CNIT 422 Exam 2

What is Routine Activity Theory (RAT)?

Crime happens when three conditions are present:

• Motivated offender

• Suitable target

• Lack of capable guardian

How are theories put into action?

Theory leads to practices and frameworks created by developers, organizations and law enforcement

T/F: Theory leads to policy that makes its way into technology

True

What is situational crime prevention?

Incorporates RAT, but focuses on contextual factors

What are the 5 ways to reduce opportunity for a crime?

• Increase the effort (for the offender)

• Increase the risks (to the offender)

• Reduce the rewards/benefits

• Reduce or avoid provocations

• Remove justifications

What is deterrence theory?

People are unlikely to commit crime if they think they will be caught or punished; foundation of criminal justice system

What are the three assumptions of deterrence theory?

• We make rational choices

• We weigh benefits and drawbacks

• We generally understand benefits and risks of crime

To deter crime, punishments must be…

Severe, Certain, and Celerity (speed)

What is General Deterrence?

People are deterred from crime when they see others punished

What is Specific Deterrence?

People are deterred from repeating a crime if punishment is uncomfortable

What are the general issues with crime aggregation at a federal level through FBI and FTC?

• They do not aggregate their data despite access

• Legacy systems were not established for cybercrime, so misrepresentation occurs

• Collecting the data is slow

What is the dark figure of crime?

The underreporting of various crimes, making our understanding of the prevelance of the crimes underestimated

What are the generally presumed underreported crimes?

Sex crimes, domestic abuse, drug-related crime

What are the qualities of National Incident Based Reporting System (NIBRS)?

• Required as of 2021

• Reports of individual crime incidents

• Info about victim, offender, property stolen, relationship, weapons, and location

• Only includes policing organizations that choose to submit info

• Has tag for cyberspace as location and some categories, but still has issues of ommitted

What are qualities of Crime Data Explorer?

• Aggregated information from the NIBRS

• Easy to use, no in-depth analysis

What are the qualities of IC3?

• Direct reporting from public organizations

• Not incorporated with NIBRS

What are some issues regarding cybercrime reporting systems in US?

• Requires someone to report something in the first place

• Omitted or aggregated under fraud

• Tags exist, but inconsistent usage

• Even in same org, data goes to different destinations and comes from different sources

• Granularity of data isn’t consistent across systems

• Crime categories aren’t the same

• Different orgs that could report to IC3 have different interests

T/F: Over-policing bias leads to communities with higher law enforcement presence have more reports of crime

True

T/F: Communities with higher law enforcement presence have more crime than those with lower law enforcement presence

False

What is the pros and cons to large-scale surveys/self reports?

Take a considerable amount of time and money but allow for a representative sample of the population in a region or the US

What is the pros and cons to small-scale surveys/self reports?

Aren’t representative, but can be targeted at specific groups and take less time and money to run

What is the National Crime Victimization Survey?

• Primary source of annual info on crime victimization

• Reaches approx 240,000 people

• Intended to capture reported and unreported crime

How is hacking defined?

Person who enjoys exploring the details of programmable systems and how to stretch their capabilities, as opposed to most users, who prefer to learn only the minimum necessary

Is hacking cyber-enabled or cyber-dependent?

Cyber-dependent

What is the description of a hero hacker?

Highly skilled; fights against unjust institutions; expose misdeeds

What is the description of a villain hacker?

Highly-skilled; steals, extorts, motivated by greed; dangerous

According to Rogers’ Hacker Typology, what is a Toolkit/Newbie/Neophyte hacker?

Limited hacking abilities

According to Rogers’ Hacker Typology, what is a Cyberpunk?

Hacker capable of writing their own software

According to Rogers’ Hacker Typology, what is an Internal?

Disgruntled employees

According to Rogers’ Hacker Typology, what is a Coder?

Hacker who focuses on writing malware and programming

According to Rogers’ Hacker Typology, what is an Old Guard Hacker?

Interested in intellectual endeavor of hacking (e.g, Phreaking)

According to Rogers’ Hacker Typology, what is a Professional Criminal?

Hackers who attack systems for economic reasons

According to Rogers’ Hacker Typology, what is a Cyberterrorist?

Those who attack systems for political or religious reasons

According to Rogers’ Hacker Typology, what is a Hacktivist?

Civil disobedience

What are some motivations of unauthorized hackers?

Revenge, entertainment, political/ideological, curiosity/knowledge, boredom, profit, peer acceptance, notoriety/prestige

How many agentic threat actors is Microsoft tracking?

100

What do disruption teams look for?

• Speed of corrections and volume of attempts

• Method

• Self-narrating code

• Noise

T/F: General Theory of Crime explains hackers strong relationship with high impulsivity, risk-taking

True

What are the key characteristics of hacker subculture?

• Technology as “tools of their craft”

• Deep commitment to knowledge and mastery

• Need for secrecy

T/F: At the group level, black hat organizations are industrializing

True

T/F: Requests for Apple exploits now exceed requests for Microsoft exploits

True

What is fraud?

Commonly defined as the criminal acquisition of money or property from victims through the use of deception or cheating

What is packaging when it comes to romance scams?

Creating a persona that mirrors that of the potential target(s)

What are Cialdini’s Principles of Persuasion?

• Reciprocity

• Scarcity/FOMO

• Consistency and Commitment

• Authority

• Liking

• Social Proof

What is the principle of persuasion reciprocity?

• People feel compelled to give back when they receive something, creating a sense of obligation

• Mechanism to build rapport

What is the principle of persuasion scarcity/FOMO?

• People value things more when they perceive them to be limited

What is the principle of persuasion consistency and commitment?

• People strive to be consistent in their actions and beliefs

• Compliance increases when individuals first agree to small requests, leading to small requests, leading to larger requests

What is the principle of persuasion authority?

• People are more likely to comply with requests from someone who appears to have authority or expertise

• Requires believable background knowledge; otherwise authority can be questioned

• Ex. Milgram’s experiment on obedience, influence of uniforms, and titles

What is the principle of persuasion liking?

• People are more likely to be influenced by those they like or find similar to themselves

• Liking can be built through genuine compliments, mirroring behaviors, and finding common ground

What is the principle of persuasion social proof?

• People look to others’ behavior to determine their own actions, especially in uncertain situations

• Powerful in social engineering, where showing that “others have done this” can lead to compliance

What age group appears to be the most victimized in hacking/computer invasion?

40-49

What age group appears to be the most victimized in identity theft?

Unknown, then 30-39

What age group appears to be the most victimized in wire fraud?

60-69

What was the origin and intended use of the modern-day computer?

Started for code breaking, tracking missiles, and wartime uses

What was the name of the “hacker club” that began in a garage?

Homebrew Computer Club

Which computer hacker was listed as the FBI’s public enemy #1?

Kevin Mitnick