout this chapter. Students should review each term before proceeding to the main sections.

From Curiosity to Crime: The Origins of Cybercriminal Culture

The history of cybercrime cannot be understood without first understanding the culture that preceded it. The men and women who became the first computer criminals did not emerge from traditional criminal backgrounds. They emerged from communities defined by intellectual curiosity, technical aptitude, and a particular attitude toward rules and authority that was shaped as much by the counterculture of the 1960s and 1970s as by the engineering traditions of the institutions where they worked. Understanding that origin is essential to understanding how a culture that began with largely noncommercial, even idealistic, impulses transformed into the organized criminal infrastructure that operates today.

The earliest hackers, in the sense that matters here, were students and researchers at institutions like the Massachusetts Institute of Technology, Stanford University, and Carnegie Mellon University in the 1960s and 1970s. They worked on early timesharing systems, mainframe computers, and eventually the networked systems that would become the internet. Their defining characteristic was not malice but obsession: an overwhelming desire to understand how systems worked, to find their limits, to discover what was possible. The term "hacker," in its original usage, simply meant someone who was highly skilled at programming and who approached problems with creative, unconventional solutions. It carried no criminal connotation.

But the exploration of computer systems without authorization, which quickly became part of hacker culture, crossed a legal and ethical line that many practitioners either did not recognize or chose to ignore. The justifications were familiar: information wants to be free; systems should be open; clever individuals should not be constrained by arbitrary gatekeeping. These rationalizations were sincere for many in the hacking community, but they also served as convenient cover for activity that caused real harm to system owners and users. By the early 1980s, as personal computers proliferated and more systems became accessible through dial-up modems, the hacker community expanded far beyond elite university labs into a broader subculture that included many individuals with less technical sophistication and fewer idealistic commitments.

The year 1983 is often cited as a turning point in public awareness of hacking. The film WarGames, in which a teenage hacker nearly triggers a nuclear war by accessing military computer systems, was a cultural sensation that brought the idea of computer intrusion to mainstream attention and, in the process, alarmed government officials who had not previously thought carefully about the vulnerability of networked military systems. Congressional hearings followed. In 1984, federal investigators arrested a group of Milwaukee teenagers known as the 414s, who had broken into dozens of computer systems including those at Los Alamos National Laboratory and Memorial Sloan Kettering Cancer Center, using nothing more sophisticated than persistence and social engineering. The 414s were not hardened criminals; they were teenagers who found breaking into systems exciting. But their arrests demonstrated that unauthorized access to sensitive computer systems was a real problem that existing law was not equipped to address.

Congress responded with the Computer Fraud and Abuse Act of 1986, the first federal statute specifically targeting computer crime. The law made unauthorized access to federal computers and systems used in interstate commerce a criminal offense. But it was hastily drafted, contained significant ambiguities, and left many forms of computer crime unaddressed. Its passage was significant less for its immediate practical effect than for what it signaled: computer crime was now on the legislative agenda, and the state was beginning, however awkwardly, to assert its authority over digital space.

The Morris Worm of 1988 marked another milestone. Robert Tappan Morris, a graduate student at Cornell University, released a piece of self-replicating code onto the internet that was intended, according to his later account, merely to demonstrate the scale of the internet and expose its vulnerabilities. But the worm, exploiting several well-known security flaws in Unix operating systems, replicated far more aggressively than Morris had anticipated, infecting thousands of systems and causing significant disruption. Morris was prosecuted under the Computer Fraud and Abuse Act, the first such prosecution, and convicted. His case established the legal principle that releasing malicious or disruptive code onto networked systems was a federal crime, regardless of the creator's intent. But it also exposed how primitive the legal and technical tools for responding to such incidents remained.

Through the late 1980s and 1990s, a generation of hackers emerged who moved more deliberately across the line from exploration to exploitation. Kevin Mitnick, who would become the most famous hacker of his era, began his career with what seemed like curiosity-driven intrusions into telephone company switching systems but escalated through the 1980s and 1990s into intrusions into some of the most sensitive corporate computer systems in the United States, including those of Digital Equipment Corporation, Pacific Bell, and various technology companies. Mitnick's case illustrated several patterns that would recur throughout the history of cybercrime: the combination of technical skill with social engineering (the manipulation of individuals into revealing access credentials or sensitive information); the escalating seriousness of intrusions as skills and ambitions grew; and the difficulty law enforcement faced in tracking and apprehending individuals who understood how to use the telephone network and early internet to obscure their locations.

But Mitnick represented an older model of hacking: individual, driven by ego and technical challenge, with theft of information rather than direct financial gain as the primary objective. By the time he was finally apprehended in 1995 and imprisoned, a new generation of cybercriminals was already emerging who were less interested in the intellectual thrill of intrusion and more interested in its financial possibilities. The commercialization of the internet, which brought millions of new users and billions of dollars in e-commerce onto networked systems in the mid-to-late 1990s, created an environment in which the financial rewards for criminal exploitation were suddenly enormous. Credit card numbers, banking credentials, personal information, and corporate secrets all had market value, and the digital infrastructure of the emerging internet economy was riddled with the security vulnerabilities that early engineers had built into it through neglect or ignorance.

The transition from curiosity-driven hacking to profit-motivated cybercrime was not sudden or complete. Elements of the older hacker culture, including the emphasis on technical skill, the underground community structures, and the particular social dynamics of reputation and status within criminal networks, were carried forward into the new criminal environment. But the motivation had fundamentally changed. By 2000, organized cybercriminal networks were beginning to emerge that bore more resemblance to the organized crime structures examined in earlier chapters of this textbook than to the individual hackers of the 1980s.

The Rise of Organized Hacking Groups

The professionalization of cybercrime in the 2000s and 2010s produced hacking organizations that bore little resemblance to the lone-wolf hackers of earlier decades. These were sophisticated enterprises with clear organizational structures, specialized roles, established operational practices, and revenues that rivaled or exceeded those of traditional organized crime groups. Understanding how these organizations developed, how they recruited and retained members, how they protected themselves from law enforcement, and how they related to each other and to state actors is essential to understanding cybercrime as a form of organized crime.

The organizational evolution of cybercrime was driven by several factors operating simultaneously. The first was the rapid increase in financial opportunity. As more commercial and financial activity moved online through the 2000s, the potential rewards for successful criminal exploitation of digital systems grew enormously. Online banking, e-commerce, digital payment systems, and the massive databases of personal financial information accumulated by retailers, financial institutions, and service providers created targets whose exploitation could yield millions or even hundreds of millions of dollars. The financial incentive to develop more sophisticated, scalable criminal operations was overwhelming.

The second factor was the development of underground criminal communities. Beginning in the late 1990s and accelerating through the 2000s, criminal hackers organized themselves into online forums that functioned as marketplaces, knowledge-sharing platforms, and social communities simultaneously. Early forums like Carderplanet, which emerged in Ukraine around 2001, and Shadowcrew, which operated primarily in the United States between 2002 and 2004, were dedicated to the buying and selling of stolen payment card data, and they established the organizational template that later criminal communities would follow. Members were organized into hierarchical tiers based on their reputation and the quality of their contributions. Trusted vendors could sell stolen data, malicious software, or criminal services to other members. Moderators enforced community rules and arbitrated disputes. Reputation systems, analogous to the feedback mechanisms of legitimate e-commerce platforms, reduced the risk of fraud between criminals who did not know each other personally.

The third factor was specialization and the division of labor. Early cybercrime was often conducted by individuals who handled all aspects of an operation themselves: writing the malicious code, deploying it, collecting the stolen data, and monetizing it. This approach had obvious limits. Specialization, in crime as in legitimate enterprise, allows practitioners to develop deeper expertise and to scale their operations more effectively. By the mid-2000s, a complex division of labor had emerged in cybercriminal underground markets. Some individuals, known as coders or developers, wrote and maintained malicious software and sold it or rented it to others. Others, known as spammers, distributed phishing emails or malware at scale. Others, known as carders, specialized in validating and monetizing stolen payment card data. Others, known as money mules, physically withdrew cash from compromised bank accounts or transferred funds in ways that helped obscure the trail of criminal proceeds. Each specialization had its own practitioners, its own reputation systems within criminal forums, and its own pricing structures.

The fourth factor was geography. The most sophisticated and prolific cybercrime organizations of the 2000s and 2010s were concentrated in Eastern Europe, particularly Russia, Ukraine, and Romania, and in parts of Asia, particularly China. This was not coincidental. These regions combined several conditions that were favorable to the development of cybercrime organizations: large numbers of highly educated technical workers produced by Soviet-era and post-Soviet educational systems; limited legitimate employment opportunities, particularly in the chaotic economic transitions of the 1990s and early 2000s; weak or corrupted law enforcement; and, in Russia's case, a government that was willing to tolerate criminal hacking directed at foreign targets, and sometimes actively cultivated relationships with criminal hackers for intelligence and operational purposes.

The Russian government's relationship with cybercriminal organizations was particularly complex and consequential. Russian law enforcement generally declined to investigate or prosecute cybercriminals who directed their activities exclusively at foreign targets, a policy that created a de facto safe haven for an entire criminal industry. Some criminal hackers appear to have been actively recruited by Russian intelligence services to conduct state-directed espionage and disruptive operations alongside their criminal activities. The case of Evgeniy Bogachev, the operator of the GameOver Zeus botnet, is illustrative: American investigators eventually concluded that Bogachev's criminal operations were intertwined with Russian intelligence work, with his botnet used both to steal hundreds of millions of dollars from victims worldwide and to search infected computers for intelligence relevant to Russian state interests. Bogachev lived openly in Russia, indicted by United States authorities but effectively beyond extradition, a protected figure whose criminal genius was apparently viewed by the Russian state as a national asset.

Advanced Persistent Threat Groups

The concept of Advanced Persistent Threats, or APTs, emerged in the vocabulary of cybersecurity researchers and law enforcement in the early 2010s to describe a category of sophisticated, well-resourced hacking operations that were capable of penetrating even well-defended systems and maintaining long-term covert access to their targets. The term reflected an important analytical development: the recognition that the most dangerous cybercriminal and state-sponsored hacking operations were not characterized by simple smash-and-grab attacks but by patient, methodical campaigns that might unfold over months or years, with attackers establishing persistent footholds in target systems and exfiltrating data or maintaining the capability for future disruption.

APT groups became associated primarily with state-sponsored hacking, and the major APTs identified by cybersecurity researchers were linked to intelligence services in Russia, China, North Korea, and Iran. But the line between state-sponsored hacking and organized cybercrime was rarely clean. Russian military intelligence operated hacking groups, known to Western researchers by names like Fancy Bear and Sandworm, that combined espionage with disruptive operations and occasionally with theft. North Korea's Lazarus Group operated with objectives that included both intelligence gathering and financial crime, stealing hundreds of millions of dollars from banks and cryptocurrency exchanges to fund a sanctions-constrained state. China's numerous APT groups, while primarily focused on industrial espionage and intelligence gathering, sometimes operated in ways that blurred the distinction between state and criminal activity.

For students of organized crime history, the APT phenomenon raises important analytical questions about the relationship between states and criminal organizations. Throughout the history of organized crime, states and criminal groups have sometimes cooperated when their interests aligned: states have used criminal organizations as instruments of violence or intelligence, and criminal organizations have purchased protection and tolerance from state officials. The APT phenomenon represents a sophisticated contemporary version of this ancient relationship, one in which the state's interest lies not in physical violence or territorial control but in digital espionage and the disruption of foreign adversaries' critical systems. The ambiguity created by this relationship, the deliberate blurring of the line between criminal organization and state instrument, is itself a tool of statecraft, complicating attribution, deterrence, and the development of legal frameworks for responding to state-sponsored cybercrime.

Ransomware Gangs: The Business of Digital Extortion

Of all the criminal innovations of the cybercrime era, ransomware, the practice of encrypting a victim's data and demanding payment for its decryption, most clearly illustrates the evolution of cybercrime into a mature criminal industry. Ransomware combined a technically sophisticated attack with a simple, direct extortion model that could be scaled to target individuals, businesses, hospitals, government agencies, and critical infrastructure alike. By the early 2020s, ransomware had become one of the most profitable and disruptive forms of organized crime in the world, with criminal organizations generating billions of dollars in annual revenue and causing damage that, in some cases, threatened human lives.

The conceptual origins of ransomware are older than most people realize. In 1989, a biologist named Joseph Popp distributed floppy disks to attendees of a World Health Organization AIDS conference, claiming they contained software that could assess an individual's risk of acquiring AIDS. The disks did contain such software, but they also contained malicious code that, after a computer had been rebooted a certain number of times, encrypted the names of all files on the computer's hard drive and displayed a message demanding payment to a post office box in Panama. The attack was primitive by later standards, the encryption was weak and was quickly cracked, and Popp was arrested, though ultimately not prosecuted after a psychiatric examination. But the AIDS Trojan, as it came to be known, established the conceptual template for what would become the most consequential form of cybercrime in the twenty-first century: using encryption as a weapon to extort payment from victims who could not access their own data.

Ransomware in its modern form emerged in the mid-2000s. Early examples used relatively simple encryption schemes that could be broken by skilled analysts, and they demanded payment through wire transfers or prepaid money cards that created some risk of law enforcement interception. The rise of Bitcoin and other cryptocurrencies fundamentally transformed the ransomware business model by providing an extortion payment mechanism that was difficult to trace and impossible to reverse, allowing criminal organizations to collect ransoms from victims anywhere in the world without exposing themselves to the financial system scrutiny that would accompany conventional wire transfers.

The first generation of modern ransomware was distributed indiscriminately, targeting any computer whose owner could be induced to click on a malicious link or attachment. These attacks were relatively low-yield, demanding ransoms of a few hundred dollars from individual consumers whose encrypted personal files, family photographs, and documents were simply not worth more. But criminal entrepreneurs quickly recognized that the real money lay in targeting organizations rather than individuals: hospitals, local governments, school districts, law firms, and corporations held data that was so operationally critical that their owners would pay far more to recover it. The shift from consumer targeting to enterprise targeting was a pivotal development in the evolution of ransomware as a criminal industry.

The ransomware group that most clearly illustrated this evolution was CryptoLocker, which emerged in late 2013 and was linked to Evgeniy Bogachev's criminal network. CryptoLocker used strong encryption (RSA 2048-bit keys) that was genuinely unbreakable without the decryption key held by the attackers, and it demanded payment in Bitcoin through a sophisticated system that provided victims with a countdown timer: pay within 72 hours and the price is $300; fail to pay and the key would be deleted forever. CryptoLocker was eventually disrupted by law enforcement in 2014, but not before it had infected hundreds of thousands of computers and collected millions of dollars in ransoms. More importantly, it demonstrated that well-designed ransomware using strong encryption and cryptocurrency payments was a viable, highly profitable criminal enterprise, and it inspired dozens of successor organizations.

Ransomware as a Service

The most consequential organizational innovation in the ransomware industry was the development of the Ransomware-as-a-Service, or RaaS, model in the mid-2010s. Under this model, a criminal organization develops and maintains a ransomware platform, handling the technical complexity of the encryption, decryption, and payment infrastructure, and then licenses access to the platform to affiliate attackers who use it to conduct attacks of their own. The affiliates pay a percentage of collected ransoms, typically between twenty and thirty percent, to the platform operators as a fee for the service. The remaining seventy to eighty percent goes to the affiliate.

The RaaS model dramatically lowered the barriers to entry for ransomware attacks. An affiliate did not need to be able to write malicious code or design a cryptocurrency payment system; they needed only to be able to penetrate target networks, which required a different and somewhat more common skill set, and to deploy the ransomware platform they had licensed. This division of labor between platform developers and attack operators meant that the criminal labor pool available for ransomware attacks was vastly larger than it would have been if every attacker needed to develop their own technical platform. The RaaS model also allowed criminal platform operators to scale their revenues by running multiple affiliate operations simultaneously, and it provided a degree of insulation from law enforcement: even if an affiliate was arrested or identified, the platform operators could continue operating through other affiliates.

The major RaaS operators of the late 2010s and early 2020s, including REvil, DarkSide, LockBit, Conti, and Ryuk, were sophisticated criminal organizations that, in some respects, resembled professional technology companies as much as they resembled traditional organized crime groups. They maintained technical development teams that continuously updated their ransomware platforms, customer service operations that negotiated with victims and provided technical assistance for making cryptocurrency payments, financial operations that managed the distribution of ransom proceeds to affiliates, and, in some cases, public relations operations that cultivated a particular image, often claiming, implausibly, that they had ethical limits on the types of targets they would attack.

The social and human costs of ransomware attacks have been devastating and often underappreciated. When ransomware attacks struck hospitals, the consequences extended far beyond financial harm. In 2020, a ransomware attack on Düsseldorf University Hospital in Germany forced the redirection of a critically ill patient who could not be treated at the compromised facility; the patient died, in what German authorities investigated as the first death potentially attributable to a ransomware attack, though the causal connection was ultimately unclear. In the United States, ransomware attacks on hospital systems have routinely forced the cancellation of surgeries, the diversion of emergency patients, and the reversion to paper-based record systems, creating serious risks for patients whose care depended on timely access to medical records. School districts forced to pay ransoms have diverted money from educational programming. Local governments have paid millions in ransoms that could have funded public services. The aggregate cost of ransomware, measured in ransom payments, recovery expenses, lost productivity, and human harm, runs to tens of billions of dollars annually.

Identity Theft: The Mass Commodification of Personal Information

Identity theft, the fraudulent use of another person's personal information to obtain credit, make purchases, receive benefits, or commit other crimes, existed long before the internet. Criminals have forged documents, stolen mail, and impersonated others for as long as complex bureaucratic and financial systems have required individuals to verify their identities. But the digital age transformed identity theft from a relatively labor-intensive crime, requiring physical access to personal documents or careful manipulation of specific individuals, into a mass-scale industry in which the personal information of millions of people could be acquired, organized, sold, and exploited through automated systems operating at global scale.

The economics of digital identity theft are shaped by a fundamental characteristic of information: unlike physical goods, information can be copied and sold repeatedly without being depleted. A stolen car can be driven by only one person at a time. A stolen credit card number can be sold on criminal forums multiple times before the card is cancelled, and each purchaser can attempt to exploit it independently. This reproducibility meant that the market for stolen personal information developed a distinctive economic structure, with large-scale data breaches creating floods of supply that periodically drove down the price of individual stolen records on criminal markets, and with demand being sustained by the vast and growing population of individuals and organizations conducting financial transactions online.

The organized criminal infrastructure for identity theft began to take shape in the late 1990s and early 2000s. Criminal forums like Carderplanet and Shadowcrew, mentioned earlier in this chapter, were devoted precisely to the buying and selling of stolen financial credentials. Members posted stolen credit card numbers, bundled with whatever associated information they had acquired (billing address, card verification code, expiration date, and sometimes Social Security numbers and banking credentials), and sold them to other forum members who would attempt to use them fraudulently. The forums developed sophisticated quality assurance mechanisms: vendors posted feedback ratings, buyers could complain about non-working cards, and reputable vendors could command premium prices for high-quality stolen data.

The major enablers of large-scale identity theft were data breaches, incidents in which criminal hackers penetrated the computer systems of organizations holding large quantities of personal financial information and exfiltrated that information in bulk. The scale of data breaches escalated dramatically through the 2000s and 2010s. The TJX breach of 2006 exposed approximately 45 million credit and debit card numbers. The Heartland Payment Systems breach of 2008 exposed approximately 130 million records. The Target breach of 2013 exposed 40 million payment card records and 70 million records of personal information. The Yahoo breaches, disclosed in 2016, exposed data from all three billion Yahoo user accounts. The Equifax breach of 2017 exposed the detailed financial and personal information of approximately 147 million Americans, including Social Security numbers, birth dates, addresses, and credit history, essentially providing criminals with nearly everything they would need to commit identity fraud against nearly half the adult population of the United States.

The individuals who conducted these breaches were typically not the same individuals who used the stolen data for fraud. The criminal ecosystem that developed around identity theft was highly specialized. Hackers who had the technical skills to penetrate corporate networks sold their stolen data to brokers on criminal forums. Brokers aggregated, organized, and resold the data to carders who specialized in monetizing stolen payment card information. Money mules, often recruited through job fraud schemes targeting vulnerable individuals looking for work-from-home opportunities, physically withdrew cash from compromised accounts or made purchases with stolen cards that were then returned for cash refunds or resold.

The human costs of identity theft fell disproportionately on ordinary individuals who had no meaningful ability to protect themselves from breaches of corporate systems over which they had no control. When Equifax's systems were breached because the company failed to patch a known vulnerability in its web application software for months after a fix became available, the 147 million Americans whose information was exposed had done nothing wrong and could do nothing to undo the exposure of their most sensitive financial information. Many would spend years dealing with fraudulent accounts opened in their names, disputing fraudulent charges, and managing the damage to their credit records. For lower-income individuals with limited financial buffers, the consequences of identity theft could be catastrophic, affecting their ability to secure housing, employment, credit, and utilities.

The identity theft industry also encompassed forms of fraud that went beyond financial crime. Medical identity theft, in which criminals used stolen health insurance credentials to receive medical services or file fraudulent claims, imposed costs on healthcare systems and left victims with erroneous medical records that could affect their future care. Tax identity fraud, in which criminals filed fraudulent tax returns using stolen Social Security numbers to claim refunds, became epidemic in the 2010s, with the Internal Revenue Service identifying billions of dollars in fraudulent refund claims annually. Synthetic identity fraud, in which criminals combined real and fabricated information to create entirely new false identities for use in financial crime, represented a particularly sophisticated evolution that even sophisticated financial institutions had difficulty detecting.

Online Fraud: Ancient Deceptions in Digital Form

Fraud, the obtaining of money or other goods through deliberate deception, is among the oldest criminal activities in human history. Every generation of criminals has adapted its deceptive practices to the technologies, social norms, and economic systems of its time. The digital age provided fraudsters with extraordinary new tools: the ability to communicate with potential victims at global scale and minimal cost; the ability to construct convincing false identities and institutions; and the ability to receive payment, and disappear, more quickly and completely than any previous communications technology had permitted. Online fraud did not invent new criminal motivations; it vastly amplified the reach and efficiency of deceptions that had existed for centuries.

The landscape of online fraud is extraordinarily diverse. It encompasses advance-fee fraud, sometimes called 419 fraud after the section of the Nigerian criminal code that addresses it, in which victims are promised a share of a large sum of money in exchange for an upfront payment that the fraudster then pockets; romance scams, in which criminals cultivate fraudulent online relationships with victims before manufacturing crises that require financial assistance; business email compromise, in which criminals impersonate executives or business partners to trick employees into making unauthorized wire transfers; investment fraud, including elaborate cryptocurrency scams; lottery and prize fraud; fake online marketplaces; counterfeit goods sales; work-from-home and employment fraud; and many others. Each represents a distinct criminal business, often operated by organized groups with specialized roles, but all share the fundamental characteristic of deception as the primary instrument of harm.

Business email compromise, sometimes abbreviated as BEC, deserves particular attention because it represents one of the most financially damaging forms of cybercrime, responsible for greater total losses than ransomware. In a typical BEC attack, criminals research a target organization and its executives, using information often freely available through corporate websites, LinkedIn profiles, and other public sources, to understand the organization's financial processes and identify individuals with the authority to authorize wire transfers. They then either compromise the email account of a senior executive (through phishing or credential theft) or create a spoofed email address that closely resembles the executive's genuine address. The compromised or spoofed account is then used to send instructions to a financial officer or employee, requesting an urgent wire transfer to an account controlled by the criminal. The urgency, authority, and apparent legitimacy of the request, coming from what appears to be a trusted source, induces the employee to bypass normal approval processes.

BEC attacks have stolen billions of dollars from organizations of all types, including large corporations, nonprofit organizations, churches, government agencies, and educational institutions. A single successful BEC attack can result in the loss of millions of dollars, and the transfers, once made, are often irreversible. The FBI's Internet Crime Complaint Center reported BEC-related losses of over 2.7 billion dollars in 2022 alone, making it by far the most financially damaging category of cybercrime reported to the bureau. The perpetrators of BEC fraud are frequently organized criminal networks, many based in Nigeria, West Africa more broadly, or Eastern Europe, that run multiple simultaneous campaigns against thousands of potential victims.

Romance scams represent a particularly damaging form of online fraud, not only financially but psychologically. In a romance scam, criminals create fictitious online identities, typically using stolen photographs and carefully constructed backstories, and cultivate romantic relationships with victims over extended periods through dating websites, social media, or email. Once an emotional connection has been established, the fraudster manufactures a crisis, typically a medical emergency, a legal problem, a business opportunity, or a travel emergency, that requires the victim to send money. Victims often send money repeatedly before recognizing the deception, and many are reluctant to report the fraud because of the embarrassment and shame associated with having been deceived by a romantic interest. The financial losses from romance scams in the United States alone exceeded 1.3 billion dollars in 2022 according to the Federal Trade Commission, though actual losses are almost certainly higher given the significant underreporting of this type of crime.

A more recent and rapidly growing category of online fraud involves the cryptocurrency investment scam, sometimes called "pig butchering" (a translation of a Chinese term for the practice of fattening a pig before slaughter). In these scams, criminals cultivate relationships with victims over days or weeks before introducing them to a fraudulent cryptocurrency investment platform that appears to generate impressive returns. Victims are encouraged to invest increasingly large sums, and are even permitted to make small withdrawals to build trust, before the fraudster disappears with all the accumulated funds. These scams have their roots in criminal operations in Southeast Asia, particularly in Cambodia, Myanmar, and the Philippines, where criminal organizations, some of them operated by Chinese organized crime groups, have held tens of thousands of people in slave-like conditions, forcing them to conduct online fraud under threat of violence.

The human trafficking dimension of online fraud operations in Southeast Asia represents a particularly disturbing intersection of digital crime and physical violence. Victims, many recruited through deceptive employment advertisements promising legitimate work, are transported across borders, stripped of their documents, and forced to operate online fraud campaigns under threat of beatings, electric shocks, and other forms of coercion. They are compelled to work long hours in guarded compounds, contacting thousands of potential victims daily through social media and messaging applications. The United Nations Office on Drugs and Crime estimated in 2023 that hundreds of thousands of individuals may have been trafficked into Southeast Asian cyber scam compounds, making this one of the largest human trafficking operations in the world, and one that is directly connected to the online fraud economy affecting victims in the United States, Europe, Australia, and elsewhere.

The State-Criminal Nexus: When Governments and Criminal Hackers Cooperate

One of the most distinctive and analytically challenging features of the cybercrime landscape is the complex, often deliberately ambiguous relationship between cybercriminal organizations and state actors. This relationship has no precise precedent in the history of organized crime, though it has important analogies: states have used criminal organizations as proxies throughout history, from privateers and pirates licensed by European monarchs to the CIA's alleged relationships with anticommunist criminal organizations during the Cold War. But the cybercrime-state nexus differs from these historical precedents in important ways, particularly in the degree to which digital tools allow states to blur the distinction between criminal activity and state operations, and to maintain plausible deniability about the nature of their involvement in specific attacks.

Russia's relationship with cybercriminal organizations is the most extensively documented and analytically significant example. The Russian government has consistently declined to extradite Russian nationals accused of cybercrime to countries seeking to prosecute them, has conducted no meaningful domestic prosecution of hackers who direct their activities at foreign targets, and has, in at least some documented cases, actively recruited or cultivated relationships with criminal hackers for intelligence and operational purposes. The result has been the creation of a criminal sanctuary in which organized cybercriminal groups can operate with near-impunity as long as they maintain certain rules, primarily directing their attacks outside of Russia and cooperating when Russian intelligence services request their assistance.

The Evgeniy Bogachev case, mentioned earlier, illustrates the depth of this relationship. American investigators concluded that Bogachev's GameOver Zeus network, which had stolen hundreds of millions of dollars from financial institutions and businesses worldwide, had also been used to search infected computers in Georgia, Turkey, and Ukraine for information about Russian intelligence priorities, including documents related to Russian organized crime, intelligence officers, and geopolitical topics of interest to the Russian state. The implication was that Bogachev's criminal operation was simultaneously an intelligence asset, tolerated and perhaps directed by Russian intelligence services who valued its reach into foreign computer networks. Bogachev was indicted by the United States Department of Justice in 2014 and placed on the FBI's most wanted list with a three-million-dollar reward for information leading to his arrest. He has continued to live openly in Russia, beyond the reach of American law enforcement.

North Korea represents a different but equally significant model of the state-criminal nexus. Unlike Russia, where the relationship between the state and criminal hackers appears to be one of mutual benefit and selective cooperation, North Korea appears to operate its cybercriminal activities as a direct state function, with the Lazarus Group and related hacking organizations operated as arms of the Korean People's Army's intelligence apparatus. North Korea's motivation is primarily financial: facing severe international economic sanctions, the country has used cybercrime as a revenue-generation mechanism to fund its nuclear weapons program and general government operations.

The scale of North Korea's cybercriminal revenue generation has been extraordinary. According to analyses by the United Nations and various government intelligence agencies, North Korean hackers stole an estimated 1.7 billion dollars in cryptocurrency in 2022 alone, and cumulative cryptocurrency theft attributed to North Korean actors exceeded three billion dollars by 2023. North Korean hackers have targeted cryptocurrency exchanges, banks, and financial institutions in dozens of countries, using sophisticated techniques that reflect genuine investment in state hacking capabilities. The WannaCry ransomware attack of 2017, which infected hundreds of thousands of computers in 150 countries and caused billions of dollars in damage before being partially halted by a security researcher who discovered and activated a kill switch, was attributed by the United States, the United Kingdom, and other governments to North Korean hackers acting under state direction.

Iran and China also maintain significant state-linked hacking operations, though with somewhat different characteristics. Iranian hacking groups, including those designated APT33 and APT35 by cybersecurity researchers, have conducted both espionage operations and disruptive attacks, including the Shamoon attack that destroyed data on tens of thousands of computers at Saudi Aramco in 2012. Iran has also used cybercrime as a revenue-generation mechanism, with criminal hackers linked to Iranian government institutions conducting ransomware attacks and financial fraud. China's state-linked hacking operations have been primarily focused on industrial espionage and the theft of intellectual property, though Chinese cybercriminal organizations also conduct profit-motivated crime.

The state-criminal nexus has profound implications for the governance of cybercrime. Traditional law enforcement approaches to organized crime assume that the state and criminal organizations are adversaries, with the state using its coercive power to suppress criminal activity. The cybercrime-state nexus breaks this assumption: when criminal organizations are protected or directed by states, the instruments available to law enforcement, including arrest, prosecution, and disruption of criminal operations, are available only to the extent that they do not require the cooperation of the state that is protecting or directing the criminal group. Responding to state-sponsored or state-tolerated cybercrime requires diplomatic tools, sanctions regimes, and international cooperation mechanisms that go far beyond conventional law enforcement.

Law Enforcement Response: Fighting Crime Without Borders

The challenge of suppressing cybercrime organizations represents one of the most difficult problems in contemporary law enforcement. The structural features that make cybercrime attractive to criminal organizations are precisely the features that make it difficult to police: its transnational nature, the anonymity that digital systems can provide, the technical complexity that creates information asymmetries between attackers and defenders, the speed at which criminal operations can be established and dismantled, and the political complications that arise when criminal organizations are protected or directed by hostile foreign states. Law enforcement agencies that were designed to investigate crimes occurring within specific national jurisdictions have been forced to adapt, with varying success, to a criminal environment in which neither the criminals, the victims, nor the evidence is reliably contained within a single jurisdiction.

American law enforcement's first major organized response to cybercrime came with Operation Sundevil in 1990, a sweeping series of raids targeting hacker communities that was ultimately more notable for its overreach than its effectiveness. The operation, which targeted dozens of individuals and seized enormous quantities of computer equipment, was widely criticized as a case of law enforcement drastically overestimating the criminal nature of hacker activity. The Electronic Frontier Foundation, a digital rights organization founded in part as a response to Operation Sundevil, argued that many of those targeted had committed no serious crime, and the operation ultimately produced few significant prosecutions. But it established the principle that federal agencies would treat computer crime as a priority enforcement matter, and it prompted investment in specialized investigative capabilities.

The Federal Bureau of Investigation established its Cyber Division in 2002, centralizing the bureau's cybercrime investigative capabilities and providing a dedicated institutional home for what had been scattered investigative work across regional offices. The Secret Service, which had long-standing jurisdiction over financial crimes, maintained parallel cybercrime investigative capabilities particularly focused on financial fraud, payment card crime, and identity theft. The Department of Homeland Security's Cybersecurity and Infrastructure Security Agency, known as CISA, focused on defensive measures and the protection of critical infrastructure. Coordination among these agencies, and between American agencies and their counterparts in other countries, remained a persistent challenge throughout the period covered in this chapter.

International cooperation is essential to effective cybercrime enforcement because almost all significant cybercrime operations are transnational. A criminal organization based in Russia may use servers in the Netherlands to distribute malware that steals financial credentials from victims in the United States, with the proceeds laundered through shell companies in Cyprus and Hong Kong and ultimately withdrawn as cash in Eastern Europe. Effective investigation of such an operation requires the simultaneous cooperation of law enforcement in multiple countries, sharing evidence across different legal systems, different evidentiary standards, and different political relationships with the source country of the criminal organization. The Budapest Convention on Cybercrime, adopted by the Council of Europe in 2001 and subsequently ratified by dozens of countries, established a framework for international cooperation in cybercrime investigation and mutual legal assistance. But the convention's practical effectiveness has been limited by the non-participation of major cybercrime source countries, most notably Russia and China, whose governments have declined to ratify the agreement.

Despite these challenges, law enforcement has achieved significant successes against cybercrime organizations. Operation Avalanche, a joint operation by law enforcement agencies from thirty countries coordinated by Europol and Eurojust in 2016, dismantled a major malware infrastructure that had been used to conduct banking fraud and ransomware attacks affecting millions of victims worldwide. The FBI's takedown of the GameOver Zeus botnet in 2014, coordinated with law enforcement in multiple countries, disrupted one of the most destructive criminal hacking operations in history and seized technical infrastructure used by the network. In 2022, coordinated law enforcement operations took down the REvil ransomware gang's infrastructure and, remarkably, saw Russian authorities arrest several alleged REvil members in early 2022, in an unusual (and short-lived, as it turned out) moment of apparent Russian cooperation with Western cybercrime enforcement.

Law enforcement has also developed innovative technical approaches to cybercrime investigation. The use of blockchain analysis, the tracing of cryptocurrency transactions through publicly recorded blockchain ledgers, has proven to be a powerful investigative tool, allowing investigators to follow the movement of criminal proceeds even when they pass through multiple cryptocurrency wallets and exchanges. In 2021, the Department of Justice recovered approximately 2.3 million dollars in Bitcoin from the DarkSide ransomware gang following the Colonial Pipeline attack, demonstrating that even Bitcoin payments could, under some circumstances, be traced and recovered. The development of the Justice Department's National Cryptocurrency Enforcement Team, and the FBI's Virtual Asset Exploitation Unit, reflected growing institutional investment in the technical capabilities needed to pursue cybercriminal proceeds.

Private-sector cybersecurity companies have played an increasingly important role alongside law enforcement in disrupting cybercrime operations. Companies like Microsoft, Mandiant, CrowdStrike, and others have conducted technical investigations of major criminal hacking operations, published detailed analyses of criminal groups and their methods, and worked with law enforcement to identify and disrupt criminal infrastructure. Microsoft in particular has used civil litigation as a tool to seize domain names and server infrastructure used by criminal hacking groups, an innovative approach that uses private legal mechanisms to achieve disruptions that law enforcement might be unable to accomplish through criminal processes. The collaboration between public law enforcement and private cybersecurity companies, while not without tensions over information sharing and the primacy of law enforcement authority, has become a central feature of the contemporary cybercrime enforcement landscape.

Research or Library Extension