"Great, sensational, terrific. What is it? I told you, science and biology. Are you with me? Not exactly with you, but somewhere nearby." This is Cybercrimeology, a podcast about cybercrime its research and its researchers. My name is Michael, and like you, I still learn new terms by context. We see and hear words in a context and start repeating them in that context. It's a very normal and communal way of developing a vocabulary, but it does mean that those words just slip into our vernacular unexamined. Which is to say, we start saying words that could mean more than we think they do. And as we'll find out in this episode, that is definitely the case for me and the term cybersecurity ecosystem. We're joined by Dr Benoit Dupont, who is Professor of Criminology at the University of Montreal, as well as the Canada Research Chair for Cybersecurity and the Research Chair for the Prevention of Cybercrime. Dr Dupont is also a co-investigator with the Human Centric Cybersecurity Partnership, which is a trans-discipline group of partners from across Canada, generating research on the social and human issues related to cybersecurity. We'll be hearing more from researchers from this group as we have an agreement with HC2P to share the work that we've been doing. I do work with the HC2P as my day job, but it's not a sponsorship, no money is changing hands, and there are no strings attached to the deal. I'd just like to be very open about this kind of thing. You can go and check out about the research being done through that partnership at hc2p.ca. Our discussion with Dr Dupont focuses around work that has gone into a forthcoming book, which he was polishing up during a recent sabbatical. So I asked, how long does it actually take to write a book? Well, it depends how organized you are and how disciplined you are, and I'm not very good at either of those kind of personal qualities or features. So for me, this book took almost eight years to write, not a quick process, say the least. What's the role of a sabbatical? The sabbatical is just to sit on a beach and write a book. Well, that's the theory, that's the dream. And the reality is slightly different for me. So I said I needed two sabbaticals. The first one was the incubating sabbatical, the one where I needed to kind of disconnect from the daily chores and the daily grind and be able to have a buffer of time to put all my ideas in order and try to find an innovative ways of proposing a new framework for what I wanted to study. And so the first sabbatical was dedicating on trying to find a framework or a theory or an approach that would make a contribution and would work for me and would keep me interested and would make sense in light of the data I had accumulated. And then I had this kind of six years gap between the first and the second sabbatical where I had my outline of the book and I kept on reading and I kept on taking notes and accumulating that to go back to when I was ready to finalize the writing of the book. And the second sabbatical was the more boring but unavoidable part, the writing section after section chapter after chapter and trying to consolidate, reject the stuff that didn't make any sense anymore or was a bit obsolete or too old. And that second part was more making sure a few hours every day and then a few hours on the beach as well to recover and be ready for the next day. So yes, you can have some time on the beach during the sabbatical but you also have to develop the discipline and to have probably done all the incubation of your ideas before that because otherwise it might be too much to do it all at once. What function does a book perform for you in amongst all of the other writing? For me, the book was the end of a ten year journey of, well, the end as the finish but the end of a stage of a ten year journey of trying to give sense to what I was reading about and I was writing on in terms of cybercrime and how it's changing the way crime is being deployed and offenders are generating criminal revenues. So it was trying to put all the insights and ideas and intuitions into a single framework and that you can do in a journal article because you have 20 pages or between 8 and 10,000 words and that's not enough to take the reader by the hand and to explain the context of your framework, what led you to it and the theoretical inspirations that drew you to adopt this particular framework and the additions that you are making to this existing theoretical background and the empirical demonstration of why this makes sense and the way forward in terms of public policy or practical applications. I think the book gives you the space and the freedom to really take your time and to develop your ideas fully without the constraint of space that the journal articles put in you and I think they're very complimentary actually. I think that you know, journal articles are very often the seeds of a book because you see the response from your colleagues, you see the citation counts and you see, okay, people seem to be interested in this approach so maybe there is something more I could develop and you could of course write more articles but if you want more altitude or a bit more breadth in your approach, I think a book is a good option and then the articles also can be used to promote your books and not many people are going to read your book if it's an academic book anyway. You have to be realistic about that so maybe articles that summarize the core ideas or the more interesting ideas can also then be used as a promotion tool or as a way to kind of disseminate your ideas more broadly. So this book is based on the idea of an ecology of cybercrime. What is that? The idea was born from my frustration I would say with the kind of segmentation of research on cybercrime within criminology but also between disciplines so you have people in computer science being very interested about the malware that cybercriminals use to infect their victims. You have people in criminology very interested about the motivations and the skills of hackers or online fraudsters. You have the political scientist very interested about how nation states are sponsoring more and more hacker groups that sometimes cross over into cybercrime but mostly deal in this information or the theft of intellectual property and I was thinking that it should all be connected because we all live in the same digital ecosystem and people talk a lot about digital ecosystem but we overuse the term without really thinking about what is an ecosystem? How does it operate? And then I turn to ecology as a science and I discovered that actually people studying the physical environment and the biological environment and species and the biosphere and all of that actually had developed concepts that could very well be translated to the social sciences and actually they were to a certain extent but in the digital space we often only use those concepts as metaphors or we sometimes even stopped mentioning the ecosystem assuming everyone understood what we talked about but in fact they were entire libraries built with books on cooperation and competition and predation and co-evolution and I thought well maybe if we go back to those concepts and the way they were designed and applied we could transfer those to criminology and use them to better understand the interactions between cybercrime groups between the industry that's designing and selling to us products and services that are very badly secured and all the security and regulatory stakeholders that actually might also play a very important role in controlling cybercrime so I thought okay well let's see how far we can push beyond the metaphor the analogy and what can be translated from ecology to criminology without becoming too deterministic without kind of blindly thinking we can model things the same way because humans have a conscience and they adapt much faster than animals do so the antelope will never become a predator of the lions I mean not in a foreseeable future but that's not the case for hackers they can be predators of the police and intelligence agencies that hunt them they can very easily turn the tables on them it's a much more symmetrical predatory world and that's what I wanted to explore as well the similarities but the differences as well and try to propose a framework that people could then use to map and to study more systematically the all those interactions because in the end we live in the world of interactions and flows and we tend to study the properties in the features and to forget a lot about the interactions and the flows but those are the interdependencies that make a difference very often when you talk of the interactions you're sort of talking about a relationship or at least the elements within a relationship what would be one of those relationships that would be a good example for highlighting this approach so a good example would be a competition you can have competition within a community or between communities an example of a competition relationship within a community would be within the industrial sector or the digital sector where you have such intense competition between digital companies and especially startups entering a new field that very often the field that speed tramps safety and security
Because of this competitive environment, they will market an MVP, a most viable product, even if they know perfectly well that it has big security holes in it, because they think it's more important for them to acquire market share. And once this will be established, then they can turn their attention to security. But in the meantime, the hackers and the attackers have identified this as an interesting opportunity that they will leverage to victimize hundreds of thousands or millions of people. So this is an example where competition between companies from the private sector is creating an environment generating new opportunities for cyber offenders. You can have also cooperation, so that's what we see in the security community where you see organizations from the private sector, from the public sector, the police, but also intelligence agencies, regulatory authorities, or even individuals coming together to share intelligence that will enable more effective interventions against online offenders. So you have the ISACs, information sharing organizations, you have the private sector with companies such as Microsoft, coordinating public and private organizations to take down botnets. So this is a few examples of cooperation between different actors that have different interests, different capacities, different mentalities, but still coming together around a common objective to try to take down online crime risks. So we have competition, we have collaboration, we have predation. Those are the kinds of relationships or interactions that occur between security actors, industry actors, criminal actors, and they're all intertwined into the same web of interactions, whether they like it or not. And the hackers, they try to escape the surveillance and the monitoring of intelligence agencies and police organizations and the cybersecurity community, but they can't because they're all tied together in the same digital ecosystem. There is no way that the Antelope can escape the Savannah, just like there is no way that the hackers or the police can escape this dense web of interactions and relationships. You mentioned the Savannah and I guess digital platforms are the savannah of the online. Where are we at in terms of the health of the environment? I think that we've come to terms with the acknowledgement that the health of the digital environment as much as in poor shape as the health of the physical environment and that we've really built digital environments that are very toxic and very full of pollution in terms of decaying trust and a lot of antagonism and confrontation and the lack of respectful discussions and consensus building opportunities. I think that governments are coming to terms with the fact that those platforms are playing a much bigger role than they anticipated in the social life of citizens and in the democratic operations and that they will need to probably regulate them a lot more just to keep the press alive or to keep democratic processes operative and effective. I think that after 20 years of social media platforms operating and growing and taking such an important place in our lives, I think we are kind of acknowledging that this is not working. It was probably a big mistake not to regulate them from the onset and that we'll probably need to do a better job and that AI will be the next opportunity but we'll also need to look backward and try to fix some of the problems if we can and some countries are doing more than others. So the European Union seems to be more advanced and more eager to regulate and other countries a little bit lagging behind. So I guess if we take social media as an example, taking the training wheels off everything left us with Google, which is a massive company that's known for just dropping innovations if it doesn't suit it anymore and I guess meta, which is what it is. So I see your point that the low regulation approach in order to encourage innovation didn't really leave us with a huge marketplace with many innovative players in it. Well, there are businesses first and foremost. So innovation for them means to land it. It's a way to generate more revenues. They innovate to create a new market but once they've captured this market, this is not to innovate anymore but to kind of maintain their source of revenue and then they become anti-innovation if it's kind of undermining their market and they're buying new innovative companies to make sure they don't expand and eat into their market. So the discourse about innovation is a little bit hypocritical and this is happening again with AI. They want to participate in all the summits and all the discussions on regulation to make sure they can shape the regulatory landscape so that they are not going to be excluded and they can exclude the smaller players that actually might have some interesting contributions to make in terms of safety and security. But that's not surprising. That's the way those big companies and the market operates. And that's why it's important for the state to be very kind of wise about it and to recognize when the market is dysfunctional and to step in and to intervene. I mean, I'm not anti-markets but it's very often markets fail and governments have to pick up all the pieces so it's probably more effective if governments are able to deploy regulations or smart, that are responsive and that's why this is an important part of my book that the ultimate objective of an ecology of cybercrime is to understand and to map the interactions so that we know where regulations and interventions are going to be the most effective. So this ecology of cybercrime is the way to empower governments and their agencies to better understand the overall landscape of online risks so that their intervention becomes more effective, more efficient and more transparent than the current interventions, some of which might come from the private sector with very little transparency about the reasons behind those interventions, the motivations, and the ultimate outcomes of those interventions. Do we have a way forward, are there a set of actions or a roadmap or something that we can put in place? I don't think there are roadmaps yet but I think they're coming. And yes, I think we should be optimistic about it because there are many many examples of interventions or measures that seem to be working. We'll need to be creative and innovative so we'll need to convince public servants and policy makers that maybe we have to reinvent how the machinery of government works and we have to be a bit more inclusive of some private sector actors or some community actors as well. And we need to see government agencies as network managers instead of just deliverers of security services. So auspices in my colleague Clifford sharing speaks of auspices and providers of security. And I think that the government needs to become an auspice where it kind of designs outcomes. It wants to see achieved and identifies stakeholders that can contribute to the delivery of those outcomes. But then it delegates to a certain extent the tasks that will be needed to achieve those outcomes. And it of course measures the effectiveness of those private sector and community contributions as well. So it's a different mindset, a network manager than just provider. But I think it's the way forward because the problem is so big, diverse spread around the world that a single government or a single agency will never be able to fix it. So it's building alliances, building networks of capacity that can actually contribute towards those objectives. The delivery of a safer internet is kind of a nebulous concept. As an academic community are we providing government with the kinds of information they need to be able to understand what that means and how to measure? Well I think actually the government has the tools to do this measurement much more than the academic community. I think the academic community role should probably be to kind of suggest the metrics that we could be using to measure the kind of the health of this digital community. And to have the time to think more deeply about what is important and what should be the priority in terms of measurements. But the government has all the tools because it has the statistical agencies running big surveys that could be made and new to see the progress being made. Those statistical agencies like Statscan in Canada are very sophisticated at capturing data from the private sector, from the public, from the economy as well. And to a certain extent it's actually measuring and surveying and capturing the data. The problem is that it doesn't have the resources necessarily to interpret or to make sense of the data. During the summer for example, summer of 2023, there was a very obscure press release from Statscan mentioning that every year in Canada 2.4 5 million Canadians are the victim of cyber fraud. It is an amazing number because it means that cyber fraud has become the number one crime in the country. But because it was released in the heat of the summer, things July 24th no one paid attention to it really or just lasted a day or two people were on holiday, didn't want to be bothered with bad news like that. And then we forgot about it. And the survey by the way was from 2019. So we were releasing numbers in 2023 from 2019 in a digital world where technology evolves at the speed of light.
This is something that probably we need to address as well. But governments have the numbers in the metrics and the regulatory agencies. They can also force companies to disclose information. So in some countries, in the UK and Australia, the government has compelled banks and telcos to disclose how many cases of fraud they've recorded among their customers. And they aggregate all of that with their public data. And we have in those countries a much clearer picture of the actual numbers of victims of cybercrime, which in turn would enable us to design and to implement more forceful cybercrime prevention programs, which could be then measured by independent academics who would be able to, like it's been the case in the UK, in the Netherlands with Redgar Lackfeld and his team. So I think that these are examples where the government certainly has the data or the tools to generate the data, but needs to work probably with the private sector and academia to make sense of the data, give meaning to the data and then agree on, you talked about roadmaps. And I think that that's what we're missing, a road map of who are all the stakeholders engaged in this anti-sibercrime web of cybercrime control and prevention. What is everyone going to do and how are we going to measure that based on the tools we already have because we don't need to reinvent the wheel. Assuming that the exclamation point created by AI has put everyone on notice and all of the people who are excited to make positive change now have the opportunity to work together. What are our chances at that? I'm a kind of optimist. So I would say chances are good. I wouldn't say hi because there are many hurdles and obstacles in the way. There is probably also a certain level of residual cybercrime that will always subsist. So that people will always keep on innovating, finding new ways to commit online crimes. In the book, I also suggest the idea that this might be not entirely bad in the sense that it also helps identify vulnerabilities in technologies that the industry hasn't identified. And so they are actually helping us fix technology and improve security. So as long as it remains at a low level, this is helping the entire digital ecosystem because it's creating new products and services that cyber security companies are offering. And as long as we can also address the needs of victims, because that's something that's very often forgotten. And that's been one of my kind of pet projects of late trying to understand and see what can be done to better answer the needs of victims. So as long as we take care of that, I think there will be a certain level of residual cybercrime. But I think we can ensure that we're not engulfed by cybercrime and that we respond forcefully. I was reading recently that more and more ransomware groups are being dismantled. And even though they are still very active, they are not overwhelming the digital environment and companies and individuals are learning how to respond. So it's not doom and gloom. It's the story of adaptation, it's the story of co-evolution. And that's why I want to, again, I'm going back to ecology. But it's a balance that we need to reach. There are shifts, there are bridges in technology and criminal innovation, but it's not the end of the world. And very often in cyber security, this is a discourse we hear, the trillions of dollars being lost to cybercrime and this is bullshit because actually if it was the case, the economy wouldn't operate normally. And we have actually as academics to respond to that to say no, this is not trillions of dollars, maybe a few billions, which is already a massive amount of criminal revenue. But I'm optimistic. Thanks very much for your time, man. I look forward to the book when it finally comes out. Thank you very much, Michael. Thank you to Dr. Ben Waddupont for sharing the positivity and the deeper understanding of not only what an ecosystem can mean, but also the process of finding a new and promising paradigm. Perhaps there's a similar perspective out there behind a word that you've taken for granted. In the meantime, though, this has been Cybercrimeology, a podcast about cybercrime its research and its researchers. It's produced by me, but it's still only really made possible for the kind guests who share their time and their research. You can find out more about the show at cybercrimeology.com, find me at Cybercrimeology on XTwitter or send me an email at
[email protected].
PodcastTranscript AI