Applying the Rational Choice Perspective to the Hacking Underground
Total Page:16
File Type:pdf, Size:1020Kb
University of Central Florida STARS Electronic Theses and Dissertations, 2004-2019 2008 What Makes Them Click? Applying The Rational Choice Perspective To The Hacking Underground Michael Bachmann University of Central Florida Part of the Sociology Commons Find similar works at: https://stars.library.ucf.edu/etd University of Central Florida Libraries http://library.ucf.edu This Doctoral Dissertation (Open Access) is brought to you for free and open access by STARS. It has been accepted for inclusion in Electronic Theses and Dissertations, 2004-2019 by an authorized administrator of STARS. For more information, please contact [email protected]. STARS Citation Bachmann, Michael, "What Makes Them Click? Applying The Rational Choice Perspective To The Hacking Underground" (2008). Electronic Theses and Dissertations, 2004-2019. 3790. https://stars.library.ucf.edu/etd/3790 WHAT MAKES THEM CLICK? APPLYING THE RATIONAL CHOICE PERSPECTIVE TO THE HACKING UNDERGROUND by MICHAEL BACHMANN M.A. University of Mannheim, 2004 A dissertation submitted in partial fulfillment of the requirements for the degree of Doctor of Philosophy in the Department of Sociology in the College of Sciences at the University of Central Florida Orlando, Florida Summer Term 2008 Major Professor: Jay Corzine ABSTRACT The increasing dependence of modern societies, industries, and individuals on information technology and computer networks renders them ever more vulnerable to attacks on critical IT infrastructures. While the societal threat posed by hackers and oth- er types of cyber-criminals has been growing significantly in the last decade, main- stream criminology has only recently begun to realize the significance of this threat. Cy- ber-criminology is slowly emerging as a subfield of criminological study and has yet to overcome many of the problems other areas of criminological research have already mastered. Aside from substantial methodological and theoretical problems, cyber- criminology currently also suffers from the scarcity of available data. As a result, scien- tific answers to crucial questions, such as who exactly the attackers are and why they engage in hacking activities, remain largely fragmentary. The present study begins to fill this remaining gap in the literature. It examines survey data about hackers, their involvement in hacking, their motivations to hack, and their hacking careers. The data for this study was collected during a large hacking con- vention in Washington D.C. in February 2008. The theoretical framework guiding the analyses is the rational choice perspective (Clarke & Cornish, 1985). Several hypothes- es about hackers are derived from the theory and some of its models are transposed into the context of hackers. Results suggest that the rational choice perspective is a vi- able theory when applied to cyber-criminals. Findings also demonstrate that the creation of more effective countermeasures requires adjustments to our understanding of who hackers really are and why they hack. ii To my wife and family, who of all that walk the earth, are most precious to me and whose continuing support and love enabled me to write this dissertation. iii ACKNOWLEDGMENTS I would like to deeply thank some of the persons who, during the several months of this endeavor, provided me with the necessary support and helpful assistance. With- out their care and consideration, this dissertation would not have matured in the same way. In particular, I would like to thank the members of my dissertation committee for their encouragement, guidance, and their feedback during all phases of this project. One of my wisest decisions as student was to select Dr. Jay Corzine as my dissertation chair. He was an excellent and committed supervisor of this project, and he also proved to be an invaluable help during my job search. I would further like to thank him as well as Dr. Jana Jasinski and Dr. James Wright (in alphabetical order) for providing me with the opportunity to even become a Ph.D. student at University of Central Florida, and to do so at a unique moment in time—during the start of a new program. All of them pro- vided me with an excellent education that significantly altered my life-course trajectory and turned me into the person I am today. I would further like to extend my gratitude to my external committee member Dr. John Jarvis, whose contacts and expertise were ex- ceptionally helpful for this project. Second, I would like to especially thank my colleague Dr. Monica Mendez for her offer to review and edit my drafts. Without her nuanced understanding of English lan- guage, this dissertation would not have been written in the same way. I cherish the time we spent together and hope we will be able to stay in touch despite the large distance that will be between us. iv TABLE OF CONTENTS LIST OF FIGURES ........................................................................................................ viii LIST OF TABLES ............................................................................................................ix LIST OF ACRONYMS/ABBREVIATIONS ....................................................................... x CHAPTER ONE: INTRODUCTION ................................................................................. 1 CHAPTER TWO: THE MEANINGS OF HACKING AND HACKERS.............................. 7 The Controversial Meanings of Hacker and Hacking ........................................ 7 The Etymological History of the Term Hacker ................................................... 9 The Current Controversy Over the Meaning of Hacker ................................... 12 The (Mis)representations of Hackers in the General Media ............................ 16 CHAPTER THREE: THE GROWING THREAT OF CYBERCRIME ............................. 24 The Co-Evolution of the Internet and Cybercrimes ......................................... 25 The Novelty of Cyber-Criminology .................................................................. 29 The Novelty of Cybercrime.............................................................................. 30 CHAPTER FOUR: THE CHALLENGES IN RESEARCHING CYBERCRIME .............. 35 Methodological Problems ................................................................................ 35 The Problem of Defining and Classifying Cybercrimes ............................... 35 The Problem of Measuring the Scale of Cybercrimes ................................. 38 Theoretical Problems ...................................................................................... 42 The Problem of Isolating Structural Correlates ............................................ 42 The Problem of Isolating Offender Characteristics ...................................... 43 The Proposed Theoretical Approach .............................................................. 45 v CHAPTER FIVE: THE RATIONAL CHOICE PERSPECTIVE ...................................... 48 The Six Basic Propositions of the Rational Choice Perspective...................... 49 The Rationality of Criminal Acts .................................................................. 50 The Limitations of Rationality in Decision Making Processes ...................... 51 The Importance of Situational Adjustments ................................................. 55 The Differences between Involvement and Event Decisions ....................... 57 The Three Different Stages of Involvement ................................................. 58 The Reconstruction of Crime Events as a Decision Sequence ................... 66 CHAPTER SIX: RESEARCH DESIGN .......................................................................... 69 The Difficulty of Sampling Hackers ................................................................. 70 The ShmooCon Convention ............................................................................ 75 The Pretest and IRB Approval ........................................................................ 79 The Data Collection Process ........................................................................... 82 CHAPTER SEVEN: THE SURVEY INSTRUMENT ....................................................... 85 The Measurements of General Hacking Activity ............................................. 87 The Measurements of Risk Propensity and Rationality ................................... 99 The Measurements of Sociodemographics ................................................... 101 CHAPTER EIGHT: METHODS AND RESULTS ......................................................... 103 The Sociodemographic Composition of the Sample ..................................... 103 The Descriptive Statistics of Continued Involvement .................................... 108 The Initiation Phase ................................................................................... 108 The Popularity of Different Hacking Methods ............................................ 114 The Prevalence and Success Rates of Different Kinds of Attack Methods 117 vi The Developments During the Habituation of Hacking .............................. 123 The Risk-Avoidance Efforts and Desistance Considerations..................... 129 The Assessment of Scale Validity and Reliability .......................................... 133 The Exploratory Factor Analysis ................................................................ 134 The Test of the Study Hypotheses ................................................................ 137 The Test of Hypotheses H1 and H2 .............................................................