6 ms·

> I am amazed at how well these criminals from another country know the details of the systems in the US when we in the US have probably a handful of people who

> I am amazed at how well these criminals from another country know the details of the systems in the US when we in the US have probably a handful of people who understand the end-to-end line they do. It’s quite literally a criminals job to understand and abuse these systems, and there’s very clear link between their performance and their reward. Makes for a good motivator. People frequently underestimate criminals because they don’t appreciate that these individuals are doing this work as full time job. I’m sure if you spent 8 hours a day for week, you’ll have an equally good understanding.

joncrane 6y ago
I always find it ironic that for all but the most lucrative criminal enterprises, if the criminal applied the same amount of effort towards pursuing legitimate employment, they would come out ahead (adjusted for risk of course). Some people just enjoy "getting over" more, to the point that they will discount their labor used for such schemes.
- exhilaration 6y ago
  Adjusted for location as well. I'm very skeptical that these Nigerians can find anything this lucrative within their own country.
- tyre 6y ago
  How do you know that to be true? Social engineering, much hacking, scamming, etc. don't care about race or gender or connections or degrees, all of which are very real things limiting people's professional success. Many can be done without interacting with a team and without any kind of interview, both of which are skills. I doubt these people are discounting their time or labor. They might be optimizing for the opportunities available to them. Willingness to do something illegal could reasonably be seen as an arbitrage opportunity—something seen in business all the time.
  - CSMastermind 6y ago
    There's a famous bit of research done by the guy who wrote Freakonomics. He tracked how much drug dealers were actually making and found that if they just got a job at McDonald's they'd have a higher income.
    - withdavidli 6y ago
      If I remember correctly, that was for low level weed dealers, not scamming financial systems. A successful identify theft of a middle or upper income family will reap a payout much greater than a fast food worker.
      - ioseph 6y ago
        Dealing drugs can also offer a much higher degree of flexibility to conventional work
    - ReactiveJelly 6y ago
      When I was a teenager, I tried to work at McDonald's over one summer break. They turned me down.
    - zymhan 6y ago
      Freakonomics is an awful representation of economics. It's literally a collection of anecdotes and uncontrolled experiments.
    - code_duck 6y ago
      I can say, based on my own observations, that is absolutely nowhere near true. Many people selling drugs to their friend groups make profit in excess of $400 a day, tax free. I can't speak for a larger group, of course. Perhaps the average is weighed down by more casual actors.
      - foldr 6y ago
        It's only tax free if you're stupid enough not to launder the money.
- Marsymars 6y ago
  Maybe. I don't have faith that the world is that meritocratic. I don't know many criminals, but I know people who are smart and competent, but who've fallen into careers with low pay and no room for advancement. Crime is something that doesn't require the resume or capital of legitimate options.
- swiley 6y ago
  It’s very very easy in the modern world to end up in a situation where you’re not allowed to contribute positively and have very few options other than crime.
  - unishark 6y ago
    You mean with some kind of criminal record, or just a dead end career? Because the latter is your starting point, not your end point, when it comes to deciding whether it pays better to put subsequent effort into figuring out how to profit via crime versus finding better legitimate ways to make money.
- weswpg 6y ago
  I think you overestimate the lucrative opportunities available to hard-working honest people especially in developing countries where a lot of these operations are based
- smabie 6y ago
  Why don't you go to Nigeria and find out.
- dannyw 6y ago
  I don't think that's true. The criminals you hear are the only ones who get caught. In fact, I would say criminal activities have a higher risk-adjusted return than legitimate activities, simply because there's less "supply" in this labour market due to moral reasons and risk-aversion. As an example, let's say you find a zero-day that gives you access to any FAMG account. Their responsible disclosure programs will pay you probably ~$31,337 (real example from Google). If you sell that on the darkweb as a "hax any Google account as service", while it is more effort, you could absolutely clear multi-millions from it (charge $50k per account hijack; which itself can lead to millions in fraud profits or selling intellectual property; etc; can maybe pull this off 50 times before it gets patched = $2.5 million). Not to mention you'd probably be able to sell it to Saudi Arabia and Israel for anywhere from six to eight digits too depending on their operational needs. So that's a >80x increase in earnings if you go the criminal route. It's more work, but there are brokers who will happily do the heavy lifting for you in exchange for taking a cut of the profits. And if you reside in a country where the government essentially encourage hacking Western companies as long as you don't hack properties of your own nation (e.g. China; Russia), then the risk to you is virtually zero (as long as you don't plan to travel to a western-extradition country).
  - tilolebo 6y ago
    for all but the most lucrative criminal enterprises What you described is top-notch hacking and super high risk (99,99% of such criminals probably never deal directly with governments). Seems similar to claim that acting pays well and take the example of Tom Cruise to prove it. The recent interview of Marcus Hutchins says something else: he's been working full time as black hat and realized afterwards that being a white hat pays better.
    - ryanlol 6y ago
      Marcus Hutchins simply didn’t understand the business side of things.
    - rwmurrayVT 6y ago
      He had his fingers in his ears singing la la la
- avianlyric 6y ago
  I work in preventing financial crime, so I have some useful context on this. Unless your hitting the big leagues (stealing millions to tens of millions of dollars) then the odds of you actually getting caught and prosecuted are basically 0. This sounds silly, but it’s mostly driven by the fact that most traditional law enforcement agency (i.e. the police) don’t understand or are interested in preventing financial crime. It’s too abstract, doesn’t have a physical component, and frequently the criminals will be completely different jurisdictions to victims. Even when you provide the police with the home address and photo ID of a financial criminal to the police, they usually won’t do anything. Again they don’t understand the crime, they don’t have the training to investigate and they don’t know what evidence is needed to prosecute. Finally the police are usually rated by the public on the number of shootings and stabbing that didn’t happen, rather than dollars not stolen. So the only agencies that actually pursue financial criminals are people like the secret service in the US, and the City of London fincrime team in the UK. Both relatively small agencies compared to a national police force. The end result is they only pursue whales, people and organisations that have stolen millions from one person or organisation. If you’re not a whale, then no ones gonna chase you. You can spend years ripping off grandma‘s at $10k a pop, and no law enforcement agency will care.

joncrane 6y ago

I always find it ironic that for all but the most lucrative criminal enterprises, if the criminal applied the same amount of effort towards pursuing legitimate employment, they would come out ahead (adjusted for risk of course). Some people just enjoy "getting over" more, to the point that they will discount their labor used for such schemes.

exhilaration 6y ago
Adjusted for location as well. I'm very skeptical that these Nigerians can find anything this lucrative within their own country.
tyre 6y ago
How do you know that to be true? Social engineering, much hacking, scamming, etc. don't care about race or gender or connections or degrees, all of which are very real things limiting people's professional success. Many can be done without interacting with a team and without any kind of interview, both of which are skills. I doubt these people are discounting their time or labor. They might be optimizing for the opportunities available to them. Willingness to do something illegal could reasonably be seen as an arbitrage opportunity—something seen in business all the time.
- CSMastermind 6y ago
  There's a famous bit of research done by the guy who wrote Freakonomics. He tracked how much drug dealers were actually making and found that if they just got a job at McDonald's they'd have a higher income.
  - withdavidli 6y ago
    If I remember correctly, that was for low level weed dealers, not scamming financial systems. A successful identify theft of a middle or upper income family will reap a payout much greater than a fast food worker.
    - ioseph 6y ago
      Dealing drugs can also offer a much higher degree of flexibility to conventional work
  - ReactiveJelly 6y ago
    When I was a teenager, I tried to work at McDonald's over one summer break. They turned me down.
  - zymhan 6y ago
    Freakonomics is an awful representation of economics. It's literally a collection of anecdotes and uncontrolled experiments.
  - code_duck 6y ago
    I can say, based on my own observations, that is absolutely nowhere near true. Many people selling drugs to their friend groups make profit in excess of $400 a day, tax free. I can't speak for a larger group, of course. Perhaps the average is weighed down by more casual actors.
    - foldr 6y ago
      It's only tax free if you're stupid enough not to launder the money.
Marsymars 6y ago
Maybe. I don't have faith that the world is that meritocratic. I don't know many criminals, but I know people who are smart and competent, but who've fallen into careers with low pay and no room for advancement. Crime is something that doesn't require the resume or capital of legitimate options.
swiley 6y ago
It’s very very easy in the modern world to end up in a situation where you’re not allowed to contribute positively and have very few options other than crime.
- unishark 6y ago
  You mean with some kind of criminal record, or just a dead end career? Because the latter is your starting point, not your end point, when it comes to deciding whether it pays better to put subsequent effort into figuring out how to profit via crime versus finding better legitimate ways to make money.
weswpg 6y ago
I think you overestimate the lucrative opportunities available to hard-working honest people especially in developing countries where a lot of these operations are based
smabie 6y ago
Why don't you go to Nigeria and find out.
dannyw 6y ago
I don't think that's true. The criminals you hear are the only ones who get caught. In fact, I would say criminal activities have a higher risk-adjusted return than legitimate activities, simply because there's less "supply" in this labour market due to moral reasons and risk-aversion. As an example, let's say you find a zero-day that gives you access to any FAMG account. Their responsible disclosure programs will pay you probably ~$31,337 (real example from Google). If you sell that on the darkweb as a "hax any Google account as service", while it is more effort, you could absolutely clear multi-millions from it (charge $50k per account hijack; which itself can lead to millions in fraud profits or selling intellectual property; etc; can maybe pull this off 50 times before it gets patched = $2.5 million). Not to mention you'd probably be able to sell it to Saudi Arabia and Israel for anywhere from six to eight digits too depending on their operational needs. So that's a >80x increase in earnings if you go the criminal route. It's more work, but there are brokers who will happily do the heavy lifting for you in exchange for taking a cut of the profits. And if you reside in a country where the government essentially encourage hacking Western companies as long as you don't hack properties of your own nation (e.g. China; Russia), then the risk to you is virtually zero (as long as you don't plan to travel to a western-extradition country).
- tilolebo 6y ago
  for all but the most lucrative criminal enterprises What you described is top-notch hacking and super high risk (99,99% of such criminals probably never deal directly with governments). Seems similar to claim that acting pays well and take the example of Tom Cruise to prove it. The recent interview of Marcus Hutchins says something else: he's been working full time as black hat and realized afterwards that being a white hat pays better.
  - ryanlol 6y ago
    Marcus Hutchins simply didn’t understand the business side of things.
  - rwmurrayVT 6y ago
    He had his fingers in his ears singing la la la
avianlyric 6y ago
I work in preventing financial crime, so I have some useful context on this. Unless your hitting the big leagues (stealing millions to tens of millions of dollars) then the odds of you actually getting caught and prosecuted are basically 0. This sounds silly, but it’s mostly driven by the fact that most traditional law enforcement agency (i.e. the police) don’t understand or are interested in preventing financial crime. It’s too abstract, doesn’t have a physical component, and frequently the criminals will be completely different jurisdictions to victims. Even when you provide the police with the home address and photo ID of a financial criminal to the police, they usually won’t do anything. Again they don’t understand the crime, they don’t have the training to investigate and they don’t know what evidence is needed to prosecute. Finally the police are usually rated by the public on the number of shootings and stabbing that didn’t happen, rather than dollars not stolen. So the only agencies that actually pursue financial criminals are people like the secret service in the US, and the City of London fincrime team in the UK. Both relatively small agencies compared to a national police force. The end result is they only pursue whales, people and organisations that have stolen millions from one person or organisation. If you’re not a whale, then no ones gonna chase you. You can spend years ripping off grandma‘s at $10k a pop, and no law enforcement agency will care.