Organized Crime Research Highlights Number 3

Organized Crime Research Highlights Number 3 PDF Version (223 KB)
Table of contents

How identities are traded online

New methods are suggested to understand and profile cyber-criminals who sell stolen identities.

Stolen personal information is used to facilitate crimes and directly victimize people and organizations. In today's cyber-landscape, criminals who obtain the personal and financial information – through methods from online phishing, to hacking, to sifting through hardcopy refuse – are often not the same people who use the identities for criminal activities. Different criminals and criminal groups specialize in certain criminal tasks, from stealing the identities to turning the illicitly obtained information into funds that appear legitimate. In most cases, elements of stolen identities or financial information, called 'credentials,' are commodities that are exchanged online for goods and services that support this type of criminal activity. These online marketplaces are essentially anonymous and no fees, charges or taxes are levied. They can be located on social networking sites, web sites, secure portals, or internet relay chat (IRC) channels.

This type of crime capitalizes on the weaknesses of the anonymous nature of the Internet, the challenges of policing across borders, and the openness and flexibility of global financial systems.

“Organized crime can target victims anywhere in the world while remaining based in their home countries outside of the reach of western law enforcement.” (33)

The authors of this study examined online spaces where criminal suppliers of 'credentials' take stolen personal and financial information from a number of people or sources and bundle these “products” for wholesale to others who would use the information for criminal purposes. Although this study specifically focused one set of IRC channels where 'credential dealing' took place, the analytic methods employed could be applied to other fora.

The authors made a textual record of the discussions that took place on the IRC channels known to be involved with credential trading. Three kinds of data were taken from these conversations: 1) the user's self-assigned nickname; 2) the time and date of the posting; and 3) the message content. Three types of analysis were then applied to this data: a) term frequency analysis; b) lexical pattern analysis; and c) geographic profiling.

In the 'term frequency analysis' how often certain words in the postings were used was statistically analysed to create a ranked list of what words could predict this type of criminal transaction. The authors believe that an automated program, a 'crawler,' could be designed to “flag web sites, IRC logs or other unstructured text databases which may be related to credential trading” (34). This same technology could conceivably be applied to the analysis of the vast quantity of evidence sometimes collected in investigations of these types of crimes.

The 'lexical pattern analysis' statistical measures were applied to the ranked list of words identified in the 'term frequency analysis' to see what meaningful groups of words were used by the criminals. These were further analysed to automatically identify elements of the conversations useful for further investigative purposes, preventative public education, or threat assessment, such as: names of banks or payment providers, actions supporting the criminal transaction, types of stolen information being traded, targeted countries, and when a crime occurred.

The authors also undertook 'geographic profiling' to try to use software that automatically identified what language was being spoken and mentions of countries to infer where criminals on the list were located. However, they found that more work needs to be done to understand how to apply these types of methods to short texts like those featured in IRC, since their results were very inaccurate. Suggestions for how to build better language classifiers were proposed.

Future research may allow for methods to be developed to be able to “cross-reference named entities in the credential trading world … and cross-reference this with known credential theft attacks” (42); and effectively develop an automated tool to predict a connection between cyber-crime events on the Internet that have been largely anonymous up until now. At the least, these methods may improve the efficiency of manually identifying the features which “could enhance criminal profiling” or investigative methods (42).

Watters, Paul and McCombie, Stephen. “A methodology for analyzing the credential marketplace.” Journal of Money Laundering Control 14, 1 (2011): 32-42.

Differences between organized criminals and other offenders

In Holland, organized crime offenders had more previous convictions for more serious offences than other criminals.

This research involved a systematic comparison between organized crime offenders and general population offenders. Data from the Dutch Organized Crime Monitor for the period of 1994 to 2006 were used, including a total of 746 offenders with known or suspected criminal organization affiliation. In addition, a sample of the same number of general population offenders was used for comparison. The comparison group members had the same age distribution as the organized crime offender group in an effort to control for the influence of age. The prevalence, frequency and seriousness of the prior offending of both groups were examined.

Previous research suggests that organized crime offenders are not convicted for a criminal offence until later in life, in contrast to the majority of offenders, who tend to engage in criminal activities as youth. In the current study, the mean age for first conviction was 24 for organized crime offenders and 24.9 for general offenders. This finding is in contrast to life-course theories of crime which suggest that offenders tend to commit crimes in their youth and stop offending as they age. This finding may be associated with the (older) age distribution of both samples.

The general offender sample included twice as many female members as the organized crime sample (16% vs. 8%, respectively). Both groups were similarly criminally active, and about the same age.

Organized crime offenders tend to commit more serious offences than general offenders, and their first offence tends to also be more serious. The authors examined 'temporary desistance': the halting of criminal activity for a period of time. Organized crime offenders showed less temporary desistance from crime over the study period. General offenders, on the other hand, showed increasingly long periods of desistance from crime over time, which is what would be expected as offenders 'age-out' of crime.

The organized crime sample was punished more severely than the general offender sample: 37% of the organized crime offender sample received a prison sentence compared to only 7% of the general offender sample. Moreover, the prison terms received by the organized crime offender sample were longer (on average 34 months for organized crime offenders versus 8 months for general population). Organized crime offenders tended to spend twice the time in prison as general offenders after their first conviction, which could be related to the more serious nature of their offending.

This research is subject to certain limitations. The differences in the findings of this study from similar previous studies indicate that the construction of comparison groups has an impact on findings. Thus, this information should be used with caution until validated through other research efforts.

van Koppen, M.V., de Poot, C.J., and Blokland, A.A.J. . “Comparing criminal careers of organized crime offenders and general offenders.” European Journal of Criminology 7,5 (2010):356-374.

White-collar crime and the global financial meltdown

The 'trivialization of fraud' will persist as long as the existing corporate culture remains entrenched.

The authors contended that a combination of flawed financial policies, lack of regulatory controls, law-breaking, greed, irresponsibility, in addition to outright stupidity contributed to the global financial meltdown of 2008. With increasing use of risky or fraudulent lending practices saturating securities with sub-prime mortgages, this approach was often trivialized by the offending companies as being “due to intricate and arcane business practices” without addressing the criminal components of such actions. The degree to which economic crime contributed to the global financial meltdown is often overlooked.

Considerable attention has been given to the criminality of Madoff's $65 billion Ponzi scheme. However, perpetrators of corporate fraud on Wall Street by financial groups such as American International Group (AIG), Countrywide, Lehman Brothers, and Bear Sterns have received much less attention. Large infusions of US taxpayer money bailed out many of these entities that were holding securities containing sub-prime mortgages in order to contain the fall out effects on the US economy. Since then, AIG as well as a number of US banks such as Citigroup, Bank of America, JP Morgan Chase have been designated as “too big to fail” by the US Government.

Existing global financial challenges are largely based on US home mortgage lending practices, including sub-prime loans, “that were less than prudent, and, at worst, criminally fraudulent” (1). The authors noted that unlike the corporate America of the past that was characterized by “patient wealth,” the new corporate culture aspires to a different wealth, a “psychopathic wealth”.

“The thirst for psychopathic wealth has been manifested both legally and illegally, and it is the illegal aspect that relates to white-collar and corporate crime.” (3)

There continues to be considerable disagreement on the role white-collar crime plays in major financial debacles in the U.S. The authors identify “trivialization of fraud” in academic and government policy circles as leading to its “entrenchment in the corporate culture”. Instead, the authors recommend the use of stricter regulatory enforcement and tougher penalties against white-collar crime that would have averted these financial crises at low cost and avoided the social disorder embodied by the protest movement that formed in response to this situation.

Pontell, Henry N. and Black, William K. “White-collar Criminology and the Occupy Wall Street Movement”. The Criminologist, Vol.37,#1 (January/February 2012):1-6.

Combating transnational environmental crime

Transnational environmental crime is one of the fastest growing areas of criminal activity, globally worth billions to organized crime.

Despite the scale of transnational environmental crime (TEC), the author states that environmental crime “relies on individual states to implement national legislation and actively enforce against environmentally criminal behaviours as they occur within their borders” (334). An extensive study into the prosecution of TEC cases in the national courts of EU member states found a “relatively low number of cases compared to other classical segments of organized crime” (334). Only 122 cases were identified between 1992 and 2003, where the penalties were “often inadequate to deter re-offending or disrupt established criminal networks in any meaningful way” (334) since environmental laws tend to be “marred by loopholes” (335), as well as a lack of capacity for enforcement.

The author identifies a number of similarities and differences between TEC to transnational organized crime (TOC). For example, environmental crime is often transnational in nature and occurs whenever there is a movement of illegal goods across national borders or where the effects of the crime are transboundary in nature. There are more similarities between TEC and TOC: the crimes are global, operating across 'porous' borders; they are conducted as a business, meeting a demand with an illegal supply; and this demand originates in the Global North, while supply from the Global South, just as with the trade in drugs and people.

One important way that TEC differs from many forms of TOC is that the illicit market usually operates in parallel with a licit market. This contrasts with the traditional TOC paradigm, where there is a total prohibition on the product or activity in question. For example, whereas drugs and trafficking in persons are prohibited and criminalized, certain wildlife species under the Convention in International Trade of Endangered Species (CITES) may only be criminalized if originating in certain countries, or illegally logged timber may come from a supplier that also logs timber legally. Presence of a licit market makes it particularly difficult for those responsible for environmental protection or enforcement to know whether what they are confronted with is legal or not. For example, different types of “sawn wood and fish fillets appear very similar to the untrained eye” (337) since there are a number of species of similar appearance. Moreover, the shipper could claim that the illegally caught animals have been bred in captivity. Similarly, illegally harvested logs are included with products produced legitimately, and illegal waste can be disposed of alongside legally disposed waste.

There is a perception that the effects of TEC are victimless. Victims, however, are often not aware that they are victims. For example, the local community may not be aware of the harvesting of unsustainable levels of a resource or may welcome the importation of the waste, without realizing the associated hazards until problems later arise. There may not be an obvious victim in accordance with the usual perpetrator-victim model that police tend to prioritize for enforcement.

The impacts of TEC differ significantly from that of traditional TOCs. Effects of TEC are often definitive, long lasting, and even permanent. For example, there is a potentially unlimited supply of narcotics, while there are a finite number of individuals in the population of an endangered species that is going extinct.

A precondition of effective policing is that those who enforce the law must see [transnational environmental crime] as a serious issue. (345)

The author recommends that policing efforts must be tailored to meet the unique nature of TEC.  The author suggests that demand and supply reduction measures aimed at preventing environmental crimes need to be implemented and strongly supported.

Wright, Glen. “Conceptualising and combating transnational environmental crime”. Trends Organized Crime, #14: (2011) p-p 332-346.

Co-offending between criminal enterprise groups

Attempts to classify criminal enterprise groups based on ethnicity and other visual identifiers could be misleading.

The authors investigated co-offending among criminal enterprise groups using social network analysis (SNA). By reviewing the literature, the authors defined the structure and composition of co-offending among types of criminal enterprise groups. A systematic assessment of the nature of the group co-offending in illicit markets was completed by applying SNA to data drawn from multiple police data systems (e.g., arrest and incident reports, completed police investigations). Using this multi-system approach, the authors were able to identify cross-group interactions.

Previous research on co-offending in criminal enterprise focused on 'individuals' who belonged to a criminal enterprise group, committing crimes with one another. A growing body of research found there is some stability in co-offending relationships based on pre-existing social relationships. Other research found that familial, ethnic and regional ties played an important role in linking people involved in a diverse set of activities involving small cells engaged in criminal enterprise.

Although 'between-class' co-offending among ethnic groups has been rare, the authors noted that there was sufficient evidence suggesting that groups tended towards opportunity-driven associations by tapping into specific skill sets. The ability of certain crime groups to adapt to changing market conditions was related to their ability to reach beyond the confines of ethnic and kinship ties.

'Functionally-derived' categories of criminal enterprise groups, such as outlaw motorcycle gangs, non-ethnically based street gangs, unclassified groups engaging in a specific market or specializing in a particular crime, are membership-driven and use similar recruitment processes. Their groups are restricted by predefined actions. The authors noted that these individuals were freer to develop side enterprises with non-members. For example, “Hell's Angels groups in Canada were found to have strong connections with other outlaw motorcycle groups and with other organizations at the national and international level. Hell's Angels co-offend with other groups to carry out a variety of different criminal activities.”(116)

The authors examined data from the 2007 'E' Division Provincial Threat Assessment report produced by analysts from the Royal Canadian Mounted Police (RCMP) and the Criminal Intelligence Section of British Columbia, with support from law enforcement agencies located within the Pacific region. The data were drawn from: intelligence reports, crime incidents, interviews with law enforcement personnel and prosecutors, review of wiretap transcripts, and offender interviews. Information was consolidated into narratives that included information about all members of the crime group, co-offending information, their demographic characteristics, description of criminal activity, the role played in the criminal organisation, and associates including legitimate business partners, relatives, friends, and co-offenders. A total of 2,197 individuals linked with criminal enterprise activity were identified in the threat assessment. Networks were generated by extracting all individuals who had co-offending ties with one another, and each criminal enterprise group from the co-offending networks. Co-offending networks were created for each of the 184 criminal enterprise groups of interest (called 'egonets'). The crime group classification was based on ethnic and functional characteristics traditionally used by law enforcement personnel, and included Asian-organized crime, Eastern European-organized crime, Hispanic-organized crime, Indo-Canadian-organized crime, Italian-organized crime, Middle-Eastern-organized crime, outlaw motorcycle gangs, or unclassified (119).

“Co-offending was defined as individuals who commit crimes with one another and measured by joint arrests, and verified using the police record systems.” (117)

The authors also extracted data to minimize skewing of the results towards very dense, small networks, and to maintain the quality of variances. The analyses were based on the remaining 107 groups. The authors eliminated groups with less than two alters, which are groups and individuals not formally associated with a group to whom the egonets were connected. As a result, the network composition statistics were marginally biased towards greater group diversity.

The authors found that ethnically defined criminal enterprise groups tended to include more brokers. This meant that their network structure tended to be more chain-like, which is easier to disrupt. A considerable number of co-offenders who were unclassified suggested that there was potential that ethnic lines were no longer functioning as boundaries for many criminal enterprises in British Columbia. Criminal enterprises based upon a functional classification had produced networks showing greater resiliency. This might have been in part due to a real difference between crime groups, or due to a greater ease in identifying group numbers.

Malm, Aili, Bichler, Gisela and Nash, Rebecca. “Co-offending between criminal enterprise groups.” Global Crime, 12:2, (2011):112-128.

Using math to estimate the gang affiliation of people who shoot rival gang members

An advanced algorithm can successfully estimate the top three most likely gang rivalries 80% of the time.

Unfortunately, in gang rivalries, lethal violence can often feature prominently and can sometimes victimize innocent bystanders. The victims of the most serious gang violence are often members of other gangs. Victims and associates of victims of this type of gang violence rarely cooperate with police, which makes solving the crime or preventing retaliatory violence difficult. Quickly knowing who might be responsible for these types of crimes could assist in police investigation and the maintenance of public security.

The prediction of missing information is important in social science research, particularly in analyses of the social networks of gang offenders. Typically, information that is missing from a social network is replaced with plausible estimates using known information or examples drawn from ideal situations of the same type. Such methods, however, cannot speak to networks that change over time. The methods used by the authors of this study can avoid some of these pitfalls.

This research involved the prediction of unknown participation in events using data on a network of gangs in Los Angeles. The social network data included information on 29 offenders, as well as some information on the rivalries between offenders (e.g., events such as murders and shots fired). For a large fraction of the rivalries only the victim's gang affiliation was known.

The researchers assumed that retaliatory gang violence in connected gang networks follows a 'Hawkes process.' A Hawkes process is commonly used to model earthquakes in seismology; basically, “each event generates a sequence of offspring or repeat events, which leads to temporal clustering” (3). In the context of gang violence, each attack against a gang generates waves of retaliatory violence, which are grouped predictably in time.

The result of applying this 'earthquake math' to gang violence is significantly better than random guessing. Various versions of the method were tested and in some cases predicted the correct participants with a very high likelihood.

This research is subject to some limitations. The social network of Los Angeles gangs was not a complete dataset and some data had to be estimated in order to undertake the analyses.

Stomakhin, A, Short, M., and Bertozzi, A. “Reconstruction of Missing Data in Social Networks Based on Temporal Patterns of Interactions.” Inverse Problems 27,11(2011):1-15.

See also: Coren, M. “Fighting Violent Gang Crime With Math.” Fastcoexist. n.d. Web. January 23, 2012. http://www.fastcoexist.com/1679110/fighting-violent-gang-crime-with-math

Comparing the illicit trades in wildlife and drugs

The business of illegal drugs and the illicit trade in wildlife are very similar.

The authors explored the similarities and differences between the illicit wildlife trade in Russia and the illicit drug trade in Western Europe. The illicit wildlife trade is estimated between USD 10 and 20 billion, placing it second to the drug trade in economic magnitude. Estimating the size of the wildlife market is problematic due to a lack of research, data, and a lower priority given to it by law enforcement. On the other hand, the illicit drug market has a tremendous volume of research, data and many documented case studies and meta-analyses.

Data from the wildlife trade was obtained from 21 in-person, semi-structured interviews conducted with experts from governments, non-governmental organizations, and academics in Russia, the United States and Europe, about wildlife trafficking in Russia. Drug trafficking operations data was drawn from fieldwork and a literature review covering the United Kingdom, Western Europe, and the United States.

Both the illicit trade in wildlife and illegal drugs have similar stages. In the illegal drug trade, initial steps involve cultivation or manufacture, and subsequent steps the collection and production of the drug product.

Following the transformation process, the drug is smuggled to its destined market via numerous methods. Unlike the wildlife trade, document counterfeiting cannot transform illegal drugs immediately into seemingly licit commodities that can be smuggled in any form open to inspection. Instead, illegal drugs are disguised and hidden in other containers that would be moved with either fraudulent or legitimate paperwork. In most cases, the drugs were sent through flights using carriers of different origin, besides using the postal courier and cargo services. At the European end of the trail, “large dealers are mixed with all different traders of all sorts of goods”, and this form of “urban bazaar” is reproduced in major cities and ports such as Rotterdam and Amsterdam, London, Hamburg, and Marseilles.

Initial steps in the wildlife trafficking involve the collection or harvesting of the animal or plant – be it alive or killed for further processing into a product or derivative of some sort. Wildlife can be captured by individuals using the same permits multiple times to take more than their licensed amount or captured as part of a more organized criminal enterprise. Following the initial collection, the illicit wildlife enters the smuggling chain to reach the consumer. For some wildlife species, a licit industry exists through which illicit products can be laundered. Illicitly obtained or re-located species are smuggled using forged paperwork, used to make the species or the shipments appear to be legal. Usually, trains or vehicles with hidden compartments are used for hiding wildlife products. Wildlife is also smuggled on planes and boats. For border crossing, the common method of gaining access to transportation is through the “paid corridor,” where guards are bribed to ensure uninhibited access to required spaces and uninspected passage across the borders.

Smuggling operations become more complex when moving live wildlife, where transportation is critical. Consequently, traffickers form criminal networks made up of drivers of cargo transport, personnel of railways (mechanics, drivers, conductors), and airline personnel (crew members and baggage handlers). A variety of perpetrators are involved in the illicit wildlife trade. Smuggling involves hiding the illicit wildlife or wildlife product, forging permits, misusing real permits, or by bribing customs and border officials. Those involved in this step may also be employed in some aspect of the transportation sector.

“Striking parallel between the markets is that close examination shows neither to be dominated by monopolistic families or power figures directing operations in the ways once traditionally assumed to be the natural model for criminal markets.”(551)

The authors introduced a framework of European drug trafficking types: “trading charities” (enterprises involved in drugs due to quasi-ideological commitments to drugs); “mutual societies” (user-dealers supporting each other and selling or exchanging drugs among themselves); “business sideliners” (legally operating economic units distributing drugs as a sideline to their main business); “criminal diversifier” (criminal entrepreneurs engaged in traditional crime by identifying profitable opportunities and responding); and “opportunistic irregulars” (individuals or groups, large or small, from street-level and street-wise operations taking advantage of limited-opening market opportunities).

Applying this framework to the illicit wildlife trade, “trading charities” relate to ideological practitioners of traditional medicines, “mutual societies” include traffickers and traders whose lifestyles revolve around the work as well as wealthy collectors of exotic species, “business sideliners” could include amateur or professional trappers legally trapping fur but taking more than allotted to supplement their earnings, “criminal diversifier” refers to organized crime's role in the black market for large profits and low risk of detection, and “opportunistic irregulars” could be individuals using indiscriminate snares to capture other mammals and accidentally catch an endangered species.

The authors noted that there are several examples of “parallel trafficking” in Europe where “wildlife contraband [was moved] along the same smuggling routes used for other illegal commodities” (555), where wildlife and drugs are frequently moved together. In particular, some “criminal diversifiers” worked in both markets, for instance, using drug trafficking profits to fund illegal logging operations in Central America.

The evolving relationship between the two illicit markets may shift the priority given to illicit wildlife trafficking as the connections between the markets increase and become clearer. This work is an indication that future research on which trafficking types are most likely to lead to hybridization and overlap between criminal markets could be a useful avenue of research to assist with law enforcement priority setting.

South, Nigel and Wyatt, Tanya, “Comparing Illicit Trades in Wildlife and Drugs: An Exploratory Study”, Deviant Behavior, 32:6 (2010):538-561.

For more information on organized crime research at Public Safety Canada, please contact the Organized Crime Research Unit at ps.organizedcrimeresearch-recherchesurlecrimeorganise.sp@canada.ca.

Organized Crime Research Highlights is produced for Public Safety Canada. Organized Crime Research Highlights supports the objectives of the National Research Agenda on Organized Crime by highlighting topical, evidence-based information found in scholarly organized crime articles. The summaries herein reflect interpretations of the report authors' findings and do not necessarily reflect those of the Department of Public Safety Canada.

Date modified: