NESTA Crime Online - University of Brighton Repository

ecosystem at various levels, creating different business models. Some of these are
explored below.
2.3 Cybercrime business models
Mimicking legitimate commercial businesses, cybercriminals in the
underground economy operate on a free market principle applying principles
such as volume discounts, commissions and pay as you go services.
The third component of the cybercrime digital ecosystem is that of business models. The
position of firms and their activities in the value chain helps determine how it
approaches business and generates a profit; all definitions of business models
emphasise how firms make money. Business models have the added attraction of being
potentially comparable across industries. Therefore, for this study, business models will
refer to the way in which different cybercriminals specifically generate revenue, and the
nature of the arrangements they have with their suppliers and customers in the value
chain. Suppliers and customers will vary depending on the activity in question. For
instance in ‘infection and distribution’ malware writers would be the suppliers of malware
to their customers, the botnet owners. However, in ‘exploitation’ activities, botnet
owners may supply buyers with stolen credit card details.
In any given industry, the methods of doing business may vary between actors and over
time. Alternative ways of conducting business can arise and change with new
technologies, market opportunities and competition.
There has been much speculation about the level of organisation and professionalism of
cybercriminal organisations. While too little is known about the types of business models
that operate in the underworld, we do know that all cybercriminals want to make
money. We also know that every business model has its own inherent strengths and
weaknesses. This section intends to categorise business models in cybercrime to
establish a base from which to examine their potential weaknesses.
While some models are quite simple, other can be more intricately woven. This
preliminary study has identified three predominant business models that are briefly
introduced below: off-line business models, Internet-based business models and hybrid
models (combining the other two). Since most cybercrime activities take place online,
Internet-based examples are more numerous. However, a significant component of
Page 73