GENG, Rui-Bin

KIM, Seung Hyun

WANG, Qiu-hong

Institutional Knowledge at Singapore Management University

Singapore Management UniversityInstitutional Knowledge at Singapore Management UniversityResearch Collection School Of Information Systems School of Information Systems11-2019The chilling effect of enforcement of computermisuse: Evidences from online hacker forumsQiu-hong WANGSingapore Management University, qiuhongwang@smu.edu.sgRui-Bin GENGSeung Hyun KIMFollow this and additional works at: https://ink.library.smu.edu.sg/sis_researchPart of the Information Security CommonsThis Conference Paper is brought to you for free and open access by the School of Information Systems at Institutional Knowledge at SingaporeManagement University. It has been accepted for inclusion in Research Collection School Of Information Systems by an authorized administrator ofInstitutional Knowledge at Singapore Management University. For more information, please email libIR@smu.edu.sg.CitationWANG, Qiu-hong; GENG, Rui-Bin; and KIM, Seung Hyun. The chilling effect of enforcement of computer misuse: Evidences fromonline hacker forums. (2019). Cambridge Cybercrime Centre: Fourth Annual Cybercrime Conference, 11 July 2019. Research CollectionSchool Of Information Systems.Available at: https://ink.library.smu.edu.sg/sis_research/4416The Chilling Effect of Enforcement of Computer Misuse: Evidences from Online Hacker Forums Assistant Professor: Qiu-Hong WANGSingapore Management University11 July 2019, CambridgeCo-authors: Rui-Bin Geng, Seung Hyun KimMotivation -- Deterrence’s DifficultyCommitting Offences including Illegal Access/ Interception, Data/System Interference, etc.Production, Distribution and Possession of Computer Misuse Tools with Offensive IntentCriminalize Computer MisuseCriminalize OffencesPerpetration cost advantage:Automation and reachabilityLower knowledge barrier to acquire hacking techniques via online communitiesEnforcement cost disadvantage:Invisibility and anonymityJurisdictional boundaryJudicial determination of CM:the legal system need to take ex-ante adjudication of the malice and severity of hacking tools which may vary with the context where the act will be committed.List of Computer Misuse Act (CMA)Country Law Amendment Australia Criminal Code Act 1995 (Cth) ss 478.3 and 478.4 Croatia New Criminal Law Article 272 Canada Protecting Canadians from Online Crime Act Section 342.2 China Criminal Code Article 285 Colombia Penal Code Act 1273 of 2009 Article 269A-J Ethiopia Telecom Fraud Offence Proclamation Article 3 Fiji Crimes Decree 2009 Article 346 France Monetary and Financial Code Article L163-4 Germany German Criminal Code Acts 202c Italy Penal Code Art 615 Netherlands Dutch Criminal Code Article 350a New Zealand Crimes Amendment Act 2013 (2013 No 27) subsection 1 of 251 Qatar Cybercrime Law (No. 14 of 2014) Article 66 Russia Criminal Code Act 273 and 138.1 Serbia Criminal Code Article 304a Singapore Computer Misuse and Cybersecurity Act Article 10(1) Sweden Criminal Code Article 9b Switzerland Criminal Code Article 143bis United Kingdom Computer Misuse Act (UK) s1, s3, s3A and s3ZA United States Computer Fraud and Abuse Act of 1986 (a)(5)(A)  UK: The Computer Misuse Act 1990: Section 3A: Making, supplying or obtaining articles for use in an offence under Section 1,3 or 3ZAUS: The Computer Fraud and Abuse Act: (a)(5)(A)China: Criminal Code: the Amended Article 285Motivation – Deterrence or Chilling Effect?illegal legalJudicial determination of CM:• Legal system with fallibility and uncertainty• Predict potential cybersecurity risks associated with new technology or new uses of existing technology • Dual use nature of cybersecurity technology: tools for penetration tests; cryptocurrency• Unfalsifiability of security claims • Ten to fifteen thousand proxies in a list [ip:port].• How to change your ip in less then 1 minute• Anonymity complete GUIDE By Theraider & Dangerous R.• Ping Scan Script • My python password finder for any site!• Easily Hackable important Website :)• [The Order] Free Rat Support | Reliable |Quick and Easy | 2+ Years of Experience• Hacking A College• DDoS Service [Cheap] [Powerful]• How to Know when you are infected with RATs or Keyl0ggers.• How to protect your HTML source code• How to stop people from resolving your IP via Skype• Nexus anti-flood 2010 with DDOS protection!Offensive intent Defensive intentNeutral intentCriminalized Prosecution Threat ProtectedMotivation – Concerns on Chilling Effect• Cost of Chilling Effect:• Defamation vs. Free Speech• Government surveillance vs. Privacy• Cybersecurity Offense vs. Defense • Empirical Challenge of Chilling effects• Where to find a control group?• Lack of individual-level data to track a choice between different intents• Globalized activities• Shift in norms• External Shock: CMA enforcement -- the production, distribution, and possession of hacking tools with offensive intent• Context: Publicly accessible online hacker communitiesØWhile the CMA enforcement explicitly imposes legal risk on the communication with offensive intent, would the supposition of this deterrence effect lead to the chilling effect on the sharing with neutral intent or even defensive intent?ØHow would the online social community context reinforce or weaken the effects of CMA enforcement?Research Questions -- Empirical Evidence of Chilling EffectOffensive intent Defensive intentNeutral intentCriminalizedProsecution threatDeterrence Effect? Chilling Effect? Chilling / Substitution Effect?ProtectedResearch Context -- Hacker Forums operated in the surface web• Moral ambiguity leads to the coexistence of black/grey/white hats in online hacker communities, and discussions on offense, defense or neutral-intent techniques with dual use (Thomas 2005)• Dual roles• A stepping stone towards more serious online cyber-attacks (Pastrana et al. 2018)• A school for white hats and grey hats to understand hacking techniques (Kirsch 2014).• Not for the most malicious activities but less determined hackers or the curious (Pastrana et al. 2018)as vantage points for diversified intentsResearch Context -- Chinese Hacker Forums• CMA enforcement -- February 28, 2009, the Amendment of Article 285 in the Criminal Law• Language barrier and Internet access filtering lead to localized subjects and their limited mobility• hackforums.net was not accessible in China• The earliest Chinese dark web was launched in October 2014• Two top forums• Ranked the 2nd and 3rd  (Alexa.comàChinaà Computers/Security à Hacker , April 05, 2017)• 89.4%~92.6% of the users geographically located in China-- The majority of the forum participants are within the jurisdictional scope of the CMA enforcementContext and Data: Author Intent ClassificationManual Labelling • Two human coders after 6 months of training • 25% of leading posts in each year:• Forum A: 38,736 / 165,870• Forum B: 12,093 / 52,154• 50,827 consistently labelled records• inter-rater agreement: 0.87 for Forum A and 0.92 for Forum B Unsupervised Clustering based on semantic cliques precision recall F1irrelevant 0.98 0.99 0.98defensive 0.95 0.94 0.94offensive 0.96 0.93 0.95neutral 0.94 0.90 0.92NLP-CNN modelExploratory knowledge4 word embedding clusters à4 categories of contribution intentsThe training and testing datasets Preliminary Analysis0100200300400500600Jan-04Aug-04Mar-05Oct-05May-06Dec-06Jul-07Feb-08Sep-08Apr-09Nov-09Jun-10Jan-11Aug-11Mar-12Oct-12May-13Dec-13Jul-14Content Volume defensiveoffensiveneutralCMA enforcementBefore EnforcementAfter EnforcementThe number of leading posts 137,718 80,306The number of replies per leading post7.53 10.09% of defensive leading posts 6.62% 12.63%% of offensive leading posts 8.78% 5.84%% of neutral leading posts 3.67% 3.59%% of irrelevant leading posts 80.97% 77.86% Quasi-Difference-In-DifferenceAfterCMAt ´ Offensiveit-0.0248***(0.0002)AfterCMAt ´ Defensiveit0.0262***(0.0002)AfterCMAt ´ Neutralit-0.0273***(0.0002)Adjusted R-squared 0.1038No. of observations 2,826,232A reduced-form regression on the number of posts in different categories {defensive, offensive, neutral, irrelevant} generated by hacker forum user i in month t (Marthews & Tucker 2017)Limitationsq Inflation with many zero observationsq User’s contribution intent decision interdependent within each user q Contribution on security-irrelevant posts is correlated with security-related posts q No way to address forum self-regulation on obviously illegal posts21 1-111exp( ) exp( )1( , )1 exp( ) 1 exp( )1 exp( )lt=---==æ öç ÷æ ö ç ÷= ×ç ÷ ç ÷+ +è ø +ç ÷è øÕå! !! !!ijk ititjA II IJI ijk itijk it JI Ijit itijkjU UL A I eU UUA Mixed Nested Logit ModelEach choice occasion: whether to post and which to post20 1 2 1 2 1 3 14 1 5 1 6 17 1 8 1+ ++ ++ _=b b b d d dd d dd db d- -- - -- -= + + ++++!" ""Aijk ij i k i k j k j ijk j ijkj ijk j k ijk j k ijkj k ijk j ijki ik jU Age Age AfterCMA Experience AttentionPeer AfterCMA Experience AfterCMA AttentionAfterCMA Peer Other PostX WijkRandomized heterogeneity across contributors on preference and life cycleProbability of being removed by forum self-regulationProbability of {Offensive, Neutral, Defensive} postProbability of postDeterrence EffectSubstitution EffectWeakenedWeakenedReinforcedReinforcedReinforcedWeakenedChilling EffectReinforcedReinforcedReinforced• Diminishing marginal perpetration cost• Increasing severity• Increasing enforcement cost• Diminishing marginal utility• Increasing utility• Increasing utility• Increasing probability of erroneous prosecution• Exemplified perceived risk associated with social interaction (Kasperson et al. 1988 )Robustness and Falsification Tests• Subsamples by varying size or varying user activeness• Alternative Models Fitness• Alternative explanations related to • Competing peer forums (impacts on different contribution intent)• 3 major vulnerability disclosure forums • Shifting norms on forum users’ topic preferences• Global or National Google Trends Index of 30 cybersecurity keywords • If the enforcement is assumed six months in advance?• If the enforcement did not occur at all? -0.500.511.5200.020.040.060.08133072093127368346744232649811559576217370484793648523693597100890106460113451120085129582136397142994Substitution effect on defensive contentmarginal effectcoefficient (beta)-1.5-1-0.500.5-0.08-0.06-0.04-0.020Deterrence effect on offensive content0100200300400500600Jan-04Jun-04Nov-04Apr-05Sep-05Feb-06Jul-06Dec-06May-07Oct-07Mar-08Aug-08Jan-09Jun-09Nov-09Apr-10Sep-10Feb-11Jul-11Dec-11May-12Oct-12Mar-13Aug-13Jan-14Jun-14Nov-14Content VolumedefensiveoffensiveneutralA Counterfactual Scenario without CMA EnforcementVarying Sample SizeResearch Implications• Initial empirical evidence of chilling effect of the CMA enforcement• Chilling effect could be strengthened in online communities• Domestic legislation may deter publicly-observable cybercrimes when the illegal activities are localized due to language barrier and internet accessibility control (Png et al. 2008)• Deterrence effect may be weakened due to the diminishing marginal cost associated with experienced perpetrators and the increasing enforcement cost associated with the number of perpetrators (Katyal1997)• Positive substitution effect of domestic enforcement on promoting security defense as a result of the dual use nature of hacking techniques and the contribution incentives on the online social communities (Png et al. 2008)Practical Implications• The balance between deterrence and chilling effects • Cost disadvantage of the traditional security measures, e.g., investment and enforcement in tackling the never-ending cybersecurity risks• The importance of information sharing among the communities consisting of white/grey/black hats• Forum administrators: feasible measures to promote the positive loop for cybersecurity in online hacker forums. • Increase public attention to both offensive posts and defensive posts. (Yue et al. 2019)• Increase the incremental benefit of defensive content contribution

The chilling effect of enforcement of computer misuse: Evidences from online hacker forums

https://ink.library.smu.edu.sg/cgi/viewcontent.cgi?article=5419&amp;context=sis_research

The chilling effect of enforcement of computer misuse: Evidences from online hacker forums

Abstract

Similar works

Full text

Available Versions

Institutional Knowledge at Singapore Management University