Criminological concepts and research findings relevant for improving computer crime control

Abstract

It is ironic that the field of information systems security lacks sufficient concepts or sophisticated insights concerning computer criminals. Information security's operating models and procedures contain a number of largely untested and possibly quite incorrect assumptions about how and why computer criminals function. These assumptions serve as the platform upon which controls and safeguards have been established. Computer aspects of computer crime have quite appropriately been stressed. Yet, other important aspects addressing how opportunities are created for crime and the motivations that shape the crime are given short shrift. It is time to add criminological concepts to the information security database and to more definitively place crime control concepts within the information security process. This paper will discuss certain major criminological aspects of information systems security. The emphasis of the discussion will be on specific criminoligical aspects that can contribute to a better understanding of how computer crimes are committed. These, in turn, can increase our ability to improve information security.