Introduction

The growth and advancement of the Internet has introduced numerous improvements to society, including better information sharing and knowledge dissemination, greater overall convenience and accessibility (e.g., instant communications and financial transactions), and enhanced connectivity through a more globalized network community (Holt & Bossler, 2016; Newman & Clarke, 2003; Wall, 2001). The ubiquity of the Internet and the lower costs of operating an Internet-enabled device has made individuals more reliant on technology to accomplish both complicated and mundane tasks (Andress & Winterfeld, 2013; Holt & Bossler, 2016; Newman & Clarke, 2003). In fact, estimates suggest that more than half of the global population (59.5%) use the Internet (see Statista, 2021), with approximately 85% of American adults owning a smartphone, 77% owning a personal computer (e.g., desktop, laptop), and 53% owning a tablet computer (see Pew Research Center, 2021).

Although the benefits of technology are extensive, its developments have concurrently given rise to various forms of online crime and deviance (Holt & Bossler, 2016). In fact, digital technology has enhanced traditional offline crimes such as fraud (Cross, 2015; Holt & Lee, 2020; Wall, 2004), harassment (Bocij, 2004; Choi & Lee, 2017; Choi et al., 2017; Fissel et al., 2021), terrorism (Britz, 2010; Holt, Lee, et al., 2020; Shandler et al., 2021), and child sexual abuse offenses (Cale et al., 2021; Demetis & Kietzmann, 2021; Holt, Liggett, et al., 2020; Jenkins, 2001). Digital technology has also created unique forms of crimes such as computer hacking (Fox & Holt, 2021; Holt & Steinmetz, 2021; Lee & Holt, 2020; Maimon et al., 2021) and virus dissemination (Bossler & Holt, 2009; Gero et al., 2021).

Before personal computers were widely accessible, modern computers were mostly owned and operated by large universities and government agencies (Holt et al., 2017). Given the infancy of computer technology in the mid-20th century, computer crime investigations mostly comprised of computer theft or the stealing of computer parts (Holt et al., 2017). The definition of cybercrime and cybercrime policing began to shift as personal computers started to surface in the mid-1970s (Holt et al., 2017). Computers were being used to commit various forms of traditional crimes, such as fraud and embezzlement, which brought widespread attention to the serious consequences of computer crime (Clifford, 2006).

By the late 1970s, there was international recognition that computer crime was a growing concern (Holt et al., 2017). In fact, the Council of Europe Conference on Criminological Aspects of Economic Crime identified several categories of computer crime in 1976, including fraud (Schjolberg, 2004). Similarly, Interpol was the first international organization to address the growing concern of computer fraud in 1979 (Holt et al., 2017). Although federal cybercrime legislation was first introduced to U.S. lawmakers in 1977 (e.g., Federal Computer Systems Protection Act), it was not until 1986 that the United States passed its first federal law criminalizing the unauthorized access of a computer (i.e., Computer Fraud and Abuse Act; see Holt et al., 2017). By the late 1980s, various law enforcement agencies found themselves collecting digital evidence to prosecute cybercrime offenders.¹

According to the Office for National Statistics (ONS), cybercrimes, which are generally defined as behaviors that use the Internet or Internet-enabled devices to inflict harm, occur more frequently than domestic burglary, car theft, vandalism, robbery, and violent crime combined (see McMurdie, 2016). The COVID-19 pandemic has further exacerbated the cybercrime problem; numerous online crimes have increased as a result of the global pandemic.² Specifically, the ONS found that social media and email hacking behaviors increased by 23% in England and Wales and that computer virus offenses increased by 61% since the COVID-19 pandemic (Muncaster, 2020). Participation in online illicit markets (Vu, 2020) and denial of service attacks (Clayton, 2020) were also behaviors that increased since the beginning of the pandemic (Horgan et al., 2021). Although many factors may explain the rise of these cybercrimes, research suggests this increase may partially be a result of individuals being confined to stay-at-home orders and government lockdowns, as well as increased boredom and anxiety over loss of employment during the pandemic (Collier, 2020; Horgan et al., 2021; Maimon & Howell, 2020).

The overall growth of cybercrime behaviors has led various stakeholders to question which group of individuals or service providers is best equipped to apprehend online offenders, support cybercrime victims, and respond to cybercrime calls for service (Dodge & Burruss, 2019; Holt & Lee, 2019; Koziarski & Lee, 2020). To that end, some believe that contacting their ISP for assistance is their best option because that is where they get their Internet connection from, while others believe that reaching out to online platforms (e.g., social media platforms, online banking sites) is most effective (see Holt et al., 2017). Alternatively, other individuals may contact their local law enforcement agencies to report their cybercrime experiences because law enforcement is traditionally recognized as an all-purpose emergency service whose goal is to protect victims and hold offenders accountable for their actions (Holt et al., 2017; Wall, 2007b). Given that law enforcement is widely regarded as first responders to offline crime and civil unrest, it may seem reasonable for individuals to seek law enforcement assistance when they experience cybercrime victimization (Dodge & Burruss, 2019).

However, cybercrimes present several significant challenges for law enforcement agencies across all levels of government (e.g., local, state or provincial, and federal). First, cybercrime offenders often conceal their actions and offline identity through anonymous interactions with victims’ devices and accounts, making arrest and criminal prosecution extremely challenging (Dodge & Burruss, 2019; Hinduja, 2007; Wall, 2001). Second, even if offenders and their actions are identified by law enforcement, agencies are limited by their geographic location and jurisdiction. Whereas traditional offline crimes tend to be regional, cybercrimes often involve a complex transnational component, making it harder for law enforcement to both investigate and apprehend offenders who reside outside their jurisdictional boundaries (Brenner, 2008; Cross, 2015; Shearing & Johnston, 2013; Wall, 2007b). Third, the often complicated and technical nature of cybercrime means that victims may not be aware of their victimization until months after the attack, which may affect the identification of digital evidence necessary to prosecute an offender (Dodge & Burruss, 2019). Fourth, law enforcement officers may not possess the knowledge and expertise needed to adequately secure and investigate a digital crime scene, which may be attributed to a lack of resources and/or insufficient cybercrime training (Dodge & Burruss, 2019; Hinduja, 2004; Holt et al., 2015; Senjo, 2004; Stambaugh et al., 2001).

Despite the growth and prevalence of cybercrime behaviors, approximately 20% of countries do not have cybercrime legislation to regulate online crimes (United Nations Conference on Trade and Development [UNCTAD], 2020; Van Nguyen et al., 2021). The absence of a cybercrime legislation makes participating in international investigations difficult, especially if the victim and offender reside in countries that do not have cybercrime laws (Clough, 2014; Maillart, 2019; Singh & Singh, 2007; United Nations Office on Drugs and Crime [UNODC], 2013; Van Nguyen et al., 2021). Furthermore, countries without any sort of comprehensive cybercrime legislation risk becoming a harbor for motivated offenders who know they cannot be extradited or apprehended for their online conduct (Van Nguyenet al., 2021).

The complications involved in enforcing and responding to cybercrime behaviors have encouraged various stakeholders (e.g., scholars, police administrators, policymakers) to both obtain a more comprehensive understanding of the cybercrime problem and develop effective solutions to resolve the issue, including implementing changes to the ways these offenses are investigated and criminally processed by the justice system (Goodman, 1997; Holt & Lee, 2019; Holt et al., 2010; Koziarski & Lee, 2020; National Institute of Justice, 2008; Stambaugh et al., 2001). To that end, more tailored and intentional cybercrime training, as well as better resources for frontline officers who often operate as first responders to cybercrime calls for service, have been identified as two of the most important areas in need of attention and reform (Goodman, 1997; Holt & Bossler, 2012b; Holt & Lee, 2019; Stambaugh et al., 2001). Additionally, research has underscored the need for greater collaboration and relational ties between the public and private sector in investigating cybercrime behaviors writ large (Brenner, 2008; Holt & Bossler, 2016; Police Executive Research Forum [PERF], 2014; Stambaugh et al., 2001; Wall & Williams, 2013).

As cybercrimes become more prevalent in society, law enforcement will be increasingly tasked with developing effective solutions to remedy the cybercrime problem (Dodge & Burruss, 2019). Understanding the capabilities and limitations of policing cybercrime is essential for the development of best practices to improve law enforcement responses to online crime and deviance (Dodge & Burruss, 2019). A more effective solution to cybercrime policing may not only serve as a deterrent for future offenders but also improve how cybercrime victims are treated and supported, subsequently affecting perceptions of both law enforcement legitimacy and competency (Koziarski & Lee, 2020).

Given the dynamic landscape of cybercrime and law enforcement efforts to regulate online behavior, a comprehensive overview of law enforcement’s interaction with cybercrime is needed, including how different levels of government respond to cybercrime behaviors. To that end, a discussion on the definition and classification of cybercrime behaviors will be provided in the section on “Cybercrime Definition”, followed by an overview of the different types of law enforcement agencies (i.e., local, state or provincial, federal) and their varying capacities in combating cybercrime, including the role of extralegal agencies and NGOs. Next, the various challenges law enforcement encounter in investigating cybercrime behaviors, including why police agencies have issues responding to cybercrime across all levels of government, will be provided in the section on “Law Enforcement Challenges”. Finally, a discussion on best practices and policy implications for improving law enforcement responses to cybercrime will be provided in the section on “Evidence-Based Policing and Cybercrime”.

Cybercrime Definition

Cybercrime is generally understood as behaviors that involve the use of virtual environments and/or networked computer systems to generate harm (Holt, 2012; Koziarski & Lee, 2020; Wall, 2007a). This broad definition of cybercrime involves a variety of different online behaviors, including interpersonal offenses such as cyberbullying, cyberstalking, and online harassment, as well as those involving the unauthorized use and access of computer systems such as malware dissemination, ransomware, and distributed denial of service (DDoS) attacks (Grabosky, 2001; Holt & Bossler, 2016; Holt, Brewer et al., 2019; Wall, 2001). Although most policymakers and law enforcement personnel acknowledge that cybercrimes exist, there is confusion and uncertainty as to the precise categories of cybercrime and the differential risks and consequences they pose to society (Brenner, 2001; Walden, 2003; Wall, 2005, 2007a.

Cybercrime can be divided into two general categories: computer-assisted crimes and computer-dependent crimes. Computer-assisted crimes are those that existed before the advancement of the Internet but have become more intricate and multi-faceted as a result of technological innovations. In essence, computer-assisted crimes constitute behaviors that have roots and origins in terrestrial spaces but have since expanded to the online realm given developments in technology. Examples of computer-assisted crimes include cyberbullying, cyberstalking, and online fraud. Given that offline versions of these behaviors predated the Internet, computer-assisted crimes are often regulated under their existing offline laws and legislation (Wall, 2007a).

Computer-dependent crimes, on the other hand, are behaviors that did not exist before the proliferation of the Internet. These behaviors are wholly dependent on the Internet and computer systems and cannot exist without them (Wall, 2007a). Examples of computer-dependent crimes include computer hacking, DDoS attacks, malware dissemination, and ransomware. These behaviors often pose the greatest threats and challenges to law enforcement, because they are more difficult to detect and regulate given their novelty, technological complexity, and constantly evolving dynamic (Wall, 2007b).

A distinct feature of cybercrime, regardless whether computer-assisted or computer-dependent, is that it does not require physical proximity between the victim and offender (Jones, 2006). In fact, offenders only need access to an Internet-enabled device (e.g., smartphone, computer, tablet) and know on how to use the Internet to orchestrate their attack (Jones, 2006). This means that victims never have to be in the same physical space or location from their offenders to be a target of cybercrime. This behavioral trait is in direct contrast to traditional offline crime, which require a physical convergence between the involved participants for victimization to occur. The ability to conduct an online attack without the spatiotemporal conditions commonly associated with traditional crime increases the pool of potential offenders and victims because the online crime scene is a globalized space open to the entire Internet-user population (Choi & Lee, 2017).

Another unique feature of cybercrime is that offenders are able to attack multiple targets at once and can do so without expending significant amounts of time and resources (Jones, 2006). Unlike traditional offline crime, cybercrime can be automated to repeat a series of critical attacks against individuals and their computer systems by using malware (i.e., malicious software) and botnets (i.e., network of computers controlled by the offender without the owner’s knowledge) to orchestrate the attack (Jones, 2006). The ability to automate an offense not only saves offenders’ time and energy but can also result in more consequential damage within a shorter time frame (Jones, 2006). These attacks have the ability to render entire servers and computer networks inoperable, leading to massive service disruptions and significant economic loss (Holt et al., 2017).

The economic costs of cybercrime vary depending on the attack, target, and reporting agency. However, the Internet Crime Complaint Center (IC3) of the FBI found that the United States incurred a loss of approximately $1.4 billion due to cybercrime victimization (Federal Bureau of Investigation [FBI], 2017), and the Symantec Corporation reported an international loss of $110 billion (Dodge & Burruss, 2019; Hyman, 2013).³ The discrepancy in figures is a result of multiple factors, including a collective failure to report victimization incidents (e.g., both individual and corporate victims), undetected losses, and self-selection bias (Dodge & Burruss, 2019; Florencio & Herley, 2013). In fact, research has found that organizations experiencing more economic loss are less likely to report their victimization to both law enforcement and private reporting agencies, whereas companies experiencing little loss are more likely to respond to surveys asking about cybercrime victimization levels (Florencio & Herley, 2013).

From a corporate standpoint, businesses may be hesitant to report their victimization because of financial concerns over their diminished reputation and trust as a reliable company. In particular, a negative public image may subsequently damage their corporate stock value and reputation (Dodge & Burruss, 2019). As a result, many companies may choose to conduct internal, private cybercrime investigations instead of informing law enforcement of their victimization (Dodge & Burruss, 2019). Although cases involving catastrophic monetary loss may invoke a law enforcement response, companies may elect to resolve smaller incidents on their own for any one of these reasons (Dodge & Burruss, 2019).

Low cybercrime reporting is also observed among computer-assisted behaviors that have no explicit ties to monetary loss or corporate value. In fact, the U.S. Attorney’s Office (2015) found that only 15% of fraud victims reported their victimization to law enforcement. Studies found that reporting cybercrime victimization to law enforcement may be difficult due to feelings of embarrassment, shame, betrayal, isolation, and loss of both privacy and security (Cross et al., 2016; Dodge & Burruss, 2019). This percentage is significantly lower for individuals who had experienced multiple victimizations, although reports suggest that they report their victimization experiences to other non–law enforcement organizations instead (Dodge & Burruss, 2019; van de Weijer et al., 2019).

It is important to note that cybercrimes can be committed by a variety of different offenders, including individual actors (e.g., lone wolf), a collection of individuals motivated by a mutually shared cause and objective (e.g., Anonymous, Lazarus Gang), or a government or nation-state actor (Chang, 2013). In fact, media reports suggest that several countries actively sponsor cybercrime networks; these countries hack other government systems to steal sensitive information as part of their cyberespionage campaign, including Taiwan, China, Russia, Iran, and the United States (Chang, 2013; Chao, 2010; Information Warfare Monitor, 2009; Mazanec, 2009; Schneier, 2008). The presence of different offender types suggests that cybercrime actors may be motivated by multiple factors, consequently shaping how deterrence tactics and investigation strategies are formulated and enacted in practice.

Local Law Enforcement

Local law enforcement agencies are composed of police officers, who are generally tasked with maintaining public order within a specific municipality or county. Local law enforcement agencies tend to vary in size and capability depending on the size of the community they serve, with larger geographic and more heavily populated localities often having bigger local law enforcement agencies servicing the community (Holt et al., 2017). Regardless of their size, local law enforcement agencies are responsible for a variety of different policing tasks, including investigating crimes, apprehending offenders, and implementing crime prevention mechanisms within their local jurisdiction (Holt et al., 2017).

Individuals may consider local law enforcement officers as first responders to cybercrime incidents, especially given their visibility and responsibility within the local community, but many local law enforcement agencies play minimal roles in the fight against cybercrime and online victimization due to their jurisdictional limitations (Holt et al., 2017). In fact, because local law enforcement agencies are responsible for crimes that occur within their territorial boundaries, they are able to provide adequate assistance and support only if both the victim and offender reside within the same jurisdiction (Holt et al., 2017). To that end, the type of cybercrime most commonly addressed by local forces includes ones that are interpersonal (e.g., person-based) in nature such as online harassment and cyberstalking, as well as those involving the creation and consumption of online child sexual abuse material and online sexual solicitation or prostitution (Cunningham & Kendall, 2010; Holt et al., 2017; Jenkins, 2001).

In addition to jurisdictional limitations, researchers have noted several other challenges to the capability of local law enforcement agencies to regulate cybercrime behaviors, including low levels of community interest and concern for cybercrime behaviors, challenges in investigating various types of online crime, lack of necessary digital forensic tools and investigative technologies, low levels of managerial support for investigating cybercrime behaviors, and difficulties in adequately training and retaining officers qualified to investigate cybercrime inquiries (see Burns et al., 2004; Goodman, 1997; Holt & Lee, 2019; Holt et al., 2010, 2017; Koziarski & Lee, 2020; Senjo, 2004; Stambaugh et al., 2001). Despite these compounding limitations, various stakeholders argue that local law enforcement should play a larger role in combating cybercrime behaviors (Bossler & Holt, 2012; Goodman, 1997; Holt & Lee, 2019; Koziarski & Lee, 2020; Stambaugh et al., 2001).

In fact, supporters advocate for the creation of specialized cybercrime investigation units at the local level that can respond directly to cybercrime calls for service (Hinduja, 2007; Holt et al., 2017; Marcum et al., 2010). To that end, several studies have noted an increase in specialized cybercrime units at the local law enforcement level (Willits & Nowacki, 2016). Even if these units are unable to comprehensively investigate each cybercrime incident, they can initiate the process of collecting digital evidence that may be transferred to state (or provincial) or federal agencies should the case escalate to that level (Hinduja, 2007; Holt et al., 2017; Marcum et al., 2010). It is important to note that local agencies with specialized cybercrime units tend to be those that service a larger community (e.g., major cities and urban areas) and have access to greater technologies and more frontline officers (Holt et al., 2017; Willits & Nowacki, 2016).

Some scholars have also suggested the need to improve the response of local law enforcement to cybercrime, regardless of whether a cybercrime investigation unit is formed and deployed at the local level (see Holt & Lee, 2019; Holt et al., 2010, 2017; Koziarski & Lee, 2020; Stambaugh et al., 2001). These perspectives focus on officers becoming better responders to digital cybercrime scenes and improving their support mechanisms when victims ask for assistance (Holt & Lee, 2019; Holt et al., 2010, 2017; Koziarski & Lee, 2020; Stambaugh et al., 2001). However, it is challenging for local law enforcement to take on this added responsibility when its agency places a lower priority on online behaviors unless a child victim is involved (e.g., online child sexual abuse materials; see Hinduja, 2004; Holt & Bossler, 2012a; Holt et al., 2017; Senjo, 2004; Stambaugh et al., 2001). The incentive to be better responders to cybercrime is unmatched by both the agency and the community they serve, thereby limiting officers’ motivation and willingness to improve their response mechanisms toward cybercrime inquiries. As a result, local law enforcement agencies generally believe that they should not be designated as the primary enforcers of cybercrime behaviors (Bossler & Holt, 2012; Burns et al., 2004; Holt & Lee, 2019; Holt et al., 2017). Rather, they suggest that individual actors be more cautious online and advocate for legal reform including cybercrime-specific legislation (Holt et al., 2017).

State and Provincial Agencies

State and provincial law enforcement agencies are larger police forces that are generally responsible for conduct that occur within their wider state and provincial borders, including conducting highway traffic control and providing forensic services to smaller local agencies residing within their state or province (Holt et al., 2017). With regard to cybercrime enforcement more specifically, state and provincial agencies often become involved only when (a) local forces are limited in their resources to respond adequately to an incident or (b) local jurisdictional conflicts exist (i.e., the victim and offender reside in different counties or municipalities within the same state or province) (Holt et al., 2017; Walker & Katz, 2012). In fact, state and provincial agencies may supply local law enforcement agencies with forensic tools and technologies without actively participating in the local investigation themselves (Holt et al., 2017). One of their primary objectives is to provide local law enforcement agencies with the resources and tools they need to successfully respond to an incident, including digital forensics.

Digital forensics is generally understood as the process of collecting and analyzing digital information to be used by the criminal justice system, including network forensics (e.g., Internet traffic), mobile device forensics (e.g., cell phones), and malware forensics (e.g., malicious software) (Holt et al., 2017). There are four stages to a digital forensic investigation: (a) survey/identification, (b) collection/acquisition, (c) examination/analysis, and (d) report/presentation. Survey/identification is the first step of the investigation process where a team of law enforcement officers and digital forensic technicians search the physical and digital crime scene(s) to identify potential sources of digital evidence (e.g., computers, tablets, phones, USB; see Holt et al., 2017). The second step involves the collection/acquisition of digital evidence, which is concerned with retrieving and preserving the digital evidence. Digital forensic technicians must document how the digital evidence was searched and seized from the original source (Holt et al., 2017). Once digital evidence is collected, the examination/analysis stage begins. This refers to analyzing data (e.g., recovery/extraction) to determine if digital evidence was hidden, manipulated, or deleted during the commission of the crime (Holt et al., 2017). The last stage involves drafting a written report/presentation of digital evidence relevant to the investigation. This report describes each step of the investigation process in detail to ensure everything about the digital forensics process is clear (Holt et al., 2017). Various public and private organizations offer professional training and certifications on digital forensics, including the National Initiative for Cybersecurity Careers and Studies, or NICCS, which is managed by the Office of the Chief Learning Officer within the Cybersecurity and Infrastructure Security Agency.⁴

Many state and provincial law enforcement agencies have specialized cybercrime units to address more technical and resource-intensive online crimes (Willits & Nowacki, 2016). The development of these units may be attributed to larger state and provincial budgets, as well as the fact that they play a role in directly assisting local forces with both cybercrime prevention and investigation (Holt et al., 2015; Willits & Nowacki, 2016). Even if state and provincial agencies are not always the principal actors investigating a cybercrime incident, their enhanced budgets and resources are quintessential in assisting local agencies respond to cybercrime incidents that occur within state and provincial borders (Holt et al., 2017). This is particularly salient for smaller local agencies that do not have enough law enforcement personnel and resources to manage and respond to cybercrime calls for service adequately.

In addition to the specialized cybercrime units, many state and provincial law enforcement agencies have also formed fusion centers that provide intelligence to the appropriate local and federal agencies to assist in crime prevention and investigation (Chermak et al., 2013; Coburn, 2015; Holt et al., 2017). Although these centers were initially conceived to collect and communicate intelligence on emerging terrorist threats, they have since developed into larger information hubs that both process and aid in various investigation efforts at the local, state or provincial, and federal level (Coburn, 2015; Holt et al., 2017; Zetter, 2012).

Federal Law Enforcement

Federal agencies, also commonly referred to as national police in countries such as Canada, South Korea, and the United Kingdom, are those that operate at the highest level of law enforcement; they deal with crimes that involve homeland security (Holt et al., 2017). Because many cybercrimes contain a transnational element, federal law enforcement agencies are often called upon to be the main responders engaging in cybercrime investigations (Holt et al., 2017). Given their broader responsibility in protecting national interests and homeland security, federal law enforcement agencies are given more powers and resources to both investigate and apprehend cybercrime offenders (Walker & Katz, 2012). In fact, federal agencies are able to gain cooperation across several national jurisdictions, as well as across different countries depending on existing political ties and extradition agreements (Holt et al., 2017).

It is important to note that although federal agencies have more power and control than both local and state or provincial law enforcement agencies, different federal actors are responsible for different categories of cybercrime (Holt et al., 2017). For instance, most computer intrusion incidents that affect financial and economic institutions in the United States are handled by the U.S. Secret Service, whereas piracy and intellectual property theft are typically addressed by U.S. Customs and Border Protection. In addition, cases involving online child sexual abuse materials are often the responsibility of Immigration and Customs Enforcement (see Holt et al., 2017).

Federal law enforcement agencies also work alongside non–law enforcement agencies when incidents rise to national security levels (Andress & Winterfeld, 2013). For instance, conduct involving computer and network intrusions of military systems, as well as those involving cyberterrorism and warfare, may invoke participation from both the Department of Defense and the National Security Agency (Holt et al., 2017). Similar agencies in the United Kingdom (e.g., The Ministry of Defense and Government Communications Headquarters), Singapore (e.g., Cyber Security Agency), and Canada (e.g., Communications Security Establishment) also function to support federal law enforcement efforts when problems pose heightened risk to national security (Holt et al., 2017).

Extralegal Agencies and Nongovernmental Organizations

Several non–law enforcement agencies are also active in responding to cybercrime incidents. These agencies, commonly referred to as NGOs given their lack of legal authority in regulating criminal behavior, emerge from both the public and private sector and generally perform acts that support law enforcement investigate cybercrime offenses and prevent online victimization (Holt et al., 2017; Wall, 2007b). These NGOs largely facilitate communication channels and information sharing between victims and law enforcement agencies (Holt et al., 2017). Numerous NGOs and private corporations have also provided important resources to support law enforcement efforts with the investigation of cybercrime (Holt et al., 2017).

The Internet Crime Complaint Center (IC3), formerly known as the Internet Fraud Complaint Center, is a prominent NGO that was created in 2000 as part of a larger joint operation of the FBI, the Bureau of Justice Assistance, and the National White Collar Crime Center. The IC3 was created to be a robust cybercrime reporting mechanism, with a particular focus on economically motivated cybercrimes (Holt et al., 2017). Reporting a cybercrime victimization through the IC3 is relatively straightforward. Individuals are asked to fill out a questionnaire asking about the nature of the cybercrime incident, the identity or traits of the offender (if known), as well as the response from the victim (Holt et al., 2017). Once they complete the questionnaire, the IC3 staff members process the complaint and transfer the case to the appropriate corresponding law enforcement agency (e.g., local, state or provincial, federal).

While the IC3 serves as a cybercrime reporting outlet, other NGOs fulfill different objectives, such as Computer Emergency Response Teams (CERTs), which provide intelligence regarding emerging cybercrime threats affecting both the public and private sector (Holt et al., 2017). Although funding for CERTs may be either public (e.g., government) or private (e.g., corporations), these groups largely function to facilitate intelligence and information sharing (Holt et al., 2017). In fact, approximately 369 CERTs exist worldwide and provide intelligence on emerging threats to computer systems (e.g., hardware and software vulnerabilities). CERTs may also perform diagnostic tests to determine how and when a cybercrime incident occurred (Cybersecurity & Infrastructure Security Agency, 2017; Holt et al., 2017).

It is important to note that not all NGOs are professionally organized or sponsored by larger organizations. In fact, an NGO known as Working to Halt Online Abuse (WHOA) was created in 1997 by community members who formed a group to support individuals victimized by harassment and stalking (Holt et al., 2017). Because WHOA is not an official government or law enforcement agency, it cannot apprehend offenders or directly participate in active criminal investigations. Instead, WHOA connects cybercrime victims with competent officials in various regions around the world to help victims secure a digital crime scene, collect evidence, document their victimization, and contact the appropriate law enforcement agency (Holt et al., 2017).

Law Enforcement Challenges

Evidence-Based Policing and Cybercrime

One approach that could improve how cybercrimes are enforced and regulated is the paradigm of evidence-based policing (EBP) (see Koziarski & Lee, 2020). EBP is a concept adapted from evidence-based medicine that seeks to identify best practices to inform and challenge policing decisions through rigorous, transparent, and replicated/reproduced scientific research (seeKoziarski & Lee, 2020; Sherman, 1998, 2013, 2015; U. K. College of Policing, n.d.). EBP is a collective effort involving law enforcement agencies, academic researchers, and industry personnel/practitioners, whose central focus is to develop a robust evidence base that can identify current and emerging problems in policing, examine possible solutions to these problems using rigorous scientific methods, and monitor these solutions over extended periods of time to ensure successful outcomes are maintained (Koziarski & Lee, 2020; Sherman, 1998, 2013, 2015; U. K. College of Policing, n.d.).

The first step toward implementing an EBP approach to cybercrime is to start an evaluation of existing cybercrime programs, tools, and strategies so that current successes, limitations, and challenges with existing approaches can be identified. The next step of the process is to evaluate best solutions to address these problems and limitations (Koziarski & Lee, 2020). It is important to ensure that police administrators are cognizant of the different forms of cybercrime and the characteristics that make them unique. Accounting for differences in cybercrime behaviors would ensure that each approach is uniquely tailored to the particular offense in question, allowing law enforcement to be more effective at responding to the entire spectrum of online behavior (Koziarski & Lee, 2020).

Along these lines, EBP approaches to cybercrime would benefit from determining best operational practices at each level of law enforcement, including those serving within specialized cybercrime units (Koziarski & Lee, 2020). This evaluation would consider the affordances and limitations of each level of law enforcement and determine best ways to expend these agencies’ time and resources to ensure a successful outcome. This may include streamlining the investigation process such that personnel in smaller, local agencies are provided with specialized training and clear guidelines on how to transfer incident knowledge and digital evidence to both larger and higher levels of law enforcement so that a case can be processed more efficiently (Koziarski & Lee, 2020). The more aware and knowledgeable agencies are with their capabilities in the investigation process, the better allocation of resources and time will be had (Koziarski & Lee, 2020).

To that end, cybercrime training and courses in digital investigation would benefit from being tailored to meet the current needs and demands of particular agencies. Although all training should include coverage of basic digital evidence collection and cybercrime awareness, local law enforcement should have additional content concerning how to respond to civilian calls for service and write cybercrime police reports, as well as effectively transfer more nuanced cybercrime investigation responsibilities to larger agencies that have greater cybercrime investigative resources. Similarly, larger agencies should incorporate more training topics around how best to recruit and retain capable cybercrime investigators, as well as how to perform their responsibilities within their jurisdictional borders (Koziarski & Lee, 2020).

Another aspect of cybercrime policing that may benefit from an EBP approach is determining when it is better for law enforcement or industry personnel to address a particular cybercrime inquiry. It could be that recruiting highly skilled industry personnel is more effective in resolving certain cybercrimes than providing extensive cybercrime training to current law enforcement officers given the experience and expertise of the representatives from industry (Koziarski & Lee, 2020). One way to ensure a more efficient process of recruitment would be to foster stronger partnerships between the public and private sectors so that greater collaborative involvement from each sector could be had without necessarily going through a formal recruitment process (Holt & Lee, 2019; Koziarski & Lee, 2020). For instance, instead of law enforcement hiring industry personnel, these sectors can collaborate to resolve cybercrime incidents by doing their part in regulating online behavior (Koziarski & Lee, 2020). To that end, studies should evaluate whether certain groups of people are better suited for different cybercrime behaviors and identify ways to streamline the investigation process to strengthen law enforcement responses to cybercrime inquiries (Koziarski & Lee, 2020).

EBP approaches to cybercrime should also focus on exploring the different kinds of job stressors affecting law enforcement tasked with enforcing cybercrime behaviors and develop effective coping mechanisms and strategies to improve their overall well-being and mental health (Koziarski & Lee, 2020). Lack of awareness toward cybercrime job stressors may be a result of an overall lack of understanding on what cybercrimes are, their investigative challenges, and the difficulties encountered by law enforcement officers tasked with responding to cybercrime calls for service. To that end, cybercrime awareness campaigns can prove beneficial in that they inform the public of emerging cybercrime threats, their costs to society, and best ways to avoid victimization (Koziarski & Lee, 2020).

As is the case with traditional offline crime, EBP approaches to cybercrime should also focus on forming greater interdisciplinary collaboration across various sectors, especially because every field and discipline has their own strengths regarding the evaluation of data, evidence, and policy. For instance, although criminology and computer science researchers examining cybercrime policing may understand the complex methodological aspects of an evaluation, their understanding of how an approach is enacted in practice may be limited, thus hindering their ability to wholly assess the approach and its effectiveness (Koziarski & Lee, 2020). In fact, research has consistently found that clear and effective communication between the public and private sector is quintessential to the fight against cybercrime (Broadhurst, 2006; Katos & Bednar, 2008; Willits & Nowacki, 2016). Clearly communicating what organization has priority and who will lead different parts of a cybercrime investigation will result in a more effective and efficient response to the cybercrime problem, especially given the large number of players who participate in the regulation of online spaces (Brenner, 2008; Furnell, 2002; Goldsmith & Brewer, 2015; Holt, Brewer, et al., 2019).

Despite the benefits of an EBP approach, it is important not to conflate the application of EBP with the strategies and approaches that are generated from its implementation (see Koziarski & Lee, 2020). Stated differently, applying the EBP framework to cybercrime does not mean that cybercrime problems are resolved using the same strategies and operational practices implemented in offline crime. Although the approach to generating a robust evidence base around best practices is uniform across all phenomena under the scope of EBP, differences in investigation tactics and prevention mechanisms acknowledge the uniqueness of the crime and behavior under review (Koziarski & Lee, 2020).

In addition, it is important that EBP approaches to cybercrime are flexible and account for changes in behavior; strategies that may be deemed effective and efficient for a particular cybercrime at one time may not have lasting effects as the behavior modifies with continued developments in technology (Koziarski & Lee, 2020). Continuously monitoring and tracking the effectiveness of cybercrime tools and approaches may prove particularly useful in these instances, as strategies that are deemed ineffective can be retooled and adjusted appropriately (Koziarski & Lee, 2020).

Although numerous peer-reviewed studies have explored issues involving law enforcement responses to cybercrime offending and victimization (Bossler & Holt, 2012; Holt & Bossler, 2012; Holt, Lee, et al., 2019; Wall & Williams, 2013; Willits & Nowacki, 2016), not enough research has been conducted to generate a replication of findings needed to substantiate a robust evidence base of best practices and operational strategies in the context of cybercrime policing (Koziarski & Lee, 2020). In other words, the scholarship exploring law enforcement responses to cybercrime has been scarce, limiting the evidence base around best practices regarding cybercrime policing (see Holt & Bossler, 2012; Holt, Lee, et al., 2019; Lee et al., 2021 for exception).

An EBP approach to cybercrime has the potential to improve both current and future police practices and decisions, including discussions about how certain strategies are being implemented, measured, and evaluated (Koziarski & Lee, 2020). Because the overall aim of applying an EBP approach to cybercrime policing is to improve law enforcement responses by generating evidence on what programs, interventions, tools, and strategies are effective in different investigation scenarios (Koziarski & Lee, 2020), knowing which operational practices work best in different situations will not only lead to a more intentional use of officers’ time and agency resources, but also strengthen public perceptions of law enforcement in responding to cybercrime calls for service. As a result, initiating an EBP approach to cybercrime would allow agencies to evaluate how their time and resources are being spent, as well as develop more effective and efficient ways to utilize these resources to improve their competencies as capable responders to online crime (Koziarski & Lee, 2020).

Conclusion

The emergence and evolution of cybercrime require a more comprehensive and coordinated solution from various individuals and agencies, including law enforcement, private corporations, and NGOs (Holt et al., 2017). The more serious and prevalent cybercrimes become, the more likely law enforcement agencies are to develop specialized cybercrime investigation units and expend greater resources to enforcing such behaviors (Willits & Nowacki, 2016). In fact, research has found that approximately 85% of law enforcement agencies in the United States addressed some form of cybercrime in 2013, which is a huge increase from 41% in 2000 (Willits & Nowacki, 2016).

Although various sectors take on different roles in the fight against cybercrime and online victimization, there is considerable variation in each agency’s role and capacity to adequately address cybercrime inquiries, including police forces at the local, state or provincial, and federal level (Holt et al., 2017). Efforts to combat cybercrime behaviors are further complicated when incidents involve international communities where political strife and hostility generate difficulties in constructing extradition agreements or cause preexisting agreements to collapse and dissolve (Holt et al., 2017).

Some scholars have promoted creative prevention solutions to the growing cybercrime problem (Jones, 2006). These solutions involve decentralizing the responsibility of policing cybercrime to the larger community of Internet and computer users by allowing individuals to alter software code whenever vulnerabilities are detected (Jones, 2006). These solutions resemble community policing models in that they seek to improve law enforcement–community relationships while simultaneously allowing community members to actively participate in cybercrime enforcement within their communities (Jones, 2006). It is important to note that this community policing approach to cybercrime is not introduced as a result of an antagonistic relationship between computer/Internet users and the police, but from an intelligence standpoint that acknowledges the benefits and strengths in seeking assistance from qualified individuals (Jones, 2006).

A successful community policing approach to cybercrime could be one that is based on a deterrence framework that increases offenders’ costs of engaging in cybercrime by improving both software and hardware technologies to make engaging in online crime more difficult and riskier (Jones, 2006). In fact, a community policing model already exists in some online communities such as those involving e-commerce (e.g., eBay, Craigslist, Amazon), where buyers use rating systems and customer feedback forums to communicate their satisfaction and experience with vendors and sellers to prospective customers (Jones, 2006).

Another way to involve ordinary civilians in the fight against cybercrime could be to increase the use and access of open software (Jones, 2006). Open software, also commonly known as open source, generally refers to those programs and applications that make their underlying source code available to the public so that users can patch and update its code whenever flaws and vulnerabilities are identified (Jones, 2006). Examples of open software include the Linux operating system and the Firefox browser (Jones, 2006). The potential benefit of using open software is in its ability to share the underlying code and be transparent of its security characteristics and flaws to the wider community of software users (Jones, 2006). In similar ways to how community policing in offline settings allow civilians to monitor their neighborhood and its surrounding activities, using open software enables software users and developers to monitor the underlying code and make changes whenever vulnerabilities are detected (Jones, 2006).

Although open software has the potential to improve the cybercrime problem, it must not be confused as a panacea for cybercrimes writ large (Jones, 2006). Even if open software gives software users the ability to rewrite code and patch known vulnerabilities in the underlying system, these individuals must be willing and motivated to interact with these projects (Jones, 2006). Knowing how to repair a flawed system and update an incomplete line of code does not necessarily mean that these individuals will be motivated to follow through with those actions. In addition, for any software to become open source, the founding individuals or corporation must be willing to divorce themselves from the proprietary software, which may result in substantive economic loss (Jones, 2006).

In addition to improving their knowledge and capacities around cybercrime investigation, law enforcement must simultaneously work toward fostering positive, mutually advantageous relationships with industry partners and computer security professionals (Brenner, 2010; Wall, 2007b). Forming strong cooperative relationships across different public and private sectors may facilitate better intelligence sharing and ways of obtaining digital evidence during cybercrime investigations (Brenner, 2010; Chang, 2013). If law enforcement desires to be more a more effective responder to cybercrime cases, both greater collaboration between the public and private sector and innovative technical solutions must be encouraged and implemented by domestic and international communities alike. Although complications in cybercrime investigation are bound to arise, if effective cybercrime policing mechanisms are to be achieved, a more concerted effort that involves the entire community must be had.