MIC drop: Beware the metaphor-industrial complex

US president Dwight Eisenhower warned in 1961 ‘we must guard against the acquisition of unwarranted influence, whether sought or unsought, by the military–industrial complex’ (MIC). The idea that there is a grouping of lobbyists and industry desperate to suborn public money for their agenda is persistent in Western political discourse. It is suspected that the MIC rigs public discourse and provokes the odd minor war or two. It is a handily portable quote, so we have references to the pharma-industrial complex, the trans-industrial complex, data-industrial complex, the woke-industrial complex and on and on. There is probably an industrial complex-industrial complex.

Though it captures some real dynamics – regulatory capture and so on – the specific claim is wrong in its context and more generally. Historically, most developments attributed to the MIC have come from political competition, external to the MIC itself. To take one core example, the ‘missile gap’ myth was promoted by president to be John F Kennedy. He used it to build his career as a US Senator and made the basis for a successful run for US President. Yes, lovely JFK was a total warmonger. Supposedly the Soviet Union had an edge in the effectiveness and quantity of their nuclear missiles and this needed to be matched by the USA. The missile gap did not in fact exist, and JFK probably knew that. He also knew that his opponent could not disprove it without looking weak and also sharing classified information. The MIC was the instrument, not the prime mover, of this particular addition to the arms race.

Coming back from that divergence, metaphors spread widely in social science, sometimes because they are more effective rhetorically than analytically. MIC succeeds because it is an effective metaphor. We see a lot of metaphorisation of our discourse. Type ‘uberisation’ into Google Scholar. Most of social life is being uberised apparently.  Before it was Googlization, and before that McDonaldization. I regret to inform you that Education 3.0 is now also a thing. The metaphors are handy but like any figure of speech might conceal as they reveal. For example, focusing on how work is being made casual and algorithmically governed is important but also tends towards presentism. We forget the tools that helped us in the past understand and sometimes fight against these tendencies.

Metaphors are useful little packages of meaning and I have used a few already (eg. ‘arms race’). They are different from reusable analytic concepts. In contrast, the concept of weapons of the weak is one that has been widely reapplied and while malleable is also coherent and internally consistent. It is also rhetorically powerful and persuasive. It is perhaps not possible to separate a concept’s rhetorical power from its empirical traction but the latter should lead. The nature of competition in social science means that we can end up pursuing beguiling rhetoric at the expense of the work needed to bring it down to earth.

If you want to read further the CIA (yes, THE C I A), has a great collection of documents on the missile gap. They are a fascinating study of evolving intelligence capabilities and concerns. Top marks if you write ‘weapons of the week’ like it’s an offer at Tesco.

Ritzer, George. The McDonaldization of Society. Sage, 2013.

Scott, James C. Weapons of the Weak. Yale university Press, 2008.

What’s the difference between description and analysis? The myth of the unfakeable banknote

I often say to students ‘describe, then analyse’. Well, how do you know which one you are doing and what the difference between them is? And while we’re about it, what’s the difference between method and methodology, hmmm? There is really no fundamental difference. Description always involves a choice of terms in which to describe, and these are analytical choices. Analysis is just being aware of those choices, understanding that some choices have been made for you before you even start, then deciding what elements to focus on, and drawing connections between cases in order to make inferences. Analysis is therefore that ability to connect the description to a category or process that tells you about it, and being aware of the context in which it is produced.

For example, I research banknote counterfeiting. One aspect of that is looking at how banks and tellers detect counterfeits. A start to that is by describing the equipment used (e.g. ultraviolet lamps) and then the process (the different kinds of examination notes undergo). Analysis is looking at what informs the design of those technologies and processes. One ground level assumption everyone works with is that there is an objective way to tell the difference once and for all. Analysis looks at what effect these assumptions have in the world. For example, if tellers are held responsible for accepting counterfeits then that shifts the responsibility from the designer to the lowest level human in the process. That tells us about who has power over money. We can then say a lot more about how cash notes fit into the economy as part of a whole process based on distributing trust and responsibility. We might also look at the changing design of notes as partly symbolic, incorporating banal nationalism at some stages, and also about shifting understandings of the role of cash and money in the economy.

The design of the Euro notes gives new meaning to both. The semiotics are significant. They are intentionally banal. Each country is only represented in the serial numbers of the notes, and the images uses are intended not to refer to anything real that might get people hot under the collar. You can compare those notes to others that intend to communicate stability and reliability, or seek to say something about the nation they represent. Finland’s markka notes designed by Eliel Saarinen are a lovely example of aspirational nationalist modernism at a time when Finnish national consciousness was starting to cohere around national independence. Scammers faked the Finnish markka and in one genius instance made a 20 markka note into a non existent 2000 mark note by the simple means of adding two zeros to the face number. While that wouldn’t have fooled a lot of Finns it might have worked when exchanging the notes abroad.

The security features also are semiotic: the signal trust, but also have to perform practically. They need to be readable to the human eye and sensitive to touch, to make them quickly recognisable. We can then ask what this tells us about the notes as circulating media or as stores of value, the intended rapidity of their circulation and how the designers understand where they will be exchanged.

Analysis then leads us to further questions. Do central banks plan there to be a perfectly unfakeable note? How do fake notes affect people’s faith in money? Do times of hyperinflation or deflation change this relationship? How does computer fraud change the faith people put in digital versus physical currency? How does the creation of automatic transaction terminals such as supermarket customer checkout systems shift the equation? Increasingly we look at currency and payment as a closed system, which alters what we understand cash to be. Cash can operate as something valued independently of its ‘face value’. For example, in Russia during 1992 there was a shortage of small value 15-kopek pieces used for payphones, so they began changing hands for much more (Lemon, 1998). Likewise, drug dealers in parts of the USA refused to accept one dollar bills, so local shops made a lively trade selling 10 dollar bills to drug users for 11 one dollar bills.

Analysis also helps us tell the difference between banally obvious statements that still need to be made (e.g. that every banknote is an act of faith) and propositions that can be tested (e.g. people automatically have more trust in higher value notes). Just in case anyone things I am ragging on cash, cryptocurrency is worse (Bratspies, 2018).

We often think of description as mundane and concrete and analysis as showy and abstract. The reverse is true. Every act of description is an act of creation, and every act of analysis brings that creation back to earth.

Bratspies, Rebecca M. 2018. Cryptocurrency and the Myth of the Trustless Transaction. SSRN Scholarly Paper. ID 3141605. Rochester, NY: Social Science Research Network.
Lemon, Alaina. ‘“Your Eyes Are Green like Dollars”: Counterfeit Cash, National Substance, and Currency Apartheid in 1990s Russia’. Cultural Anthropology 13, no. 1 (1998): 22–55. https://doi.org/10.1525/can.1998.13.1.22.

Malware: proposal for a social history

Computer security is the culmination of a series of subversions. Just as policing evolves in response to crime, so computer systems evolve in response to threats. When it comes to malware, while the code is clever, the social engineering is more persistent, and more depressing. Malware designers evolve their products through testing and tooling to find out what works best. What wording will mean that more victims click on that ransomware link? Do people trust social media messages more than emails? More and more, malware evolves in response to human social and economic systems, and organisational/geo-political priorities, rather than to technical vulnerabilities.

Technological histories exist, recording major developments – the first Worm, the first RootKit, the first ransomware and so on. The social history is more dispersed and is yet to be written. Elements of a theory of malware could focus on: Where was it developed, for what purpose, who by, and how? How have victim and perpetrator characteristics evolved with the systems they use? What ethical and political questions are raised by it? For example, do we have the right to destroy self replicating computer programs, and how should malware be preserved for future study? My sense is malware history is somewhat separated from other kinds of crime historiography.

We would need to begin with a basic taxonomy. Here is my first sketch of the social history of malware: First stage: technically focused malware. Often created to prove a point, or by accident, like the first computer worm. Second stage: payload. Malware delivers a technical form that does something else, like modifies a computer system, or locks you out of it. Third stage: organisational. Malware becomes an object of economic and political activity. There is a high division of labour. Stuxnet and NotPetya encode geo-political priorities. Markets like Dark0de trade and systematise it.

Methods should set out the relevant fields. Studying evolving malware means studying the evolving computer security industry, its capacity for threat detection and horizon analysis, and the back and forth between malware operators and industry personnel. Constructs to be examined include changes in how costs are calculated and understood – from direct economic losses to reputation damage, lay perceptions of malware, and popular discourse and cultural representations of the topic. There is an opportunity for theoretical innovation here, for example considering QAnon as a mimetic virus.

Lessons to learn: total security is not possible (Aycock, 2006). We might end up with an understanding of malware as a varied sphere of illegitimacy, which is occupied in different ways by systems and people. The debate over disinformation could fit into this.  It is a powerful propaganda tool used by authoritarian regimes to suppress civil liberties, undermine opposition and simply swamp out opposition or independent information and as a tool of international relations. But also itself become a go-to tool for strategic de-legitimation of uncomfortable political positions (you used the fakes!). Likewise, malware is a purposeful set of technical instruments which share characteristics. There may be a myth of precision influencing discussion, that if only we get the right focus we can pre-cog malware and harden vulnerable targets – code for you dumb users. It is a dance that won’t stop.
To carry out this study we would have to be mindful of Inglis (2014) critique of presentism and simplistic periodisation in sociology and elsewhere, and develop an understanding of the sociological dynamics underpinning cybercrime that avoids simple periodisation and to which I would add social science’s tendency towards deletion of its recent past.
Aycock, John. 2006. Computer Viruses and Malware. Springer.
Inglis, David. 2014. ‘What Is Worth Defending in Sociology Today? Presentism, Historical Vision and the Uses of Sociology’. Cultural Sociology 8(1):99–118. doi: 10.1177/1749975512473288.

Aspirational illicit markets

Early in my career I researched smoking in areas of multiple deprivation in Scotland. At the time these were places where the social, economic and physical fabric had been severely weakened due to overlapping stressors. High crime, low income, low economic activity and widespread health problems were multiple challenges for people who lived there. That is what I think of as intersectionality. Smoking was often quoted by people I interviewed as being their one reliable pleasure. The rising cost of cigarettes and tobacco was an irritant but not often an incentive to quit. Though under strain at the time, there was a strong neighbourhood environment in many places.

One set of relationships that was sustained throughout was the illicit cigarette market. Taxes were spiking and there was a wide opportunity for people who wanted to import tobacco products cheaply. As with many illicit importing operations a tricky bit is the last retail step. Shipments need to be broken into units that will be affordable and available and this needs a staged operation with sometimes multiple ‘final miles’ involved. Several competing approaches were applied. Tobacco could be sold in pubs, under the counter of existing shops, or delivered directly. In the last case pizza companies were set up as fronts for tobacco delivery.

The level of entrepreneurial innovation going on here alerted me to the aspirational nature of illicit markets. Some illicit operations are attractive because they are the only game in town, sometimes participating in them offers purpose, income and aspiration and something resembling a career. While that was going on many others in the community rejected this as a route. They viewed illicit work as harmful to the community, attracting dangerous criminals and damaging its reputation. These markets were contested, and meaningful. Therefore when they are interdicted we should be aware of the fallout, positive and negative, and the absences left behind by them.

The long and short future

🎵 In the year 2525, if man is still alive, if woman can survive 🎵 

Projects such as the Clock of the Long Now, the Svalbard Global Seed Vault, and deep time Nuclear Semiotics work with time horizons of millenia. These are about changing our time perspective in response to challenges created by humanity such as environmental problems and the demands of long term nuclear waste storage. These come at a time when the tools humanity set up that institute a long term consciousness, religion and orthodoxy, have been swept aside by the Smiley People Who Know Everything. The moral obligations current humans have to future society are up for grabs. What costs might we be unknowingly or uncaringly imposing on them? Maybe the only obligation you have is to live your best life. In the Douglas Adams short story Young Zaphod Plays it Safe a way of mining the past for energy is discovered. Everyone is pretty pleased with themselves at this innovation: energy from the one place where no-one will kick up a fuss. Too late they discover that mining the past creates a problem for the present, as the future is doing the same thing to them. People will only really be motivated to act, he implies, if they have something at stake. 

So what can be employed to give us something to care about? One answer is the human delight in narrative, which explains why science fiction authors made such a contribution o the long term semiotics discussions that have come about as a result of the need to store long term nuclear waste, with a time horizon of about 10,000 years. Can a message be dispatched, interpreted, understood and acted on over a timescale greater than human civilisation? If we create a story of ourselves as heroically saving the future while also leaving a bloody big monument to it, we night be bothered to make an actual effort. The content is tricky however. It must convince the future people not to dig up this particular patch of ground and also convince the present people that it will do that. The paradox is that we might like to leave some monuments to ourselves, but any monument is attractive. Any warning sign looks like a treasure map, or just ceases to mean anything, given enough time. Gregory Benford points to problems of expert conformity and false certainty in deep time estimation, as in any enterprise.

The coming of the … society

The …isation hypothesis

That is certainly the case in future world talk in sociology. How good has sociology been at identifying valid future trends and self-correcting in the face of evidence? And can we not talk about this please? Let’s start with one of the worst charges on the docket, the secularisation hypothesis. Basically: as societies become modern, they become secular. It is pretty much not true and like most failed predictions extrapolates from a small set of cases in one moment to a general trend about societal evolution. Demographic transition is a more solid prediction, and is notable for largely existing outside mainstream sociology. Yup, everyone is getting older apart from the religo-crazies, a fact we would all just rather ignore thank you.

Lots of sociology futures now name a type of society coming into being – the metric society, the screen society, the network society, the algorithmic/platform society. Or they seek out an organising metaphor like fluidity or liquidity, using it a characteristic that in some way is central to the transformed social life and which people will have to live with. Usually the argument is presented in a motte and bailey style. It is asserted that such and such a characteristic is fluid, meaning without form or structure. Then it is pointed out that it does have form and structure, at which point the argument shifts to say that fluidity just means flexible or changing, network just means connected etc. No books have been titled ‘The Rigid Society’ or ‘Inflexible, Untroubled Gender’ or ‘The Coming Non-Crisis of Capitalism’. The traffic is all one way, which tells you how detached it is from empirical data but not from the incentives of academic publishing.

While sociology and future writing love their metaphors, they do not love their humans. Humans get a bad rep in sociology, behavioural economics and social psychology. They are usually criticised for their short termism,  various cognitive biases and a general inability to consider severe threats and fantastic opportunities that are not immediately apparent and the general set of cognitive limits I am confident nobody ever called ‘Gidden’s Paradox’. I am not sure humans suffer from the short term perspective often claimed. Giddens, the Nudgers and others speak confidently from a future that has not happened yet, and condemn humans for being insufficiently panicked at something which we have very little capacity to do much about. It is irksome because of the tendency for expert groups and elites to form their own consensus and anathematise any doubters, and the lack of humility when they turn out yet again to be wrong. 

“In the Year 2525 (Exordium & Terminus)” by Zager and Evans, RCA Victor, 1969.

Microsocial crime script in a meta criminal context: crime script analysis as applied to hybrid digital crime

This post is about crime script analysis as a method of bridging micro- and meta- analysis of criminal activity. It lays out what crime script is and how it can be used to understand the relationship between the material criminal context and the patterning of criminal action.

The origins and application of crime script analysis

Cohen and Felson (Cohen and Felson, 1979) analysed US crime rates following the Second World War. They suggested crime rates are not well correlated with socio-economic stressors such as unemployment, poverty and inequality. Crime incidence may increase in good times and slow in bad times. It does closely match opportunities. What is there matters more than what is not there. That is why crime can increase in good times. There is more stuff. As a material of theory of crime this works on a basic level. There is no car theft without cars to steal and a large enough market to sell into. That insight is the basis for Routine Activities Theory (RAT) which states that acquisitive crime is patterned and dependent on the existence of an opportunity, a motivated criminal and an absent guardian (Andersen and Farrell, 2015). It also explains some of the reduction of material crime as a result of the rise of the digital economy. As the economy becomes centred on virtual goods it becomes more difficult and less lucrative to traffic in stolen property. In this new environment criminal groups and methods either fall or adapt and exploit new opportunities presented by digital society.

An approach is needed to understand criminal innovation and the success or failure of specific criminal methods which are persistent, patterned and shared between criminals. One way of doing this is through Crime Script Analysis (CSA), developed by Cornish (Cornish, 1994). CSA characterises criminal activity as routine and purposive and identifies a criminal modus operandi. Much criminology and policing practice had focused on the crime event itself, hoping to catch criminals in the act. CSA puts the offending act itself in a context of preparation, commission, and leaving. By laying out the sequence like this the criminal act can be disrupted by situational crime prevention (SCP) measures which interfere with different stages of the script. For example a study of illicit opioid sales might identify lax or corruption prescription of painkillers as a source for drug dealers and reduce incentives for overprescribing (Moreto et al., 2020). Each stage in the script suggests a control intervention like target hardening, control of entry/exit routes, and limiting opportunities to profit from crime. Many of the steps identified might not in isolation constitute illegal acts. As a result CSA can be used to propose changes in the law, for example, criminalising ‘grooming’ by child sexual predators as a critical stage in the preparation of child abuse.

Target attraction is based on VIVA (value, inertia, visibility and accessibility). Felson (Felson, 2000) argues the theory helps avoid common mistakes which assume in a common-sense fashion that social disorder leads to more crime. He argues: “Shabby paint on buildings might be ugly, but it probably does not itself contribute to more crime. Graffiti in subways probably does not lead to more robberies. Extreme deterioration of a neighborhood might cause vice crimes to decline by scaring away customers”. These factors are likely to be correlated not causal. For instance, street drug markets operate in the absence of the guardian, not because the neighourhood lacks streetlighting. ‘Broken windows’ theory of crime might correlate to reality because it signals the absence of a guardian rather than indicating a generalised lawlessness which criminals take advantage of.

Crime script analysis in microsocial detail

CSA is a microsocial analysis of routine criminal activities which at its most basic level divides the crime sequence into three stages: precursors, commission and resolution/departure. Or Sue, Grabbit and Runne. Each stage can be further subdivided into more detailed stages, such as preparation, entry, precondition, instrumental initiation, instrumental actualisation, continuation, post-condition, exit/reset. Each element is required to complete the whole crime chain. Cases for the script are collected from various sources. These might be police investigation files, court transcripts, or raw accounts by those involved given to interviewers.

In order to compile the crime script, begin with a blank sheet of categories to be populated:

Table 1 Blank Crime Script  
          Scene Action Example of a house burglary Overall stage
Preparation Obtain necessary tools/precursors Obtain lockpicking tools, intelligence about opportunities, associate with accomplices Precusors
Entry Gain access to targeted space Find neighbourhood judged to be sufficiently undefended/lucrative
Precondition Condition necessary for target choice Choose time of day/night when residents out or asleep
Selection Identify specific opportunity Choose dwelling
Instrumental initiation Begin action sequence Approach entryway/other weak point Commission
Instrumental actualisation Initiate action Gain entry illegally
Continuation Carry out action Take value items/Remain on scene to conduct opportunistic criminal acts
Post condition Maintain role out of scene, getting away, extracting value, other necessary end states to reset the sequence. Leave, divide up and sell stolen goods Resolution/departure
Exit/reset Return to starting point/desist Cash out goods

The script can be adapted to a wide range of criminal activity. A study of illicit meth production might identify sources of precursor chemicals, spaces used for laboratories, and processes of integrating with cartel buyers or other distributors. Many non-or semi-criminal actors are involved in activities such as facilitating infrastructure, finding transport, security, and sorting out legal and administrative issues for example by creating front companies. Larger illicit operations use front entities like fake pharmaceutical buyers, requiring a greater degree of network extent and complexity. A point we learn from this is that there is no such actor as ‘the criminal’. The person running the lab may be a part time hire, they may be supplied by a knowing person in the chemical industry. One task assigned was popping Sudafed out of thousands of pill blisters (Chiu et al., 2011).

When we use the CSA method then we see that there may be no central criminal actor and guiding mind. Scripts then connect to further scripts, for example, one for drug distribution which might involve a different subset of actors. Scripts can also be incomplete. The hacking group LAPSUS$ was very successful in applying login credentials purchased in a criminal marketplace to access Electronic Arts’ internal systems – potentially a major breach. However it had no idea what to do after that and was reduced to begging a journalist for contact details for the company in order to make a failed attempt to blackmail them (Cox, 2022).

A reason for using CSA is it allows analysts to identify control conditions that can be applied at different stages. How might absent guardians be substituted? How might opportunities be reduced? How might motivated actors be demotivated? The script can be used to recommend actions at each stage and evaluate their potential cost effectiveness. For example, knowing that counterfeit cigarette manufactures buy second hand cigarette manufacturing machines and also draw on cash rich businesses as a ready source of capital, then manufacturers might be required to account for those sold into the second hand market and the accounts of nightclubs closely monitored (Antonopoulos and Hall, 2016). For that reason, each sequence stage must be necessary for completion of the whole script. The analysis must separate out extraneous activity and focus on those conditions without which the script would fail.

Applied to digital and hybrid crime

The digital sphere appears to lack some of the qualities involved in routine activities theory however, time-space stretching means co-presence in the same time and space are not needed but there does need to be some kind of shared networked connection. The digital environment may enable absent guardianship through anonymity and other features of distanced responsibility, de-personalisation and remoteness of consequences. As increasingly digital crime is hybridised scripts can usefully identified transition points between online and face to face action (Brown, 2006; Roks et al., 2020). Leukfeldt (Leukfeldt, 2014) describes a situation where a phishing network largely coordinates in person and uses social engineering rather than malware to suborn victims.

The lens might need to shift from capable guardianship to relative visibility (Leukfeldt and Yar, 2016). We also need to rethink motivation. A study of web defacement in the Netherlands showed that those motivated by fun, patriotism and revenge tended to stick to local websites and use known SQL vulnerabilities, and so were more easily deterred than those doing it to demonstrate skill (Holt et al., 2020).

Case: A Darknet Counterfeit Currency Vendor

I am using a case where I mapped counterfeit currency distributor and user crime scripts using a sales and discussion thread scraped from a darknet market. The distributor sold fake US Dollars in $20, $50 and $100 denominations. The discussion thread was extensive and took place over several years. The distributor ‘Benjamin’ and their customers discussed the quality of the notes and how to successfully use them. The thread was open coded using NVIVO and then recoded according to crime script stages for both distributor and user. Contextualisation codes were also used which identified the material and social context of the criminal community. For instance, one code which became important in relation to the users’ moral justification for what they were doing was ‘Politics’. Users justified their activity in relation to the US Federal Reserve’s degrading the currency.

Matrix coding was then conducted, cross tabulating the contextualizing codes with the CSA codes. These codes fed into the crime script coding, for example, technical features were coded and then distributed according to their function in the precondition/actualisation parts of the script. That exposed the technical, stealth, performative and organisational features at different stages of the script execution.

Cases were created for each contributor to the forum and the attribute function was used to record their role/stance. While some roles were immediately obvious, such as Benjamin, others emerged during the contextualising analysis. For example, some contributors took on the role of mediating the crime script, advising others on how to successfully use the notes in different contexts and de-risk their use.  The following crime script was developed:

Table 2 Crime Scripts for Benjamin and Users
Benjamin Users
Entry Bulk order from supplier Set up cryptomarket account Receive currency

Target scoping

Precondition Pricing and divide up note ‘packs’ Choose high traffic setting

Work notes


Selection Market/sales/advertise Select/stealth person/car

Select young cashier/busy time

Instrumental initiation Receive orders from buyers Identify high value/good return good
Instrumental actualisation Process orders, select consumer/delivery Buy goods/swap out cash
Continuation After sales support/manage reputation/expectations on forum Recycle bad product into good notes
Post condition Close the feedback loop with supplier Transfer legit cash
Exit/reset Cash out/repost Return to thread/leave

Distribution of counterfeit currency in this way is an example of a hybrid crime combining online distribution and offline actualisation. The script required understanding the meta-criminal context in which Benjamin and the users operated. Benjamin was a secondary distributor for the primary note producer. Therefore they had to manage both their supply and manage expectations within the darknet community about the effectiveness of the notes. Benjamin’s second stage role meant they could palm off some of the responsibility for poor quality product onto the supplier but still needed to maintain a reasonably high hit rate among their customers. It was vital in order to keep selling the notes that users reported success with them. So Benjamin and some key contributors maintained a modus operandi document, effectively their own crime script, to guide users through the process. This involved ensuring users did not try too high and invite suspicion, for example, by buying a one dollar item with a one hundred dollar note.

The discussion was open to different kinds of qualitative analysis. A narrative analysis was also conducted which showed the evolution of the community over time. It began well. Buyers expressed excitement at a new source of counterfeit notes which appeared to come directly from a well known producer. Initial batches were received well and were passed off successfully. The second batch had a noticeable drop in quality. Gradually the group turns against Benjamin and they withdraw from the forum. The narrative analysis also allowed me to understand much more about how the script was developed and finessed by the group. It showed how much criminal innovation is about learning and adapting in the moment.

Strengths and limits

CSA itself is scaleable. Examples of its application run from smash and grab robberies, interest rate market manipulation, polluting a river, the assault on the US Capitol Building in January 2021. This makes it eminently suitable for darknet and other digital crime research which uses a range of data covering for example drug dealing enforcement to cross-border ransomware activity. The offender themselves is less central to this theory and it therefore means we might miss significant demographic attributes such as sex, or assume they are irrelevant or not present. Sex is critical to many crimes, particularly those involving sexual predation. It does not  account for effervescence, feedback loops and the seductions of crime which may make digital offending more attractive in itself (Goldsmith and Wall, 2019; Katz, 1988). On the counterfeit currency thread it was questionable how profitable the activity really was, given the likely costs. One motive some users had was a political one, getting something for nothing and engaging in the thrill of purchase using counterfeit notes. These elements are likely to keep criminals involved and looking for opportunities even as some are closed off.


Crime Script Analysis can be used effectively with a large volume of qualitative data scraped from the Tor darknet. I used it to derive two distinct scripts for different criminal actor types. Further data would have allowed for further scripts to be developed, for example, coving the notes producer, or the supporting characters who guided others through their own scripts.

Drug markets and pre-made futures

Some further thoughts on the long term future of illicit drug markets.

10-15 years ago most people buying drugs would do it from a known contact, arranged by telephone, handing over cash in person. Now a deal typically is arranged by social media, sometimes through the open web or darknet, dropped by delivery and paid for electronically, including by cryptocurrency. The drugs being bought would often be the big 6, heroin, cocaine, ecstasy, LSD, amphetamines and cannabis, with known supply routes and methods. Now the classic illegal drugs mix with pharmaceuticals, enhancement and lifestyle drugs, and a vast array of novel psychoactives. As much as new drugs, we have existing drugs being used in new ways, with varying degrees of social legitimacy. For a perspective on the future we can ask how drugs combine chemistry and culture, and how risks and benefits are distributed in Scottish society.

We can look back to some pre-made futures. Here is Star Trek’s Data serving Scotty some synthehol, an artificial alcohol providing pleasure without suffering. A gentle future without human nature in it. Like Data himself. In contrast the 2005 Foresight/Office of Science and Technology Project Drugs Futures 2025 (Nutt, Robbins and Stimson, 2007) recognised that  ‘for thousands of years individuals have used some form of mind-altering chemicals, ranging from comparatively harmless substances, like coffee, to others with substantial scope for harm and abuse’. DF 2025 suggested trends continuing: More sympathy towards people with drug dependence, more understanding of the risks deriving from improved brain science, and improved prediction of problems due to better genetic data and understanding of drug-body-mind interactions. The prediction of magic bullet treatment was confident:  ‘By 2025, vaccinations for a growing number of common drugs of addiction, such as cocaine, heroin, nicotine, amphetamines and cannabis, will almost certainly be available to prevent initiation of, or to treat, drug misuse.’ Also predicted was non-pharmacological neural manipulation e.g. transcranial magnetic stimulation. The scientific predictions didn’t work too well but the organisational, cultural and economic ones are more in evidence. Human nature being obdurate.

In that spirit we can be guided by looking at ethics, care, and human hybridity.

The authors suggest a number of more interesting cultural developments: Extended ‘youth’ leading to more extended drug use life course. Indeed we see much more consumption across the life course and experimentation throughout. We see business executives using LSD. The drug market tends to keep prices down. New drug types have emerged such as smart drug use, use of drugs for cognition enhancement and improvement.  Behavioural addictions are more recognised. Digital life is noted as a vector for behavioural addictions. ‘the Internet and mobile phones may lead to an increase in gambling and to new behavioural addictions, for example, to Internet chat rooms.’ These developments have change the setting of drug use and the kind of normalisation at work. They are less normalised for leisure, and more normalised for work/self. A very good call was the intersection of crime and foreign policy which we see in the alignment of major ransomware/crimeware outfits and Russian foreign policy.

Beyond trends we invite new ethical questions, such as using drugs for enhanced work performance, new kinds of social coercion and competition involved.

What was not present is the digital as an independent factor in drug production, distribution and use. This is the wild card. On a closer look it obeys many of the same rules as before – governed by culture, economics, social shame/desire.

To understand the future of digital drug use we can also recognised past digital myths. In the 1990s the ‘cyber’ was reckoned to be decentralised, voluntary and free flowing. It was separated from geography, nation-states and from pre-digital governance. This describes a moment in time. The digital world is not smooth, light, autonomous, network space. It is disjointed, centralised, heavy. The digital has qualities of permanence, scarcity, and memory over virtuality, abundance, anonymity. It exploits and polarises. It mixes the criminal and the political. Networks used by organised criminals also provide valuable space for dissidents, refugees and others. Conceptually there is no such thing as ‘the digital’ understood as a single, globalised, flat open virtual space. In part it is a digital extension of other institutions such as the mass media, states, corporations, education systems and others,  So how do we develop/adapt investigatory methods to work across that? What configurations of health, harm, and the illicit are borne out of it?

Let us look at an unexpected confluence which nobody predicted but emerged from the ferment of digital innovation. The darknet and cryptocurrency came together to allow for online anonymous markets in illicit goods and services. Drugs could be browsed, bought and paid for, contactless, remotely and in relative anonymity.. Why trust a dealer when you can read reviews and demand next day delivery? Like the early internet, the darknet devolved from a politicised anarchy to something more dominated by big players, with service integration and automation. It developed national, linguistic cultures as in the Russian centred ‘Hydra’ site, which provides secret shopper sampling of drugs sold, and also violent enforcement of contracted gig economy style employees. As well as being functional it also shows a morality of exchange. Networks of people advising each other and learning from them – not wholly individualistic and transactional but also meaningful.

Policing action tended to demonstrate the resilience of darknet operations rather than their vulnerability. Operation Onymous in 2014 had near term effects but that and later operations were often met with innovation and reformation of the markets on other platforms.The NCA and other agencies use other forms of disruption not easily represented here, and whose effectiveness is not always measurable in the same way. Law enforcement interventions allow participants to calibrate their expectations of security and risk. Interventions scrub weaker and more vulnerable players, hence change can be noted prior to intervention. Tactical displacement means drug markets move on-phone and indoors.

We are best seeing this as a reactive moral economy. Crimes you opt into – dodging council tax, TV license, overblown insurance claims, faking school eligibility, as opposed to survival crimes.

Mass crime is a kind of protest/reaction and withdrawal of consent after a threshold is reached. Karsted and Farrall point to 4 anomic cycles. 1 – market society’s emphasis on risk/choice blurs the line between licit and illicit risk. 2. Buyer beware lessens mutual obligation between business and consumer 3. Blurring between fair, shady and outright criminal 4. Growing rules/regulation based society means paradoxically they become meaningless and people/businesses violate the spirit while adhering to the letter. A rote compliance replaces organic solidarity. ‘Legal cynicism’.

Developing the idea that drugs are a system. Drugs are a great internet commodity as much like Jeff Bezos’ decision to start Amazon by selling books, they are relatively easy to warehouse and distribute.  Noticed how criminal groups move from e.g. drugs to cigarette smuggling to malware. There’s not a ‘criminal mode’ they are committed to.  Moving from commodities to services in the illicit drug economy What is a service? I mean it as supply beyond trade, ie there’s a function which is shared. So not necessarily ‘customer service’ though that exists. 

Two claims: reality: services around drug production, distribution, knowledge framework, data infrastructure, substitution/functional effect Directed, functional, not things in themselves. Empirical: And drugs themselves as being services and shaped by a self-referential service culture.  Characteristics of a maturing service market: Expertise can be rented rather than acquired. Decreasing cultural capital and skill demands – lower ‘cost of entry’.  Not human centric, modular, remote contact. Automated e.g. trust systems not local cultural capital, branded pharmaceuticals. Open sourced drug production formulae. Multiple user identities and biographies – not a ‘cocaine user’ ‘ritalin user’ etc

Systems operate across territories – a drone delivery- drug ordering and feedback system is an integrated system involving a service organisation and a digital front end. Infrastructure effects feed off developments in the economy. Distributed industrial production can be retasked to illicit product, as in see counterfeit cigarettes, illicit Xanax production using second hand pill machines, and 3-D printed weapons. Harms can be driven by supply chain needs such as fentanyl displacing heroin/opioids. As in the Country Lines instance, these methods provide vectors for exploitative control. It also opens the way to algorithmic control over operatives.


Karstedt S and Farrall S (2006) The Moral Economy of Everyday Crime Markets, Consumers and Citizens. British Journal of Criminology 46: 1011–1036. DOI: 10.1093/bjc/azl082.

Nutt, David, Trevor W. Robbins, and Gerry Stimson. 2007. ‘Chapter 1 – Drugs Futures 2025’. Pp. 1–5 in Drugs and the Future, edited by D. Nutt, T. W. Robbins, G. V. Stimson, M. Ince, and A. Jackson. Burlington: Academic Press.


Political affordances of the internet and the privacy divide

The internet has been turned into a disclosing machine. Anonymous communication is rare and difficult to achieve. Digital worlds are characterised by affordances, the technological qualities that enable and promote some kinds of human action and which hinder or disable others. Some of these qualities are so fundamental we scarcely are aware of them. One is the tendency of digital platforms to define, identify and label their users. It is a capacity fundamental to their business model. As well as enabling a cash for clicks advertising business it also provides unprecedented technological scope for mass surveillance and digital fingerprinting (Linder, 2019). The surveillant assemblage, as Haggerty and Ericson (2000) coin it, is the melding of different data types such as video, audio, location data and social media streams with automatic analysis and prioritisation in order to identify threats. Private companies compete to offer these services to police, military and private security agencies (Aas, 2011). These qualities are not natural outgrowths of what the internet is but are actively produced according to the economic, social and political priorities that are set by governing forces in our societies. Just as these features are made so they can be contested and disrupted through rival assemblages. One of these is the Tor darknet, a combination of technologies, services and infrastructures that limits monitoring and promotes anonymity (Dingledine et al., 2004).

A darknet redistributes visibility. Facebook and Instagram for example operate as self-contained private networks. Users are visible to Meta and its advertisers, to each other with some limits, but invisible to google or other web search engines. Darknets like Tor (henceforth ‘the darknet’), the focus of this post, shift the disclosure locus of control from the designed-in affordances of the platform to the decisions of the user. The darknet is one of several community supported, technical solutions to the surveilling internet (Collier, 2020). It is intended to bypass censorship and contribute to a sphere of privacy and autonomy. Users often see it as a valued place of privacy and anonymity (Mirea et al., 2019).

Tor is a routing system which encrypts connection data in order to disrupt what is called traffic analysis. Doing so makes it difficult for a third party to tell who is connecting from where. Effectively it means an internet user can browse websites and send messages without being easily traced. The design of Tor allows for relatively fast communication compared to for example Freenet, a peer-to-peer darknet. Tor is relatively easily accessible and useable. To connect to the Tor network a user just has to download the Tor Browser from the Tor foundation (see Web Resources section). The Tor Browser is built on Mozilla Firefox so its interface is familiar to web users. It is designed to work with the user’s mental model of how a web browser functions (Perry et al., 2018). When the user launches the browser it seeks to connect to a node on the Tor network, called a relay.  A start or guard relay, a connecting or middle relay, and a final or exit relay makeup a complete circuit. The network routes and encrypts data packets between relays to reduce the risk of identification. Nodes are hosted by volunteers. The code on which the network runs is maintained by the Tor Project’s developers and by a wider community.

Tor allows users to browse the web and connect to services. It has a significant second function also. It allows services to connect directly through its network, called onion or location-hidden services. Onion services allow a server to be connected without its location being revealed. Users can set up web services without the host’s IP address being known. The investigative journalism institution ProPublica and the privacy focused email service Protonmail both offer onion services along with their normal web sites, as does Facebook. The British Broadcasting Corporation (BBC) provides an onion mirror for its international news to help citizens of authoritarian countries. These services protect users and provide an anonymous route to using them. It is possible to combine an onion service with a payment system using cryptocurrency. That allows for illicit services called ‘cryptomarkets’ to be offered (Martin, 2014). The focus of much research on the darknet is about this criminogenic aspect, in part because it offers a place where illicit markets can be researched with relative ease.

What kind of questions can be asked of and with the darknet

Research questions can be asked about Tor, and of Tor. Tor is part of a much wider movement for online anonymity and privacy. As Collier (2021) shows, Tor is itself a place where the meaning of privacy is contested. It has a fascinating history having emerged from a collaboration between the US Naval Research Laboratory and the Free Haven Project. The development and evolution of Tor can be used to trace shifting political and ethical debates about privacy and autonomy and the degree to which social values can be embedded in infrastructure (Bancroft and Scott Reid, 2017).

Onion services are a social sphere in themselves. For example, The Hub hosts Reddit like discussions about the darknet itself, and about various social and political issues.

The cryptomarkets are sites of illicit exchange and also typically host discussion forums that focus on drug quality, trust and reliability of the illicit markets, and issues like harm reduction. As the markets evolve new social formations emerge. For example, Hydra is the predominant cryptomarket operating in the Russian and post-Soviet space. Cryptomarkets focused on Western nations separate drug selling from drug delivery which is mostly carried out through the postal system. Hydra has a hybrid system of dead drops in operation and is a far more integrated business than other cryptomarkets. The historical evolution and adaption of criminal business models can be studied in its context through examining different cryptomarkets and their history. National differences can be explored as can the specific state formations they operate in. Using this approach criminological models and concepts regarding criminal organisation and exchange can be tested.

The demographics of who uses the darknet and how they come to use it is a set of questions which link to themes of the digital divide, digital literacy and varying degrees of online censorship and repression throughout the work. As the world becomes more authoritarian data on darknet usage can provide one metric of shifting repression and political activism. It can also be used to examine the privacy divide. Much like the digital divide, the privacy divide means that the resources to protect one’s own privacy are very unevenly distributed. Varied technological, economic and cultural resources make a significant difference to the legal and social exposure of digital citizens. The ability to protect oneself against public shaming and cancellation and to recover from reputational damage matter alongside legal liability.



The future has arrived, said William Gibson. It just has not happened to you yet.

The future has arrived, said William Gibson. It just has not happened to you yet. Count yourself lucky. Participating in discussions on the future of policing gives me a chance to think about the role of futurology in social science. Futurology often shows up in a way that gives it a bad name. It is always wrong, except for my go at it, which you should definitely listen to. Breathless predictions of the coming of network societies, freedom from the bonds of the real, and unlikely tech innovations merge together in a techno-libertarian monster. They flounder in the face of humanity’s limitless ability to screw it all up. There are some obvious flaws in these visions which I still need to point out: they assume change is driven by technology as an independent force, rather than human interests. It is a damn sight easier to change the past than the future. They read from ideal world relations to real world uses. The lol-worthy elements of this should not detain us for long. Instead let us look at what predictions have already come about, using our first trick – the old is the new thing:

We already have driverless cars. They are called ‘metros’ and ‘railways’.

We already have nuclear fusion. It is called the sun. And also ‘global thermonuclear war’.

England had a social network operating since 1516, called ‘The Royal Mail’. And since the late 19th century, ‘Have you called your mother recently?’.

We definitely already have killer robots operating in the battlefield.

I am dipping into futurology because I am examining the future of digital drug markets.

The second trick is to predict the past. Let us start from the past, usually a good, predictable place. 10-15 years ago most people buying drugs would do it from a known contact, arranged by telephone, handing over cash in person. Now a deal typically is arranged by social media, sometimes through the open web or darknet, dropped by delivery and paid for electronically, including by cryptocurrency. The drugs being bought would often be the big 6, heroin, cocaine, ecstasy, LSD, amphetamines and cannabis. Now the classic illegal drugs mix with pharmaceuticals, enhancement and lifestyle drugs, and a vast array of novel psychoactives. 

Let us draw some generalisable conclusions:

  • There is no direct correlation between economic development and digitisation of the drug market. The darknet is much more prevalent in Russia than the West for example. 
  • Over time, illicit labour organisation and distribution of wealth have become more like licit models
  • The digital has become embedded in everyday life so there no segment untouched by it
  • Increasingly digital operating criminals are innovative rather than reactive

Final trick, it is safe to assume some trends will gather steam. Other have inbuilt limits which we already know:

  • Some of these trends will continue, particularly innovation. The digital world is fracturing politically and nationally, for example, as alt-right alternatives to social media are launched. Criminal groups are likely to take the lead or take advantage of the development of infrastructures that are independent of the tech economy mainstream.
  • Early trends we can see now will expand, particularly localisation and compartmentalisation. Drug businesses will be sold as an integrated package, including hosting, services and delivery.
  • We will see the replacement of the core/distributor model of drug business operation with one where the most successful will be ‘meta criminals’ who can license others to act on their behalf. 
  • The cryptocurrency moment is probably over as Bitcoin collapses under its own weight and blockchain analysis makes deanonymisation much more likely. Instead we will see payments through other non-cash systems.

Futurology tends towards the untestable and it is reasonable that social scientists do not like it very much.  Our role is often to burst the bubble at the Ted-talk party. However we have a number of jobs we have to do in order to serve our societies and communities. We need to be able to confidently predict the threat horizon. We should sketch out different possible developments and show how likely it is we will get there from here. We should be able to feedback and to pull the alarm about where these developments lead. We need to prepare people for future shocks and enhance societal resilience. 

Find out more at the Institute for the Future 

Pour me some of that sweet, sweet critical sauce

<img> ‘Motherfuckin’ Critcal Thinking – How does that work?InsaneClownPosse.jpg'</img>

A regular comment on students’ work from essays to PhD drafts is that they could improve by adopting a more critical perspective. Martin Booker explores it very effectively in his blog, Critical Turkey. He defines it as common-sense scepticism plus social science analysis. Critical thinking is at heart about developing your voice on the topic and finding what matters within it. It is evaluative, considered and objective. It minimuses what we have to take as read and maximises persuasion through argumentation. Should be simple, right?

So what can we tell students to actually do to get there? What tasks can they incorporate into their thinking? My answer is that you do this by asking questions of the topic. Robert Ennis (1993) lays out a combination of activities, abilities and stances that we look for as evidence of critical thinking: ‘1. Judge the credibility of sources. 2. Identify conclusions, reasons, and assumptions. 3. Judge the quality of an argument, including the acceptability of its reasons, assumptions, and evidence. 4. Develop and defend a position on an issue. 5. Ask appropriate clarifying questions. 6. Plan experiments and judge experimental designs 7. Define terms in a way appropriate for the context. 8. Be open-minded. 9. Try to be well informed. 10. Draw conclusions when warranted, but with caution’. These roughly divide into: develop your own position from the evidence, be aware of what you are saying and and assess claims independently of what is in front of you. Critical thinking is also traceable. Yourself and your readers can grasp why you arrived at your argument because you lay out the evidence trail that took you there.

In this post I drill down further to set out some tasks students can add to their toolkit and which show critical thinking at work.

The first set of questions/attributes are variations of ‘what is it?’.

  1. How can we categorise it. What typologies, taxonomies and distinctions apply. Are these categories coherent, consistent and logical? Who/what creates them? Where is it written? What are their limits? We often find that categories that are presented as scientifically derived turn out not to be, or are contingent, or are hybrids, or their content varies massively under the same label. Examples I deal in are: addiction, disease, money, capital, and crime, but they are endless. Often people claim to be just using common sense – ‘it just is’ – while in fact referencing a societally, historically specific and novel definition. The variable understanding of what ‘biological addiction’ as opposted to psychological habit means is one. We might think that it is obvious what it means to say grounded in biology. Yet what that means and where it is presumed to happen has changed a lot, from a kind of organic dependency to neurological  adaption. That leads us to other interesting questions about why it has changed in the way it has. The critical bit lies in not just assuming that the scientific lens changed because of some set of godlike revelations on the topic.
  2. Does it have many faces? Give things names or look at the different names given to it. Do positions on the issue have a name and what do they reflect? What is the FBI’s take on cybercrime versus the critical criminological one?
  3. Does form get mistaken for content? The FBI define the Juggalos as a gang. But plenty of groups have the same structure as gangs, but are not them. There is sometimes a wilful blindness there. Muslim self-help organisations get wrapped up with money laundering or terrorism.  Alcoholics Anonymous has the structure of a terrorist network, but it is not one.

The next set of questions are about the data and evidence on the topic.

  1. What does it look like in context. Sprinkle in some background data or statistics that give us an idea of the phenomenon you are examining. How common is this behaviour? What are the patterns? This will allow you to give a quick thumbnail sketch of the issue before diving into the detail.
  2. How is it lived. Get back to the people and the real lives behind the data. What is it like to live as a gangster, or in a place dominated by organised crime? Doing so adds richness and nuance.
  3. Why does the evidence look like that? Are authors making unexamined assumptions about differences and similarities? Why so? Why is the topic being mainly examined as a particular kind of problem? For example, illicit drug use as a social problem rather than an issue of consumer safety.
  4. Assess the credibility of the claims being made. Check for any assumptions or suppositions being made and check them against the research evidence.
  5. Attribute validity. A way of examining the evidence is to look at the the validity of the concepts being used by the research. For example, why one death comes to be classified as drug related, how those judgements are arrived at and what the process of attributing a death tells us about for example how risk is identified and accounted for.

The next are your set of analytical party tricks which get down further into why it looks the way it does, why it happens like this and if it helps us to think differently about it.

  1. What causes it/what is said about causes? Examine where you and others are making claims of causality or correlation and look at the evidence to support that, so you can elaborate on the causal processes you are examining. Look for the following: are the presumed causal factors the actual ones, or are there other factors involved; in what circumstances are these claims true, and to what extent is the cause univariant, or multivariant; finally, what the implications of these claims being true. This will give you a much more grounded and nuanced set of claims to work with. This is a great trick to use, as causality often implied in many documents without being explicitly examined. Consider: are there multi-causal factors to take into account, or is there another, hidden cause, at work? This helps generate hypotheses to examine and helps bring in wider sociological themes of historical change and societal development.
  2. Reduce it. We usually tell students to be wary of reduction and essentialism buy they are both fine as long as they are appropriate. Reducing the issue to its barest essences but no more allows us do other critical things like comparing across cases and between contexts.
  3. Decentre it. Globalise your perspective by decentering the West. The emergence of the BRIC economies and multiple global power centres has meant that global economic and power structures have shifted radically. This can be used to critically assess existing theoretical and empirical claims. That affects both our tendency to treat the West as a baseline, but also theories that treat the Global South as being without agency and endlessly pushed around by the US/Western Europe.
  4. Normalise it. This works especially well when studying criminal or deviant behaviour.  Can it be explained in the same way we explain normalised behaviour? For example, is illegal market activity much like the regular kind? Normalisation means not looking for a special explanation before we have looked for a general one.
  5. What is missing. Look for alternative explanations for your examples. For example, crime reporting is a big challenge. Some crimes are more likely to be reported and to end up in the data, some are not. This means that claims about the contexts in which crimes happen can be challenged.

Above all, live with it. All phenomena we study are multi-causal, multi-factorial, and have varying effects depending on where people are at. Allow yourself to live with the contradictions and uncertainties inherent in your field. Whenever you see statements guaranteeing certainty about anything, run like the wind. That includes especially those who make sweepingly certain statements about uncertainty, or non-existence. The most crippling conclusion drawn by some scholars is that because it is difficult to define something or know it, or since it is changeable and contingent, then nothing can be known about it and it does not really exist. That is not a scholarly life I want and I do not see why anyone should be paying me to say that something is impossible or undefinable. The difficulty and the uncertainty are the challenge and the fun. So get to it.

Ennis, Robert H. 1993. ‘Critical Thinking Assessment’. Theory Into Practice 32(3):179–86. doi: 10.1080/00405849309543594.