Influence, infrastructure, and recentering cybercrime policing: evaluating emerging approaches to online law enforcement through a market for cybercrime services

Figures & data

Figure 1. Total attack numbers over time (light bars) with negative binomial model (thin line line) overlaid. Labels indicate the statistically significant interventions (modelled over periods shown by the thick line).

Table 1. List of interventions.

Operation start	Intervention	Type	Statistically significant impact in our model
2016-09-08	vDOS arrests	Arrests (of 2 people)	No
2016-10-06	Lizardstresser arrests	Arrests (of 2 people)	No
2016-10-28	Hackforums SST shutdown	Takedown	Yes
2016-12-05	Operation Tarpit	Arrests (of 34 people)	No
2016-12-01	Destressbooter sentencing	Sentencing	No
2017-04-25	Titaniumstresser sentencing	Sentencing	No
2017-12-15	NCA messaging campaign	Messaging	Yes (in the UK)
2017-12-19	VDOS sentencing	Sentencing	Yes
2018-03-27	Lizardstresser sentencing	Sentencing	No
2018-04-24	Webstresser arrest	Takedown and arrests (of 4 people)	Yes
2018-09-18	Mirai sentencing	Sentencing	Yes
2018-10-26	Mirai sentencing 2	Sentencing	Yes(overlapping with above)
2018-12-19	FBI mass takedowns	Multiple takedowns and arrests (of 3 people)	Yes

Table 2. Negative binomial regression model showing model composition, including key interventions, seasonal components, first order trend, and constant with significance and effect size.

						95% CI
	Date	Coef.	Std.error	z'	$P>\left|z^{\mathrm{\prime }}\right|$	Lower	Upper
Xmas2018	2018-12-19	−0.393	0.039	−10.05	0.000**	−0.469	−0.316
Webstresser	2018-04-24	−0.238	0.0574	−4.15	0.000**	−0.351	−0.126
Mirai sentencing and arrests	2018-10-26	−0.516	0.049	−10.46	0.000**	−0.613	−0.420
HackForums SST forum closed	2016-10-28	−0.360	0.039	−9.16	0.000**	−0.437	−0.283
vDOS sentencing	2017-12-19	−0.275	0.057	−4.83	0.000**	−0.387	−0.164
Easter		−0.016	0.094	−0.17	0.864	−0.200	0.168
seasonal_2		0.076	0.066	1.15	0.25	−0.053	0.205
seasonal_3		−0.051	0.060	−0.86	0.390	−0.168	0.066
seasonal_4		−0.025	0.057	−0.44	0.660	−0.137	0.087
seasonal_5		−0.098	0.062	−1.59	0.110	−0.220	0.023
seasonal_6		−0.134	0.069	−1.95	0.050*	−0.269	0.001
seasonal_7		−0.125	0.054	−2.32	0.020*	−0.230	−0.019
seasonal_8		−0.078	0.060	−1.3	0.190	−0.196	0.040
seasonal_9		0.069	0.058	1.19	0.240	−0.045	0.184
seasonal_10		−0.086	0.048	−1.77	0.080	−0.181	0.009
seasonal_11		−0.111	0.051	−2.16	0.030*	−0.211	−0.010
seasonal_12		0.091	0.047	1.93	0.050	−0.001	0.182
Time		0.010	0.000	27.04	0.000**	0.009	0.011
_cons		10.289	0.060	170.88	0.000**	10.171	10.407

Notes: Asterisks indicate if inclusion of an intervention made a significant (*) or strongly significant (**) contribution to the model. The seasonal variables model the month-by-month seasonality of the data. We also included a separate component for Easter as school holidays are linked to rises in attacks and the date of Easter is not fixed.

Table 3. Estimated effect sizes of statistically significant (at the global scale) interventions by country (UK, US, Russia, France, Germany, Poland, and the Netherlands), showing the effects of each intervention component in separate negative binomial models of attack numbers over time in each country.

Intervention		UK	US	RU	FR	DE	PL	NL	Overall
Xmas2018	Mean	−27%	−49%	−33%	−1%	−28%	−23%	−16%	−32%
Intervention	L95/U95	−43/−28%	−55/−42%	−43/−22%	−13/11%	−36/−20%	−37/−5%	−27/−3%	−37/−27%
12/19/2018	Duration	9 weeks	9 weeks	9 weeks	N/A	8 weeks	3 weeks	8 weeks	10 weeks
	Signif.	0.000**	0.000**	0.000**	0.828	0.000**	0.014*	0.018*	0.000**
Mirai sentencing and other actions 2018-10-26	Mean	−27%	−31%	−5%	−9%	−32%	−47%	−19%	−40%
	L95/U95	−42/−9%	−41/−20%	−16/7%	−31/21%	−40/−23%	−56/−36%	−35/0%	−46/−34%
	Duration	2 weeks	7 weeks	2 weeks	N/A	6 weeks	2 weeks	6 weeks	8 weeks
	Signif.	0.006**	0.000**	0.41	0.533	0.000**	0.000**	0.053	0.000**
Webstresser takedown 2018-04-24	Mean	−10%	−24%	−16%	−22%	−29%	−29%	146%	−21%
	L95/U95	−21%/3%	−40/−4%	−33/6%	−35/−7%	−36/−22%	−42/−14%	94/211%	−30/−12%
	Duration	N/A	4 weeks	2 weeks	4 weeks	9 weeks	6 weeks	4 weeks	3 weeks
	Signif.	0.120	0.022*	0.14	0.006*	0.000**	0.001**	0.000**	0.000**
vDOS sentencing	Mean	−20%	−4%	−37%	−30%	−4%	16%	−24%	−24%
12/19/2017	L95/U95	−33/−5%	−18/12%	−47/−24%	−37/−23%	−17/10%	−17/62%	−33/−13%	−32/−25%
	Duration	3 weeks	3 weeks	2 weeks	2 weeks	N/A	N/A	3 weeks	3 weeks
	Signif.	0.011*	0.563	0.000**	0.000**	0.532	0.373	0.000*	0.000**
HackForums	Mean	−48%	−30%	−13%	−52%	−32%	2%	−35%	−30%
10/28/2016	L95/U95	−53/−42%	−37/−21%	−23/−3%	−59/−43%	−41/−23%	−19/28%	−42/−27%	−33/−25%
	Duration	15 weeks	7 weeks	14 weeks	15 weeks	7 weeks	N/A	15 weeks	13 weeks
	Signif.	0.000**	0.000**	0.02*	0.000**	0.000*	0.86	0.000*	0.000**

Notes: Asterisks indicate inclusion of intervention in the model made a significant (*, <0.05) or strongly significant (**, <0.001) contribution to the model. Countries were chosen by prominence in number of attacks, or factors which made them of interest (such as NL retaliation for Webstresser takedown)

Figure 2. Stacked area graph showing total number of DoS attacks per week over time as self-reported by booter provider websites. Each stacked area series refers to the attacks reported by an individual booter service – as can be seen, the market structure changes in December 2018, where most of the attacks displace to a single service.

Figure 3. US and UK attack counts comparison. Non-stacked graph with totals scaled so both start at 100 in June 2016, with 200 representing a doubling. The NCA advertising intervention period which affects the UK data is highlighted in grey.