Cybercrimeology

Notes:
Alessandro's journey from studying law to discovering criminology and pursuing a career in research.
His experience conducting ethnographic research into black-market ticket selling and online deviance.
Traditional neutralization theory and how individuals justify behaviour they recognise as wrong.
The development of the aesthetics of cruelty as an extension of existing criminological theory.
The role of shock, humour and provocation in sharing hateful memes.
How the target of offensive content can be irrelevant or interchangeable within certain online communities.
The shared appreciation of shocking material as a basis for social interaction and belonging.
The importance of context in understanding offensive humour and online behaviour.
How memes can escape their original communities and reach unintended audiences.
The increasing accessibility of extreme content on mainstream social media platforms.
The potential normalization of offensive content through repeated exposure.
The status associated with receiving platform bans for sharing particularly offensive material.
The potential exploitation of these communities by individuals promoting extremist ideologies.
The challenges of automated content moderation and the commercial incentives of social media platforms.
The discussion of social media restrictions for younger users.
About our Guest
Alessandro Moretti
https://researchprofiles.ku.dk/en/persons/alessandro-moretti/

Papers or resources mentioned in this episode:
Moretti, A., & Demant, J. (2026). Neutralization without drift: The aesthetics of cruelty in hateful meme sharing. The British Journal of Criminology. https://doi.org/10.1093/bjc/azaf092
Hayward, K., Moretti, A., Mizrahi-Werner, J., & Demant, J. (2026). “That is just fucked up, I think I’ll be leaving now”: Coded language, hateful humor, and plausible deniability in dark memes on Facebook. Deviant Behavior. https://doi.org/10.1080/01639625.2026.2688360
Demant, J. J., & Moretti, A. (2024). Intrusiveness and the public-private divide in netnography: A situated, structured approach for ethical research in the context of closed, group-based, or hidden social media behavior. International Journal of Qualitative Methods, 23. https://doi.org/10.1177/16094069241257937
Sykes, G. M., & Matza, D. (1957). Techniques of neutralization: A theory of delinquency. American Sociological Review, 22(6), 664–670. https://doi.org/10.2307/2089195
Other
Moretti, A. (2023). The rise and rise of illegal ticket touting: An ethnography of deviant entrepreneurship. Routledge. https://doi.org/10.4324/9781003168553
L'Hoiry, X., Moretti, A., & Antonopoulos, G. A. (2024). Identifying sex trafficking in adult services websites: An exploratory study with a British police force. Trends in Organized Crime, 27, 34–55. https://doi.org/10.1007/s12117-021-09414-1

Notes:

Ms. Aybar traces her interest in criminal justice, government and politics back to childhood. She recalls her father having her choose a current event from the Sunday newspaper and then discussing it with him, and says she already knew by seventh grade that she wanted to attend John Jay College of Criminal Justice.

Her route into cybercrime came through advertising and political campaigns. As digital advertising became increasingly important, she encountered problems with advertisements being directed toward bots rather than people and became involved in applying fraud-prevention techniques to campaigns. This experience sparked a wider interest in cybercrime.

After beginning her PhD, Ms. Aybar worked on a research assignment involving USAID and DAI focused on enhancing Ukraine’s cybersecurity posture. The work led her further into the national-security side of cybersecurity and into studying nation-state, non-state and other cyber actors.

Ms. Aybar and her dissertation chair, Dr. Rob T. Guerette, used environmental criminology and rational choice theory to examine whether state-sponsored and non-state cyber actors demonstrate different behavioural signatures. Rather than focusing only on the tools used in an attack, the approach considers the choices attackers make around risk, reward, effort, visibility, operational security and what they are ultimately trying to accomplish.

The study uses data from the European Repository of Cyber Incidents (EuRepoC), allowing the researchers to look for patterns across a large number of publicly documented cyber incidents over time. Ms. Aybar notes that this scale is useful, but also stresses that the data only represent incidents that are visible, recorded and attributable rather than the full universe of cyber activity. Changes in the threat landscape, actor names and APT naming conventions also create challenges for classification and consistency.

The clearest distinction in the study was that non-state actors were more associated with high-visibility and immediate-impact activity, including ransomware, disruption, doxxing and publicly confirming responsibility for an attack. State-sponsored or state-affiliated actors were more associated with lower-visibility strategic activity, particularly data theft and reduced operational disruption.

From a rational choice perspective, Ms. Aybar suggests these differences reflect different incentives. Non-state actors may benefit from visibility, pressure or immediate financial gain, while state-linked actors may have reasons to preserve access, avoid attention and quietly collect intelligence or strategically valuable data. She emphasizes that, regardless of the category of actor, there are still people behind the screens making these choices.

Not all of the study’s expectations were supported. The researchers expected state-sponsored actors to be more likely to target state and political systems, but this was not supported in their first theoretically guided model. Ms. Aybar suggests this may reflect strategic indirection: a state-linked actor can pursue a state-level objective by targeting contractors, universities, infrastructure dependencies, supply-chain intermediaries or private companies rather than attacking a government agency directly.

Ms. Aybar’s planned dissertation consists of three studies. The first will develop behavioural baselines for state-linked cyber operations associated with China, Iran, North Korea and Russia and compare their operational and visibility patterns. The second will examine time to public attribution and whether behavioural characteristics are associated with how quickly an actor is publicly named.

Her third dissertation study will examine ransomware crime scripts in the biotechnology and life sciences sector compared with general enterprise cases. The aim is to identify points in the ransomware process where situational crime-prevention techniques could potentially disrupt an attack.

This work has also led Ms. Aybar toward the emerging area of cyber biosecurity. She is interested in what happens when cyber threats intersect with biological data, laboratory systems, pharmaceutical research, AI and the wider bioeconomy, approaching these issues from a cybercrime and national-security perspective.

About our guest:

Priscilla F. Aybar, M.A.

Florida International University — International Crime and Justice PhD Program

https://ccj.fiu.edu/people/ph.d.-students/



Papers or resources mentioned in this episode:

Aybar, P. F., & Guerette, R. T. (2026). Rational choices in cyberspace: Quantitative insights into targeting and attack behavior among cyber offenders. Journal of Criminal Justice, 103, 102621. https://doi.org/10.1016/j.jcrimjus.2026.102621

Pixalate & The Democratic Congressional Campaign Committee (DCCC): How the DCCC used Pixalate to reduce ad fraud

A case study featuring Ms. Aybar’s work using invalid-traffic detection and advertising analytics to reduce ad fraud in political digital campaigns.

https://www.pixalate.com/case-study-dccc-ad-fraud-protection

European Repository of Cyber Incidents (EuRepoC)

https://eurepoc.eu/database/

Notes:

Ms. Ayerza studied criminology, forensic behavioural sciences and psychology. Her early research examined eyewitness memory and the re-entry of exonerees before she became interested in cybercrime and cyberstalking.

She was drawn to cybercrime because it is not limited to hacking, malware and phishing. Technology is part of everyday life through social media, email, dating apps and other commonly used services.

Dating apps allow users to create profiles, specify the people and relationships in which they are interested and indicate interest in other users. When two users express an interest in one another, they can normally begin communicating through the app.

Some dating apps are intended for broad audiences, while others serve particular lifestyles, interests or sexual orientations. Profiles are often presented as individual photographs or grids of photographs from which users make selections.

Ms. Ayerza explains that dating apps are designed to make dating convenient and can feel like games. The superficial and rapid nature of matching can encourage users to make decisions based primarily on photographs.

Harassment can arise when users send repeated messages in an effort to gain someone’s attention. Some people may not recognize these repeated or unwanted communications as harassment.

Users may also deliberately match with someone because they disagree with something in that person’s profile and want an opportunity to criticize or harass them.

Ms. Ayerza conducted an online survey of adult dating app users living in the United States. The study examined the information people included in their profiles, the photographs they shared and characteristics of the applications they used.

The study considered whether users disclosed their relationship preferences, sexual orientation, workplace or occupation. It also examined whether they used their full name or an alternative name and whether their photographs included friends or family.

Verification on dating apps can be a relatively superficial process in which a live photograph is compared with the photographs on a profile. Premium features may also allow users to change the location in which their profiles appear.

Users often adopt their own protective measures, such as using pseudonyms or withholding photographs of their faces. However, designing effective technical safeguards is difficult because repeated messages can be part of both ordinary conversations and harassment.

Most dating app users do not experience harassment, but Ms. Ayerza says that around a quarter of the users in the study experienced these forms of harm.

The study did not compare victimisation across individual dating apps. Ms. Ayerza suggests that larger platforms may have more resources and face greater public pressure to introduce safeguards, while smaller platforms may have fewer resources.

Sharing relationship or sexual orientation preferences was not found to increase risk. Ms. Ayerza suggests that these preferences help platforms present users with people who have similar interests without necessarily revealing where someone can be found.

Including information about where a person works or studies increased risk. Photographs featuring friends or family also had an influence because they can reveal social connections and additional information about the user.

Uploading photographs of one’s face was not found to increase risk, possibly because facial photographs are a normal and often required part of using dating apps.

Matching with someone under the age of 18 increased risk. Ms. Ayerza connects this finding to the limited measures used by dating apps to confirm that users are old enough to participate.

One of the most surprising findings was that using a pseudonym or nickname increased risk. Ms. Ayerza discusses the possibility that an alternative name creates a false sense of security and encourages people to disclose more information.

Ms. Ayerza advises users to think carefully about what they disclose. Preferences may be appropriate to share, while details about occupations, workplaces, friends and family may be better withheld until someone is known more closely.

She emphasizes that responsibility should not be placed entirely on victims. People should understand that harassment is unacceptable and platform operators should do more to prevent and respond to harmful behaviour.

Possible platform interventions include better reporting mechanisms and educational or training modules that users complete before creating a profile.

Schools could help prepare young people to communicate appropriately on dating apps once they are old enough to use them. Ms. Ayerza also argues that governments should treat conduct on dating apps more seriously because every profile represents a real person.

Future researchers need measures that reflect the activities people actually perform on dating apps. Greater consistency would also make it easier to compare findings across studies.

Ms. Ayerza plans to examine offending as well as victimisation. Her future research will consider unwanted sexual messages, sexual violence and the experience of multiple forms of harm on dating apps.

About our guest:

Jennifer M. Ayerza, M.A.

https://cls.gmu.edu/people/jayerza

https://cebcp.org/team/jennifer-ayerza/

https://www.linkedin.com/in/jennifer-ayerza-38353a233

Papers or resources mentioned in this episode:

Ayerza, J. M., Lee, J. R., O’Malley, R. L., & Lee, C. S. (2026). Cyberstalking and online dating: Examining cyberstalking victimization among dating app users. Asian Journal of Criminology, 21, Article 5.

https://doi.org/10.1007/s11417-025-09480-2

Notes:

Irnasya Hadi explains how growing up with the internet, and being frustrated by the limited connection between critical criminology and cybercrime, drew her toward the study of cyber insecurity.

The conversation turns to Indonesia and the difficulty of producing nationally representative cybercrime research in a country with a very large population, uneven internet access and uneven documentation.

She discusses why cybercrime theories, surveys and assumptions from places such as Canada, the United States, the United Kingdom and Australia cannot simply be imported into Indonesian or Asian contexts.

The episode examines the stereotype that cybercrime is produced in Asia and victimizes people elsewhere. Hadi pushes back against this framing by noting that many of the victims of cybercrime in Asia are themselves Asian.

She reflects on the imbalance between Global North and Global South knowledge production, especially when Global South researchers often have to know Northern theory while Northern researchers may know far less about Southern contexts.

The conversation introduces the Snapshot of Society method, which begins with people and organizations already working on a topic, then moves to affected members of the public, then to a broader survey stage.

Civil society organizations can provide an insider perspective on issues such as government data breaches, while affected members of the public can reveal where expert assumptions do or do not match lived experience.

A central finding from Hadi’s work is that people may not be indifferent to government data breaches. Instead, they may care deeply but feel too fatigued, resigned or worn down to respond.

The discussion explores generational differences in how Indonesians understand government data breaches. Younger people may be more aware of cascading risks such as spam calls, identity theft and data being sold online, while older generations may interpret exposure to online risk differently.

She discusses the role of insider knowledge in qualitative research, including how local jokes, shared experience and awareness of government priorities can shape what a researcher hears and how they interpret it.

The episode closes with the broader promise of the Snapshot of Society approach: locally grounded studies from different places could be added together to build a richer global picture of cybercrime that does not simply mean the United States and the United Kingdom.

About our guest:

Irnasya Hadi

https://www.linkedin.com/in/irnasya-shafira-hadi-9524b0145/

https://scholar.google.com/citations?user=dnc6cUcAAAAJ

https://orcid.org/0000-0001-8929-329X

 

Papers or resources mentioned in this episode:

Hadi, I. S., Chang, L. Y. C., & Davies, S. G. (2026). The Snapshot of Society: Challenges of Studying Cyber Insecurity in the Global South? Asian Journal of Criminology, 21, Article 25. https://doi.org/10.1007/s11417-026-09494-4

Hadi, I. S. (2025). Inaction as Nonformal Reaction: Rethinking Crime Perception in the Era of Data Breaches. Jurnal Kriminologi Indonesia, 1(1), Article 1. https://doi.org/10.7454/kriminologi.v1.i1.1000

 

Other:

“The data analysis process uses Atlas.ti software, Microsoft Word, Microsoft Excel, printouts, and highlighters.” (Hadi et al., 2026, p. 14).  🤣

Notes:

Dr. Bridgman discusses his path from Winnipeg to McGill and how he became involved with the Media Ecosystem Observatory while still a PhD student.

The conversation turns to the origins of the Media Ecosystem Observatory during the 2019 Canadian federal election and how its work continued through the pandemic, the Hogue Commission and the growing focus on information ecosystem health in Canada.

Dr. Bridgman explains why COVID-19 and AI have been two major disruptions in the information environment and why AI agents may become one of the main ways people encounter public information.

The episode looks at the shift from traditional search, where users clicked through to sources, to AI summaries that may give users enough information without sending them to the people or organizations that produced it.

Dr. Bridgman discusses the problem of value transfer, explaining how aggregators have captured value from original information production and how AI agents may become even more powerful aggregators.

The conversation considers how common AI news use already is, including the difficulty of measuring it because many people may not recognize that ordinary search now includes AI-generated answers.

Dr. Bridgman explains what he means by an AI agent: a general intelligence connected to tools that allow it to search, read, summarize and act in digital environments.

The discussion uses the idea of AI as a “brilliant intern” to explain why these systems can be useful, capable and eager to please, while still lacking judgment about the broader consequences of how they complete a task.

The episode closes by looking at the harms that may follow if original information production is not sustained, including poorer information, weaker attribution and new challenges for democratic accountability.

About our guest:

Dr. Aengus Bridgman

https://meo.ca/people/aengus-bridgman

https://abridgman.ca/

Papers or resources mentioned in this episode:

Owen, T., & Bridgman, A. (2026). AI News Audit: How AI Models Use and Distribute Canadian Journalism. Media Ecosystem Observatory.

https://meo.ca/work/how-ai-models-use-and-distribute-canadian-journalism

Owen, T., & Bridgman, A. (2026). AI News Audit: AI, Canadian Journalism, and Paths for Policy Action. Centre for Media, Technology and Democracy.

https://www.mediatechdemocracy.com/all-work/ai-canadian-journalism-and-paths-for-policy-action

Other:

Media Ecosystem Observatory

https://meo.ca/

Centre for Media, Technology and Democracy

https://www.mediatechdemocracy.com/