NESTA Crime Online - University of Brighton Repository

improvement and the introduction of new processes. 174 As with firms that deploy home-
grown capabilities to create competitive advantage or a market niche, cybercriminals
appear also to have some in-house capabilities to carry out their activities and easy
access to buy in the required capabilities. This may reflect the complete absence of
norms or legislation preventing such change and the eclectic mix of actors involved.
Value chain analysis understands specialisation in a context of ‘systemic
competitiveness’, where individual firms operate in a wider system of suppliers,
customers and competitors. This may be located locally, regionally or internationally.
Within this ‘ecosystem’, the identification of the firm’s distinctive competencies leads the
process of specialisation and determines the behaviour of the individual firm within the
value chain. 175
This is all relevant to cybercrime. The roots of modern cybercrime capability lie in the
work of individual hackers who sought infamy through the disruption of as many PCs as
possible, the benchmark by which they would be judged by peers. The cybercrime
ecosystem has since become the playing field for criminal organisations and organised
criminals who have realised the potential for fraud on the Internet and have made
common cause with hackers reconfiguring their capabilities for their own profit.
Specialisation often implies higher barriers of entry; the higher the barriers, the greater
the profitability. Technical skills, organisational capabilities and levels of risk all limit
those who have the requisite skills, though some of these barriers are introduced by law
enforcement agencies, security firms and software companies.
At the top of the chain are ‘harvesting fraudsters’ (hackers, malware writers and botnet
owners). At this level we find evidence that criminals are becoming more advanced and
sophisticated in the techniques to gather exploitable data. 176 Higher technical capabilities
174 Bessant, J. and Caffyn, S. (1997), “High-involvement innovation through continuous improvement.”
International Journal of Technology Management, 14(1).
175 Kaplinsky R, and M. Morris, (2001), A Handbook for Value Chain Research. International Development
Research Centre: Ottawa. p.9.
176 Interviews conducted with IT specialists suggested that the IT skills required by various cybercrime
activities range from those expected of 2 nd year undergraduates up to post-graduate qualifications (interviews
with Professor Richard Clayton on the 21 st November 2008, and Brian Moore in London 17 th November 2008).
Page 59