Abstract
Illicit data markets have emerged on Telegram, a popular online instant messaging application, bringing together thousands of users worldwide in an unregulated exchange of sensitive data. These markets operate through vendors who offer enormous quantities of such data, from personally identifiable information to financial data, while potential customers bid for these valuable assets. This study describes how Telegram data markets operate and discusses what interventions could be used to disrupt them. Using crime script analysis, we observed 16 Telegram meeting places encompassing public and private channels and groups. We obtained information about how the different meeting places function, what are their inside rules, and what tactics are employed by users to advertise and trade data. Based on the crime script, we suggest four feasible situational crime prevention measures to help disrupt these markets. These include taking down the marketplaces, reporting them, spamming and flooding techniques, and using warning banners.
This is a preview of subscription content, log in via an institution to check access.
Similar content being viewed by others
References
Ablon L, Libicki M, Abler A (2014) Markets for Cybercrime Tools and Stolen Data: hackers’ Bazaar. RAND Corporation. https://doi.org/10.7249/RR610
Aldridge J, Askew R (2017) Delivery dilemmas: how drug cryptomarket users identify and seek to reduce their risk of detection by law enforcement. Int J Drug Policy 41:101–109. https://doi.org/10.1016/j.drugpo.2016.10.010
Aldridge J, Décary-Hétu D (2014) Not an Ebay for drugs: the Cryptomarket Silk Road as a paradigm shifting Criminal Innovation. SSRN Electron J. https://doi.org/10.2139/ssrn.2436643
Barr R, Pease K (1990) Crime placement, displacement, and deflection. Crime Justice 12:277–318
Borrion H (2013) Quality assurance in crime scripting. Crime Sci 2(1):6. https://doi.org/10.1186/2193-7680-2-6
Brewer R, de Vel-Palumbo M, Hutchings A, Holt T, Goldsmith A, Maimon D (2019) Cybercrime Prevention: theory and applications. Springer International Publishing. https://doi.org/10.1007/978-3-030-31069-1
Broadhurst R, Foye J, Jiang C, Ball M (2021) Illicit firearms and other weapons on darknet markets. Trends Issues Crime Criminal Justice 662:1–20. https://doi.org/10.3316/agispt.20210504046046
Chavez N, Bichler G (2019) Guarding against Cyber-trespass and theft: routine precautions from the Hacking Community. https://doi.org/10.5281/ZENODO.3551489
Chiu Y-N, Leclerc B, Townsley M (2011) Crime script analysis of Drug Manufacturing in Clandestine Laboratories: implications for Prevention. Br J Criminol 51(2):355–374. https://doi.org/10.1093/bjc/azr005
Clarke RV (ed) (1997) Situational crime prevention: successful case studies, 2 edn. Criminal Justice
Clarke RV (2016) Situational crime prevention. In: Wortley RK, Townsley M (eds) Environmental Criminology and Crime Analysis. Routledge
Clarke RV, Cornish DB (1985) Modeling offenders’ decisions: a Framework for Research and Policy. Crime Justice 6:147–185. https://doi.org/10.1086/449106
Collier B, Thomas DR, Clayton R, Hutchings A (2019) Booting the Booters: Evaluating the Effects of Police Interventions in the Market for Denial-of-Service Attacks. Proceedings of the Internet Measurement Conference, 50–64. https://doi.org/10.1145/3355369.3355592
Collier B, Clayton R, Hutchings A, Thomas D (2021) Cybercrime is (often) boring: infrastructure and alienation in a deviant subculture. Br J Criminol 61(5):1407–1423. https://doi.org/10.1093/bjc/azab026
Collier B, Thomas DR, Clayton R, Hutchings A, Chua YT (2022) Influence, infrastructure, and recentering cybercrime policing: evaluating emerging approaches to online law enforcement through a market for cybercrime services. Polic Soc 32(1):103–124. https://doi.org/10.1080/10439463.2021.1883608
Copeland C, Wallin M, Holt TJ (2020) Assessing the practices and products of Darkweb Firearm vendors. Deviant Behav 41(8):949–968. https://doi.org/10.1080/01639625.2019.1596465
Cornish DB (1994) Crimes as scripts. In D. Zahm & P. Cromwell (Eds.), Proceedings of the International Seminar on Environmental Criminology and Crime Analysis, University of Miami, Coral Gables, Florida, 1993
Cornish DB, Clarke RV (2003) Opportunities, precipitators and criminal decisions: a reply to Wortley’s critique of situational crime prevention. Crime Prev Stud 16:41–96
Cunliffe J, Martin J, Décary-Hétu D, Aldridge J (2017) An island apart? Risks and prices in the Australian cryptomarket drug trade. Int J Drug Policy 50:64–73. https://doi.org/10.1016/j.drugpo.2017.09.005
Décary-Hétu D, Dupont B (2013) Reputation in a dark network of online criminals. Global Crime 14(2–3):175–196. https://doi.org/10.1080/17440572.2013.801015
Décary-Hétu D, Giommoni L (2017) Do police crackdowns disrupt drug cryptomarkets? A longitudinal analysis of the effects of Operation Onymous. Crime Law Social Change 67(1):55–75. https://doi.org/10.1007/s10611-016-9644-4
Dehghanniri H, Borrion H (2021) Crime scripting: a systematic review. Eur J Criminol 18(4):504–525. https://doi.org/10.1177/1477370819850943
Demant J, Bakken SA, Oksanen A, Gunnlaugsson H (2019) Drug dealing on Facebook, Snapchat and Instagram: a qualitative analysis of novel drug markets in the nordic countries. Drug Alcohol Rev 38(4):377–385. https://doi.org/10.1111/dar.12932
Dupont B, Côté A-M, Boutin J-I, Fernandez J (2017) Darkode: recruitment patterns and transactional features of the most dangerous Cybercrime Forum in the World. Am Behav Sci 61(11):1219–1243. https://doi.org/10.1177/0002764217734263
Europol (2019), November 25 Europol and Telegram take on terrorist propaganda online. Europol. https://www.europol.europa.eu/media-press/newsroom/news/europol-and-telegram-take-terrorist-propaganda-online
Felson M (2003) The Process of Co-offending. In M. J. Smith & D. B. Cornish, Theory for Practice in Situational Crime Prevention. Crime Prevention Studies, 16, 149–167. Criminal Justice Press
Holt TJ (2013) Exploring the social organisation and structure of stolen data markets. Global Crime 14(2–3):155–174. https://doi.org/10.1080/17440572.2013.787925
Holt TJ, Lampke E (2010a) Exploring stolen data markets online: products and market forces. Criminal Justice Stud 23(1):33–50. https://doi.org/10.1080/14786011003634415
Holt TJ, Lee JR (2022a) A crime script analysis of Counterfeit identity document procurement online. Deviant Behav 43(3):285–302. https://doi.org/10.1080/01639625.2020.1825915
Holt TJ, Lee JR (2022b) A crime script model of Dark web firearms Purchasing. Am J Criminal Justice 48(2):509–529. https://doi.org/10.1007/s12103-022-09675-8
Holt TJ, Smirnova O (2014) Examining the Structure, Organization, and Processes of the International Market for Stolen Data [Data set]. ICPSR - Interuniversity Consortium for Political and Social Research. https://doi.org/10.3886/ICPSR35002.V1
Holt TJ, Smirnova O, Chua YT, Copes H (2015) Examining the risk reduction strategies of actors in online criminal markets. Global Crime 16(2):81–103. https://doi.org/10.1080/17440572.2015.1013211
Holt TJ, Smirnova O, Chua YT (2016) Exploring and estimating the revenues and profits of participants in Stolen Data markets. Deviant Behav 37(4):353–367. https://doi.org/10.1080/01639625.2015.1026766
Hutchings A (2014) Crime from the keyboard: organised cybercrime, co-offending, initiation and knowledge transmission. Crime Law Social Change 62(1):1–20. https://doi.org/10.1007/s10611-014-9520-z
Hutchings A, Holt TJ (2015) A crime script analysis of the online Stolen Data Market. Br J Criminol 55(3):596–614. https://doi.org/10.1093/bjc/azu106
Hutchings A, Holt TJ (2017) The online stolen data market: disruption and intervention approaches. Global Crime 18(1):11–30. https://doi.org/10.1080/17440572.2016.1197123
Jardine E (2021) Policing the Cybercrime Script of Darknet Drug markets: methods of effective Law enforcement intervention. Am J Criminal Justice 46(6):980–1005. https://doi.org/10.1007/s12103-021-09656-3
Kamps J, Kleinberg B (2018) To the moon: defining and detecting cryptocurrency pump-and-dumps. Crime Sci 7(1):1–18. https://doi.org/10.1186/s40163-018-0093-5
Ladegaard I (2019) Crime displacement in digital drug markets. Int J Drug Policy 63:113–121. https://doi.org/10.1016/j.drugpo.2018.09.013
Leclerc B (2016) Crime scripts. In: Wortley RK, Townsley M (eds) Environmental Criminology and Crime Analysis. Routledge
Lee JR, Holt TJ, Smirnova O (2022) An assessment of the state of firearm sales on the Dark web. J Crime Justice 1–15. https://doi.org/10.1080/0735648X.2022.2058062
Legg J (2021), October 21 Confronting The Shortage Of Cybersecurity Professionals. Forbes. https://www.forbes.com/sites/forbesbusinesscouncil/2021/10/21/confronting-the-shortage-of-cybersecurity-professionals/
Leukfeldt R (2014) Cybercrime and social ties: Phishing in Amsterdam. Trends Organized Crime 17(4):231–249. https://doi.org/10.1007/s12117-014-9229-5
Leukfeldt ER, Holt TJ (2020) Examining the Social Organization Practices of Cybercriminals in the Netherlands Online and Offline. Int J Offender Ther Comp Criminol 64(5):522–538. https://doi.org/10.1177/0306624X19895886
Leukfeldt R, Jansen J (2015) Cyber Criminal Networks and Money mules: an analysis of low-tech and high-tech Fraud attacks in the Netherlands. Int J Cyber Criminol 9(2):173. https://doi.org/10.5281/zenodo.56210
Leukfeldt R, Kleemans ER, Stol WP (2017a) A typology of cybercriminal networks: from low-tech all-rounders to high-tech specialists. Crime Law Social Change 67(1):21–37. https://doi.org/10.1007/s10611-016-9662-2
Leukfeldt R, Kleemans E, Stol W (2017b) The Use of Online Crime Markets by Cybercriminal networks: a View from within. Am Behav Sci 61(11):1387–1402. https://doi.org/10.1177/0002764217734267
Leukfeldt R, Kleemans ER, Stol WP (2017c) Cybercriminal Networks, Social ties and Online forums. Br J Criminol 57(3):704–722. https://doi.org/10.1093/bjc/azw009
Loggen J, Leukfeldt R (2022) Unraveling the crime scripts of phishing networks: an analysis of 45 court cases in the Netherlands. Trends Organized Crime 25(2):205–225. https://doi.org/10.1007/s12117-022-09448-z
Maimon D, Alper M, Sobesto B, Cukier M (2014) Restrictive deterrent effects of a warning banner in an Attacked Computer System: restrictive deterrent effects of a warning. Criminology 52(1):33–59. https://doi.org/10.1111/1745-9125.12028
Melde C, Weerman F (eds) (2020) Gangs in the era of internet and Social Media. Springer International Publishing. https://doi.org/10.1007/978-3-030-47214-6
Mirea M, Wang V, Jung J (2019) The not so dark side of the darknet: a qualitative study. Secur J 32(2):102–118. https://doi.org/10.1057/s41284-018-0150-5
Miró Llinares F, Johnson SD (2018) Cybercrime and Place (G. J. N. Bruinsma & S. D. Johnson, Eds.; Vol. 1). Oxford University Press. https://doi.org/10.1093/oxfordhb/9780190279707.013.39
Moneva A (2020) Cyber Places, Crime Patterns, and Cybercrime Prevention: An Environmental Criminology and Crime Analysis approach through Data Science [Doctoral dissertation]. https://core.ac.uk/download/pdf/392256988.pdf
Moneva A, Caneppele S (2020) 100% sure bets? Exploring the precipitation-control strategies of fixed-match informing websites and the environmental features of their networks. Crime Law Social Change 74(1):115–133. https://doi.org/10.1007/s10611-019-09871-4
Moneva A, Leukfeldt R, Klijnsoon W (2022) Alerting consciences to reduce cybercrime: a quasi-experimental design using warning banners. J Experimental Criminol 1–28. https://doi.org/10.1007/s11292-022-09504-2
Morselli C, Décary-Hétu D, Paquet-Clouston M, Aldridge J (2017) Conflict Management in Illicit Drug Cryptomarkets. Int Crim Justice Rev 27(4):237–254. https://doi.org/10.1177/1057567717709498
Motoyama M, McCoy D, Levchenko K, Savage S, Voelker GM (2011) An analysis of underground forums. Proc 2011 ACM SIGCOMM Conf Internet Meas Conf - IMC ’11 71. https://doi.org/10.1145/2068816.2068824
Ouellet M, Maimon D, Howell JC, Wu Y (2022) The Network of Online Stolen Data markets: how Vendor flows Connect Digital marketplaces. Br J Criminol 62(6):1518–1536. https://doi.org/10.1093/bjc/azab116
Ricle J (2019), October 2 What Is Scam Label Next To Telegram Username? How To Report Telegram Scammers? Telegram Adviser. https://www.telegramadviser.com/scammers-in-telegram-and-how-to-report
Soudijn MRJ, Zegers BCHT (2012) Cybercrime and virtual offender convergence settings. Trends Organized Crime 15(2–3):111–129. https://doi.org/10.1007/s12117-012-9159-z
Telegram (2022a) Bot Payments API. Telegram. https://core.telegram.org/bots/payments
Telegram FAQ. Telegram, Telegram (2022b) https://telegram.org/faq#q-there-39s-illegal-content-on-telegram-how-do-i-take-it-down
Thomas DR, Pastrana S, Hutchings A, Clayton R, Beresford AR (2017) Ethical issues in research using datasets of illicit origin. Proceedings of the 2017 Internet Measurement Conference, 445–462. https://doi.org/10.1145/3131365.3131389
van Hardeveld GJ, Webber C, O’Hara K (2017) Deviating from the Cybercriminal Script: Exploring Tools of Anonymity (Mis)used by carders on cryptomarkets. Am Behav Sci 61(11):1244–1266. https://doi.org/10.1177/0002764217734271
Wortley R, Townsley M (eds) (2017) Environmental criminology and crime analysis (Second Edition). Routledge, Taylor & Francis Group
Acknowledgements
We thank Floor Jansen and Wouter Klijnsoon, Cyber Offender Prevention Squad (COPS), Team High Tech Crime (THTC), Netherlands Police, for finding time to discuss the potential interventions with us.
Funding
Not applicable.
Author information
Authors and Affiliations
Contributions
Taisiia Garkava: Conceptualization, Methodology, Investigation, Data Curation, Writing – Original Draft. Asier Moneva: Conceptualization, Methodology, Validation, Writing - Review & Editing, Visualization, Supervision, Project Administration. E. Rutger Leukfeldt: Conceptualization, Writing - Review & Editing, Supervision, Funding Acquisition.
Corresponding author
Ethics declarations
Ethics approval
This study received ethics approval from the Ethical Committee of The Hague University of Applied Sciences.
Competing interests
The authors have no competing interests to declare that are relevant to the content of this article.
Additional information
Publisher’s Note
Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.
Rights and permissions
Springer Nature or its licensor (e.g. a society or other partner) holds exclusive rights to this article under a publishing agreement with the author(s) or other rightsholder(s); author self-archiving of the accepted manuscript version of this article is solely governed by the terms of such publishing agreement and applicable law.
About this article
Cite this article
Garkava, T., Moneva, A. & Leukfeldt, E.R. Stolen data markets on Telegram: a crime script analysis and situational crime prevention measures. Trends Organ Crim (2024). https://doi.org/10.1007/s12117-024-09532-6
Accepted:
Published:
DOI: https://doi.org/10.1007/s12117-024-09532-6