Free Hacking Tools and Gaming Forums Help Youngsters Become Cybercriminals

The National Crime Agency's (NCA) National Cyber Crime Unit (NCCU) Prevent team spoke to a range of former offenders and those heading towards cybercriminality via cease and desist visits, in order to better understand the pathways into cybercrime.

Their findings indicate many youngsters are drawn into cybercrime via "modding" and gaming cheat forums, before quickly progressing to criminal hacking forums without fully acknowledging the gravity of the step. While no sociodemographic bias detected in the criminal fraternity's ranks, the average age of cybercriminals in the UK is far lower than other times of misdemeanor — a mere 17 in 2015, compared to around 37 for drug dealing.

In terms of facilitation, the assessment notes off-the-shelf tools such as DDOS-for-hire services and Remote Access Trojans (RATs) are available with step by step tutorials at little to no cost to the user, making the skills barrier for entry into cybercrime lower than it has ever been.

In terms of motivation, the agency perhaps surprisingly found money is not always a priority for young offenders, although off-the-shelf hacking tools have made it ever-easier for even low-skilled hackers to generate profits with relatively little effort. Instead, many offenders are motivated by more innocuous factors.

"Completing a challenge, a sense of accomplishment and proving oneself to peers are key [motivators]. These factors are repeated throughout the debriefs and academic literature as the main reason young people begin and continue hacking. An 18-year-old who was arrested for obtaining unauthorized access to a US government site said 'I did it to impress the people in the hacking community, to show them I had the skills to pull it off… I wanted to prove myself… that was my main motivation,' " the report said.

Another individual noted in the report, Subject 7, was jailed for Computer Misuse Act and fraud offenses. In explaining his actions, he told officers:

"It made me popular, I enjoyed the feeling… I looked up to those users with the best reputations."

These motivational factors could be used to steer young offenders away from cybercrime, according to the NCA — this could be as simple as highlighting opportunities in coding and programming, or jobs in the gaming and cyber industries, which still offer a sense of accomplishment and respect that offenders seek. Subject 1, a member of a hacking collective who sold DDoS tools and Botnet services, told officers a mere warning from law enforcement would have made him cease his activities.

The report also challenges the notion cybercrime is a lonesome affair, contrarily suggesting online relationships are key and building reputation drives young cyber-criminals.

Commenting, Dr. Jamie Graves, chief executive of cybersecurity ZoneFox, said the findings were "worrying," and major incidents such as the 2015 TalkTalk hack, in which a person not yet old enough to vote brought a major firm "to its knees" were clear examples of the hazards posed by younger hackers.

"It shouldn't be this way. We live in a country where technology encompasses every inch of our daily lives — especially younger generations. Now is the time for the UK to really focus on tackling this by putting an emphasis on trying to flip young people's attitudes on cyber-security from ‘bad' to ‘good'," he added.

Nonetheless, he questioned the NCA's proposed remedies — while acknowledging targeting and removing free online tools that allow hacking to take place must be a focus, "more innovative approaches are needed," he argued.

"Instead of spending resources looking to suppress these highly intelligent young individuals and put them behind bars, we should be identifying them and nurturing and encouraging them to contribute positively in roles that can utilize their skills, both in the private and public sectors. This will not only empower them for good, but also boost the economy and safeguard the nation."

Richard Jones, Head of the National Cyber Crime Unit's Prevent team, said there was much value in reaching young people before they ever become involved in cybercrime, as even the most basic forms of cyber crime can have huge impacts and the NCA and police will arrest and prosecute offenders, which can be devastating to their futures.

"The aim of this assessment has been to understand the pathways offenders take, and identify the most effective intervention points to divert them towards a more positive path. That can be as simple as highlighting opportunities in coding and programing, or jobs in the gaming and cyber industries, which still give them the sense of accomplishment and respect they are seeking," he added.