A new study suggests that so-called cybercriminals — people who commit crimes related to computer data — are going to cool it over the next few years. Why? Because they watch CSI. It's one of the most entertainingly awful examples of science you'll ponder today.
The study, conducted by informatics researcher Richard Overill at Kings College of London, takes its cues from an idea called the CSI effect. The CSI effect explains that jurors who watch shows like CSI are more likely to believe the testimony of forensics experts, even when their findings are speculative. Jurors are so impressed with the forensics investigators on TV that it clouds their objectivity in the courtroom.
Overill describes an "Inverse CSI Effect," which suggests that criminals respond to the CSI effect by modifying their behavior. In other words, Overill assumes criminals have exactly the same reaction to CSI that jurors do: These criminals think, "Wow those forensics folks are so good that they always catch the bad guy!" Let's just leave aside the obvious problems with assuming that everybody reacts to a story in the same way. Things get seriously bad when Overill decides his Inverse CSI Effect will actually help predict "future trends in the behavioural profiles of cyber-criminals."
If the CSI Effect causes many cyber-criminals to believe that unambiguous digital evidence of their activities can be routinely obtained almost instantaneously, they are likely to modify their MO in a number of ways. They are likely to withdraw from cyber-criminal activity that now appears too risky in the light of the perceived ease of discovery. They may migrate to alternative modalities involving many layers of concealment, stealth and obfuscation. The up-front investment required to implement these advanced methodologies will necessitate a proportionate increase in the expected returns, in order to maintain a stable cost-benefit ratio. Thus we would anticipate a compensating increase in the average value of cyber-crime heists, accompanied by a migration to sophisticated strategies of concealment.
In other words, these criminals — awestruck by TV cyber investigators — will either quit their criminal activities, or up their games. They'll be become sneakier because they assume that forensics experts are hot on their tails.
This is a terrible way to predict criminal behavior, not least because it assumes a causal relationship between what people see on TV and how they act.
All you have to do if you want to find out about trends in computer crime is look at Verizon's annual Data Breach Investigations report on the topic. Astoundingly, the numbers of hacking crimes have not gone down since the advent of CSI. Indeed, as you can see from this chart from the report below, most computer crimes committed by "external actors" (the vast majority this past year) are committed by people in countries where the population probably isn't obsessed with watching CSI. Or, if they are watching it, they're not too concerned about American forensics experts discovering their crimes.
This is the danger with trying to do any study which draws a strong causal link between behavior and people's exposure to pop culture. It's possible that CSI has influenced English-speaking jurors to take forensics experts more seriously than they should. This show might indeed have some nebulous correlation with a juror's decision, or at least their decision about whether to believe a crime expert. That's a reasonable proposition.
But a reverse-CSI effect that dissuades criminals based on how competent they think investigators are? That's like saying people will commit fewer (or better) crimes because they watched Sherlock and Columbo and now they're scared that all detectives can catch them. If we were all so easily persuaded by what we saw on television, every single commercial would cause us to buy things. That's just not how culture influences behavior. I'm not saying television doesn't affect how people perceive the world. But the idea that CSI is going to deter cybercrime, or make a new generation of even more cunning cybercriminals, is a laughable conclusion to draw.
Read more about Overill's study