Mapping existing knowledge on online and offline involvement mechanisms and desistance  processes in cybercrime offending

Mapping Existing Knowledge

A systematic narrative review of pathways into, desistance from, and risk factors of financial-economic cyber-enabled crime

Pathways Into, Desistance From, and Risk Factors Related to Cyber-Dependent Crime: A Systematic Narrative Review

We will start by analysing 25 completed interviews by Leukfeldt with self-identified hackers 
over the past few years. These interviews contain valuable data about pathways into cybercrime. 
Subsequent interviews with additional cybercriminals will be undertaken to explore patterns 
identified through the systematic review and expert interviews, providing an insider’s 
perspective on the mechanisms of cybercrime involvement. The research team plans to 
interview around fifteen additional Dutch offenders, comprising five individuals involved in 
cyber-dependent crimes and ten in cyber-enabled financial crimes. These interviews will focus 
on pathways, cybercrime involvement mechanisms and processes of desistance. To facilitate 
this, the interview protocol employed in the previous interviews will be updated and refined. 
The interview process and coding and analysis schemes will be guided by previous research on 
offender interviews, grounded theory and coding methods (Charmaz, 2014; Holt, 2011; 
Hutchings & Holt, 2018; Saldaña, 2021).

A unique perspective: A qualitative analysis of interviews with offenders

Collecting Data from Offenders and Ethical Hackers

In addition to interviews conducted by the research team, a similar interview protocol will be used within the “International Cyber Offender Prevention” (InterCOP) network. The network comprises offender prevention professionals from police forces in over 30 participating countries, with five of these countries serving as co-signers. InterCOP is supported by Europol as part of EMPACT (European Multidisciplinary Platform Against Criminal Threats) (Europol, 2023). The objective is to gain additional insights from cybercriminals in these countries, aligned with the network’s goals of collaboration and knowledge sharing in preventing and disrupting cybercrime. The interview protocol was presented at the InterCOP conference on 11–12 June 2024 (Lyon). Police professionals from each co-signing country, as well as interested parties from other countries, are tasked with conducting at least two interviews or “debriefs” of individuals linked to cybercriminal activity but who are outside the criminal justice system. The expectation is that this minimum requirement of ten debriefs will be met and it is anticipated that more debriefs will be conducted. Emphasis will be placed on strict adherence to the interview protocol, and collaboration with a digital specialist and researcher will be encouraged to ensure effective communication and methodological rigor. The collected data will be anonymized and distributed to the research team for analysis.

Offender debriefs

The fourth study entails a secondary data analysis aimed at discerning socio-psychological factors influencing cybercrime involvement and desistance. The survey data were collected in 2023 from a research panel of a renowned Dutch research agency, resulting in a sample of 1,240 individuals aged 16 to 25. Validated questionnaires and items were utilized, capturing risk and desistance factors commonly observed within forensic populations. The dataset includes measures of involvement in four cyber-dependent and six cyber-enabled financial crimes, as well as intentions to engage in these activities in the future. It encompasses components expected to be associated with cybercrime involvement or desistance, including demographics, criminogenic needs (i.e. antisocial personality patterns, attitudes, peer influence), and cyber-specific factors (i.e. IT-skills, online disinhibition, routine activities, parental supervision).
Beyond shedding light on the risk and desistance factors associated with cybercrime involvement, the dataset enables comparisons between (potential) cyber-enabled crime offenders, (potential) cyber-dependent crime offenders, traditional crime offenders, and non-offenders.

Secondary data analysis: Assessing cybercrime involvement and desistance factors

Online gaming as a criminological environment: exploring criminogenic needs and offending behaviors of gamers

Distinct group, distinct traits? A comparison of risk factors across cybercrime offenders, traditional offenders and non-offenders

Exploring the factors that differentiate individual and group offenders in cyber-dependent crime

Ethical hackers often possess comparable skills and use similar tools as cybercrime offenders, 
sharing potential commonalities in pathways into cybercrime. However, ethical hackers did not 
initiate or ceased engaging in cybercrime, directing their skills toward legal endeavours. This 
presents a valuable opportunity to gain insights into desistance processes. To explore this, we 
plan to conduct interviews with thirty ethical hackers, recruited through the personal networks 
of the research team and employing a snowballing approach. A distinct interview protocol will 
be tailored for this group, while the same methodologies utilized for offender interviews will be 
adopted to ensure consistency and comparability in data collection and analysis.

Analysing the desistance process of ethical hackers

For study 6, we will analyse large-scale police investigations focusing on cyber-enabled financial 
and cyber-dependent crime offenders. We will only select completed cases in which suspects are 
handed over to the public prosecutor. In the expert interviews with practitioners conducted in 
Study 1, besides garnering insights into pathways, we will seek advice on identifying relevant 
investigations from the past five years to delve deeper into the initiation processes, networks, 
ties, and meeting places of cybercriminals. Useful data from these investigations may include 
information obtained through interrogations, intercepted communication (online and telephone 
conversations), information from servers, as well as details from house and computer searches. 
For this study, a variety of analytical approaches will be utilized. We will draw upon the 
framework established by the Dutch Organized Crime Monitor and other previous research 
(Kruisbergen et al., 2018; Leukfeldt, 2016; Leukfeldt & Kleemans, 2021).

 Analysing large-scale police investigations

Breaking the Walls of Silence: Using Criminal Justice System Data

For this study, we will analyse police interrogations with offenders of cyber-dependent and 
cyber-enabled crime, specifically focusing on the social or “person-focused” segments. In the 
social segments, which are integral to every Dutch interrogation, offenders are questioned about 
their background, encompassing aspects such as living and financial situations, education, daily 
activities, and substance use. This part of the interrogations is distinct from the “case part”, 
where offenders are questioned about the committed crime. Nevertheless, elements from both 
segments may hold relevance for this study, as they can both contain personal or social details. 
The insights derived from the interrogations will contribute to a deeper understanding of risk 
and desistance factors, as well as pathways into cybercrime in general. For this study, we will 
select cases of the past five years wherein suspects have been identified and interrogated. The 
cases will be selected from the police systems using queries to select relevant crime types. We 
will draw upon insights from a similar approach employed in a prior study (Leukfeldt & 
Kleemans, 2019).

Analysing police interrogations

We aim to analyse the cybercriminal “career paths” of offenders known to the police in Study 8. 
To accomplish this, we will identify suspects involved in cyber-dependent as well as cyberenabled financial crimes in the preceding year. Subsequently, we will examine all other criminal 
activities associated with these suspects in the years before. By employing this approach, we aim 
to trace career paths across traditional, cyber-enabled and cyber-dependent crime domains. We 
will adopt a quantitative approach to discern patterns. For instance, we will explore whether 
certain traditional offenses serve as predictors for later involvement in cyber-dependent or 
financially motivated cyber-enabled crime. While we acknowledge that police data on suspects 
may not provide a comprehensive overview of offenders’ actual activities, the aggregated data 
will offer valuable insights into broader patterns in cybercriminal career paths. We will use a 
similar approach as studies by Blokland and colleagues (2020), Kleemans and De Poot (2008), 
and Kleemans and Van Koppen (2020), who studied the career paths of people in organized 
crime and outlaw motor cycle gangs.

 Cybercriminal career paths

In addition to data from police systems, we aim to study probation data from Reclassering 
Nederland concerning convicted offenders of traditional, cyber-dependent and cyber-enabled 
financial crimes. We plan to perform a qualitative analysis of their advisory reports, which offer 
recommendations for potential probation supervision trajectories. These reports serve as the 
foundation for such trajectories and inform court decisions (Abraham et al., 2007). They provide 
detailed information on various aspects, including the nature of the committed crime, reasons 
behind it, interpersonal relationships, attitudes, and behaviour. The advisory reports are partly 
based on RISC – a risk assessment and advisory tool to systematically assess risk and desistance 
factors. In addition to analysing the reports, we intend to perform a quantitative analysis of RISC 
data. Through this approach, we will gain insights into risk and desistance factors associated 
with cybercrime, as well as pathways into and out of cybercrime.


 Analysing probation data

Our objective in study 10 is gaining insight into the interests of (aspiring) cybercriminals by 
mapping their actual online behaviour. Firstly, we will achieve this by analysing their web 
searches on mainstream platforms such as Google and YouTube. This involves identifying entrylevel cybercrime-related search terms (e.g. DDoS, hacking, gaming mods) and automatically 
extracting data of these platforms for different search terms at different points in time. Secondly, 
we will compile information about the interests of (aspiring) cybercriminals through qualitative 
analysis where we use similar search terms on platforms such as Reddit, Discord, and 
Hackforums, or other platforms that emerge in the future.

 Mapping cybercrime interests of (aspiring) cybercriminals

Online Interaction and Interests of Cybercriminals

Study 11 focuses on the online interaction of current and potential cybercriminals. In the context 
of open-character groups where cybercriminals operate, researchers and scientific 
organizations can gain insights by scraping these data. This includes data from open groups on 
Telegram, where discussions about cybercrime occur and CaaS is sold, as well as data from 
dedicated cybercrime forums such as Hackforums, Exploit and XSS. Furthermore, the Dutch 
police holds data from illicit online forums used by cybercriminals. Employing thematic analysis 
and social network analysis, our aim is to deepen our understanding of how cybercriminals 
interact in online forums, initiate contact with new collaborators and facilitators, establish trust, 
and form enduring networks. We will seek expert advice to select the most relevant data and 
determine the approach for optimal insights.

Systematic analysis of online interaction between (aspiring) cybercriminals

The aim of study 12 is to raise awareness among individuals with potential interest in 
cybercrime and to cut off their pathways into such criminal activities, while also providing 
information about alternative pathways (e.g., related to cybersecurity). Targeting potential 
cybercrime offenders, we will use mainstream platforms (e.g., Google, Instagram, YouTube, 
Snapchat) to disseminate tailored messages or advertisements. The selection of platforms will 
be based on their prevalence and popularity at the time of this study. The scientific evaluation of 
Google and Instagram ads for similar purposes in previous studies will serve as foundations (e.g. 
Bekkers et al., 2022; Moneva et al., 2023). Additionally, insights gained from prior WPs will be 
incorporated to tailor both content and platforms for these messages. Behavioural theory and 
developments in police practices for offender prevention, such as the current 4D-approach 
(Francis, 2022), will inform the refinement of experiments designed to resonate with our target 
group of (potential) cybercrime offenders.

Online field experiments on mainstream platforms

Online Fields Experiments

For study 13, we will focus on deterring aspiring and actual cyber offenders by deploying honey 
pot banners or messages across cybercrime-related platforms, including hacking forums and 
social media groups (e.g. Telegram) dedicated to cybercrime. The previous studies will serve as 
the foundation for the development of this study. Consequently, the selection of specific 
platforms and design of associated experiments will occur at a later stage. Insights will also be 
drawn from previous research on these kinds of experiments (e.g. Brewer et al., 2019; Maimon 
et al., 2014; Prichard et al., 2022; Vetterl, 2020), as well as police practice. 

Research Outputs

Types of offenders

Cyber-dependent crimes

Cyber-enabled financial crime

Insights & Publications