The cybercrime industry

Journal article

Over recent decades, cybercrime has morphed from a curiosity into a serious global challenge. In many cases, the stereotype of the nerdy hacker in their parent’s basement has been superseded by a highly professional, specialised, and multi-faceted industry, made up of coders, entrepreneurs, managers, street criminals, and their protectors. This evolution of cybercrime presents a striking paradox, which has largely escaped notice: how did cybercriminals achieve industrialisation on such a scale, when they operate in an environment characterised by intense levels of distrust? One would expect legal scholarship to have identified this puzzle and resolved it. After all, the concept of private ordering has been a powerful and influential subfield for a number of decades; to build an industry like cybercrime would, no doubt, require order. But the literature on private ordering has been focused on informal, but licit, economic activities, and is yet to intersect with the important case of cybercrime. The cybercrime industry is an intriguing example of the private ordering of the dark side. This article aims to bring clear focus, as well as theoretical and empirical rigor, to the question of how cybercriminals govern themselves. It draws on three main sources of data: 1) fieldwork carried out over a 7-year period in 20 countries, which involved semi-structured interviews with almost 250 law enforcement agents, security professionals, and former cybercriminals; 2) indictments and other legal documents; 3) archives of major cybercriminal forums.

Authors: Lusthaus, J

• Publication status: Published
• Peer review status: Reviewed (other)
• Publisher: Harvard Law School
• Journal: Harvard National Security Journal
• Volume: 16
• Issue: 2
• Pages: 195-245
• Publication date: 2025-11-06
• Acceptance date: 2024-08-02
• ISSN: 2153-1358
• Language: English