Malware: proposal for a social history

Computer security is the culmination of a series of subversions. Just as policing evolves in response to crime, so computer systems evolve in response to threats. When it comes to malware, while the code is clever, the social engineering is more persistent, and more depressing. Malware designers evolve their products through testing and tooling to find out what works best. What wording will mean that more victims click on that ransomware link? Do people trust social media messages more than emails? More and more, malware evolves in response to human social and economic systems, and organisational/geo-political priorities, rather than to technical vulnerabilities.

Technological histories exist, recording major developments – the first Worm, the first RootKit, the first ransomware and so on. The social history is more dispersed and is yet to be written. Elements of a theory of malware could focus on: Where was it developed, for what purpose, who by, and how? How have victim and perpetrator characteristics evolved with the systems they use? What ethical and political questions are raised by it? For example, do we have the right to destroy self replicating computer programs, and how should malware be preserved for future study? My sense is malware history is somewhat separated from other kinds of crime historiography.

We would need to begin with a basic taxonomy. Here is my first sketch of the social history of malware: First stage: technically focused malware. Often created to prove a point, or by accident, like the first computer worm. Second stage: payload. Malware delivers a technical form that does something else, like modifies a computer system, or locks you out of it. Third stage: organisational. Malware becomes an object of economic and political activity. There is a high division of labour. Stuxnet and NotPetya encode geo-political priorities. Markets like Dark0de trade and systematise it.

Methods should set out the relevant fields. Studying evolving malware means studying the evolving computer security industry, its capacity for threat detection and horizon analysis, and the back and forth between malware operators and industry personnel. Constructs to be examined include changes in how costs are calculated and understood – from direct economic losses to reputation damage, lay perceptions of malware, and popular discourse and cultural representations of the topic. There is an opportunity for theoretical innovation here, for example considering QAnon as a mimetic virus.

Lessons to learn: total security is not possible (Aycock, 2006). We might end up with an understanding of malware as a varied sphere of illegitimacy, which is occupied in different ways by systems and people. The debate over disinformation could fit into this.  It is a powerful propaganda tool used by authoritarian regimes to suppress civil liberties, undermine opposition and simply swamp out opposition or independent information and as a tool of international relations. But also itself become a go-to tool for strategic de-legitimation of uncomfortable political positions (you used the fakes!). Likewise, malware is a purposeful set of technical instruments which share characteristics. There may be a myth of precision influencing discussion, that if only we get the right focus we can pre-cog malware and harden vulnerable targets – code for you dumb users. It is a dance that won’t stop.
Aycock, John. 2006. Computer Viruses and Malware. Springer.

Aspirational illicit markets

Early in my career I researched smoking in areas of multiple deprivation in Scotland. At the time these were places where the social, economic and physical fabric had been severely weakened due to overlapping stressors. High crime, low income, low economic activity and widespread health problems were multiple challenges for people who lived there. That is what I think of as intersectionality. Smoking was often quoted by people I interviewed as being their one reliable pleasure. The rising cost of cigarettes and tobacco was an irritant but not often an incentive to quit. Though under strain at the time, there was a strong neighbourhood environment in many places.

One set of relationships that was sustained throughout was the illicit cigarette market. Taxes were spiking and there was a wide opportunity for people who wanted to import tobacco products cheaply. As with many illicit importing operations a tricky bit is the last retail step. Shipments need to be broken into units that will be affordable and available and this needs a staged operation with sometimes multiple ‘final miles’ involved. Several competing approaches were applied. Tobacco could be sold in pubs, under the counter of existing shops, or delivered directly. In the last case pizza companies were set up as fronts for tobacco delivery.

The level of entrepreneurial innovation going on here alerted me to the aspirational nature of illicit markets. Some illicit operations are attractive because they are the only game in town, sometimes participating in them offers purpose, income and aspiration and something resembling a career. While that was going on many others in the community rejected this as a route. They viewed illicit work as harmful to the community, attracting dangerous criminals and damaging its reputation. These markets were contested, and meaningful. Therefore when they are interdicted we should be aware of the fallout, positive and negative, and the absences left behind by them.

The long and short future

🎵 In the year 2525, if man is still alive, if woman can survive 🎵 

Projects such as the Clock of the Long Now, the Svalbard Global Seed Vault, and deep time Nuclear Semiotics work with time horizons of millenia. These are about changing our time perspective in response to challenges created by humanity such as environmental problems and the demands of long term nuclear waste storage. These come at a time when the tools humanity set up that institute a long term consciousness, religion and orthodoxy, have been swept aside by the Smiley People Who Know Everything. The moral obligations current humans have to future society are up for grabs. What costs might we be unknowingly or uncaringly imposing on them? Maybe the only obligation you have is to live your best life. In the Douglas Adams short story Young Zaphod Plays it Safe a way of mining the past for energy is discovered. Everyone is pretty pleased with themselves at this innovation: energy from the one place where no-one will kick up a fuss. Too late they discover that mining the past creates a problem for the present, as the future is doing the same thing to them. People will only really be motivated to act, he implies, if they have something at stake. 

So what can be employed to give us something to care about? One answer is the human delight in narrative, which explains why science fiction authors made such a contribution o the long term semiotics discussions that have come about as a result of the need to store long term nuclear waste, with a time horizon of about 10,000 years. Can a message be dispatched, interpreted, understood and acted on over a timescale greater than human civilisation? If we create a story of ourselves as heroically saving the future while also leaving a bloody big monument to it, we night be bothered to make an actual effort. The content is tricky however. It must convince the future people not to dig up this particular patch of ground and also convince the present people that it will do that. The paradox is that we might like to leave some monuments to ourselves, but any monument is attractive. Any warning sign looks like a treasure map, or just ceases to mean anything, given enough time. Gregory Benford points to problems of expert conformity and false certainty in deep time estimation, as in any enterprise.

The coming of the … society

The …isation hypothesis

That is certainly the case in future world talk in sociology. How good has sociology been at identifying valid future trends and self-correcting in the face of evidence? And can we not talk about this please? Let’s start with one of the worst charges on the docket, the secularisation hypothesis. Basically: as societies become modern, they become secular. It is pretty much not true and like most failed predictions extrapolates from a small set of cases in one moment to a general trend about societal evolution. Demographic transition is a more solid prediction, and is notable for largely existing outside mainstream sociology. Yup, everyone is getting older apart from the religo-crazies, a fact we would all just rather ignore thank you.

Lots of sociology futures now name a type of society coming into being – the metric society, the screen society, the network society, the algorithmic/platform society. Or they seek out an organising metaphor like fluidity or liquidity, using it a characteristic that in some way is central to the transformed social life and which people will have to live with. Usually the argument is presented in a motte and bailey style. It is asserted that such and such a characteristic is fluid, meaning without form or structure. Then it is pointed out that it does have form and structure, at which point the argument shifts to say that fluidity just means flexible or changing, network just means connected etc. No books have been titled ‘The Rigid Society’ or ‘Inflexible, Untroubled Gender’ or ‘The Coming Non-Crisis of Capitalism’. The traffic is all one way, which tells you how detached it is from empirical data but not from the incentives of academic publishing.

While sociology and future writing love their metaphors, they do not love their humans. Humans get a bad rep in sociology, behavioural economics and social psychology. They are usually criticised for their short termism,  various cognitive biases and a general inability to consider severe threats and fantastic opportunities that are not immediately apparent and the general set of cognitive limits I am confident nobody ever called ‘Gidden’s Paradox’. I am not sure humans suffer from the short term perspective often claimed. Giddens, the Nudgers and others speak confidently from a future that has not happened yet, and condemn humans for being insufficiently panicked at something which we have very little capacity to do much about. It is irksome because of the tendency for expert groups and elites to form their own consensus and anathematise any doubters, and the lack of humility when they turn out yet again to be wrong. 

“In the Year 2525 (Exordium & Terminus)” by Zager and Evans, RCA Victor, 1969.

Microsocial crime script in a meta criminal context: crime script analysis as applied to hybrid digital crime

This post is about crime script analysis as a method of bridging micro- and meta- analysis of criminal activity. It lays out what crime script is and how it can be used to understand the relationship between the material criminal context and the patterning of criminal action.

The origins and application of crime script analysis

Cohen and Felson (Cohen and Felson, 1979) analysed US crime rates following the Second World War. They suggested crime rates are not well correlated with socio-economic stressors such as unemployment, poverty and inequality. Crime incidence may increase in good times and slow in bad times. It does closely match opportunities. What is there matters more than what is not there. That is why crime can increase in good times. There is more stuff. As a material of theory of crime this works on a basic level. There is no car theft without cars to steal and a large enough market to sell into. That insight is the basis for Routine Activities Theory (RAT) which states that acquisitive crime is patterned and dependent on the existence of an opportunity, a motivated criminal and an absent guardian (Andersen and Farrell, 2015). It also explains some of the reduction of material crime as a result of the rise of the digital economy. As the economy becomes centred on virtual goods it becomes more difficult and less lucrative to traffic in stolen property. In this new environment criminal groups and methods either fall or adapt and exploit new opportunities presented by digital society.

An approach is needed to understand criminal innovation and the success or failure of specific criminal methods which are persistent, patterned and shared between criminals. One way of doing this is through Crime Script Analysis (CSA), developed by Cornish (Cornish, 1994). CSA characterises criminal activity as routine and purposive and identifies a criminal modus operandi. Much criminology and policing practice had focused on the crime event itself, hoping to catch criminals in the act. CSA puts the offending act itself in a context of preparation, commission, and leaving. By laying out the sequence like this the criminal act can be disrupted by situational crime prevention (SCP) measures which interfere with different stages of the script. For example a study of illicit opioid sales might identify lax or corruption prescription of painkillers as a source for drug dealers and reduce incentives for overprescribing (Moreto et al., 2020). Each stage in the script suggests a control intervention like target hardening, control of entry/exit routes, and limiting opportunities to profit from crime. Many of the steps identified might not in isolation constitute illegal acts. As a result CSA can be used to propose changes in the law, for example, criminalising ‘grooming’ by child sexual predators as a critical stage in the preparation of child abuse.

Target attraction is based on VIVA (value, inertia, visibility and accessibility). Felson (Felson, 2000) argues the theory helps avoid common mistakes which assume in a common-sense fashion that social disorder leads to more crime. He argues: “Shabby paint on buildings might be ugly, but it probably does not itself contribute to more crime. Graffiti in subways probably does not lead to more robberies. Extreme deterioration of a neighborhood might cause vice crimes to decline by scaring away customers”. These factors are likely to be correlated not causal. For instance, street drug markets operate in the absence of the guardian, not because the neighourhood lacks streetlighting. ‘Broken windows’ theory of crime might correlate to reality because it signals the absence of a guardian rather than indicating a generalised lawlessness which criminals take advantage of.

Crime script analysis in microsocial detail

CSA is a microsocial analysis of routine criminal activities which at its most basic level divides the crime sequence into three stages: precursors, commission and resolution/departure. Or Sue, Grabbit and Runne. Each stage can be further subdivided into more detailed stages, such as preparation, entry, precondition, instrumental initiation, instrumental actualisation, continuation, post-condition, exit/reset. Each element is required to complete the whole crime chain. Cases for the script are collected from various sources. These might be police investigation files, court transcripts, or raw accounts by those involved given to interviewers.

In order to compile the crime script, begin with a blank sheet of categories to be populated:

Table 1 Blank Crime Script  
          Scene Action Example of a house burglary Overall stage
Preparation Obtain necessary tools/precursors Obtain lockpicking tools, intelligence about opportunities, associate with accomplices Precusors
Entry Gain access to targeted space Find neighbourhood judged to be sufficiently undefended/lucrative
Precondition Condition necessary for target choice Choose time of day/night when residents out or asleep
Selection Identify specific opportunity Choose dwelling
Instrumental initiation Begin action sequence Approach entryway/other weak point Commission
Instrumental actualisation Initiate action Gain entry illegally
Continuation Carry out action Take value items/Remain on scene to conduct opportunistic criminal acts
Post condition Maintain role out of scene, getting away, extracting value, other necessary end states to reset the sequence. Leave, divide up and sell stolen goods Resolution/departure
Exit/reset Return to starting point/desist Cash out goods

The script can be adapted to a wide range of criminal activity. A study of illicit meth production might identify sources of precursor chemicals, spaces used for laboratories, and processes of integrating with cartel buyers or other distributors. Many non-or semi-criminal actors are involved in activities such as facilitating infrastructure, finding transport, security, and sorting out legal and administrative issues for example by creating front companies. Larger illicit operations use front entities like fake pharmaceutical buyers, requiring a greater degree of network extent and complexity. A point we learn from this is that there is no such actor as ‘the criminal’. The person running the lab may be a part time hire, they may be supplied by a knowing person in the chemical industry. One task assigned was popping Sudafed out of thousands of pill blisters (Chiu et al., 2011).

When we use the CSA method then we see that there may be no central criminal actor and guiding mind. Scripts then connect to further scripts, for example, one for drug distribution which might involve a different subset of actors. Scripts can also be incomplete. The hacking group LAPSUS$ was very successful in applying login credentials purchased in a criminal marketplace to access Electronic Arts’ internal systems – potentially a major breach. However it had no idea what to do after that and was reduced to begging a journalist for contact details for the company in order to make a failed attempt to blackmail them (Cox, 2022).

A reason for using CSA is it allows analysts to identify control conditions that can be applied at different stages. How might absent guardians be substituted? How might opportunities be reduced? How might motivated actors be demotivated? The script can be used to recommend actions at each stage and evaluate their potential cost effectiveness. For example, knowing that counterfeit cigarette manufactures buy second hand cigarette manufacturing machines and also draw on cash rich businesses as a ready source of capital, then manufacturers might be required to account for those sold into the second hand market and the accounts of nightclubs closely monitored (Antonopoulos and Hall, 2016). For that reason, each sequence stage must be necessary for completion of the whole script. The analysis must separate out extraneous activity and focus on those conditions without which the script would fail.

Applied to digital and hybrid crime

The digital sphere appears to lack some of the qualities involved in routine activities theory however, time-space stretching means co-presence in the same time and space are not needed but there does need to be some kind of shared networked connection. The digital environment may enable absent guardianship through anonymity and other features of distanced responsibility, de-personalisation and remoteness of consequences. As increasingly digital crime is hybridised scripts can usefully identified transition points between online and face to face action (Brown, 2006; Roks et al., 2020). Leukfeldt (Leukfeldt, 2014) describes a situation where a phishing network largely coordinates in person and uses social engineering rather than malware to suborn victims.

The lens might need to shift from capable guardianship to relative visibility (Leukfeldt and Yar, 2016). We also need to rethink motivation. A study of web defacement in the Netherlands showed that those motivated by fun, patriotism and revenge tended to stick to local websites and use known SQL vulnerabilities, and so were more easily deterred than those doing it to demonstrate skill (Holt et al., 2020).

Case: A Darknet Counterfeit Currency Vendor

I am using a case where I mapped counterfeit currency distributor and user crime scripts using a sales and discussion thread scraped from a darknet market. The distributor sold fake US Dollars in $20, $50 and $100 denominations. The discussion thread was extensive and took place over several years. The distributor ‘Benjamin’ and their customers discussed the quality of the notes and how to successfully use them. The thread was open coded using NVIVO and then recoded according to crime script stages for both distributor and user. Contextualisation codes were also used which identified the material and social context of the criminal community. For instance, one code which became important in relation to the users’ moral justification for what they were doing was ‘Politics’. Users justified their activity in relation to the US Federal Reserve’s degrading the currency.

Matrix coding was then conducted, cross tabulating the contextualizing codes with the CSA codes. These codes fed into the crime script coding, for example, technical features were coded and then distributed according to their function in the precondition/actualisation parts of the script. That exposed the technical, stealth, performative and organisational features at different stages of the script execution.

Cases were created for each contributor to the forum and the attribute function was used to record their role/stance. While some roles were immediately obvious, such as Benjamin, others emerged during the contextualising analysis. For example, some contributors took on the role of mediating the crime script, advising others on how to successfully use the notes in different contexts and de-risk their use.  The following crime script was developed:

Table 2 Crime Scripts for Benjamin and Users
Benjamin Users
Entry Bulk order from supplier Set up cryptomarket account Receive currency

Target scoping

Precondition Pricing and divide up note ‘packs’ Choose high traffic setting

Work notes


Selection Market/sales/advertise Select/stealth person/car

Select young cashier/busy time

Instrumental initiation Receive orders from buyers Identify high value/good return good
Instrumental actualisation Process orders, select consumer/delivery Buy goods/swap out cash
Continuation After sales support/manage reputation/expectations on forum Recycle bad product into good notes
Post condition Close the feedback loop with supplier Transfer legit cash
Exit/reset Cash out/repost Return to thread/leave

Distribution of counterfeit currency in this way is an example of a hybrid crime combining online distribution and offline actualisation. The script required understanding the meta-criminal context in which Benjamin and the users operated. Benjamin was a secondary distributor for the primary note producer. Therefore they had to manage both their supply and manage expectations within the darknet community about the effectiveness of the notes. Benjamin’s second stage role meant they could palm off some of the responsibility for poor quality product onto the supplier but still needed to maintain a reasonably high hit rate among their customers. It was vital in order to keep selling the notes that users reported success with them. So Benjamin and some key contributors maintained a modus operandi document, effectively their own crime script, to guide users through the process. This involved ensuring users did not try too high and invite suspicion, for example, by buying a one dollar item with a one hundred dollar note.

The discussion was open to different kinds of qualitative analysis. A narrative analysis was also conducted which showed the evolution of the community over time. It began well. Buyers expressed excitement at a new source of counterfeit notes which appeared to come directly from a well known producer. Initial batches were received well and were passed off successfully. The second batch had a noticeable drop in quality. Gradually the group turns against Benjamin and they withdraw from the forum. The narrative analysis also allowed me to understand much more about how the script was developed and finessed by the group. It showed how much criminal innovation is about learning and adapting in the moment.

Strengths and limits

CSA itself is scaleable. Examples of its application run from smash and grab robberies, interest rate market manipulation, polluting a river, the assault on the US Capitol Building in January 2021. This makes it eminently suitable for darknet and other digital crime research which uses a range of data covering for example drug dealing enforcement to cross-border ransomware activity. The offender themselves is less central to this theory and it therefore means we might miss significant demographic attributes such as sex, or assume they are irrelevant or not present. Sex is critical to many crimes, particularly those involving sexual predation. It does not  account for effervescence, feedback loops and the seductions of crime which may make digital offending more attractive in itself (Goldsmith and Wall, 2019; Katz, 1988). On the counterfeit currency thread it was questionable how profitable the activity really was, given the likely costs. One motive some users had was a political one, getting something for nothing and engaging in the thrill of purchase using counterfeit notes. These elements are likely to keep criminals involved and looking for opportunities even as some are closed off.


Crime Script Analysis can be used effectively with a large volume of qualitative data scraped from the Tor darknet. I used it to derive two distinct scripts for different criminal actor types. Further data would have allowed for further scripts to be developed, for example, coving the notes producer, or the supporting characters who guided others through their own scripts.

Drug markets and pre-made futures

Some further thoughts on the long term future of illicit drug markets.

10-15 years ago most people buying drugs would do it from a known contact, arranged by telephone, handing over cash in person. Now a deal typically is arranged by social media, sometimes through the open web or darknet, dropped by delivery and paid for electronically, including by cryptocurrency. The drugs being bought would often be the big 6, heroin, cocaine, ecstasy, LSD, amphetamines and cannabis, with known supply routes and methods. Now the classic illegal drugs mix with pharmaceuticals, enhancement and lifestyle drugs, and a vast array of novel psychoactives. As much as new drugs, we have existing drugs being used in new ways, with varying degrees of social legitimacy. For a perspective on the future we can ask how drugs combine chemistry and culture, and how risks and benefits are distributed in Scottish society.

We can look back to some pre-made futures. Here is Star Trek’s Data serving Scotty some synthehol, an artificial alcohol providing pleasure without suffering. A gentle future without human nature in it. Like Data himself. In contrast the 2005 Foresight/Office of Science and Technology Project Drugs Futures 2025 (Nutt, Robbins and Stimson, 2007) recognised that  ‘for thousands of years individuals have used some form of mind-altering chemicals, ranging from comparatively harmless substances, like coffee, to others with substantial scope for harm and abuse’. DF 2025 suggested trends continuing: More sympathy towards people with drug dependence, more understanding of the risks deriving from improved brain science, and improved prediction of problems due to better genetic data and understanding of drug-body-mind interactions. The prediction of magic bullet treatment was confident:  ‘By 2025, vaccinations for a growing number of common drugs of addiction, such as cocaine, heroin, nicotine, amphetamines and cannabis, will almost certainly be available to prevent initiation of, or to treat, drug misuse.’ Also predicted was non-pharmacological neural manipulation e.g. transcranial magnetic stimulation. The scientific predictions didn’t work too well but the organisational, cultural and economic ones are more in evidence. Human nature being obdurate.

In that spirit we can be guided by looking at ethics, care, and human hybridity.

The authors suggest a number of more interesting cultural developments: Extended ‘youth’ leading to more extended drug use life course. Indeed we see much more consumption across the life course and experimentation throughout. We see business executives using LSD. The drug market tends to keep prices down. New drug types have emerged such as smart drug use, use of drugs for cognition enhancement and improvement.  Behavioural addictions are more recognised. Digital life is noted as a vector for behavioural addictions. ‘the Internet and mobile phones may lead to an increase in gambling and to new behavioural addictions, for example, to Internet chat rooms.’ These developments have change the setting of drug use and the kind of normalisation at work. They are less normalised for leisure, and more normalised for work/self. A very good call was the intersection of crime and foreign policy which we see in the alignment of major ransomware/crimeware outfits and Russian foreign policy.

Beyond trends we invite new ethical questions, such as using drugs for enhanced work performance, new kinds of social coercion and competition involved.

What was not present is the digital as an independent factor in drug production, distribution and use. This is the wild card. On a closer look it obeys many of the same rules as before – governed by culture, economics, social shame/desire.

To understand the future of digital drug use we can also recognised past digital myths. In the 1990s the ‘cyber’ was reckoned to be decentralised, voluntary and free flowing. It was separated from geography, nation-states and from pre-digital governance. This describes a moment in time. The digital world is not smooth, light, autonomous, network space. It is disjointed, centralised, heavy. The digital has qualities of permanence, scarcity, and memory over virtuality, abundance, anonymity. It exploits and polarises. It mixes the criminal and the political. Networks used by organised criminals also provide valuable space for dissidents, refugees and others. Conceptually there is no such thing as ‘the digital’ understood as a single, globalised, flat open virtual space. In part it is a digital extension of other institutions such as the mass media, states, corporations, education systems and others,  So how do we develop/adapt investigatory methods to work across that? What configurations of health, harm, and the illicit are borne out of it?

Let us look at an unexpected confluence which nobody predicted but emerged from the ferment of digital innovation. The darknet and cryptocurrency came together to allow for online anonymous markets in illicit goods and services. Drugs could be browsed, bought and paid for, contactless, remotely and in relative anonymity.. Why trust a dealer when you can read reviews and demand next day delivery? Like the early internet, the darknet devolved from a politicised anarchy to something more dominated by big players, with service integration and automation. It developed national, linguistic cultures as in the Russian centred ‘Hydra’ site, which provides secret shopper sampling of drugs sold, and also violent enforcement of contracted gig economy style employees. As well as being functional it also shows a morality of exchange. Networks of people advising each other and learning from them – not wholly individualistic and transactional but also meaningful.

Policing action tended to demonstrate the resilience of darknet operations rather than their vulnerability. Operation Onymous in 2014 had near term effects but that and later operations were often met with innovation and reformation of the markets on other platforms.The NCA and other agencies use other forms of disruption not easily represented here, and whose effectiveness is not always measurable in the same way. Law enforcement interventions allow participants to calibrate their expectations of security and risk. Interventions scrub weaker and more vulnerable players, hence change can be noted prior to intervention. Tactical displacement means drug markets move on-phone and indoors.

We are best seeing this as a reactive moral economy. Crimes you opt into – dodging council tax, TV license, overblown insurance claims, faking school eligibility, as opposed to survival crimes.

Mass crime is a kind of protest/reaction and withdrawal of consent after a threshold is reached. Karsted and Farrall point to 4 anomic cycles. 1 – market society’s emphasis on risk/choice blurs the line between licit and illicit risk. 2. Buyer beware lessens mutual obligation between business and consumer 3. Blurring between fair, shady and outright criminal 4. Growing rules/regulation based society means paradoxically they become meaningless and people/businesses violate the spirit while adhering to the letter. A rote compliance replaces organic solidarity. ‘Legal cynicism’.

Developing the idea that drugs are a system. Drugs are a great internet commodity as much like Jeff Bezos’ decision to start Amazon by selling books, they are relatively easy to warehouse and distribute.  Noticed how criminal groups move from e.g. drugs to cigarette smuggling to malware. There’s not a ‘criminal mode’ they are committed to.  Moving from commodities to services in the illicit drug economy What is a service? I mean it as supply beyond trade, ie there’s a function which is shared. So not necessarily ‘customer service’ though that exists. 

Two claims: reality: services around drug production, distribution, knowledge framework, data infrastructure, substitution/functional effect Directed, functional, not things in themselves. Empirical: And drugs themselves as being services and shaped by a self-referential service culture.  Characteristics of a maturing service market: Expertise can be rented rather than acquired. Decreasing cultural capital and skill demands – lower ‘cost of entry’.  Not human centric, modular, remote contact. Automated e.g. trust systems not local cultural capital, branded pharmaceuticals. Open sourced drug production formulae. Multiple user identities and biographies – not a ‘cocaine user’ ‘ritalin user’ etc

Systems operate across territories – a drone delivery- drug ordering and feedback system is an integrated system involving a service organisation and a digital front end. Infrastructure effects feed off developments in the economy. Distributed industrial production can be retasked to illicit product, as in see counterfeit cigarettes, illicit Xanax production using second hand pill machines, and 3-D printed weapons. Harms can be driven by supply chain needs such as fentanyl displacing heroin/opioids. As in the Country Lines instance, these methods provide vectors for exploitative control. It also opens the way to algorithmic control over operatives.


Karstedt S and Farrall S (2006) The Moral Economy of Everyday Crime Markets, Consumers and Citizens. British Journal of Criminology 46: 1011–1036. DOI: 10.1093/bjc/azl082.

Nutt, David, Trevor W. Robbins, and Gerry Stimson. 2007. ‘Chapter 1 – Drugs Futures 2025’. Pp. 1–5 in Drugs and the Future, edited by D. Nutt, T. W. Robbins, G. V. Stimson, M. Ince, and A. Jackson. Burlington: Academic Press.


Political affordances of the internet and the privacy divide

The internet has been turned into a disclosing machine. Anonymous communication is rare and difficult to achieve. Digital worlds are characterised by affordances, the technological qualities that enable and promote some kinds of human action and which hinder or disable others. Some of these qualities are so fundamental we scarcely are aware of them. One is the tendency of digital platforms to define, identify and label their users. It is a capacity fundamental to their business model. As well as enabling a cash for clicks advertising business it also provides unprecedented technological scope for mass surveillance and digital fingerprinting (Linder, 2019). The surveillant assemblage, as Haggerty and Ericson (2000) coin it, is the melding of different data types such as video, audio, location data and social media streams with automatic analysis and prioritisation in order to identify threats. Private companies compete to offer these services to police, military and private security agencies (Aas, 2011). These qualities are not natural outgrowths of what the internet is but are actively produced according to the economic, social and political priorities that are set by governing forces in our societies. Just as these features are made so they can be contested and disrupted through rival assemblages. One of these is the Tor darknet, a combination of technologies, services and infrastructures that limits monitoring and promotes anonymity (Dingledine et al., 2004).

A darknet redistributes visibility. Facebook and Instagram for example operate as self-contained private networks. Users are visible to Meta and its advertisers, to each other with some limits, but invisible to google or other web search engines. Darknets like Tor (henceforth ‘the darknet’), the focus of this post, shift the disclosure locus of control from the designed-in affordances of the platform to the decisions of the user. The darknet is one of several community supported, technical solutions to the surveilling internet (Collier, 2020). It is intended to bypass censorship and contribute to a sphere of privacy and autonomy. Users often see it as a valued place of privacy and anonymity (Mirea et al., 2019).

Tor is a routing system which encrypts connection data in order to disrupt what is called traffic analysis. Doing so makes it difficult for a third party to tell who is connecting from where. Effectively it means an internet user can browse websites and send messages without being easily traced. The design of Tor allows for relatively fast communication compared to for example Freenet, a peer-to-peer darknet. Tor is relatively easily accessible and useable. To connect to the Tor network a user just has to download the Tor Browser from the Tor foundation (see Web Resources section). The Tor Browser is built on Mozilla Firefox so its interface is familiar to web users. It is designed to work with the user’s mental model of how a web browser functions (Perry et al., 2018). When the user launches the browser it seeks to connect to a node on the Tor network, called a relay.  A start or guard relay, a connecting or middle relay, and a final or exit relay makeup a complete circuit. The network routes and encrypts data packets between relays to reduce the risk of identification. Nodes are hosted by volunteers. The code on which the network runs is maintained by the Tor Project’s developers and by a wider community.

Tor allows users to browse the web and connect to services. It has a significant second function also. It allows services to connect directly through its network, called onion or location-hidden services. Onion services allow a server to be connected without its location being revealed. Users can set up web services without the host’s IP address being known. The investigative journalism institution ProPublica and the privacy focused email service Protonmail both offer onion services along with their normal web sites, as does Facebook. The British Broadcasting Corporation (BBC) provides an onion mirror for its international news to help citizens of authoritarian countries. These services protect users and provide an anonymous route to using them. It is possible to combine an onion service with a payment system using cryptocurrency. That allows for illicit services called ‘cryptomarkets’ to be offered (Martin, 2014). The focus of much research on the darknet is about this criminogenic aspect, in part because it offers a place where illicit markets can be researched with relative ease.

What kind of questions can be asked of and with the darknet

Research questions can be asked about Tor, and of Tor. Tor is part of a much wider movement for online anonymity and privacy. As Collier (2021) shows, Tor is itself a place where the meaning of privacy is contested. It has a fascinating history having emerged from a collaboration between the US Naval Research Laboratory and the Free Haven Project. The development and evolution of Tor can be used to trace shifting political and ethical debates about privacy and autonomy and the degree to which social values can be embedded in infrastructure (Bancroft and Scott Reid, 2017).

Onion services are a social sphere in themselves. For example, The Hub hosts Reddit like discussions about the darknet itself, and about various social and political issues.

The cryptomarkets are sites of illicit exchange and also typically host discussion forums that focus on drug quality, trust and reliability of the illicit markets, and issues like harm reduction. As the markets evolve new social formations emerge. For example, Hydra is the predominant cryptomarket operating in the Russian and post-Soviet space. Cryptomarkets focused on Western nations separate drug selling from drug delivery which is mostly carried out through the postal system. Hydra has a hybrid system of dead drops in operation and is a far more integrated business than other cryptomarkets. The historical evolution and adaption of criminal business models can be studied in its context through examining different cryptomarkets and their history. National differences can be explored as can the specific state formations they operate in. Using this approach criminological models and concepts regarding criminal organisation and exchange can be tested.

The demographics of who uses the darknet and how they come to use it is a set of questions which link to themes of the digital divide, digital literacy and varying degrees of online censorship and repression throughout the work. As the world becomes more authoritarian data on darknet usage can provide one metric of shifting repression and political activism. It can also be used to examine the privacy divide. Much like the digital divide, the privacy divide means that the resources to protect one’s own privacy are very unevenly distributed. Varied technological, economic and cultural resources make a significant difference to the legal and social exposure of digital citizens. The ability to protect oneself against public shaming and cancellation and to recover from reputational damage matter alongside legal liability.



The future has arrived, said William Gibson. It just has not happened to you yet.

The future has arrived, said William Gibson. It just has not happened to you yet. Count yourself lucky. Participating in discussions on the future of policing gives me a chance to think about the role of futurology in social science. Futurology often shows up in a way that gives it a bad name. It is always wrong, except for my go at it, which you should definitely listen to. Breathless predictions of the coming of network societies, freedom from the bonds of the real, and unlikely tech innovations merge together in a techno-libertarian monster. They flounder in the face of humanity’s limitless ability to screw it all up. There are some obvious flaws in these visions which I still need to point out: they assume change is driven by technology as an independent force, rather than human interests. It is a damn sight easier to change the past than the future. They read from ideal world relations to real world uses. The lol-worthy elements of this should not detain us for long. Instead let us look at what predictions have already come about, using our first trick – the old is the new thing:

We already have driverless cars. They are called ‘metros’ and ‘railways’.

We already have nuclear fusion. It is called the sun. And also ‘global thermonuclear war’.

England had a social network operating since 1516, called ‘The Royal Mail’. And since the late 19th century, ‘Have you called your mother recently?’.

We definitely already have killer robots operating in the battlefield.

I am dipping into futurology because I am examining the future of digital drug markets.

The second trick is to predict the past. Let us start from the past, usually a good, predictable place. 10-15 years ago most people buying drugs would do it from a known contact, arranged by telephone, handing over cash in person. Now a deal typically is arranged by social media, sometimes through the open web or darknet, dropped by delivery and paid for electronically, including by cryptocurrency. The drugs being bought would often be the big 6, heroin, cocaine, ecstasy, LSD, amphetamines and cannabis. Now the classic illegal drugs mix with pharmaceuticals, enhancement and lifestyle drugs, and a vast array of novel psychoactives. 

Let us draw some generalisable conclusions:

  • There is no direct correlation between economic development and digitisation of the drug market. The darknet is much more prevalent in Russia than the West for example. 
  • Over time, illicit labour organisation and distribution of wealth have become more like licit models
  • The digital has become embedded in everyday life so there no segment untouched by it
  • Increasingly digital operating criminals are innovative rather than reactive

Final trick, it is safe to assume some trends will gather steam. Other have inbuilt limits which we already know:

  • Some of these trends will continue, particularly innovation. The digital world is fracturing politically and nationally, for example, as alt-right alternatives to social media are launched. Criminal groups are likely to take the lead or take advantage of the development of infrastructures that are independent of the tech economy mainstream.
  • Early trends we can see now will expand, particularly localisation and compartmentalisation. Drug businesses will be sold as an integrated package, including hosting, services and delivery.
  • We will see the replacement of the core/distributor model of drug business operation with one where the most successful will be ‘meta criminals’ who can license others to act on their behalf. 
  • The cryptocurrency moment is probably over as Bitcoin collapses under its own weight and blockchain analysis makes deanonymisation much more likely. Instead we will see payments through other non-cash systems.

Futurology tends towards the untestable and it is reasonable that social scientists do not like it very much.  Our role is often to burst the bubble at the Ted-talk party. However we have a number of jobs we have to do in order to serve our societies and communities. We need to be able to confidently predict the threat horizon. We should sketch out different possible developments and show how likely it is we will get there from here. We should be able to feedback and to pull the alarm about where these developments lead. We need to prepare people for future shocks and enhance societal resilience. 

Find out more at the Institute for the Future 

All the world is not a stage and life is not a performance

Photo by Kyle Head on Unsplash
Photo by Kyle Head on Unsplash

Okay, someone writing a crime script analysis should probably not be saying this but here we go.

One of the lightulb moments in teaching sociology is when you introduce Erving Goffman’s Presentation of Self in Everyday Life. It tells on us. In a compelling way it shows what we are like when we act in front of an imagined audience. It shows the pose of normality and agreeableness demanded by modern social life. It is immediately tangible because it feels like everyone does it – poses while waiting to meet someone in public, gives off ‘I’m not suspicous’ signals when talking out of a shop past the eletronic detector. It’s why everyone around the Queen tries to sound posher than her.

The language of drama, scripting and front/backstage is very compelling. It is a bit harder to sustain as an exciting revelation when this is not a revelation at all but an explicit feature of the technology of life. I picture a billion Insta users saying ‘well, duh! Filters!’. As with all good sociological ideas it has been generalised to within an inch of its life. There is a tendency to code everything as performance – data, sex, nations, emotions, it is all a performance. There is a constant presence of explicit impression management tools in our social media and validation of impression management in British culture. Be yourself! but the better self, with the nicer complexion y’know. That beguiles us into thinking that these practices are typical and fundamental to social life.

What do contemporary writers mean by performance? They make several implied claims that are not the same and do not in face validate each other. These are:

  1. People act into their socially defined role, beyond what is necessary to fulfil its functions.
  2. A lot of work is put into a kind of ‘demonstration of the self as suitable to this function’
  3. There is a fundamental dramaturgical structure to social life, for example, gender is only ever a performance with no ground floor in biological sex. Yes I know Judith Butler says gender is a performative in the speech-act sense but we all know they do not really mean that.
  4. Meaning that the world is a text.

Here is an example of one way performance appears a lot of the time. I have taken this from Holt and Lee’s (2021) crime script analysis of purveyors of forged documents. They do not make claims about performance, this is just a good bit of data for me. In it a vendor of counterfeit documents says: ‘After we receive your message, our support team will get in touch with you directly with all the necessary follow up and complimentary details for the transaction.’ I noticed a lot of text used in online crime transactions of this type are used to give the impression of a honed, complex professional operation at work. It is an open question how incidental these elements are to the crime script.

Whether in the case quoted by Holt and Lee that is true we do not know. Criminal operations adopt the customer care language of the service economy. In part this is grease on the wheels, which is intended to make the transaction more trustworthy in the eyes of the buyer. In part, it becomes a part of the culture: you just talk in that way because that is how it is done. As a previous generation of criminals would be adapt in the language of intimidation so the new generation of service criminals are adept at the global language of human resource management. But at its heart they still need to know how to inveigle, deceive, manipulate and sometimes bring violence to bear on a target. The right performance might help them do that, and it might have evolved as the way of doing things in that context. But it does not make sense to say that the essence of what we are looking at is a performance.

Holt, Thomas J., and Jin R. Lee. 2020. ‘A Crime Script Analysis of Counterfeit Identity Document Procurement Online’. Deviant Behavior 1–18. doi: 10.1080/01639625.2020.1825915.

The fundamental laws of crime and why I’m not a critical sociologist

Photo by Dan Meyers on Unsplash

This post was inspired by reading David Buil-Gil and Patricia Saldaña-Taboada’s article cited below. It helped crystalise my thinking about what colour of sociologist I am.

One of the fundamental insights of critical sociology or criminology is that what we are studying is a social construct. I used to be very enamoured of this as it provides a graspable critical handle on the issue. For example, we might say what matters is what we define as a crime, and how doing so affects people’s life course, how they are labelled and so on. These decisions do matter. Along with that I have come to believe that there are underlying rules which are independent of these constructions. We should not be so enamoured of our constructionist analysis that we stop trying to find or paying attention to these laws. We are often cagey about recognising them given how sensitive crime statistics are to recording and just how awful we have been as a society at recording some crimes, such as sexual violence.

Your mission, should you choose to accept it, is to decide whether you are a critical scholar – everything comes down to its construction – or a social facts kind of scholar – there are basic laws of human society. No, you cannot be both. If there are fundamental rules then all the stuff studied by critical scholars matters but is subordinate to the social facts, or socio-biological facts. That also means accepting that there are some essential qualities to social categories like ‘crime’, however wobbly and contingent any one definition of crime might be.

I am more and more convinced that sociological phenomena like crime obey some basic statistical laws which govern everything else that happens. I suspect that these processes are fundamental to the human condition. They are a basic function of how humans work, and are grounded in the mix of biology, psychology and material essences which make up the human. They shape what we encounter, and our constructions shape how we encounter it. Here we go:

1. Law of concentration. Most crime is committed by a small number of offenders.

2. Proximity rules. Crime takes place when/where it is convenient, and generally harms people who have something in common with the offender.

3. Pesistence of harm. People who are victimised once will often be victimised multiple times (See rule 1).

4. Social specialisation over time. Criminals select for criminal contacts, and their skill/division of labour increases, leading to high lock in over the criminal career.

These laws are demonstrably persistent between jurisdictions, crime types and other variations in the environment. Some of them could be explained by for example the theory of labelling and deviance amplification. The very fact of the social construction of criminal offences works against that. Offences that are ignored by society or deeply mischaracterised still respond to these rules. Now, economics on the other hand …

Another problem with the peformance take on things is it lets some of us off the hook. For example: one position in the debate on sex work takes it that there is something fundamentally dangerous and exploitative about it. The opposing view is that the only dangers emerge due to societal stigmatisation and criminalisation. The only harms are socially constructed ones. That side is also an essential claim, that sex work is just work, but it gets disguised as a critical claim and so gets a free pass on having to prove its case.


Brantingham, P. L., and P. J. Brantingham. 1981. ‘Notes on the Geometry of Crime (1981)’. 26.

Buil-Gil, David, and Patricia Saldaña-Taboada. 2021. ‘Offending Concentration on the Internet: An Exploratory Analysis of Bitcoin-Related Cybercrime’. Deviant Behavior 0(0):1–18. doi: 10.1080/01639625.2021.1988760.

Hipp, John R. 2016. ‘General Theory of Spatial Crime Patterns’. Criminology 54(4):653–79. doi: 10.1111/1745-9125.12117.

Kaplan, Howard B., Steven S. Martin, and Cynthia Robbins. 1982. ‘Application of a General Theory of Deviant Behavior: Self-Derogation and Adolescent Drug Use’. Journal of Health and Social Behavior 23(4):274–94.

Glueck, Sheldon, and Eleanor T. Glueck. 1950. Unraveling Juvenile Delinquency / Sheldon and Eleanor Glueck.Cambridge, Mass: Harvard University Press.


The material matrix and the illicit biosocial economy

The end of European empires contributed to the rise of methodological nationalism. That is the set of infrastructures and habits of mind that treats each nation-state a single coherent container of a population. Global datasets like that held by the United Nations are typically aggregates of national ones so preserve this principle that the nation is a singular research unit. That has problems: it assumes internal homogeneity and coherence over external influence and cross-national dynamics. There is a danger of seeking like a state in analysis rather than seeing in terms of material relations that can span borders and might have more in common with each other than the ‘home’ state. This approach will challenge us in many ways. In sociology the standard model is pretty much one of exploitation, the powerful centre imposing homogenisation on the periphery. The standard model is out of date and misses how the periphery is itself productive, or is not even especially peripheral. I am using the concept of the matrix to capture the different arrays of forces that work to distribute commodities, people and cultures across borders.

There is a hidden history of drug trades that contributed to or were part of the rise of globalisation and the pre-eminence of Western Europe. “Psychoactive commerce” provided intoxicants in huge quantities. Drugs became commodified.  Their production ceased being for local use and became for sale, usually to another part of the globe.  Began from the colonial age onwards, when European countries began colonising other parts of the globe. This went for wine, spirits, tea, coffee, tobacco, opium and later cocaine and cannabis. Were these developments specific to narcotic globalisation or just globalisation that happened and caused narcotic trade to be globalised with it?  Historian David Courtwright’s argument is that one of the forces driving globalisation was the developing demand in modern European countries for stimulants and narcotics.  In vaguely historical order: tea, tobacco, coffee, opium, cocaine.  Narcotics were of decreasing historical importance though.  The last in this list, cocaine, relied on globalisation to come into being as a mass drug, but the demand for it in no way drove globalisation, unlike the others mentioned.

Objects have the power of embodying all kinds of relationships and dispositions, of pleasure, pathology and recovery. They can delimit, though not dictate, the terms of their use. Intoxicants mediate such issues as social class (wine), gender (sugar) and savoir-faire (absinthe). In the rhetoric of intoxication, each quality is constructed in relationship to others such that the sweetness of sugar only exists in relation to the bitterness, acidity, saltiness, sourness and umami of other substances. Material culture reproduces and affirms these social relationships which become, in part, relationships between objects. The complex back-and-forth between the drug, its cultural signification and material matrix of production and consumption constantly regenerates the materiality of intoxication within an algorithmic culture.

We now see Opium closely bound up with geopolitics. However there are many myths to the opium wars. One is that the population was addicted. However opium was commonly used in England, India and China at the time and ill effects were limited – other than some people smoking away in languor (Dikotter, Zhou and Laamann, 2006). Opium use was mostly moderate. A more subtle picture emerges than the drug being forced on China. China had a well developed intoxication culture. The 1895 Royal Commission on Opium in India also viewed opium as beneficial, a cash crop, medicine and recreational intoxicant. The standard Opium War narrative treats the world outside the West as passive and victimised.

Let us take an intoxicant focused view. In this the capacity for intoxication was enhanced by capitalism. Capitalist trade is a route for intoxication. Continuing this theme of the global transition of methamphetamine. Meth is cheaper to produce and is produced in greater volumes than ever. The market has shifted from Mexico/Northern America and the Golden Triangle to Europe, South Asian and Africa. The Asia-Pacific market estimates at $61billion. In many African countries it has displaced cannabis. As in  North America, meth occupies left-behind communities, takes the space of those marginalised by economic development.  The meth market in Africa is highly centralised and controlled, with strong cross region integration and stable pricing. The South African meth market is well established, with production moving to cheaper spots such as Nigeria/West Africa. Meth is also being smuggle from Afghanistan via Pakistan, displacing the old heroin route.

Years ago we would never have thought that buying MDMA would involve a distributed accounting ledger which is now one of the world’s major consumer of electricity and microchips. Bitcoin and the darknet cryptomarkets is one part of the emergence of a global integrated system of addicting, treating, and intoxicating selves. It goes well beyond that to agricultural innovation in the Rif, laboratory production in Afghanistan, rapid testing of new psychoactive substances in China, and the world empire of pharmaceuticals. We used to call Colombia and Afghanistan narco states: nations where the illicit economy had taken over swathes of government and policing such as to replace formal governance with shadow government by cartels. Now the narco state is a global material matrix of licit and illicit, pharma and tech companies, organised crime and criminal entrepreneurs. The material culture of intoxication is created within global flows, technoscapes and the residue of past efforts. There is no natural, herbal high here, untroubled by cultural norms, political economies and human meddling. 

Dikotter, Frank, X. Zhou, and L. Laamann. 2006. ‘’China, British Imperialism, and the Myth of the’Opium Plague”’. in Drugs and empires.

Eligh, Jason. 2021. A Synthetic Age The Evolution of Methamphetamine Markets in Eastern and Southern Africa. Geneva: Global Initiative Against Transnational Organized Crime.