Most of us are seeing that the COVID-19 will cause a global recession, but exactly how will this effect cybercrime? Cybercrime and the economy go hand in hand. Will cybercrime increase, and criminals step up their malware production, speed up their phishing attacks? After all they goal is to grab our cash. Or perhaps they’ll slow down malware making and their dodgy dealings?
Cyber recession: setting the scene
When the last recession occurred back in 2009, front and centre for every write up referenced Crime online: cybercrime and illegal innovation put together by a team of researchers from around the world. Likewise, articles written in the last 12 months often link it when talking about the impact of recession on cybercriminal activity, it’s that persuasive.
First off, once you read the article you notice that the paper mentions recession only 3 times. Secondly, out of the 3, 2 times the same sentence appears, saying it was likely “to increase the chances of people moving into cybercrime” at the time of a global recession. Meanwhile, many including The Telegraph, Metro, OneIndia and others use the research paper to focus on the impact of a recession. And that’s a problem. Certainly, it’s like someone saying, “here comes the cybercrime recession, probably.” And it feels more like an opinion rather than research when it talks about recession.
The Past: Making predictions
The paper itself covers a large range of threat developments. These range from credit card fraud, phishing, malware authoring and “value chain analysis. Similarly, they’re all known threats, and all very interesting in and of themselves. However, nothing really answers the question of “recession is going to explode bad activity online and this is- why? For instance, is only states that technology x or people getting better at y would result in probable increases in z. That is to say that, the presumed press release obviously saw the single line about recession and then pinned their entire piece around it. We can’t be sure. But there’s not a lot for them to go on if you look at the paper.
Putting the puzzle together
In truth it’s not just the research paper that has affected the news. In 2009 a panel talked about how a recession produces “more cybercriminals” who then go on to do a lot more cybercrime. It basically assumes that a large proportion of the people hit by a recession will take up cybercrime. In short it says if moneys short, people will need to turn to crime to survive. They will;
- Invest time, electricity and study on a crash course in hacking, malware, phishing, digging around on forums. In the hope they’ll succeed at ripping off someone off online. With absolutely no guarantees or experience. Or
- Go out and steal some food or break into physical objects such as cars?
Most of us would say in hard times people would take option 2. It’s easier!
Wages down, crime up? Not so simple
If a recession comes, will new criminals start appearing? If we draw upon the data for this we see crime rates can actually fall significantly. Importantly, when the economic downturn is keeping people at home, it’s harder for criminals to a commit their crimes.
But we’re in a pandemic and the globe is now staying at home. Will this mean- criminals will need to find a new way to do their crimes? And will their new crimes involve computers or something else?
Driving the direction of technological attacks
Some people consider cybercrime the ideal place to go when taking on a new crime, however the truth is it’s not that straightforward. Importantly, in economic stable periods online crime as a rule operates in fluctuations based on threat campaigns as opposed to some sort of wholesale digital rush to do something differently.
Cybercriminals of late have decreased their consumer onslaught preferring to target business with the good stuff being locked away behind corporate firewalls. Subsequently, with COVID-19 and many people forced to work from home, we’ll expect to see these cybercriminals change their tactics. In other words, they’ll start trying to tap into our home computers or our work computers on our home network.
Here comes the massive caveat:
Looking a little closer, we see that for every article that says “crime goes down during a recession” there’s another claiming the opposite. For instance, if you do some research of your own on google and browse through the pieces, you’ll end up confused.
For anyone trying to discover the cybercrime/recession link it’s proving difficult as there’s a significant shift in the data analysis. That’s to say even the non-cybercriminal data seems to have a hard time being piled up one way or another. It all depends on which data is used and who is doing the reporting. And if we’re comparing the infection rate or attack numbers of the past. Is it even possible to use data from over 10 years ago? Technology has moved so fast in that time.
Playing the numbers
The cybercrime tactics of last year are even outdated, never mind those campaigns of 10 years ago. Everything could be potentially different from;
- Types of infections
- Spreading techniques
- Operating systems
- Security tools
- Data collection tools used by vendors and governments
- Sophistication
However, we can’t dismiss all the information, there are still some interesting titbits underneath it all. A UKGov hosted cybercrime report from 2013 regarding the 2009 financial crisis reports that internet fraud lowered around the time of the year-long recession. Higher figures were shown before and after, however it depends on the type of attack.
For example, according to the UK report a partial estimate of “internet enabled card-not-present fraud” (bit of a mouthful!) was at around £131 million loss costs recorded in 2010, starting off at a peak of about £181 million in 2008. On the other hand, online banking fraud hit a peak of £59.7 million in 2009, before collapsing to £39.6 million by 2012. And then, Financial Fraud Action stands at “just” 50k phish banking phishes in 2009 and 256k by 2012. So, we can see the difference, it seems to reduce in 2009, even though the online banking fraud is higher.
The malware explosion of 2012 onwards
The numbers are not easy to find as malware development begins with 2011. However a full AV Test chart in this 2015/16 PDF document contains the numbers from 2005 at 1.7 million a huge 578 million in 2016. The figures increase year to year from 2007 onwards, in the amounts of 10 to 20 million. 2009 hasn’t anything unusual when compared to the years. Moreover, we see that the numbers in 2012/13 begin to blow out. In terms of security in 2009 had a prevalence of worms; Sality, Conficker, and others.
Another AV Test report (2017/18) is also very illuminating. Similarly, it shows how 2012 is the year where cybercrime goes into overdrive. Whereas 2009 hasn’t anything worth noting.
Meanwhile, different types of fraud did receivea boost. For example internet fraud losses were up to the tune of 33% in 2008. So, it’s fair to say some types of crime go up while other go down. And that’s to be expected.
Present: The cybers will get us
Interestingly, we hear talk of cybercrime being the cause of a possible recession. Back in 2018, the fear of a massive attack on banking systems worldwide was publicised as the way in which we’d end up in a recession. And in this way;
- Rogue state, nation or a person with equivalent resources, will somehow causes a massive “cashout strike. This is where a huge wave of fraudulent withdrawals happens at the same time and on such a grand scale that the banks all fall over. Movie-like.
- A teenage computer wizz does…something…extraordinarily malicious and everything breaks. Perhaps even more movie-like?
The report says itself that when network functionality is restored, the banks will return to normal, even if some what lighter. Could it potentially bring a nation to its knees?
Last year, in 2019 there was also another prediction related to the cyber related recession. Likewise there was going to be some sort of undefined bank exploit / attack to crash our economies. The writer starts of by saying, “I predict a recession within 2 years and I don’t need to have a formal qualification in finance or economics to see the signs around me.” He was correct, but it’s not happening because of cybercrime.
(Potential) future: 2020 and beyond
The reality of the situation is that we’re facing the next recession not due to cybercrime but the coronavirus pandemic. In other words, the current financial meltdown came hand in hand with a virus of the non-digital kind. The crystal ballers got it wrong this time round.
At the moment concerning health service we hear that ransomware authors claim they won’t target hospitals during the pandemic. Perhaps their scared of the eventual legal fallout they’ll attract in the long run. On the other hand, there’s a bunch of health services under fire from hack attacks during the pandemic. In other words, as said previously some types of attacks go up while others go down. This makes it difficult to make sense of the conflicting data.
Meanwhile, other organisations are experiencing a “five-fold increases” in cyber-attacks. But both Microsoft and NCSC are claiming the overall levels of cyber-crime aren’t going up. And criminals don’t seem to be making anything off the COVID-19 outbreak either.
These pandemic numbers could change dramatically as time goes on. How about the future recession?
My guess is that cyber crimes will continue to expand and contract at its own pace and for its own reason. Rather that due to a recession, as we saw from the report in 2009.
We’re in interesting and unprecedented times for technology, and may need to wait till the smoke clears to judge the next step. Where will it end up. We’ll have to wait and see.
Let’s hope it’s a bit better than what we have right now.
