The New Economics of Cybercrime

The biggest shift in the past decade is that it has gotten much less profitable to do what Gonzalez did—namely, steal millions of payment-card numbers and sell them to fraudsters. According to the cybersecurity firm Intel Security, the price of a stolen payment-card record has dropped from $25 in 2011 to $6 in 2016.

“We’re living through an historic glut of stolen data,” explains Brian Krebs, who writes the blog Krebs on Security. “More supply drives the price way down, and there’s so much data for sale, we’re sort of having a shortage of buyers at this point.”

Cybersecurity is often framed as a matter of keeping up with the rapid evolution of online attacks—patching software vulnerabilities and identifying new malware programs. But cybercriminals’ most crucial adaptation in recent years has little to do with their technical tools and everything to do with their business model: They have started selling stolen data back to its original owners.

To keep cybercrime profitable, criminals needed to find a new cohort of potential buyers, and they did: all of us. At the heart of this new business model for cybercrime is the fact that individuals and businesses, not retailers and banks, are the ones footing the bill for data breaches.

This represents quite a departure from the model for most cybercrimes 10—or even five—years ago. It used to be that someone would steal a huge cache of stored data, usually credit-card numbers and billing information belonging to U.S. customers, and sell this data to other criminals, who would use it to manufacture fraudulent credit cards overseas. Those cards would then have to be brought back to the U.S. to be sold, in order to avoid triggering fraud alerts.

Each stage of this process provided law enforcement with an opportunity to track the payments made between buyers and sellers of stolen information and monitor the movement of money between national borders. (Following this money trail ultimately led to the identification and prosecution of several cybercriminals, including Gonzalez.)

So, historically, the riskiest stages of cybercrimes have been the ones that come after the perpetrator has already successfully stolen data from a protected computer. Finding a way into a computer system to steal data is relatively easy, but finding a way to monetize that data—making sure that credit-card companies don’t cancel stolen card numbers before they’re sold, identifying buyers willing to pay a good price, and hiding those profits from the police—can be much harder.

But the calculus changes if victims can be persuaded to buy back their own data, in some cases because of a ransomware attack, which encrypts their computers until they pay a ransom. In other cases, some individuals and companies monitor the black market to see if their own stolen data is up for sale, and purchase it to prevent it from falling into the wrong hands. Whether victims are coerced into paying a ransom or voluntarily make a bid, the sale of stolen data back to its original owner solves a pressing problem for cybercriminals: It transforms data that was nearly worthless into a very valuable asset.

The contents of any given person’s hard drive, for instance, would be unlikely to fetch a large sum on the black market. But to that person, that data is probably worth at least a few hundred (or even a few thousand) dollars. Conveniently for criminals, this also often means dealing not with a small group of fellow criminals, but instead with a much larger population of lay users who are unlikely to disappear behind bars.

All this explains why the use of ransomware is increasingly common. The FBI reported some 2,500 incidents in 2015, from which individuals and organizations lost $1.6 million. It’s not known how much money in total is spent by companies and organizations to directly purchase stolen data or intellectual property, but such stories are increasingly common (even if few major companies,other than PayPal, openly admit to the practice).

Rodney Joffe, a senior vice president at the technology firm and domain-name registry Neustar, says he knows of individual organizations that have paid tens of thousands of dollars to criminals for stolen data.

“What would shock you is how many companies have quietly gone ahead and paid for information to be returned,” Joffe says. “It’s not the kind of thing they publicize.”

Indeed, deciding whether or not to pay for access to stolen data is complicated by the possibility of dealing with a dishonest seller.

“If you pay there’s no guarantee that you will get the actual decryption key,” says Chris Stangl, a section chief at the FBI's Cyber Division. “The latest trend we’re seeing is a company will attempt to negotiate with the criminal and then they pay and the next day the criminals want more money.”

So, just like sellers in legal marketplaces such as Amazon and eBay, sellers of stolen information are now focusing on their online reputations, which can signal to victims that they are “trustworthy” criminals, Krebs says.

“Thieves at the end of the day are dependent on their reputation in the underground, and if they have a reputation for ripping people off then they won’t get customers,” he explains. Recently, as more criminals have entered the market, “Good criminals’ reputations are being ruined by bad criminals,” Joffe says.

Regardless of what individuals and organizations should do when presented with the opportunity to buy stolen data, what are they legally allowed to do? The guidance from law enforcement on whether victims should pay ransoms or directly purchase stolen data remains ambiguous.

Last year, Joseph Bonavolonta, an FBI agent, stirred controversy when he spoke at a security conference in Boston and told the audience, “We often advise people just to pay the ransom.”

But Stangl, of the FBI’s Cyber Division, tells me that “the FBI doesn’t condone payment because payment in our view allows for that criminal model to develop and may allow the activity to continue.” Still, he adds, “We do recognize that companies need to make informed decisions and … sometimes you have to pay to get access to your data back.”

The Jusitce Department has no position on whether or not buying back stolen data is legal, according to a spokesperson. However, John Delmore, an assistant general counsel at the FBI’s Cyber Law Unit, says that “in the vast majority of situations, you would not be breaking the law when you do that, and it’s certainly not something the FBI would pursue in an investigation.” (He says that an exception to this could be any transaction involving a terrorist group.)

The reluctance of law-enforcement agencies to take a clear stance is surprising.

“In the physical world, you have law enforcement coming out against paying ransom for hostages, but in this case we’ve seen law-enforcement agencies not only recommend it but actually paying it themselves,” Alperovitch says, referring to incidents in which police departments have paid bitcoin ransoms to recover control of their systems. “The problem you have here is that literally everyone is experiencing this problem. No one is immune. Luckily, hostage-taking is a pretty rare activity in our society, so it’s easy to recommend not paying a ransom when they know they’re not likely to experience that issue themselves.”

Trusting criminals to do right by victims is a treacherous business, but for now, it seems, enough of them will keep their word if paid. And as long as those payments keep coming in, this new business model is likely to remain effective. Possibly the only way, short of a global crackdown on cryptocurrency exchanges, to put a real dent in the profits of cybercriminals is to organize a concentrated campaign to stop people from paying. But it’s hard to see such a campaign gaining much traction, given how valuable targeted systems tend to be.

“I don’t think it’s realistic to encourage people not to pay these ransoms,” Alperovitch says. “How do you tell a hospital that has to keep people alive not to pay the ransom?”