An Examination of Motivation and Routine Activity Theory to Account for Cyberattacks Against Dutch Web Sites

Abstract

This study provides a partial test of the relationship between actor motivations and target suitability using a routine activity framework to understand a form of cybercrime called web defacements. Specifically, the relationships between the visibility, inertia, value, and accessibility of the target in online spaces relative to the unique nonmonetary motivations of the attacker were examined. This study utilized a sample of 138,361 web defacements performed against websites hosted within the Netherlands IP space from January 2011 to April 2017. Seven multinomial logistic regression models were conducted for each self-identified motive for the attack, clustered by attacker to minimize the size of standard errors. The findings demonstrated partial support for aspects of routine activity theory to account for differences in offender motivation, suggesting web defacements are similar to other forms of cybercrime. At the same time, motivations differentially shape target selection.

The Dynamics of Business, Cybersecurity and Cyber-Victimization: Foregrounding the Internal Guardian in Prevention

“…Those individuals and objects which cybercriminals perceive to be more valuable are those that are more frequently targeted (Holt et al, 2020). While offline 'value' is frequently associated with monetary worth, in cyberspace it tends to be an expression of information (as a route to financial gain): "the focus of cybercrime, therefore, is to acquire information in order to extract its value" (Wall, 2007: 36).…”

Website Defacer Classification: A Finite Mixture Model Approach

“…Corroborating this finding, Howell et al (2019) show that hackers target websites hosted on servers around the globe based on the routine activities of the target country. Similarly, Holt et al (2020) found that target characteristics vary across hackers. For example, some hackers engage in attacks against homepages, which may be viewed as having more value given their increased visibility (Holt et al, 2020).…”

“…Nevertheless, we do know that unlike many hackers who seek to erase evidence of their intrusion (Howell et al, 2017), hackers who engage in attacks against websites often brag about their successful exploits on various platforms (Maimon, Fukuda, et al, 2017), making them ideal subjects for empirical analysis (Howell & Burruss, 2020). Although website defacement originated to mock system administrators for poor security protocol (Kilger, 2011), hackers now engage in website defacement for a variety of reasons (Holt et al, 2020). Interestingly, Holt et al (2020) found hackers’ motivations are predictive of target selection.…”

“…Although website defacement originated to mock system administrators for poor security protocol (Kilger, 2011), hackers now engage in website defacement for a variety of reasons (Holt et al, 2020). Interestingly, Holt et al (2020) found hackers’ motivations are predictive of target selection. Corroborating this finding, Holt et al (2019) report that far-left extremists deface websites belonging to businesses they deem unethical in social protest.…”

“…Although over 1 million websites are defaced each year (Zone-h, 2019), scant criminological attention has been paid to website defacement. In recent years, however, some scholars have recognized the importance of studying website defacement behavior and have examined the correlates of both offending (Maimon, Fukuda, et al, 2017; Ooi et al, 2012) and victimization (Holt et al, 2020; Howell et al, 2019). Despite improving our understanding about the modus operandi and rationale of hackers who deface websites, we still do not have a solid typology of website defacers.…”