Summary

Hacking is becoming more common and dangerous. The challenge of dealing with hacking often comes from the fact that much of our wisdom about conventional crime cannot be directly applied to understand hacking behavior.

Against this backdrop, hacking studies are reviewed in view of the new features of cybercrime and how these features affect the application of the classical economic theory of crime in the cyberspace. Most findings of hacking studies can be interpreted with a parsimonious demand-and-supply framework. Hackers decide whether and how much to “supply” hacking by calculating the return on hacking over other opportunities. Defenders optimally tolerate some level of hacking risks because defense is costly. This tolerance can be interpreted as an indirect “demand” for hacking. Variations in law enforcement, hacking benefits, hacking costs, legal alternatives, private defense, and the dual-use problem can variously affect the supply or demand for hacking, and in turn the equilibrium amount of hacking in the market. Overall, it is suggested that the classical economic theory of crime remains a powerful framework to explain hacking behaviors. However, the application of this theory calls for considerations of different assumptions and driving forces, such as psychological motives and economies of scale in offenses, that are often less prevalent in conventional (offline) criminal behaviors but that tend to underscore hacking in the cyberspace.