Interview, Podcast
a16z Podcast | The Business of Cybercrime
- The cybercriminal landscape is projected to evolve into a large-scale global technology industry featuring organizational structures, recruiting practices, and specialization comparable to legitimate businesses, driven by a shift from lone hackers to profit-driven organizations that began in the 1990s and saw rapid commercialization around 1999–2000.
- Criminal groups are expected to increasingly apply traditional business principles to maximize profits, including the formation of online marketplaces like "Carter Planet," specialized teams for coding and "cash out" operations, and a fracturing of the market from single malware programs into distinct, specialized players.
- Operational scale is anticipated to vary by jurisdiction, with small online groups limited to eight to ten members to maintain trust, while offline operations in regions with weak enforcement or regulatory arbitrage may scale to thousands of members in physical office spaces resembling technology firms.
- Geographic specialization is expected to persist, with former Soviet Union states primarily producing technical malware coders and Western regions including the US and UK specializing in converting virtual gains into monetary profit through deceptive work-at-home recruitment.
- Cybercriminal syndicates are expected to proliferate in jurisdictions with low law enforcement risk, potentially engaging in internal conflicts, hacking each other's websites, and selling exploit code, while law enforcement faces ongoing limitations due to the transnational nature of the threat and corruption.
- State actors are expected to merge with criminal enterprises in places like Russia, where intelligence targeting may pivot to commercial cybercrime such as ransomware targeting hospitals, or where state-sponsored actors shift focus to the lucrative private market under pressure, as seen with Chinese cyber actors.
- The "cash out" sector and broader money laundering operations are expected to expand significantly, aided by the proliferation of cryptocurrencies like Bitcoin which solve traditional laundering issues, and the recruitment of uneducated individuals who may unknowingly participate in money laundering schemes.
- Cybercrime is expected to increasingly blend with the offline real world, involving street gangs integrating cyber tactics into traditional operations, utilizing local infrastructure and trust networks, and adopting physical violent tactics such as armed raids on cryptocurrency exchanges.
- Ransomware operations are expected to become more targeted and specialized, focusing on specific market verticals like hospitals known to pay ransoms, while a fundamental shift toward extortion and direct threats may occur as two-factor authentication reduces the ease of accessing bank accounts.
- Talent dynamics are expected to involve highly varied demographics ranging from educated coders to uneducated recruits, with skilled personnel branching out to start their own operations, while the lack of legitimate startup opportunities in Eastern Europe continues to make cybercrime an attractive path for accumulating wealth and societal legitimacy.
- Reputation and anonymity are expected to remain critical tensions, with top-layer coders changing names regularly to avoid detection while vendors maintain consistent brands and nicknames over time to signal reliability to buyers, reflecting a growing value placed on cybercriminal brand longevity.
- Attribution efforts in the private sector are expected to rely on technical artifacts and code metadata rather than shifting online identities, while traditional organized crime groups are not expected to take over core technical aspects due to a lack of relevant skills, remaining involved primarily in the financial side.
- The core driver of cybercrime is expected to remain a secrets management problem where credential theft fuels fraud, necessitating that security measures and legal frameworks address the human behavior elements that cause organizational structures to evolve slowly and return to patterns seen in traditional crime syndicates over the past two decades.