Cybercrime

Featured

A wide range of computer security threats exists—including faulty software, password trafficking and fraud, and hostile groups intending to inflict damage—and awareness of these threats varies. RAND has conducted research to measure and increase understanding of the impact of cybercrime on businesses and governments and has addressed such issues as the pros and cons of counterattack, the value of deterrence and vigilance, and actions that can be taken in the face of cyberattack.

Explore Cybercrime

  • Report

    Report

    Fostering Innovation to Respond to Top Challenges in Law Enforcement: Proceedings of the National Institute of Justice's 2018 Chiefs' Panel on Priority Law Enforcement Issues and Needs

    An expert panel of law enforcement leaders identified challenges facing law enforcement today, and their priorities are presented in this report. Panel members discussed needs for innovation that, if pursued, might help resolve those challenges.

    Jul 22, 2019

  • Report

    Report

    When Autonomous Vehicles Are Hacked, Who Is Liable?

    The arrival of autonomous vehicles (AVs) on the roads will require policymakers, industry, and the public to adapt to the risk of hackers attacking these vehicles. RAND researchers explored the civil liability issues related to hacked AVs.

    Jul 12, 2019

  • Smart car 3D rendering, photo by Production Perig/Adobe Stock

    Research Brief

    When an Autonomous Vehicle Is Hacked, Who Is Liable?

    Hacks on autonomous vehicles could lead to deaths, property destruction, ransomware attacks, or data theft. Several scenarios, such as a hacker disabling a car to demand ransom, illustrate the policy challenges facing the civil legal system, insurers, and others.

    Jul 12, 2019

  • A portion of a city model glows red indicating a cyber threat to infrastructure at the DarkMatter booth during the Black Hat information security conference in Las Vegas, Nevada, July 26, 2017

    Commentary

    Fighting and Winning the Undeclared Cyber War

    Russia has executed deliberate intrusions into U.S. critical infrastructure since at least 2011. These systems have included government entities, commercial facilities, water resource plants, and aviation institutions. What actions or policies can the U.S. execute to improve security?

    Jun 24, 2019

  • Mock Bitcoins are displayed in Berlin, January 7, 2014, photo by Pawel Kopczynski/Reuters

    Report

    Terrorist Use of Cryptocurrencies

    Counterterrorism finance strategies have reduced terrorist access to official currencies. Will terrorist groups therefore increase their use of digital cryptocurrencies? New ones have emerged, including some that claim to be more private and secure than Bitcoin, but they also have limitations that make them less viable.

    Mar 27, 2019

  • Hawaii Air National Guardsmen evaluate network vulnerabilities during the Po’oihe 2015 Cyber Security Exercise at the University of Hawaii Manoa Campus, Honolulu, HI, June 4, 2015, photo by Airman 1st Class Robert Cabuco/Hawaii Air National Guard

    Commentary

    Developing an Objective, Repeatable Scoring System for a Vulnerability Equities Process

    If governments seek to create an objective framework for decision making about whether or when to disclose software vulnerabilities, what might that look like? What questions should be included, how should they influence the outcome and how can one interpret the results?

    Feb 5, 2019

  • Accountability in Cyberspace: The Problem of Attribution

    Multimedia

    How to Achieve Accountability in Cyberspace

    Identifying the responsible party behind malicious cyber incidents is necessary for holding bad actors accountable. But there are many challenges that accompany cyber attribution. Creating an independent, global organization that investigates and publicly assigns blame for major hacks could help.

    Jan 14, 2019

  • Journal Article

    Journal Article

    Economics of Vulnerability Disclosure

    This study serves as a follow up to the 2015 ENISA Good Practice Guide on Vulnerability Disclosure and seeks to provide a glimpse into the economics, costs, and incentives related to discovering and disclosing vulnerabilities.

    Dec 14, 2018

  • World map with electronic circuits

    Commentary

    When Cyber Attacks Occur, Who Should Investigate?

    Data breaches and cyberattacks cross geopolitical boundaries, targeting individuals, corporations and governments. Creating a global body with a narrow focus on investigating and assigning responsibility for cyberattacks could be the first step to creating a digital world with accountability.

    Dec 6, 2018

  • Journal Article

    Journal Article

    The Trade in Small Arms and Light Weapons on the Dark Web: A Study

    A summary of the main findings and implications of the first empirical study investigating the scale and scope of arms trafficking on the dark web, illustrating the range of weapons traded, their market price and most common transit routes.

    Oct 24, 2018

  • Processor pins of a microchip

    Commentary

    Examining the Weak Spots in Tech's Supply Chain Armor

    When an attack on the supply chain occurs, manufacturers and purchasers should be better positioned to respond and recover. Even the simplest devices can rely on parts from multiple suppliers, which may have their own suppliers and so on. But every supplier, no matter how small, represents a potential weak link in the chain.

    Oct 16, 2018

  • Hacker on a laptop

    Commentary

    Have a Victim Response Plan for Data Breaches

    In a large data breach, there could be a real risk to victims' financial or personal security. Though responsible organizations should do everything in their power to ensure data is protected in the first place, they also should prepare a plan to ensure prompt victim response.

    Oct 2, 2018

  • Report

    Report

    Developing Cybersecurity Capacity: A proof-of-concept implementation guide

    This document is a proof-of-concept operational toolbox designed to facilitate the development of national-level cybersecurity capacity building programmes and of holistic policy and investment strategies to tackle challenges in the cyber domain.

    Aug 2, 2018

  • Server room data center with icon representing cloud storage

    Report

    Identifying Law Enforcement Needs for Access to Digital Evidence in Remote Data Centers

    Researchers discuss the challenge of accessing data in remote data centers, summarize the discussion of an expert panel, and provide a list of needs identified and prioritized by the panel to inform concerned communities and stakeholders.

    Apr 23, 2018

  • Padlock generated from a particle vortex

    Multimedia

    Data Thieves: The Motivations of Cyber Threat Actors and Their Use and Monetization of Stolen Data

    An overview of testimony by Lillian Ablon presented before the House Financial Services Committee, Subcommittee on Terrorism and Illicit Finance.

    Mar 15, 2018

  • Brochure

    A focus on cybersecurity

    Cybersecurity has risen to become a prominent issue of national and global security for governments and international organisations worldwide. A focus on cybersecurity looks at the issues and details RAND Europe's expertise and work in the area.

    Feb 15, 2018

  • Opening Ceremony of the 2018 Winter Olympics in Pyeongchang, South Korea, February 9, 2018

    Commentary

    Why the 2018 Winter Olympics Are the Perfect Storm for Cyberattacks

    The Olympic Games could invite the most severe cyber threats to a major sporting event in recent years. The location of the Games and increased connectivity, both among the public and infrastructure, make them a prime target for cyberattacks.

    Feb 12, 2018

  • Shiny gold Bitcoin coin with gun on black background

    Commentary

    Bitcoin and the Dark Web: The New Terrorist Threat?

    Bitcoin has become the prominent currency of the dark web, which is often used to buy illegal goods, such as weapons and drugs. Anecdotal evidence suggests terrorists are using cryptocurrency and the dark web, but further investigation is needed.

    Jan 22, 2018

Research conducted by