Advertise on podcast: Cybercrimeology

Notes:Alessandro's journey from studying law to discovering criminology and pursuing a career in research.His experience conducting ethnographic research into black-market ticket selling and online deviance.Traditional neutralization theory and how individuals justify behaviour they recognise as wrong.The development of the aesthetics of cruelty as an extension of existing criminological theory.The role of shock, humour and provocation in sharing hateful memes.How the target of offensive content can be irrelevant or interchangeable within certain online communities.The shared appreciation of shocking material as a basis for social interaction and belonging.The importance of context in understanding offensive humour and online behaviour.How memes can escape their original communities and reach unintended audiences.The increasing accessibility of extreme content on mainstream social media platforms.The potential normalization of offensive content through repeated exposure.The status associated with receiving platform bans for sharing particularly offensive material.The potential exploitation of these communities by individuals promoting extremist ideologies.The challenges of automated content moderation and the commercial incentives of social media platforms.The discussion of social media restrictions for younger users.About our GuestAlessandro Moretti  https://researchprofiles.ku.dk/en/persons/alessandro-moretti/   Papers or resources mentioned in this episode:Moretti, A., & Demant, J. (2026). Neutralization without drift: The aesthetics of cruelty in hateful meme sharing. The British Journal of Criminology. https://doi.org/10.1093/bjc/azaf092Hayward, K., Moretti, A., Mizrahi-Werner, J., & Demant, J. (2026). “That is just f****d up, I think I’ll be leaving now”: Coded language, hateful humor, and plausible deniability in dark memes on Facebook. Deviant Behavior. https://doi.org/10.1080/01639625.2026.2688360Demant, J. J., & Moretti, A. (2024). Intrusiveness and the public-private divide in netnography: A situated, structured approach for ethical research in the context of closed, group-based, or hidden social media behavior. International Journal of Qualitative Methods, 23. https://doi.org/10.1177/16094069241257937Sykes, G. M., & Matza, D. (1957). Techniques of neutralization: A theory of delinquency. American Sociological Review, 22(6), 664–670. https://doi.org/10.2307/2089195OtherMoretti, A. (2023). The rise and rise of illegal ticket touting: An ethnography of deviant entrepreneurship. Routledge. https://doi.org/10.4324/9781003168553L'Hoiry, X., Moretti, A., & Antonopoulos, G. A. (2024). Identifying sex trafficking in adult services websites: An exploratory study with a British police force. Trends in Organized Crime, 27, 34–55. https://doi.org/10.1007/s12117-021-09414-1

Notes: Ms. Aybar traces her interest in criminal justice, government and politics back to childhood. She recalls her father having her choose a current event from the Sunday newspaper and then discussing it with him, and says she already knew by seventh grade that she wanted to attend John Jay College of Criminal Justice. Her route into cybercrime came through advertising and political campaigns. As digital advertising became increasingly important, she encountered problems with advertisements being directed toward bots rather than people and became involved in applying fraud-prevention techniques to campaigns. This experience sparked a wider interest in cybercrime. After beginning her PhD, Ms. Aybar worked on a research assignment involving USAID and DAI focused on enhancing Ukraine’s cybersecurity posture. The work led her further into the national-security side of cybersecurity and into studying nation-state, non-state and other cyber actors. Ms. Aybar and her dissertation chair, Dr. Rob T. Guerette, used environmental criminology and rational choice theory to examine whether state-sponsored and non-state cyber actors demonstrate different behavioural signatures. Rather than focusing only on the tools used in an attack, the approach considers the choices attackers make around risk, reward, effort, visibility, operational security and what they are ultimately trying to accomplish. The study uses data from the European Repository of Cyber Incidents (EuRepoC), allowing the researchers to look for patterns across a large number of publicly documented cyber incidents over time. Ms. Aybar notes that this scale is useful, but also stresses that the data only represent incidents that are visible, recorded and attributable rather than the full universe of cyber activity. Changes in the threat landscape, actor names and APT naming conventions also create challenges for classification and consistency. The clearest distinction in the study was that non-state actors were more associated with high-visibility and immediate-impact activity, including ransomware, disruption, doxxing and publicly confirming responsibility for an attack. State-sponsored or state-affiliated actors were more associated with lower-visibility strategic activity, particularly data theft and reduced operational disruption. From a rational choice perspective, Ms. Aybar suggests these differences reflect different incentives. Non-state actors may benefit from visibility, pressure or immediate financial gain, while state-linked actors may have reasons to preserve access, avoid attention and quietly collect intelligence or strategically valuable data. She emphasizes that, regardless of the category of actor, there are still people behind the screens making these choices. Not all of the study’s expectations were supported. The researchers expected state-sponsored actors to be more likely to target state and political systems, but this was not supported in their first theoretically guided model. Ms. Aybar suggests this may reflect strategic indirection: a state-linked actor can pursue a state-level objective by targeting contractors, universities, infrastructure dependencies, supply-chain intermediaries or private companies rather than attacking a government agency directly. Ms. Aybar’s planned dissertation consists of three studies. The first will develop behavioural baselines for state-linked cyber operations associated with China, Iran, North Korea and Russia and compare their operational and visibility patterns. The second will examine time to public attribution and whether behavioural characteristics are associated with how quickly an actor is publicly named. Her third dissertation study will examine ransomware crime scripts in the biotechnology and life sciences sector compared with general enterprise cases. The aim is to identify points in the ransomware process where situational crime-prevention techniques could potentially disrupt an attack. This work has also led Ms. Aybar toward the emerging area of cyber biosecurity. She is interested in what happens when cyber threats intersect with biological data, laboratory systems, pharmaceutical research, AI and the wider bioeconomy, approaching these issues from a cybercrime and national-security perspective. About our guest: Priscilla F. Aybar, M.A. Florida International University — International Crime and Justice PhD Program https://ccj.fiu.edu/people/ph.d.-students/   Papers or resources mentioned in this episode: Aybar, P. F., & Guerette, R. T. (2026). Rational choices in cyberspace: Quantitative insights into targeting and attack behavior among cyber offenders. Journal of Criminal Justice, 103, 102621. https://doi.org/10.1016/j.jcrimjus.2026.102621 Pixalate & The Democratic Congressional Campaign Committee (DCCC): How the DCCC used Pixalate to reduce ad fraud A case study featuring Ms. Aybar’s work using invalid-traffic detection and advertising analytics to reduce ad fraud in political digital campaigns. https://www.pixalate.com/case-study-dccc-ad-fraud-protection European Repository of Cyber Incidents (EuRepoC) https://eurepoc.eu/database/

Notes: Ms. Ayerza studied criminology, forensic behavioural sciences and psychology. Her early research examined eyewitness memory and the re-entry of exonerees before she became interested in cybercrime and cyberstalking. She was drawn to cybercrime because it is not limited to hacking, malware and phishing. Technology is part of everyday life through social media, email, dating apps and other commonly used services. Dating apps allow users to create profiles, specify the people and relationships in which they are interested and indicate interest in other users. When two users express an interest in one another, they can normally begin communicating through the app. Some dating apps are intended for broad audiences, while others serve particular lifestyles, interests or sexual orientations. Profiles are often presented as individual photographs or grids of photographs from which users make selections. Ms. Ayerza explains that dating apps are designed to make dating convenient and can feel like games. The superficial and rapid nature of matching can encourage users to make decisions based primarily on photographs. Harassment can arise when users send repeated messages in an effort to gain someone’s attention. Some people may not recognize these repeated or unwanted communications as harassment. Users may also deliberately match with someone because they disagree with something in that person’s profile and want an opportunity to criticize or harass them. Ms. Ayerza conducted an online survey of adult dating app users living in the United States. The study examined the information people included in their profiles, the photographs they shared and characteristics of the applications they used. The study considered whether users disclosed their relationship preferences, sexual orientation, workplace or occupation. It also examined whether they used their full name or an alternative name and whether their photographs included friends or family. Verification on dating apps can be a relatively superficial process in which a live photograph is compared with the photographs on a profile. Premium features may also allow users to change the location in which their profiles appear. Users often adopt their own protective measures, such as using pseudonyms or withholding photographs of their faces. However, designing effective technical safeguards is difficult because repeated messages can be part of both ordinary conversations and harassment. Most dating app users do not experience harassment, but Ms. Ayerza says that around a quarter of the users in the study experienced these forms of harm. The study did not compare victimisation across individual dating apps. Ms. Ayerza suggests that larger platforms may have more resources and face greater public pressure to introduce safeguards, while smaller platforms may have fewer resources. Sharing relationship or sexual orientation preferences was not found to increase risk. Ms. Ayerza suggests that these preferences help platforms present users with people who have similar interests without necessarily revealing where someone can be found. Including information about where a person works or studies increased risk. Photographs featuring friends or family also had an influence because they can reveal social connections and additional information about the user. Uploading photographs of one’s face was not found to increase risk, possibly because facial photographs are a normal and often required part of using dating apps. Matching with someone under the age of 18 increased risk. Ms. Ayerza connects this finding to the limited measures used by dating apps to confirm that users are old enough to participate. One of the most surprising findings was that using a pseudonym or nickname increased risk. Ms. Ayerza discusses the possibility that an alternative name creates a false sense of security and encourages people to disclose more information. Ms. Ayerza advises users to think carefully about what they disclose. Preferences may be appropriate to share, while details about occupations, workplaces, friends and family may be better withheld until someone is known more closely. She emphasizes that responsibility should not be placed entirely on victims. People should understand that harassment is unacceptable and platform operators should do more to prevent and respond to harmful behaviour. Possible platform interventions include better reporting mechanisms and educational or training modules that users complete before creating a profile. Schools could help prepare young people to communicate appropriately on dating apps once they are old enough to use them. Ms. Ayerza also argues that governments should treat conduct on dating apps more seriously because every profile represents a real person. Future researchers need measures that reflect the activities people actually perform on dating apps. Greater consistency would also make it easier to compare findings across studies. Ms. Ayerza plans to examine offending as well as victimisation. Her future research will consider unwanted sexual messages, sexual violence and the experience of multiple forms of harm on dating apps. About our guest: Jennifer M. Ayerza, M.A. https://cls.gmu.edu/people/jayerza https://cebcp.org/team/jennifer-ayerza/ https://www.linkedin.com/in/jennifer-ayerza-38353a233 Papers or resources mentioned in this episode: Ayerza, J. M., Lee, J. R., O’Malley, R. L., & Lee, C. S. (2026). Cyberstalking and online dating: Examining cyberstalking victimization among dating app users. Asian Journal of Criminology, 21, Article 5. https://doi.org/10.1007/s11417-025-09480-2

Notes: Irnasya Hadi explains how growing up with the internet, and being frustrated by the limited connection between critical criminology and cybercrime, drew her toward the study of cyber insecurity. The conversation turns to Indonesia and the difficulty of producing nationally representative cybercrime research in a country with a very large population, uneven internet access and uneven documentation. She discusses why cybercrime theories, surveys and assumptions from places such as Canada, the United States, the United Kingdom and Australia cannot simply be imported into Indonesian or Asian contexts. The episode examines the stereotype that cybercrime is produced in Asia and victimizes people elsewhere. Hadi pushes back against this framing by noting that many of the victims of cybercrime in Asia are themselves Asian. She reflects on the imbalance between Global North and Global South knowledge production, especially when Global South researchers often have to know Northern theory while Northern researchers may know far less about Southern contexts. The conversation introduces the Snapshot of Society method, which begins with people and organizations already working on a topic, then moves to affected members of the public, then to a broader survey stage. Civil society organizations can provide an insider perspective on issues such as government data breaches, while affected members of the public can reveal where expert assumptions do or do not match lived experience. A central finding from Hadi’s work is that people may not be indifferent to government data breaches. Instead, they may care deeply but feel too fatigued, resigned or worn down to respond. The discussion explores generational differences in how Indonesians understand government data breaches. Younger people may be more aware of cascading risks such as spam calls, identity theft and data being sold online, while older generations may interpret exposure to online risk differently. She discusses the role of insider knowledge in qualitative research, including how local jokes, shared experience and awareness of government priorities can shape what a researcher hears and how they interpret it. The episode closes with the broader promise of the Snapshot of Society approach: locally grounded studies from different places could be added together to build a richer global picture of cybercrime that does not simply mean the United States and the United Kingdom. About our guest: Irnasya Hadi https://www.linkedin.com/in/irnasya-shafira-hadi-9524b0145/ https://scholar.google.com/citations?user=dnc6cUcAAAAJ https://orcid.org/0000-0001-8929-329X   Papers or resources mentioned in this episode: Hadi, I. S., Chang, L. Y. C., & Davies, S. G. (2026). The Snapshot of Society: Challenges of Studying Cyber Insecurity in the Global South? Asian Journal of Criminology, 21, Article 25. https://doi.org/10.1007/s11417-026-09494-4 Hadi, I. S. (2025). Inaction as Nonformal Reaction: Rethinking Crime Perception in the Era of Data Breaches. Jurnal Kriminologi Indonesia, 1(1), Article 1. https://doi.org/10.7454/kriminologi.v1.i1.1000   Other: “The data analysis process uses Atlas.ti software, Microsoft Word, Microsoft Excel, printouts, and highlighters.” (Hadi et al., 2026, p. 14).  🤣

Notes: Dr. Bridgman discusses his path from Winnipeg to McGill and how he became involved with the Media Ecosystem Observatory while still a PhD student. The conversation turns to the origins of the Media Ecosystem Observatory during the 2019 Canadian federal election and how its work continued through the pandemic, the Hogue Commission and the growing focus on information ecosystem health in Canada. Dr. Bridgman explains why COVID-19 and AI have been two major disruptions in the information environment and why AI agents may become one of the main ways people encounter public information. The episode looks at the shift from traditional search, where users clicked through to sources, to AI summaries that may give users enough information without sending them to the people or organizations that produced it. Dr. Bridgman discusses the problem of value transfer, explaining how aggregators have captured value from original information production and how AI agents may become even more powerful aggregators. The conversation considers how common AI news use already is, including the difficulty of measuring it because many people may not recognize that ordinary search now includes AI-generated answers. Dr. Bridgman explains what he means by an AI agent: a general intelligence connected to tools that allow it to search, read, summarize and act in digital environments. The discussion uses the idea of AI as a “brilliant intern” to explain why these systems can be useful, capable and eager to please, while still lacking judgment about the broader consequences of how they complete a task. The episode closes by looking at the harms that may follow if original information production is not sustained, including poorer information, weaker attribution and new challenges for democratic accountability. About our guest: Dr. Aengus Bridgman https://meo.ca/people/aengus-bridgman https://abridgman.ca/ Papers or resources mentioned in this episode: Owen, T., & Bridgman, A. (2026). AI News Audit: How AI Models Use and Distribute Canadian Journalism. Media Ecosystem Observatory. https://meo.ca/work/how-ai-models-use-and-distribute-canadian-journalism Owen, T., & Bridgman, A. (2026). AI News Audit: AI, Canadian Journalism, and Paths for Policy Action. Centre for Media, Technology and Democracy. https://www.mediatechdemocracy.com/all-work/ai-canadian-journalism-and-paths-for-policy-action Other: Media Ecosystem Observatory https://meo.ca/ Centre for Media, Technology and Democracy https://www.mediatechdemocracy.com/

Notes: The conversation begins with his path into teaching public policy, despite never having planned a conventional academic career, and why translating technical subjects for non-technical students became rewarding work. He explains the importance of analogies and memorable language when communicating difficult concepts, noting that terms such as “security theatre” can help audiences quickly grasp complex ideas before deeper nuance is added. The original meaning of security theatre was intentionally critical, though he later came to recognize that symbolic security measures can sometimes provide reassurance and psychological value even when they do little to reduce objective risk. Effective cybersecurity often depends on economics, incentives, usability, and human behaviour, not simply technical controls. He reflects on the development of fields examining both the economics and psychology of security. The discussion examines AI-generated content, manipulated images, and why many current concerns about authenticity are extensions of older problems that existed throughout the history of photography and media. He warns that conversational AI systems can create parasocial relationships in which users relate to corporations as though they were trusted companions or advisers. On harmful technologies, he argues that regulation remains one of society’s most effective tools, comparing AI governance to safety regulation in aviation, pharmaceuticals, and food systems. He emphasizes the need for more “public interest technologists” capable of translating between engineering, policy, and social science perspectives. AI is likely to enhance both cyber offenders and defenders. He suggests phishing and scams may scale through automation, while defenders will also use AI to detect fraud and patch vulnerabilities. The conversation also explores whether AI will deepen inequality through access to computing power, with a more optimistic view offered that increasingly efficient models may broaden access rather than restrict it. About our guest:  Bruce Schneier  https://www.schneier.com/ https://www.hks.harvard.edu/faculty/bruce-schneier https://munkschool.utoronto.ca/ Papers or resources mentioned in this episode: Schneier, B. (2003). Beyond fear: Thinking sensibly about security in an uncertain world. Copernicus Books. Schneier, B. (2018). Click here to kill everybody: Security and survival in a hyper-connected world. W. W. Norton & Company. Schneier, B. (2023). A hacker's mind: How the powerful bend society's rules, and how to bend them back. W. W. Norton & Company. Schneier, B. (2025). Rewiring democracy: AI, governance, and the future of politics. MIT Press. Other: Public Interest Technology University Network  https://pitun.org/  Bruce Schneier Essays and Writing https://www.schneier.com/essays/ The Cottingley Fairies https://en.wikipedia.org/wiki/Cottingley_Fairies Bicentennial Man (Film) https://en.wikipedia.org/wiki/Bicentennial_Man_(film) The Fifth element (Film) https://en.wikipedia.org/wiki/The_Fifth_Element Thank you to the CICC (https://www.cicc-iccc.org) for enabling this interview. Mental note, next time don’t bring water in a plastic bottle.

Notes: Cybercrime is often treated as a distinct phenomenon, but there are strong continuities with offline crime that are frequently overlooked. Digital technologies change behaviour and scale, but do not fundamentally alter the social dynamics underlying crime. There is a significant gap between the harms experienced by individuals and the institutions available to respond to those harms. Federal law enforcement has expanded cyber capabilities, but local and state-level responses to individual victimization remain limited. Private sector actors, particularly financial institutions, play a major role in responding to financially motivated cybercrime. Non-financial cyber harms, such as sextortion or image-based abuse, often fall outside both private and public response systems. In the absence of clear response pathways, private companies are emerging to fill the gap, sometimes exploiting victims seeking help. Public attitudes toward police in cybercrime contexts are shaped by perceptions that police do not care or are unable to help. These attitudes mirror broader perceptions of policing, indicating continuity between offline and online trust dynamics. Perceptions of police capability differ depending on the type of cybercrime: Computer-focused crimes (e.g., malware) are associated with lower perceived police usefulness Interpersonal cybercrimes (e.g., sextortion) are associated with higher perceived police relevance Perceived likelihood of victimization reduces confidence in police effectiveness, while fear increases it. Gender differences emerge, with men less likely to believe police can help in cybercrime contexts. A central problem is definitional ambiguity: There is no consistent definition of cybercrime across agencies This limits measurement, comparison, and policy design Reporting systems are fragmented and often poorly understood by the public. Cybercrime often involves chains of offences, making classification and response assignment difficult. Comparative research suggests that investment and coordination can improve public confidence, but large-scale successes do not always translate to individual-level trust. About our guest: Rachel McNealey https://www.linkedin.com/in/rachel-mcnealey-4b8720284/ Papers or resources mentioned in this episode: McNealey, R. L., Figueroa, C. I., & Maher, C. A. (2025). “Police can't help you”: Exploring influences on perceptions of policing cybercrime. Journal of Criminal Justice, 101, 102542. https://doi.org/10.1016/j.jcrimjus.2025.102542 Hale, R., & Penzendstadler, N. (2025, March 20). Digital forensics firms promise help to sextortion victims. Some leave them worse off. USA Today. https://www.usatoday.com/story/life/health-wellness/2025/03/20/digital-forensics-sexortion-blackmail-recovery-services/81934584007/ Other: Internet Crime Complaint Center (IC3): https://www.ic3.gov/

Notes: Dr Samuel Tanner began his doctoral research examining war crimes and armed militias involved in mass violence in the Balkans, conducting extensive fieldwork and interviews with participants on multiple sides of the conflict. A central puzzle of his PhD research was not denial of violence, but how individuals who acknowledged their participation struggled to explain how they came to commit acts of mass violence. This led to an intellectual shift from viewing violence as purely intentional to understanding it as embedded in structures, representations, and processes of sense-making. Following a postdoctoral year at MIT working with political scientist Roger Petersen, Dr Tanner deepened his focus on the relationship between political violence, identity narratives, and institutional structures. After joining the Université de Montréal, he shifted toward research on policing and later co-led a major project examining right-wing extremism in Canada beginning in 2013. The Canadian project revealed that relatively few participants were “true believers.” Many were navigating economic precarity, cultural uncertainty, and political confusion, often influenced by moral or ideological entrepreneurs. Fieldwork in this area involved significant challenges, including surveillance, threats, cancelled interviews, and difficulties accessing participants. During the COVID-19 pandemic, Dr Tanner and colleagues examined anti-restriction movements and observed how disinformation and fragmented information ecosystems shaped divergent interpretations of shared events. He argues that information is not neutral. Information produces order. The ways in which information is produced, amplified, and consumed shape how individuals interpret reality and coordinate socially. Social media platforms function as privatized public spaces, structuring discourse through governance mechanisms that are not democratically accountable. Dr Tanner’s more recent research focuses on the evolution of extremist discourse, particularly the emergence of “pop masculinism,” where gendered and anti-feminist narratives are embedded within popular culture, fitness culture, gaming aesthetics, and entrepreneurial self-discipline discourse. The “sigma” discourse operates as a gateway into broader manosphere ideologies by framing personal discipline and self-improvement in opposition to women, feminism, and equality discourse. Interviews with young men and women reveal perceptions of a growing gender gap, including feelings among some young men of status loss and lack of positive role models. Dr Tanner raises concern about the erosion of shared institutional facts and the desynchronization of social expectations, suggesting that social trust depends upon shared informational baselines. He argues for an expanded criminology attentive to digital environments, disinformation, and the governance of online prejudice, aligning with broader developments in digital criminology. Central to his work is the question: how do people make sense of their world when institutional anchors weaken and informational environments fragment? About our guest: Dr Samuel Tanner https://crim.umontreal.ca/repertoire-departement/professeurs/professeur/in/in15014/sg/Samuel Tanner/ Papers or resources mentioned in this episode: Tanner, Samuel & Gillardin, François (2025).Toxic Communication on TikTok: Sigma Masculinities and Gendered Disinformation.Social Media + Society, 11(1).https://doi.org/10.1177/20563051251313844 Open access PDF:https://doi.org/10.1177/20563051251313844 Leman-Langlois, Stéphane, Campana, Aurélie & Tanner, Samuel (2024).The Great Right North: Inside Far-Right Activism in Canada. McGill-Queen’s University Press. (Book overview: https://www.jstor.org/stable/jj.20829378) People mentioned in this episode: Jean-Paul Brodeur — Presses de l’Université de Montréal (institutional collection page) https://pum.umontreal.ca/collections/jean-paul-brodeur/ Roger D. Petersen — MIT Political Science profile  https://polisci.mit.edu/people/roger-petersen Aurélie Campana — Université Laval (Faculté des sciences sociales)   https://www.fss.ulaval.ca/notre-faculte/repertoire-du-personnel/aurelie-campana Stéphane Leman-Langlois — Université Laval (Faculté des sciences sociales)   https://www.fss.ulaval.ca/notre-faculte/repertoire-du-personnel/stephane-leman-langlois François Gillardin — Centre international de criminologie comparée (CICC), Université de Montréal  https://www.cicc-iccc.org/fr/personnes/etudiants-supervises/gillardin Francis Dupuis-Déri — UQAM Professor   https://professeurs.uqam.ca/professeur/dupuis-deri.francis Anastasia Powell — RMIT University   https://www.rmit.edu.au/profiles/p/anastasia-powell Other: The term enrobage naïf (or naïf enrobage, as said) refers to a veneer of naivety; in this case, a problematic discourse wrapped in innocent or everyday cultural forms, akin to a wolf in sheep’s clothing.

Notes:Dr Bekkers describes his academic pathway from psychology to criminology and explains why his research focus has consistently been on offenders and their behaviour rather than on offences or technologies.Cybercrime offenders are often portrayed as a homogeneous group of highly skilled hackers, but research shows they are a heterogeneous population with distinct motivations, skills, and pathways into crime.A key distinction can be made between financially motivated cybercrime, such as online fraud, and more technically complex cyber-dependent crimes such as hacking, DDoS attacks, and website defacement.Financially motivated cybercrime offenders often resemble traditional offline offenders and may commit both online and offline crimes, with similar risk factors, peer influences, and personality profiles.Technically skilled cyber offenders tend to show different characteristics, including higher levels of self-control and intrinsic motivations such as curiosity, challenge, and skill development.Research suggests that traditional criminological theories still help explain some forms of cybercrime, particularly financially motivated offences, while other forms require additional or adapted theoretical approaches.Gaming environments may act as pathways into certain forms of cybercrime by facilitating skill development, exposure to deviant peers, and access to illicit online forums, though gaming may also be protective in some contexts.Parental supervision and open communication may play a role in shaping online behaviour, similar to the role of guardianship and social control in offline offending.Law enforcement responses differ depending on the type of cybercrime, with financially motivated offences often handled by local police and more technical crimes investigated by specialized units.Dr Bekkers highlights the need for longitudinal research and greater engagement with offenders to better understand pathways into cybercrime and to inform prevention and intervention strategies.About our guest:Dr Luuk Bekkers https://www.thuas.com/research/research-groups/team-cybercrime-cybersecurity https://www.linkedin.com/in/luuk-bekkers-79621b162/ Papers or resources mentioned in this episode:Bekkers, L. M. J., Moneva, A., & Leukfeldt, E. R. (2025). Distinct group, distinct traits? A comparison of risk factors across cybercrime offenders, traditional offenders and non-offenders. Psychiatry, Psychology and Law, 1–25. https://doi.org/10.1080/13218719.2025.2546311 Bekkers, L. M., Holt, T. J., & Leukfeldt, E. R. (2025). The psychological correlates of cybercrime offending: Exploring the self-control/social learning relationship in serious cyber-dependent crime. European Journal of Criminology, 0(0). https://doi.org/10.1177/14773708251378356 Bekkers, L. M. J., Holt, T. J., & Leukfeldt, E. R. (2025). Exploring the factors that differentiate individual and group offenders in cyber-dependent crime. Journal of Criminal Justice, 101, 102522. https://doi.org/10.1016/j.jcrimjus.2025.102522

Notes:Julia Prümmer describes her transition from legal psychology into cybersecurity research and how psychological methods shape her approach to cybersecurity training.The discussion explores the role of systematic reviews in mapping what a research field actually knows, rather than relying on highly visible or frequently cited studies.Findings from a large-scale systematic review of cybersecurity training methods are discussed, highlighting the diversity of training approaches used across the literature.The episode examines results from a meta-analysis assessing the overall effectiveness of cybersecurity training and the gap between improvements in precursors such as knowledge and intentions versus observable behaviour.Julia explains why many cybersecurity training programmes lack explicit behavioural theory and rely on trial-and-error design choices.A key theme is the distinction between cybersecurity behaviours that require active engagement, such as phishing detection, and behaviours that may benefit from habit formation, such as screen locking or password management.The conversation draws on research into email habits and phishing susceptibility to illustrate how habitual behaviour can increase vulnerability in certain contexts.Julia discusses the use of psychological theory, including habit formation and implementation intentions, to design and evaluate cybersecurity training interventions.The episode concludes with reflections on the future of cybersecurity training research and the need for behaviour-specific, theory-informed models.About our Guest:Julia Prümmer https://www.universiteitleiden.nl/medewerkers/julia-prummer#tab-1 https://www.linkedin.com/in/julia-prümmer-376778159/ Papers or resources mentioned in this episode Prümmer, J., van Steen, T., & van den Berg, B. (2024). A systematic review of current cybersecurity training methods. Computers & Security, 136, 103585. https://doi.org/10.1016/j.cose.2023.103585 Prümmer, J. (2024). The role of cognition in developing successful cybersecurity training programs: Passive vs. active engagement. In D. D. Schmorrow & C. M. Fidopiastis (Eds.), Augmented cognition. HCII 2024 (Lecture Notes in Computer Science, Vol. 14695, pp. 185–199). Springer. https://scholarlypublications.universiteitleiden.nl/handle/1887/4093101 Prümmer, J., van Steen, T., & van den Berg, B. (2025). Assessing the effect of cybersecurity training on end-users: A meta-analysis. Computers & Security, 150, 104206. https://doi.org/10.1016/j.cose.2024.104206 Vishwanath, A. (2015). Examining the distinct antecedents of e-mail habits and its influence on the outcomes of a phishing attack. Journal of Computer-Mediated Communication, 20(5), 570–584. https://doi.org/10.1111/jcc4.12126 Other If this topic of training as an intervention to reduce susceptibility to cybercrime, you might also enjoy the recent Episodes 123, 116, 110, 106, 60, and 59 that are all on related topics. If you are brave you can even go right back to Episodes 6, 7 and 8, there is a lot to listen to.

otes: Melissa completed her PhD after two decades of operational work, bringing a pracademic perspective to cyber profiling and offender pathways. Her research focuses on understanding the human behind the keyboard through developmental history, motivation and lived experience. Initial motivations among hackers often centre on curiosity, challenge seeking and belonging rather than financial gain. Many participants reported early interest in technology, solitary online activity and experiences they described as destabilising events. Melissa distinguishes between lawful and criminal pathways using indicators such as modifying games, low self-control and a history of property offending. Her work highlights misunderstandings about intent, the role of gamification and the abstraction of harm when offending takes place online. She argues that cybercrime is a societal problem requiring early education, parental and teacher capability building and partnerships with tech and gaming companies. Diversion programs are essential to guide youth with technical interest toward prosocial cybersecurity roles rather than criminalisation. About our guest: Dr Melissa Martineau https://www.linkedin.com/in/melissa-martineau-369bb5258/ https://www.captechu.edu/webinar-series-melissa-martineau Papers or resources mentioned in this episode: Martineau, M. (2023). The pathways of cyber dependent offenders. Journal of Cybercriminology, 3(3), 32. https://www.mdpi.com/2673-6756/3/3/32 Martineau, M. (2024). Distinguishing lawful and criminal hacker trajectories. Journal of Cybercriminology, 4(4), 45. https://www.mdpi.com/2673-6756/4/4/45 Other: Dr Martineau wanted to share something called PRISMA (Preferred Reporting Items for Systematic reviews and Meta-Analyses) which is a helpful guideline designed to improve the reporting of systematic reviews. You can find out more about it here.    http://www.prisma-statement.org

Episode Notes: Dr Ho describes an empirical research agenda focused on how security actually operates in organisations. He explains his experience with getting this research off the ground to allow them to perform the research in this setting.Study setting and scope: eight-month randomised controlled trial at UC San Diego Health involving ~19,500 employees and ten distinct phishing campaign lures.Annual awareness training: the study found no significant relationship between how recently staff completed the mandated course and their likelihood of failing a simulated phishing campaign.Embedded training (when someone clicks a phishing simulation and is immediately redirected to training): the measurable improvement was very small (≈2% reduction in failure rate) and varied significantly by lure and engagement.Engagement challenge: The vast majority of embedded-training sessions were extremely short or incomplete, a key factor in explaining limited effect size.Variability of lure difficulty: Some phishing lures elicited very low click-rates (~1.8%) while others up to ~30.8%, indicating that the phishing stimulus matters as much as, or more than, the training intervention.Practical takeaway: Organizations should treat training (especially annually mandated modules) as only one part of a broader defence strategy, and design empirical measurement systems (including controls, realistic lures, and sustained engagement) before assuming large effect sizes. About our Guest: Dr Grant Ho Profile: https://cs.uchicago.edu/people/grant-ho/ Papers or resources mentioned in this episode: Ho, G.; Mirian, A.; Luo, E.; Tong, K.; Lee, E.; Liu, L.; Longhurst, C.A.; Dameff, C.; Voelker, G.M. (2025). Understanding the Efficacy of Phishing Training in Practice: A Randomized Controlled Trial at a Large Health Organisation. Presented at the IEEE Symposium on Security & Privacy (May 2025). Full PDF: https://people.cs.uchicago.edu/~grantho/papers/oakland2025_phishing-training.pdf Other:  I mentioned some figures about the spending on cybercsecurity education and training, You can find those here.   Canadian Survey of Cyber Security and Cybercrime (CSCSC) https://www23.statcan.gc.ca/imdb/p2SV.pl?Function=getSurvey&SDDS=5244 Get convenient Excel Tables of the Statistics from 2017 and 2019.  https://www.serene-risc.ca/en/statistics-canada Other Other: Dr Ho was great to chat with and has a long history of researching phishing, Some of his older work that is more technical in nature, as so we didn't talk about in the episode, but in the case that it  might be interesting to you, here are some links:  Ho, G., Sharma, A., Javed, M., Paxson, V., & Wagner, D. (2017). Detecting Credential Spearphishing Attacks in Enterprise Settings. In Proceedings of the 26th USENIX Security Symposium (USENIX Security ’17), Vancouver, BC, Canada, August 16-18, 2017. USENIX Association. ISBN 978-1-931971-40-9. PDF: https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-ho.pdf USENIX+2USENIX+2 Presentation page: https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/hoUSENIX+1 Ho, G., Cidon, A., Gavish, L., Schweighauser, M., Paxson, V., Savage, S., Voelker, G. M., & Wagner, D. (2019). Detecting and Characterizing Lateral Phishing at Scale. In Proceedings of the 28th USENIX Security Symposium (USENIX Security ’19), Santa Clara, CA, USA, August 14-16, 2019. USENIX Association. ISBN 978-1-939133-06-9. PDF: https://www.usenix.org/system/files/sec19-ho.pdf USENIX+1 Presentation page: https://www.usenix.org/conference/usenixsecurity19/presentation/ho USENIX

Trigger warning: This episode includes discussion of suicide in the context of researching measurable predictive indicators and the lack thereof in the context of cyber.  Episode Notes Dr Caputo's path from social psychology to applied security, including intelligence analysis and building a behavioural-science team at MITRE.What MITRE is: a not-for-profit operating six federally funded R&D centres that provide independent, public-interest research alongside government.Why early “indicator” hunting on endpoints often chased the last bad case; shifting to experiments and known-bad/created-bad data to learn patterns of behaviour change.The LinkedIn recruiter field experiment: ethically approved creation of recruiter personas, staged outreach in three messages, and follow-up interviews to understand reporting barriers.What user-activity monitoring can and cannot tell you; the role of human judgement and programme design.Insider-risk is not only “malicious users”: designing programmes for negligent, mistaken or outsmarted behaviours as well.Current lines of work include improving employee recognition and reporting of malicious elicitations and exploring whether insider-risk telemetry offers early signals of suicide risk.Why multidisciplinary teams beat solo efforts in insider-risk operations.About our guest: Dr. Deanna D. Caputo   MITRE Insider Threat Research & Solutions profile: https://insiderthreat.mitre.org/dr-caputo/  LinkedIn: https://www.linkedin.com/in/dr-deanna-d-caputo Papers or resources mentioned in this episode: Caputo, D. D. (2024). Employee risk recognition and reporting of malicious elicitations: Longitudinal improvement with new skills-based training. Frontiers in Psychology. https://www.frontiersin.org/journals/psychology/articles/10.3389/fpsyg.2024.1410426/full  MITRE Insider Threat Research & Solutions. (2025). Suicide risk and insider-risk telemetry overview. https://insiderthreat.mitre.org/suicide-risk/  MITRE. (2024). Managing insider threats is a team sport. https://www.mitre.org/news-insights/impact-story/managing-insider-threats-team-sport  MITRE Insider Threat Research & Solutions. (2024). Capability overview two-pager (PDF). https://insiderthreat.mitre.org/wp-content/uploads/2024/06/MITREInTResearchSolutions-CapabilityTwoPager-24-0659_2024-02-01.pdf  MITRE Insider Threat Research & Solutions. (2024). Insider Threat Behavioural Risk Framework two-pager (PDF). https://insiderthreat.mitre.org/wp-content/uploads/2024/06/MITREInTResearchSolutions-InTFramework_TwoPager-24-0674_2024-03-18.pdf

Show Notes: Daniëlle began her academic path in psychology, later moving into criminology through her interest in decision making and online behaviour.Her PhD research at NSCR focuses on cybercriminal decision making, using honeypots and experiments in real online environments.Early experiments tested how different rewards affected access attempts on fake accounts.A major focus has been on the impact of Operation Cookie Monster (2023), which disrupted the Genesis Market. Danielle’s work examined how this law enforcement operation influenced behaviour and moderation practices on hacker forums.She emphasizes the value of experiments in the field, which allow researchers to test criminological theories with live offender behaviour, while balancing strict ethical and legal safeguards.About our guest: Danielle Stibbe NSCR Profile Page: https://nscr.nl/en/medewerker/danielle-stibbe-msc/Google Scholar: https://scholar.google.com/citations?user=1fsHJEgAAAAJ&hl=enLinkedIn: https://www.linkedin.com/in/danielle-stibbe/?originalSubdomain=nlPapers or resources mentioned in this episode: Onaolapo, J., Mariconti, E., & Stringhini, G. (2016). What happens after you are pwnd: Understanding the use of leaked webmail credentials in the wild. Proceedings of the 2016 Internet Measurement Conference. https://doi.org/10.1145/2987443.2987475Europol (2023). Operation Cookie Monster: Genesis Market taken down in coordinated international action.https://www.europol.europa.eu/media-press/newsroom/news/operation-cookie-monster-genesis-market-taken-down-in-coordinated-international-actionOxford Handbook of Criminal Decision Making (2016). Eds. Bruinsma & Weisburd. Oxford University Press.Other: The open science framework https://osf.io

Episode NotesAbout our guest:Dr. Francesco Carlo Campisi PhD in Criminology, Université de Montréal Researcher, International Centre for Comparative Criminology 🔗 https://www.cicc-iccc.org/fr/personnes/etudiants-supervises/carlo-campisi 🔗 https://www.linkedin.com/in/francesco-carlo-campisi-aa3576125/ Topics discussed in this episode:From street gangs to digital deviance: a research trajectoryWhy “recruitment” doesn’t fit how modern movements growHow groups like QAnon and Anonymous influence participation onlineUsing social media metrics to measure engagementEmotional capital, visibility, and symbolic participationUpdating resource mobilization theory for digital contextsHashtag hijacking and online visibility strategiesStochastic terrorism and the challenge of lone-wolf violencePapers or resources mentioned in this episode:Campisi, F. (2024). Unveiling the digital underworld – Exploring cyberbanging and recruitment of Canadian street gang members on social media. Canadian Journal of Criminology and Criminal Justice, 66. https://doi.org/10.3138/cjccj-2023-0033Campisi, F., Fortin, F., & Néron, M.-E. (2022). Hacktivists from the inside: Collective identity, target selection and tactical use of media during the Quebec Maple Spring protests. Presented at the ICCC Symposium. Available on ResearchGateCampisi, F., & Beauregard, E. (2025). QAnon’s use of hashtag hijacking on X and its impact on online engagement. SSRN preprint. LinkMcCarthy, J. D., & Zald, M. N. (1977). Resource mobilization and social movements: A partial theory. American Journal of Sociology, 82(6), 1212–1241.Vigil, J. D. (1988). Barrio gangs: Street life and identity in Southern California. University of Texas Press. https://www.ojp.gov/ncjrs/virtual-library/abstracts/barrio-gangs-street-life-and-identity-southern-california-0Other: If you are curious about the video that was taken down, you should watch this video. https://www.youtube.com/watch?v=PIyrzMThHq8