NESTA Crime Online - University of Brighton Repository

of innovation studies have had little to contribute thus far. 6 In this report we explore
whether innovation perspectives, insights and responses could increase our
understanding of cybercrime and help to tackle it.
1.2 Sources of knowledge of cybercrime
It is often said that what cannot be measured cannot be managed. Despite the
abundance of various types of cybercrime-related statistics, the lack of
consensus on reliable measures and methodologies remains a matter for public
concern.
Figures on the nature, magnitude and impact of credit card fraud and identity theft are
far from straightforward. There have been plenty of recent estimates and forecasts.
However, they employ different methods of data capture and analysis which are not
always clearly explained. As a result, interpretations of statistics vary widely, as do the
assessments of the effectiveness of responses and directions for future prevention. Most
of our interviewees counselled that cybercrime figures need to be taken cautiously. 7
Many organisations regularly estimate the extent of cybercrime, providing data on
security threats, victimisation, financial losses and breaches in confidentiality. Each
organisation includes and excludes different things which make comparisons difficult.
The need for standardised measures has been recognised by both the private sector and
Parliament. 8 However, the shortage of official data and a baseline against which to
6 A notable exception has been the series of reports commissioned by the Foresight programme of the Office of
Science and Technology in 2004 under the banner of the Cyber Trust and Crime Prevention project. See
http://www.foresight.gov.uk/OurWork/CompletedProjects/CyberTrust.
7 For instance Richard Clayton, University of Cambridge, stressed the importance of analysing and
understanding the data in order to design effective solutions for specific cybercriminal activities (such as
phishing) and avoid getting to inadequate conclusions and recommendations. Interview conducted on the 21 st
November 2008. Differences in published data reflect the existing differences in the conception of cybercrime
by the various interested parties or ‘stakeholders’ of criminal activities, namely academic researchers, IT
experts, law enforcement agencies, the financial services industry, retailers and the general public.
8 The House of the Lords Science and Technology Select Committee report on personal Internet security
claimed that “While the incidence and cost of e-crime are known to be huge, no accurate data exist”, and
recommended “[…] that the Government establish a cross-departmental group, bringing in experts from
industry and academia, to develop a more co-ordinated approach to data collection in future. This should
Page 12