# Characterising Cybercriminals: A Review

Matthew Edwards, Emma Williams, Claudia Peersman & Awais Rashid

## Executive Summary

This review provides an overview of current research on the known
_characteristics_ and _motivations_ of offenders engaging in cyber-dependent
crimes. Due to the shifting dynamics of cybercriminal behaviour, and the
availability of prior reviews in 2013, this review focuses on original
research conducted from 2012 onwards, although some older studies that were
not included in prior reviews are also considered. As a basis for
interpretation of results, a limited _quality assessment_ was also carried out
on included studies through examination of key indicators.

The results of this survey indicate that while the research base is expanding,
evidence on these topics remains limited. Existing research is constrained by
methodological limitations and difficulties in accessing offender populations.
Many studies reported on low-level or loosely-defined forms of
cybercriminality, self-reported in student or youth populations, rather than
technically sophisticated attackers. Anonymous online surveys of cybercriminal
venues have greater potential to access this latter population, but are
limited by doubt about the accuracy of self-reported accomplishments or skill.
Police case data is also used, but relatively small numbers of prosecutions
for cybercrime relative to traditional offending hamper generalisability of
results, particularly when focused on technically sophisticated attackers.

With these limitations in mind, the characteristics supported from the
literature include a greater likelihood of being in younger age groups, being
male, high levels of internet/computer use, completing or having completed
higher education, and low levels of self-control. In Western countries, there
may be an ethnic bias towards offenders being white. Limited evidence exists
on the living situations of offenders, with some indication that being single
is more likely amongst cybercriminals.

The motivations highlighted from the literature include financial reward,
revenge, previous victimisation in cybercrime, a desire for power and
recognition, curiosity, immersion in the challenge of defeating security
systems, the perception of low risk of punishment, and perceived social and
moral acceptability of cybercrime. Revenge and previous victimisation are
given particular attention, with examination of the overlap between offenders
and victims being a focus of a number of studies.

The review results highlight the need for more objective measures of
cybercriminals, and greater focus on technically sophisticated attacker
populations. The AMoC project’s later stages will tackle these challenges
through large-scale data mining of cybercriminal forums.

##  Introduction

This literature review aims to provide an overview of current research
regarding the characteristics and motivations of offenders engaging in cyber-
dependent crimes. It represents the first deliverable within WP1 of the AMoC
project and reviews existing literature on cyber offenders, their motivations
and characteristics (both in terms of demographic characteristics and
psychological characteristics). This review will form the basis for the
development of an initial framework regarding cybercriminal characteristics,
providing an evidence-based foundation from which to interpret data gathered
from forums and other sources, both over the course of the AMoC project and in
future research.

The review is structured as follows:

  * •

The remainder of Section 1 considers (i) the method used to conduct the
literature review, (ii) the primary theoretical approaches that have been
applied to aid understanding of the behaviour, characteristics and motivations
of cyber offenders, and (iii) a summary of work conducted prior to the main
period of focus for the literature search.

  * •

Section 2 provides an overview of the primary characteristics of cyber
offenders that have been identified within prior literature and considers the
relative robustness of findings in this area, focusing predominantly on
literature published from 2012 onward.

  * •

Section 3 discusses the various motivations of cyber offenders that have been
identified within prior literature, again considering the relative robustness
of findings in this area and focusing predominantly on literature published
from 2012 onward.

  * •

Section 4 reports on the overall quality assessment of literature included in
the review, focusing on sample sizes and types as well as method
replicability.

  * •

Section 5 discusses limitations of existing research in this area, including
the primary research methods used and associated issues. This section also
highlights current gaps within the existing research base, which may limit the
extent to which robust conclusions can be drawn.

  * •

Finally, Section 6 offers key conclusions from the literature review,
including the main characteristics and motivations that are sufficiently
supported to warrant inclusion within the initial framework.

### Review Methodology

This review focuses on research that investigates the various motivations of
cyber offenders (i.e., the factors that account for why an individual engages
in online offending) and the likely characteristics of these offenders, both
in terms of demographic characteristics (i.e., age, gender, education level,
etc.) and psychological characteristics (e.g., personality traits, behavioural
characteristics). Research that does not investigate these aspects will be
excluded from the review. This review will also focus on literature
investigating particular types of cyber offences, namely cyber-dependent
crimes such as hacking, malware development, online fraud (e.g., carding), and
hacktivism. Research investigating cyber terrorism, child sexual exploitation
or other forms of cyber-enabled crime will be explicitly excluded.

The review will focus on identifying and evaluating original research
conducted in this area, although review articles and those describing or
evaluating relevant theoretical models may also be considered if they make an
original contribution to the research base. Existing research will also be
subject to a form of quality assessment to enable the potential contribution,
generalisability and likely replicability of the research to be evaluated.
This quality assessment will focus on considering the participant sample size
and sample type (e.g., the relative diversity of participants), the publishing
outlet (e.g., the impact factor of academic journals, whether the article has
undergone peer-review prior to publication), and whether sufficient
information is provided within the research methodology of the article to
enable the method to be effectively reproduced by other researchers if they
had access to a comparable sample population. The extent to which particular
findings have been replicated in multiple research studies will also be
considered.

The fast pace of change inherent in online services, digital technologies, and
resultant criminal activities exploiting these services is likely to result in
an ever-shifting dynamic of cybercriminal behaviours, motivations and
characteristics. To ensure that this literature review considers an evidence-
base that is sufficiently relevant to current issues within the time
available, the literature search will focus predominantly on identifying and
evaluating research that has been published from 2012 onward. Research
published prior to this time will not be ignored, but will similarly not form
the predominant basis for evidence-based recommendations and evaluations. This
date was specifically chosen due to the publication of a number of in-depth
reviews of research regarding the characteristics and motivations of various
types of cyber offenders in 2013 (e.g., Kirwan and Power [1], Broadhurst et
al. [2]), and a Home Office review of available evidence on cybercrime more
generally [3], which includes a focus on UK evidence about offender
characteristics. Together, these resources provided a strong basis for
understanding the key findings of research prior to this period.

### Key Theoretical Approaches

A range of theoretical approaches from psychology, criminology and sociology
have previously been considered in relation to the behaviour, motivations and
characteristics of cyber criminals. These have focused predominantly on five
main theories: (1) neutralisation theory, (2) self-control theory, (3) social
cognitive theory, (4) routine activity theory, and (5) the theory of planned
behaviour.

#### Neutralisation Theory

Neutralisation Theory [4] focuses on how individuals perceive and consider the
potential impact of their criminal activities, and the way in which they may
distort these perceptions in order to make their activities more morally
acceptable. This can be linked to the psychological process of cognitive
dissonance [5], whereby people find it uncomfortable to hold competing
thoughts about an issue. For instance, if they believe that engaging in
hacking is a morally unethical behaviour, but they engage in this activity,
then in order to reduce the resultant conflict between their moral perceptions
and their behaviours, they can either stop engaging in the behaviour
altogether (i.e., no longer engage in hacking activities), or they can adjust
their attitudes and thoughts to correspond with their behaviour (e.g.,
considering that hacking is not hurting anyone directly and so it must be
okay, thus making it a morally acceptable activity). Neutralisation theory has
been applied to hacking (e.g., [6]) and digital piracy activities (e.g., [7]),
with 5 primary mechanisms originally highlighted by which this may occur.
These include: (a) denial of responsibility (e.g., “I had no other choice”),
(b) denial of injury (e.g., “it doesn’t hurt anyone”), (c) denial of victim
(e.g., “the victim deserves it in some way”), (d) condemnation of the
condemners (e.g., “victims are hypocrites”) and (e) appeal to higher loyalties
(e.g., the behaviour was warranted to achieve a higher purpose).

#### Self-Control Theory

The Self-Control Theory of Crime considers that individuals often engage in
criminal activities due to failure in their ability to effectively control
their behaviour [8]. Self-control is considered a trait psychological
characteristic linked to the ability to avoid and resist temptation (or not)
(see Ent et al. [9]). Individuals low in self-control are considered to be
more impulsive, take greater risks, and fail to adequately consider the long-
term consequences of their actions. This trait has also been linked with cyber
criminal activities, such as downloading illegal content [10], as well as
traditional forms of crime.

#### Social Cognitive Theory

Social Cognitive Theory [11] reflects how individuals learn how to behave in a
particular environment based on observing the actions of those around them and
the resultant consequences and outcomes of the behaviours that they observe
(both positive and negative). It is proposed that this social learning process
occurs through engagement with particular role models within an individual’s
environment, such as observing the behaviour of family members. It can also
occur via exposure to mass-media content or through observation and
understanding of particular social norms and activities linked to specific
geographical locations or communities. This process may not only influence
what types of behaviour an individual considers to be socially acceptable, but
can also lead to direct learning and skill acquisition related to the actual
ability to engage in particular types of deviant online activities. For
instance, attitudes to digital piracy have previously been found to be related
to association with deviant peers and the perception that important others
wanted or expected the individual to engage in digital piracy behaviours [1,
12, 13]. Therefore, engagement and affiliation with others who engage in cyber
criminal behaviours can influence an individual’s perceptions of the
acceptability of such activities, social norms and expectations surrounding
these behaviours, and the actual ability to effectively engage in cyber
criminal activities. Similarly, social-ecological approaches to crime and
deviant online activities, such as cyber bullying, highlight the potential
role of these various social factors in influencing individual behaviour
(e.g., close peer and family relationships, wider community settings, and
societal-level norms and approaches) [14].

#### Routine Activities Theory

Routine Activities Theory [15] refers to three main elements that must align
in order for a particular crime to occur: (1) the existence of an attractive
target (e.g., credit card details stored in a particular location), (2) the
presence of a motivated offender (e.g., an individual who becomes aware of
this data or actively seeks it out) and (3) the lack of a capable guardian
(e.g., a lack of sufficient technical protections). As a result, the existence
of a sufficiently attractive target and the use of poor protective mechanisms
can, in turn, influence the behaviour, characteristics and potential
motivations of an offender to commit a particular crime (e.g., a particular
activity representing a sufficient intellectual challenge, the lack of a
requirement for technical skills to achieve a particular outcome or use a
particular method, the potential availability of different types of targets
that relate to various degrees of financial or reputational motivations).

#### The Theory of Planned Behaviour

The Theory of Planned Behaviour (TPB) [16] provides a framework to explore the
relationship between an individual’s beliefs and their behaviour. It considers
three primary mechanisms through which an individual’s intentions to engage in
a particular behaviour may be influenced: (1) their attitudes towards a
particular behaviour, which represents how positively or negatively they
evaluate the behaviour and those who engage in it, (2) perceived social norms
related to engaging in that behaviour, and (3) the perceived ease of engaging
in the behaviour (termed perceived behavioural control). Overall, the use of
the TPB as a framework to understand and change behaviour has been supported
in multiple domains, although effects are generally found to be stronger for
intentions to engage in particular activities compared to actual behavioural
responses (see Sheeran and Webb [17] for a review). Although the TPB has been
predominantly considered in relation to what factors influence engagement in
secure online behaviour, there has also been a very limited consideration of
how these concepts may also apply to cyber criminal behaviours, such as
hacking (e.g., Rennie and Shore [18]).

#### Other Approaches

Finally, previous research has highlighted that the likelihood of getting
caught when engaging in a cyber criminal activity influences an individual’s
attitudes and resultant behaviour. For instance, Nandedkar and Midha [19]
assessed the presence of optimism bias in relation to music piracy and
suggested that greater optimism with regards to potential risks (i.e.,
thinking that they were less likely to be caught compared to other people)
influenced attitudes towards digital piracy. Theoretical models originally
applied to the health behaviour domain, such as Protection Motivation Theory
[20], have also shown how differences in perceived risk (i.e., the perceived
likelihood of a threatening outcome occurring, and the potential impact of
that threat if it were to occur) combine with other aspects, such as the
perceived ability to cope with the threat and the perceived benefits of a
threat-reducing behaviour, to influence resultant protective actions, (e.g.,
engaging in secure online behaviour [21]). However, this approach has yet to
be applied to decisions to engage in cyber criminal behaviour and has
particular relevance when considering potential responses to interventions and
adverse events.

### Research Pre-2012

A considered summary of research conducted prior to 2013 is provided by Kirwan
and Power [1] , who discussed the state of research related to the motivations
and characteristics of various types of cybercriminals in the 2013 book,
Cybercrime: The Psychology of Online Offenders. This identified differences in
the extent of research conducted across different types of cybercrime, with
substantially more research focused on understanding the motivations and
characteristics of hackers than on malware developers for instance, with
research in the latter area being outdated and limited in its methodological
approach. Conversely, digital piracy, which was considered to be a more
widespread activity at the time, was found to be an area that demonstrated a
more developed research base due to the relative ease of conducting research
related to this activity with larger participant samples.

Within their work, the authors highlighted how previous theoretical
discussions related to hacking behaviour have emphasised the role of factors
such as curiosity, the desire for achieving status in a social group, and the
need for power, with more limited empirical research highlighting the role of
practicing and developing skills, wishing to undertake simple pranks, and the
desire for intellectual challenge. It was suggested that many hackers were
younger males, who lived with parents, had achieved middle or higher levels of
education, and who were often students or trainees using computers in their
spare time. Limited research was also discussed that tentatively suggested
that hackers displayed more nocturnal activities, were more task-oriented, had
a higher propensity for risk, and demonstrated greater use of rational
thinking styles rather than intuitive thinking styles. However, research in
this area was found to lack consistent findings, as well as suffer from
methodological issues related to the use of self-report survey methods, and
the inherent constraints and biases associated with these.

When considering other cyber offences, such as developing malware, Kirwan and
Power [1] claimed that research suggested that such offenders were
increasingly motivated by financial gain (although factors such as
intellectual challenge, peer recognition, and vengeance were still present).
Conversely, saving money and gaining immediate access to content were found to
be key motivators for engaging in digital piracy behaviours, the latter of
which can also be linked to psychological characteristics such as low self-
control. Demographic characteristics associated with digital piracy were also
found to include being younger and being more familiar with computers.

Overall, the work of Kirwan and Power [1] highlights a range of different
characteristics and motivations related to cyber criminal activities that were
identified by early research, and that these were found to vary, both across
different cyber offences and across different individuals engaging in the same
type of offence, making the development of conclusive typologies challenging.
The remainder of this review now considers how research in this area has
advanced post-2012 to allow a more in-depth understanding of cybercriminal
characteristics and motivations related to cyber-dependent crime.

##  Characteristics of Cybercriminals

• Studies were largely self-report surveys, often targeted at student or youth
groups. • Under- and over-confidence in anonymous self-reporting may bias
findings. • Various measures of engagement with technology or the internet
were found to be associated with cybercriminality. • Most studies described
cybercriminals as 60-90% male, highly-educated and young. • Widely studied
demographic characteristics are summarised in Table 1.

Table 1: Literature estimates of the common descriptive demographic characteristics of cybercriminals. The plurality response is given for most categorical variables. Education was translated into primary or below, secondary, or tertiary and higher.  Characteristic | Estimate | Sample | Study
---|---|---|---
Age | “late teens or 20s” | 821 | Hyslip and Holt [22]
50%+ $<19$, 83% $<25$ | 729 | Woo [23]
28.67 | 595 | Liao et al. [24]
23 | 457 | Voiskounsky and Smyslova [25]
94% $<23$ | 179 | Seigfried-Spellar et al. [26]
35.6 (m) 51.5 (f) | 119 | Payne et al. [27]
50.9% 19-24, 33% 25-30 | 112 | McBrayer [28]
30 | 61 | Chan et al. [29]
29 | 39 | Odinot et al. [30]
34.71 | 14 | Steinmetz [31]
90% 16-24, 10% 25-34 | 10 | Hutchings and Clayton [32]
Gender | 88% male | 821 | Hyslip and Holt [22]
88% male | 729 | Woo [23]
60.34% male | 595 | Liao et al. [24]
49.2% male | 179 | Seigfried-Spellar et al. [26]
91.4% male | 117 | Payne et al. [27]
51.4% male | 112 | McBrayer [28]
67.2% male | 61 | Chan et al. [29]
92.9% male | 14 | Steinmetz [31]
80% male | 10 | Hutchings and Clayton [32]
Ethnicity | 63% white | 821 | Hyslip and Holt [22]
60.4% asian | 729 | Woo [23]
77.98% white | 595 | Liao et al. [24]
84.4% white | 179 | Seigfried-Spellar et al. [26]
89.3% white | 112 | McBrayer [28]
92.9% white | 14 | Steinmetz [31]
Education | “the majority“ tertiary | 821 | Hyslip and Holt [22]
47.8% tertiary | 729 | Woo [23]
63.9% secondary | 61 | Chan et al. [29]
100% tertiary | 14 | Steinmetz [31]
| 80%+ tertiary | 10 | Hutchings and Clayton [32]
Marital Status | 68.8% single | 112 | McBrayer [28]
63.9% single | 61 | Chan et al. [29]
| 50% single | 14 | Steinmetz [31]
Occupation | 55.7% employed | 61 | Chan et al. [29]
92.9% employed | 14 | Steinmetz [31]
| 80% student | 10 | Hutchings and Clayton [32]
Criminal History | 90.2% none | 90 | Chan et al. [29]
42.1% none | 19 | Odinot et al. [30]

The role of a number of demographic and psychological factors in effectively
characterising individuals engaged in cyber-dependent crime has been
investigated in recent years, including age, gender, Internet usage, degree of
self-control, and particular characteristics associated with Asperger’s
Syndrome, such as attention to detail and poor social skills. This section
reviews research investigating these characteristics, with Table 1 providing a
summary of findings related to demographic characteristics in this area.

In 2018, Hyslip and Holt [22] used an anonymous survey to explore both the
self-reported characteristics and motivations amongst users of booter and
stresser services. They contacted some 59,009 account holders and gathered
partial responses from 821 individuals, with at least 250 responses for each
question. Although this provided sufficient data for analysis and represents a
reasonably large survey sample, it was still a very small proportion of the
number of people initially contacted who chose to provide data. Overall, self-
reported characteristics included (a) that respondents were ‘primarily’ in
their late teens or 20s, (b) that ‘the majority’ reported living in the U.S.
or U.K., and (c) that many were educated beyond high school level. 88% of
respondents also reported being male, and 63% reported being white. Finally,
the survey also asked respondents to rate their skill level on a scale from 1
to 10, with 1 being the lowest and 10 being the highest. The most frequent
response was 10, followed by 1, which suggests either a substantial divergence
in actual skill level or in the degree of confidence that individuals have
(e.g., displaying high levels of over- and under- confidence).

Although published in 2003, Woo [23] was not included in previous reviews, and
covers a significant population of cybercriminals. The author conducted an
anonymous survey with some 729 self-reported hackers examining a range of
socio-demographic factors. 88% of respondents were found to be male, with only
4.3% being female, and the remainder not identifying their sex. Hackers were
young, with over half being younger than 19, roughly 83% being younger than
25, and 98% being younger than 35. About 40% of hackers reported no religion,
followed by Christianity (24.7%), Buddhism (19.3%). Reported ethnicity was
shown to be heavily Asian (60.4%), followed by Caucasian (18.8%). This is
distinct from other literature suggesting a majority of cybercriminals are
white, likely due to the survey being distributed in Korean as well as
English. First languages were highlighted as Korean (48.6%), English (29.2%),
Afghan (8.4%), Spanish (1.5%) and Japanese (1.4%). Respondents conformed to
perceptions of hackers as mostly educated. The greatest number had, at most,
completed 4 years of college [university] (26.6%), followed by high school
(25.2%), elementary school (15.2%), 2 years of college (13.9%), middle school
(11.8%), master’s degree (4.7%) and Ph.D. (2.6%). When considering the types
of hacking that individuals had engaged in, respondents reported having broken
into personal sites (70%), university web sites (56.5%), small business web
sites (47.2%), big business websites (42.2%), foreign government sites (38%),
porn sites (35.9%), foreign ethnicity websites (31.8%), military websites
(27.8%), transnational corporation sites (27.7%), secret agency sites (26.5%),
foreign religion websites (22.6%) and bank computer systems (21.9%). However,
since these claims can not be verified, the extent to which this information
is accurate is unclear, and may represent a higher estimation due to potential
over-confidence in ability or a desire to communicate a high status or
expertise.

Donner [33] conducted an online survey of 522 students enrolled on social
science or general education courses in the US, examining self-reported
engagement in three categories of cyber crime (hacking, digital piracy and
cyber-harassment) and the potential relationship with individual
characteristics, such as gender, degree of self-control, and degree of
immersion in the cyber environment. Regression analyses conducted on the data
suggested that men were more likely to engage in hacking activities than
women, however this relationship was dependent on the degree to which
individuals used the Internet, with the gender difference disappearing among
high Internet users. Conversely, being older and spending less time online was
associated with lower engagement in hacking activities. This suggests that
findings related to greater involvement in deviant online activities, such as
hacking, by males may in fact be due to a traditionally greater propensity of
Internet and computer use by such individuals.

Pyrooz [34] interviewed 585 young adult respondents across different cities in
the US about their use of the Internet, their involvement in gangs, and their
criminal and deviant activities online. Overall, 45% of the sample were found
to have engaged in some form of online offending in the last 6 months (e.g.,
selling drugs, digital piracy, selling stolen property) and both gang
membership and being younger was found to be associated with increased online
offending. Greater technological competence, spending a greater amount of time
on the Internet, and greater use of social networking, were also all found to
be associated with greater online offending.

Liao et al. [24] studied data on offenders from a national reporting system,
examining differences in arrest likelihood according to the form of cybercrime
engaged in by some 595 offenders, reporting also on offender characteristics.
Their findings raise questions for studies based on arrest data or police
reports. They found that personalised fraud (confidence tricks, impersonation)
has a significantly lower likelihood of arrest compared to impersonal credit
card fraud. Greater age was associated with greater probability of arrest,
with law enforcement treating the many offenders younger than 20 with more
leniency. Females were more likely to be arrested than males.

Steinmetz [31] took an ethnographic approach to understanding hackers,
attending public in-person meetings for a hacker group. Ethnographic
observations on demographics and social background were supplemented with 14
semi-structured interviews. Considerable ethnographic detail is presented
about the developmental factors, parental influence, exposure to technology
and exposure to hacking. Support was found for a gender and race disparity,
but not for a youth bias. Most participants considered themselves middle-
class, and were employed in the technology sector. A parental involvement in a
technological occupation was also common, with Steinmetz positing that early
exposure to technology is followed by a drift toward hacking in adolescence,
which may then be confirmed through self-identification.

Examining cases of known offenders who were prosecuted by law enforcement,
Payne et al. [27] undertook a content analysis of 119 cybercrime cases
prosecuted by the US Dept of Justice between 2013 and June 2017 and found that
the most common cases related to hacking and online fraud, with 91.5% of
offenders being male. Interestingly, the average age for male offenders (mean
age 35.6 years) was found to be younger than for female offenders (mean age of
51.5 years). More than half of the cases were also found to involve more than
one offender, suggesting that either such online activities have an important
social or group-based component, or that offenders who work with others are
merely more likely to be identified and prosecuted. The research also found
that 30% of offenders were from countries outside the US and that,
interestingly, these offenders tended to be younger than US offenders.

In their survey of 488 university students in the US, Donner et al. [35] also
considered the role of degree of self-control, age and degree of Internet use
in influencing different forms of deviant online activities (including
hacking, distributing malware, and using the internet for a drug transaction).
Correlation and regression analyses conducted on this data found that low
self-control was associated with the majority of online deviance
(specifically, 7 out of the 10 forms of online deviance). Greater Internet use
was also associated with greater online deviance overall, supporting both
self-control theory (i.e., that greater criminal deviance is associated with a
decreased ability to control behaviour in the face of temptation) and routine
activities theory (i.e., that greater presence in an environment where
opportunities for criminal activities are available is associated with greater
criminal activity). However, the latter still requires the offender to be
sufficiently motivated and for there to be sufficient opportunities for
engagement in criminal activities, which are not necessarily an obvious result
of greater Internet use per se. Similarly, in their survey of 2751 Korean
youths who were part of a longitudinal youth survey panel and had an average
age of 14 years, Moon et al. [36] found that low self control was associated
with a greater likelihood of illegally downloading software and a higher
likelihood of illegally using others’ personal identity online. Greater time
spent using computers, joining a cyber club, being male, and having greater
academic competence were also associated with illegally downloading software.

Seigfried-Spellar et al. [26] undertook an online survey with 296 respondents
who were undergraduate students from a variety of disciplines at a Southern US
university to explore the relationship between various characteristics
associated with Asperger’s Syndrome (which was assessed using the self-report
Autism Quotient scale) and a range of deviant computer activities, including
hacking and virus writing. Surprisingly, hacking was found to be negatively
associated with the AQ subscale attention to detail, suggesting that lower
attention to detail was related to increased self-reported engagement in
hacking activities. Identity theft was also found to be positively associated
with overall score on the AQ, as well as poor social skills, poor
communication and poor imagination, with virus writing similarly positively
associated with overall AQ score, poor social skills, poor communication and
poor imagination. Overall, greater levels of computer deviance in general were
associated with higher total AQ scores, as well as particular sub-scale scores
related to social skills, communication and imagination.

Finally, Chan et al. [29] used an online auction offender database containing
case reports collected between 2012 and 2013 in Hong Kong (61 case reports in
total) to examine various socio-demographic characteristics of offenders.
Variables from these case reports (e.g., age, education level etc) were
divided into offender behavior and personal characteristic types. Three
clusters of offender were then identified, with age, education level and
intrinsic motivation (both objective and why [an offender was] not afraid of
being caught) identified as being primarily responsible for differentiating
between these different offender types. Interestingly, intrinsic motivation
and age was suggested to be the most evident aspects for experienced-active
offenders.

##  Motivations of Cybercriminals

• A number of existing criminological theories, such as Neutralisation Theory
and Self-Control Theory were applied to the cybercrime context. • Application
of other approaches, such as the Theory of Planned Behaviour, is increasing,
but with gaps for exploitation. • A number of studies examine the overlap
between prior victimisation and offending, which is considerable. •
Distinctions between different kinds of cybercriminal could explain differing
motivations. • A summary of motivations supported by current and previous
studies is presented in Table LABEL:tab:motivations.

The various factors that may motivate individuals to engage in different types
of cyber-dependent crimes has been the focus of increasing research in recent
years. Such motivations may range from financial reward and organised criminal
set-ups that mirror legitimate business sectors, to individual vengeance,
political statements, and the pursuit of excitement, status and intellectual
challenge. This section reviews research investigating these motivations, with
Table LABEL:tab:motivations providing a summary of findings in this area to
date.

Xu et al. [37] provide a review of literature on cybercrime motivations prior
to 2013, including a number of theoretical lenses such as social learning
theory, rational choice theory and neutralisation theory. They also present a
case study of six Chinese hackers, discussing elements from their histories
such as early interest in computers, innocent motives for hacking, being
under-challenged by education, endemic poor computer security, tolerance by
schools and peer support. They found general support for routine activity
theory, social learning theory and situational action theory, and provide an
integrative framework for combining the three theories in a developmental
model of hacker evolution.

Although conducted in 2003, Voiskounsky and Smyslova [25] undertook an
interesting study exploring the experience of flow within Russian-language
hackers. Overall, hacker motivations were considered, at that point, to be
largely intrinsic and cognitive (i.e., reflecting internal mental processes)
and the researchers focused on investigating the presence of ‘flow’ as a
causative factor, expecting to find that it occurs more often in more
qualified and competent hackers. The psychological process of flow relates to
being fully immersed in an activity to the extent that it completely absorbs
the individual and is associated with enjoyment and energised focus. This
immersion is known as experiencing a flow state. In their survey of 457 self-
reported Russian-language hackers, who were drawn from online venues of
different competence levels, the researchers showed that greater reported flow
was associated with the less-competent population. Analysis of follow-up
interviews also suggested that such flow can be interrupted in a ‘zigzag’
fashion, with crises related to lack of skill motivating hackers’ further
development.

In their 2003 review of previous work categorising and understanding the
motives of ideological or hobby-driven hackers, Woo [23] approached the topic
theoretically by considering factors related to self-esteem (particularly
narcissism), extrinsic (i.e., external) vs. intrinsic (i.e., internal)
motivations, flow, and threats to the hacker’s worldview. A survey was
distributed at an online hacking event in English and Korean and 729 valid
responses were collected and analysed. These showed an association between
hackers’ narcissism and aggressiveness. Higher extrinsic motivation in hackers
was associated with aggressive temperament, and specific categories of hacking
target. Hacking was also positively associated with the experience of flow,
with further analysis showing that this was overall positively associated with
intrinsic-motivation, and negatively related to extrinsic motivations.
Finally, higher nationalism and religious pride scores were associated with
angry temperament.

Broadhurst et al. [38] covered the diverse motivations of groups involved in
known cases of cybercrime of various kinds. Individual offenders “appeared
less preoccupied with financial gain than with libertarian ideology,
technological challenge, celebrity obsession, and revenge against a former
employer”. Similarly, organisations were not always focused on financial gain,
and “reflected a variety of goals, including defiance of authority, freedom of
information, sexual gratification of members, and technological challenge”.
However, the profit motive was more apparent in the organization cases than
with individual offenders. Relatively complex protest activity and ‘annoyance
crime’ such as that involving denial of service attacks, seemed to be best
served by a ‘swarm’ organization structure, with protest activity being of a
more ad hoc, short-term nature.

More recently, Hyslip and Holt [22] asked users of booter and stresser
services about their motivations, with 230 responses. The majority reported
innocuous use of the services for system testing (60%), research (49%) or to
test their own abilities (47%). Others reported using the services to affect
an online game or game opponent (41%), and for hacktivism purposes (26%).
Smaller categories reported being hired to use the services (19%) or using
them to affect a business competitor (11%). Many users (54%) reported running
their own similar services, and 76% reported having been targeted by such a
service themselves in the past. An earlier and much smaller study of 11
operators of booter and stresser services by Hutchings and Clayton [32]
provides deeper qualitative insight into their motivations. Broad support was
found for rational choice theory (the financial gains of users) and
neutralisation theory (their focus on legitimate usage of these systems).

Prior victimisation is often encountered as a motivation. Kerstens and Jansen
[39] studied the overlap between victims and perpetrators of three categories
of financial cybercrimes (auction fraud, virtual theft and identity fraud) in
a cross-sectional study of 6,299 Dutch youths aged 10 to 18. Victimhood and
perpetration were assessed through self-report items in an online
questionnaire, along with measures of the respondents’ online behaviour,
parental mediation and self-control. The overlap between victims and
perpetrators was significant, with victims more than six times as likely as
the general population to report perpetrating a cybercrime, and perpetrators
more than five times as likely to report victimhood. Motives reported for
perpetration included financial gain, entertainment and bullying as well as
retaliation. A multinomial regression analysis found significant effects for
both victimhood and perpetration for being male, having a high frequency of
internet usage, a higher level of online disinhibition, a higher level of
online disclosure, and a lower level of self-control.

Building on this result in more detail, Kranenbarg et al. [40] compares
victimisation, offending and victim-offending between 240 cybercrime suspects
and 219 traditional crime suspects. They find a considerable victim-offender
overlap in cybercrime, but this is qualified by the technical sophistication
of attacks. For instance, hacking by guessing a password was more common
amongst victim-offenders, while other forms were more often committed by pure
offenders. Pure offenders were more likely to spend time on forums and possess
greater IT skills. Low self-control was an important predictor for being a
cybercrime victim-offender (as opposed to victim or offender only). IT skills
and spending more time on online shopping also increased the likelihood of
victimization-offending, as well as living with parents (though this effect
was reversed amongst pure offenders).

Marcum et al. [41] studied self-reported offending in a survey of 1,617 high-
school students, measuring low self-control and association with deviant
peers. Logistic regression showed that low self control and deviant peers were
associated with logging into Facebook accounts and accessing websites without
permission. Deviant peer association was associated with sending email as
another person without permission, but not low-self control. A number of
demographic variables were also found to be predictive of particular
categories of deviant behaviour.

Ho et al. [42] conducted a survey of 1644 12-17 year olds in Taiwan who were
recruited via schools and correctional institutions and suggested that
gratification and previous victimisation experiences were amongst the most
influential factors in self-reported engagement in deviant computer
activities. In their MSc thesis, McBrayer [28] used snowball sampling to
recruit 120 survey respondents to explore motivational factors for different
types of cyber crime behaviours. Overall, it was found that males were more
likely to be script kiddies, cyberpunks, and old guard hackers compared to
females and that these computer deviant behaviors overlapped in both
motivational factors and the behaviors themselves. Script kiddie, password
cracker, and old guard hacker behaviors were found to be motivated primarily
by addiction processes, whereas cyberpunk behavior was found to be motivated
by financial, peer recognition, and revenge motivations, and internal computer
deviant behavior was related to financial and peer recognition motivations.

In their report exploring cybercriminal overlap with traditional organised
crime Odinot et al. [30] examined 11 criminal cases and 107 suspects, 39 of
which had roles connected to ICT use. The investigation found four broad
categories of criminality: fraud relating to banks and payment systems; trade
in illict goods (including online drugs sales, botnet sales); extortion
(ransomware, DDoS extortion) and data theft. Case files revealed that criminal
motives included making money, paying off debts, revenge, coercion by others,
and ‘as a hobby’.

In 2018, Kranenbarg et al. [43] examined longitudinal registration data on
adults suspected of cybercrimes (870) or traditional crimes (1,144,740) in the
Netherlands between 2000 and 2012. They examined a number of lifestyle
patterns suggested to reduce the likelihood of committing crime, including
whether the suspect was living with a romantic partner or child, whether they
were employed, and whether they were enrolled in education. They found that
living with a partner and child decreases the likelihood of committing
cybercrime by 46%, compared to a decrease of 19% for traditional crime. Having
a job also reduced the likelihood of offending by 10% (compared to 7% for
traditional crime), but if the job was IT-related, likelihood was actually
increased by 14% (compared to a decrease of 11% for traditional crime). This
is likely due to increased computer knowledge and increased computer and
Internet usage presenting a risk factor, as highlighted by research discussed
in Section 2. Education level was not found to produce any significant
effects, but the direction of effects tentatively suggested that greater
education may increase the likelihood of engaging in cybercrime offences.

Finally, Holt et al. [44] conducted an online survey of 779 students in a
midwestern university in the US exploring the different factors that may
influence the likelihood that an individual will engage in the defacement of
websites. Regression analyses showed that computer ownership and not feeling
that there are clear rules about online behavior were associated with being
more willing to engage in website defacements. In addition, respondents who
felt that law enforcement didn’t respond to cybercrime and those who were also
more willing to engage in offline protest behaviors were more willing to
deface websites.

Table 2: Table of supported motivations reproduced from McBrayer [28] for pre-2013 evidence, and updated with reference to the studies discussed above. Motivation | Supporting Studies
---|---
Addiction/Low Self Control | Taylor [45]
Woo [23]
Beveren [46]
Voiskounsky and Smyslova [25]
Turgeman-Goldschmidt [47]
Smyslova and Voiskounsky [48]
Marcum et al. [41]
McBrayer [28]
Donner et al. [35]
Moon et al. [36]
Kerstens and Jansen [39]
Kranenbarg et al. [40]
Curiosity | Beveren [46]
Voiskounsky and Smyslova [25]
Woo [23]
Turgeman-Goldschmidt [47]
Smyslova and Voiskounsky [48]
Nikitina [49]
Xu et al. [37]
Excitement/Entertainment | Beveren [46]
Gordon and Ma [50]
Voiskounsky and Smyslova [25]
Turgeman-Goldschmidt [47]
Smyslova and Voiskounsky [48]
Ho et al. [42]
Xu et al. [37]
Chan et al. [29]
Kerstens and Jansen [39]
Odinot et al. [30]
Broadhurst et al. [38]
Money | Taylor [45]
Gordon and Ma [50]
Woo [23]
Kilger et al. [51]
Turgeman-Goldschmidt [47]
Holt [52]
Chan et al. [29]
McBrayer [28]
Broadhurst et al. [38]
Kerstens and Jansen [39]
Odinot et al. [30]
Hyslip and Holt [22]
Power/Status/Ego | Taylor [45]
Woo [23]
Holt [52]
Nikitina [49]
Xu et al. [37]
Broadhurst et al. [38]
McBrayer [28]
Marcum et al. [41]
Kerstens and Jansen [39]
Ideology | Woo [23]
Kilger et al. [51]
Schell and Martin [53]
Jordan and Taylor [54]
Holt [55]
Broadhurst et al. [38]
[22]
Revenge | Taylor [45]
Loper [56]
Voiskounsky and Smyslova [25]
Best [57]
Kilger et al. [51]
Turgeman-Goldschmidt [47]
Williams [58]
Holt [52]
McQuade III [59]
Ho et al. [42]
Xu et al. [37]
McBrayer [28]
Broadhurst et al. [38]
Kerstens and Jansen [39]
Odinot et al. [30]
Kranenbarg et al. [43]
Hyslip and Holt [22]

##  Quality Assessment

Research included in this review was subjected to a quality assessment to
enable the potential contribution, generalisability and likely replicability
of the research to be evaluated. In this assessment, we have focused on
considering the participant sample size and sample type, the publishing outlet
(e.g., the impact factor of academic journals), and whether sufficient
information is provided within the research methodology of the article to
enable the method to be effectively reproduced by other researchers if they
had access to a comparable sample population. As cybercriminality appears to
be a rapidly-evolving subject, and older work may quickly lose relevance, we
also note the year of publication for studies.

The overall sample size for a study ($N$) and the sample of cybercriminals
($C_{n}$) are recorded separately. Many studies surveyed larger populations
looking for evidence (usually self-reported) of cybercriminality.
Understanding the strength of the evidence about cybercriminals requires both
figures to be considered. The definition of cybercriminality used was that
adopted by each study, so samples may not be directly comparable. The type of
sample used was coded based on the method presented in each study. Impact
factors were retrieved from journal homepages where available. Replicability
was coded as one of:

  * n

Significant missing information about the method, or the method is qualitative
by nature;

  * m

Most detail about the study approach is available, but specifics of
questions/measures used are missing or incomplete;

  * y

Sufficient detail for full replication, given access to a comparable
population.

Table 3: Quality analysis elements for included studies. $N$ = Total sample covered; $C_{n}$ = Total cybercriminals covered; IF = journal impact factor; $\varnothing$ = figures not reported (may be subcategories or other measures); * = identified by police report. Paper | $N$ | $C_{n}$ | Type | IF | Replicable | Year
---|---|---|---|---|---|---
Steinmetz [31] | 14 | 14 | cybercriminal cases |  | n | 2015
Xu et al. [37] | 6 | 6 | cybercriminal cases | 3.06 | n | 2013
Broadhurst et al. [38] | 6 | 6 | cybercriminal cases |  | n | 2014
Hyslip and Holt [22] | 821 | 821 | cybercriminal survey |  | m | 2018
Woo [23] | 729 | 729 | cybercriminal survey |  | y | 2003
Voiskounsky and Smyslova [25] | 457 | 457 | cybercriminal survey | 2.69 | m | 2003
Hutchings and Clayton [32] | 11 | 11 | cybercriminal survey | 1.05 | m | 2016
McBrayer [28] | 120 | 112 | cybercriminal survey |  | y | 2014
Kranenbarg et al. [40] | 535 | 268 | cybercriminal survey* | 1.05 | y | 2017
Liao et al. [24] | 595 | 595 | police reports | 3.23 | y | 2017
Payne et al. [27] | 119 | 119 | police reports | 0.95 | m | 2018
Chan et al. [29] | 61 | 61 | police reports | 5.06 | m | 2014
Kranenbarg et al. [43] | 1,145,610 | 870 | police reports |  | y | 2018
Odinot et al. [30] | 107 | 39 | police reports |  | m | 2016
Donner [33] | 522 | $\varnothing$ | student survey |  | y | 2016
Donner et al. [35] | 488 | $\varnothing$ | student survey | 3.54 | y | 2014
Seigfried-Spellar et al. [26] | 296 | 179 | student survey | 1.38 | y | 2015
Marcum et al. [41] | 1,617 | $\varnothing$ | student survey | 1.05 | y | 2014
Ho et al. [42] | 1,592 | $\varnothing$ | student survey |  | n | 2012
Holt et al. [44] | 779 | $\varnothing$ | student survey | 1.05 | y | 2017
Pyrooz [34] | 585 | 209 | youth survey | 2.22 | y | 2013
Moon et al. [36] | 2,751 | 473 | youth survey | 3.14 | y | 2010
Kerstens and Jansen [39] | 6,299 | 862 | youth survey | 1.05 | y | 2016

Table 3 reports on the chosen quality analysis measures for the papers
included in this review, grouped by sample type. Most studies were surveys of
student or youth populations, or online surveys of self-identified
cybercriminals. Kranenbarg et al. [40] is notable for surveying cybercriminals
identified by police reporting information (suspects in a case). Other uses of
police report information tended to work from case file details and national
registers.

Overall sample sizes ($N$) were varied, ranging from discussion of six cases
[37] to analysis of over a million offenders of any type in a given timeframe
[43]. The median overall sample size was 522. Samples of cybercriminals
($C_{n}$) were usually smaller and varied less widely (median=194; mean=324;
sd=324). Several studies reported on particular subcategories or measures of
cybercriminality in their sample in a manner such that the overlap between
subcategories could not be established in order to extract a single figure for
the size of cybercriminal population studied. These studies (all student
surveys) are marked as $\varnothing$ in Table 3.

Replicability of studies was reasonable, with only four studies marked as n,
the lowest level, and three of these being explicitly qualitative in their
methodology. Over half (13) of the studies were graded as y, highly replicable
given access to a comparable population. Student and youth surveys tended to
be more often highly replicable than studies of police reports or online
surveys of cybercriminals, perhaps due to differing backgrounds of authors.

The average journal impact factor was 2.181. However, journal impact factors
were not available for many (9) studies. In addition, over one-third of the
studies for which IF was available originated from the same journal – _Deviant
Behaviour_ – which may be given undue weight as a result.

##  Limitations and Current Research Gaps

• Research is limited by poor access to cybercriminal communities. Self-report
methodologies are highly common. • Studies in students or youth populations
make presumptions about cybercriminality, and may not reflect technically
sophisticated, financially-motived or organised cybercrime. • Varying and
sometimes loose definitions of cybercriminality, cyber-deviance or “hacking”
compound comparison problems. • Priorities for improvement should include
identifying data sources for diverse samples of technically-sophisticated
cybercriminals, avoiding self-report structures.

Although the current research base investigating the primary motivations and
characteristics of cyber criminals continues to increase, work in this area
remains limited. Existing research is also constrained by methodological
limitations, predominantly due to difficulties in accessing offender
populations and a reliance on self-report measures and self-selected samples.
However, the growing use of techniques that enable the scraping of forums and
the analysis of large volumes of data (e.g., data mining, machine learning)
provide a mechanism to continue to improve and develop current understanding
of cybercriminal behaviour. This section discusses the limitations of previous
research in this area, including the primary research methods used (e.g.,
self-report surveys, case data, interviews) and the potential issues
associated with these. This section also highlights current gaps within the
existing research base, which may limit the extent to which robust conclusions
can be drawn, and emerging methodological approaches that aim to address some
of these issues. Table 3 above highlights the key methodological details of
identified research and associated limitations.

The majority of research in this area has used self-report methods (including
online surveys and less commonly, in-person semi-structured interview
approaches). This has provided a range of data types, including qualitative
themes identified via responses to open-ended questions, and quantitative data
that commonly uses responses to questionnaire measures addressing
demographics, psychological characteristics (such as self-control) and
reported engagement in a number of online activities. This data is then
typically analysed using regression approaches to determine which factors
predict cyber criminal activities. Online surveys often utilise student
samples, or existing research panels that are available to access,
particularly when attempting to investigate participants from younger
demographic samples, which does lead to limitations with regards to the
generalisability of findings across wider population groups. Work focused on
accessing other groups, including law enforcement or other forms of debriefs
and data collected via volunteers on forums, provides other mechanisms to
increase the generalisability of research findings, but bring further
limitations (e.g., individuals who have been caught/ are willing to engage
with debriefs, self-selected samples within volunteers). While online surveys
often capture international cybercriminals, and there are studies focused on
Russian, Chinese and Korean cybercriminals, the majority of studies are
focused on cybercriminality in the US, UK and Netherlands, making
international comparisons difficult.

Other methods that are increasingly used include analysing data that has been
scraped from online forums, such as [60, 61, 62, 63], which to date commonly
focus on market dynamics and the impact of law enforcement interventions
rather than offender motivations or characteristics. There is also the
examination of available data on prosecutions, arrests, and the
characteristics associated with this by some researchers. This can also
include a case-based theoretical consideration of potential factors that are
identified across different case reports and how these relate to existing
criminological and psychological theory.

Much of the prior work on cybercriminal characteristics and motivations has
suffered somewhat from a lack of distinction between different categories and
subcategories of cybercriminal offending, with some authors noting this
explicitly. Rogers [64] provides a taxonomy of “hackers” which attempts to
address the confusion between different categories of offending, positing
eight or nine distinct classifications with their own distinctive features:
_Novices_ , who rely on pre-written tools for thrill-seeking or ego stroking
purposes; _Cyber-punks_ , who have limited programming ability which they
employ for attention or financial gain; _Internals_ , who are disgruntled (and
possibly ex-) employees seeking revenge; _Petty Thieves_ , who are traditional
criminals following their targets into the digital realm; _Old Guard_ , who
have deep technical skill and hack as an intellectual exercise; _Professional
Criminals_ , who are professional financially-motivated criminals;
_Information Warriors_ , who are state-sponsored combatants in the digital
realm; _Political Activists_ , who are ideologically motivated for notoriety;
and _Virus Writers_ – the background of which is poorly distinguished. This
taxonomy gives a frame of reference for understanding the targeted population
of some empirical studies of cybercriminals. However, many studies reviewed
use far looser definitions of cybercriminality or ‘cyber deviance’ than any of
the above categories. Particularly in student and youth surveys, but also in
analyses of police case reports, there is a lack of distinction between low-
level juvenile cybercriminality involved in, e.g., guessing a person’s
Facebook password and accessing their account without permission, versus
deploying skilled technical attacks or taking part in organised cybercrime.
This broadened definition may be motivated by the difficulties in accessing
cybercriminals of the latter type.

Several researchers have deployed anonymous online surveys to investigate the
background and motivations of cybercriminals. These have plausibly better
access to this latter category of advanced cybercriminality, although with the
penalty of far less verifiable data. Some demographic details from these
surveys have proven relatively consistent: for example, that the population is
predominantly young [22, 25, 23, 26] and male [22, 23, 27]. While the heavy
gender bias is also confirmed in results from surveys carried out at hacker
conferences [65, 66], and other sources [32, 27] the evidence on age may be
skewed by targeting _Novice_ or _Cyber-punk_ venues (Hyslip and Holt [22]
target users of stresser services, and Woo [23] surveyed participants in an
esteem-driven hacking contest). Some authors have challenged the perception of
cybercriminals as mostly young [31], suggesting a middle-aged population,
which may reflect a different category of offender. This is a significant
limitation for generalisation from the (dominant) youth and student surveys,
which necessarily exclude older cybercriminals. Other demographics have proven
more sensitive, for example, the majority ethnicity of respondents differing
apparently according to the languages in which surveys were available (cf.
[23, 22]).

While regressions on survey results have pointed towards potential predictors
of hacking such as narcissism, nationalism and propensity toward ‘flow’ states
[23], the accuracy of survey self-reports about skill or criminal
accomplishments is uncertain and somewhat suspect, with, e.g., 26% of Woo
[23]’s respondents reporting having broken into secret agency sites, and the
most common self-reported skill rating on Hyslip and Holt [22]’s 10-point
scale being 10. Voiskounsky and Smyslova [25] attempt to control for this by
delivering their survey to two Russian forums of reportedly different quality
levels, and using simple tests of the depth of IT knowledge in respondents,
with some apparent success, finding that ‘flow’ is inversely predictive of
skill when measured in this manner.

Other approaches for understanding cybercriminals have worked from case
details drawn from police investigations, often producing more qualitative
insight into the operation of cybercrime. Leukfeldt et al. [67], for example,
describe the function of online marketplaces as exchanges and enablers of
crime with reference to some 40 internationally-sourced cases. Odinot et al.
[30] use 11 police files to explore the link between cybercrime and
traditional organised crime, finding interesting deviations in offender age
profile which may be influenced by the balance of traditional organised crime,
and motives including financial, revenge and hobby-driven cases. Case files
are illustrative, but comparatively few, and may not capture the full nature
of ongoing cybercrime. Even within cases, the range of suspects included may
be more strongly influenced by the focus of a police inquiry than the nature
of the offender community [30].

Although the above aspects present a range of limitations that should be
considered when evaluating the relative robustness of findings in this area,
future work should also consider ways to address these limitations and thus
reduce current research gaps. Although it is appreciated that such work
represents a substantial challenge, current efforts should focus on:

  1. 1.

Identifying data sources that provide access to a more diverse sample, such as
individuals from various socio-demographic backgrounds and geographic
locations, as well as encompassing a range of types of activity that have been
/ are currently engaged in and a range of knowledge levels and expertise.

  2. 2.

Identifying data sources that do not rely on self-report responses or self-
selection of participants, using objective sources of data where possible.
Such an approach may require a more systematic collection of different types
of data by certain bodies, and a greater ability to share such data with
researchers where possible.

  3. 3.

Developing methods of analysis that are less resource-intensive than
traditional qualitative approaches and are able to reliably analyse large
quantities of both linguistic, and other, data types.

The AMoC project aims to provide a means to address some of these aspects,
developing reliable, evidence-based methods to automatically analyse large
volumes of textual data gathered from a range of online sources. More
specifically, previous work by [68, 69, 70, 71, 72, 73] has demonstrated that
automatic user profiling in online social media based on their text messages
can be highly accurate, even when only limited data per user is available and
in the presence of adversaries (i.e., users who attempt to hide their true
identity or who create a false digital persona) [72, 74]. Language can also be
identifying of location, with language identification and native language
identification techniques helping to narrow down the origin of users [75, 76,
77]. Within the AMoC project, an evaluation of the efficiency of existing text
mining approaches will be evaluated to assess their forensic readiness when
applied in the context of forensic investigations pertaining to cybercrime.
Additionally, novel, advanced techniques to automatically identify cyber
offenders and their characteristics (demographic, psychological and
situational) across different online environments based on their linguistic
fingerprint will be developed.

##  Conclusions

This review aimed to evaluate current research regarding the motivations and
characteristics of individuals engaging in cyber-dependent crimes, focusing on
research conducted within the last 7 years (i.e., 2012 onward). Overall, a
range of literature has been identified that provides a degree of support for
a number of primary characteristics and motivations, which have been examined
across a range of studies and have been found to be sufficiently supported in
the prior literature to warrant inclusion in an initial framework. However, it
should be noted that these findings may reflect potential methodological
biases in accessing various population samples in prior studies. It also does
not suggest that individuals outside of these characteristics will not be
engaged in cyber criminal activities. These characteristics include:

• Age: A greater likelihood of being in relatively younger age groups,
particularly individuals in their late teens and twenties; • Gender: A greater
likelihood of being male; • Education level: A greater likelihood of
completing a higher level of education (e.g., high school and beyond) and
greater academic competence; • Extent of internet use/ computer use: Spending
a greater amount of time on the internet and engaging in a greater degree of
computer use, as well as greater technological competence associated with
this; • Employment status: Having a greater likelihood of being employed in
computing and technology occupations or of being unemployed; • Trait self-
control: Having a greater likelihood of being low in trait self-control.

Motivations that have been highlighted within the current research literature
include:  • financial reward; • a desire for status, power and recognition
from others; • addiction processes and other forms of hedonic gratification; •
a desire for vengeance against particular individuals, groups or society; •
curiosity related to accessing particular information or information sources,
or the technical protections related to them; • immersion in an activity,
experiencing psychological flow during the process of engaging in the
activity, and developing skills and expertise in relation to particular
activities; • previous victimisation in relation to cyber crime, exposure to
cyber criminal activities and the people that engage in them; • risk
perceptions related to the perceived likelihood of being caught and punished
for engaging in cyber criminal activities; • the perceived social and moral
acceptability of engaging in cyber criminal activities (e.g., the perception
that there are no clear rules governing online environments or no real victims
of cyber crime).

However, the majority of this research was found to focus on: (i) the use of
self-report methods, exploring what have historically been more common deviant
online behaviours, such as digital piracy and, to a degree, hacking
activities; and (ii) applying established criminological theories, such as
Neutralisation Theory and Self-Control Theory, to the cyber crime context.
Hence, the research surveyed in this review still shows a number limitations.
Self-report methods remain restricted by self-selection bias (i.e., only
people relatively easy to access and interested in taking part have completed
surveys), and a difficulty in validating people’s responses (i.e., have they
really engaged in the behaviours they claim, for the reasons that they claim?
Are they potentially under- or over-reporting certain aspects?). Additionally,
although the application of other psychological / behaviour change theories,
such as the Theory of Planned Behaviour, is increasing, there remains an
opportunity to undertake further work considering these approaches in relation
to cyber criminal behaviour. As a result, these factors will be used to
provide an evidence-based foundation for the future work of the AMoC project,
in order to explore whether these concepts are also supported when
investigated in relation to their presence in objective, forum-based data
taken from a range of forum sites and which historically include individuals
from a range of geographic locations and backgrounds.

This data is being gathered by the project team and will be analysed using a
combination of quantitative automated approaches and more nuanced qualitative
approaches using human coders. This will provide a basis to further validate
pre-identified characteristics and motivations on a new dataset, whilst
simultaneously providing the opportunity to identify new concepts that may
have not previously been investigated.

## References

  * Kirwan and Power [2013] G. Kirwan, A. Power, Cybercrime: The psychology of online offenders, Cambridge University Press, 2013.
  * Broadhurst et al. [2013] R. Broadhurst, P. Grabosky, M. Alazab, B. Bouhours, S. Chon, C. Da,  Crime in cyberspace: offenders and the role of organized crime groups (2013).
  * McGuire and Dowling [2013] M. McGuire, S. Dowling,  Cyber crime: A review of the evidence,  Home Office Research report 75 (2013).
  * Sykes and Matza [1957] G. M. Sykes, D. Matza,  Techniques of neutralization: A theory of delinquency,  American Sociological Review 22 (1957) 664–670.
  * Festinger [1957] L. Festinger, A theory of cognitive dissonance, volume 2, Stanford University Press, 1957.
  * Morris [2011] R. G. Morris,  Computer hacking and the techniques of neutralization: An empirical assessment,  in: Corporate Hacking and Technology-Driven Crime: Social Dynamics and Implications, IGI Global, 2011, pp. 1–17.
  * Morris and Higgins [2009] R. G. Morris, G. E. Higgins,  Neutralizing potential and self-reported digital piracy: A multitheoretical exploration among college undergraduates,  Criminal Justice Review 34 (2009) 173–195.
  * Muraven et al. [2006] M. Muraven, G. Pogarsky, D. Shmueli,  Self-control depletion and the general theory of crime,  Journal of Quantitative Criminology 22 (2006) 263–277.
  * Ent et al. [2015] M. R. Ent, R. F. Baumeister, D. M. Tice,  Trait self-control and the avoidance of temptation,  Personality and Individual Differences 74 (2015) 12–15.
  * Higgins [2007] G. E. Higgins,  Digital piracy: An examination of low self-control and motivation using short-term longitudinal data,  CyberPsychology & Behavior 10 (2007) 523–529.
  * Bandura [1986] A. Bandura, Social foundations of thought and action, Englewood Cliffs, NJ, 1986.
  * d’Astous et al. [2005] A. d’Astous, F. Colbert, D. Montpetit,  Music piracy on the web–how effective are anti-piracy arguments? evidence from the theory of planned behaviour,  Journal of Consumer Policy 28 (2005) 289–310.
  * Malin and Fowers [2009] J. Malin, B. J. Fowers,  Adolescent self-control and music and movie piracy,  Computers in Human Behavior 25 (2009) 718–722.
  * Cross et al. [2015] D. Cross, A. Barnes, A. Papageorgiou, K. Hadwen, L. Hearn, L. Lester,  A social–ecological framework for understanding and reducing cyberbullying behaviours,  Aggression and Violent Behavior 23 (2015) 109–117.
  * Cohen and Felson [1979] L. E. Cohen, M. Felson,  Social change and crime rate trends: A routine activity approach,  American Sociological Review (1979) 588–608.
  * Ajzen [1991] I. Ajzen,  The theory of planned behavior,  Organizational Behavior and Human Decision Processes 50 (1991) 179–211.
  * Sheeran and Webb [2016] P. Sheeran, T. L. Webb,  The intention–behavior gap,  Social and Personality Psychology Compass 10 (2016) 503–518.
  * Rennie and Shore [2007] L. Rennie, M. Shore,  An advanced model of hacking,  Security Journal 20 (2007) 236–251.
  * Nandedkar and Midha [2012] A. Nandedkar, V. Midha,  It won’t happen to me: An assessment of optimism bias in music piracy,  Computers in Human Behavior 28 (2012) 41–48.
  * Rogers [1975] R. W. Rogers,  A protection motivation theory of fear appeals and attitude change,  The Journal of Psychology 91 (1975) 93–114.
  * Tsai et al. [2016] H.-y. S. Tsai, M. Jiang, S. Alhabash, R. LaRose, N. J. Rifon, S. R. Cotten,  Understanding online safety behaviors: A protection motivation theory perspective,  Computers & Security 59 (2016) 138–150.
  * Hyslip and Holt [2018] T. Hyslip, T. Holt,  Defining the profile of potential cybercriminals,  Homeland Defence & Security Information Analysis Center (HDIAC) Journal 5 (2018) 25–30.
  * Woo [2003] H.-J. Woo, The hacker mentality: exploring the relationship between psychological variables and hacking activities, Ph.D. thesis, University of Georgia, 2003.
  * Liao et al. [2017] R. Liao, S. Balasinorwala, H. R. Rao,  Computer assisted frauds: An examination of offender and offense characteristics in relation to arrests,  Information Systems Frontiers 19 (2017) 443–455.
  * Voiskounsky and Smyslova [2003] A. E. Voiskounsky, O. V. Smyslova,  Flow-based model of computer hackers’ motivation,  CyberPsychology & Behavior 6 (2003) 171–180.
  * Seigfried-Spellar et al. [2015] K. C. Seigfried-Spellar, C. L. O’Quinn, K. N. Treadway,  Assessing the relationship between autistic traits and cyberdeviancy in a sample of college students,  Behaviour & Information Technology 34 (2015) 533–542.
  * Payne et al. [2018] B. K. Payne, B. Hawkins, C. Xin,  Using labeling theory as a guide to examine the patterns, characteristics, and sanctions given to cybercrimes,  American Journal of Criminal Justice (2018) 1–18.
  * McBrayer [2014] J. C. McBrayer, Exploiting the digital frontier: hacker typology and motivation, Master’s thesis, University of Alabama Libraries, 2014.
  * Chan et al. [2014] V. Chan, K.-P. Chow, M. Kwan, G. Fong, M. Hui, J. Tang,  An exploratory profiling study of online auction fraudsters,  in: IFIP International Conference on Digital Forensics, Springer, pp. 43–56.
  * Odinot et al. [2016] G. Odinot, M. A. Verhoeven, R. L. D. Pool, C. J. de Poot, Organised Cybercrime in the Netherlands: Empirical findings and implications for law enforcement, Technical Report, WODC, 2016.
  * Steinmetz [2015] K. F. Steinmetz,  Becoming a hacker: Demographic characteristics and developmental factors,  Journal of Qualitative Criminal Justice and Criminology 3 (2015) 31–60.
  * Hutchings and Clayton [2016] A. Hutchings, R. Clayton,  Exploring the provision of online booter services,  Deviant Behavior 37 (2016) 1163–1178.
  * Donner [2016] C. M. Donner,  The gender gap and cybercrime: An examination of college students’ online offending,  Victims & Offenders 11 (2016) 556–577.
  * Pyrooz [2013] D. C. Pyrooz,  Gangs, criminal offending, and an inconvenient truth: Considerations for gang prevention and intervention in the lives of youth,  Criminology & Public Policy 12 (2013) 427–436.
  * Donner et al. [2014] C. M. Donner, C. D. Marcum, W. G. Jennings, G. E. Higgins, J. Banfield,  Low self-control and cybercrime: Exploring the utility of the general theory of crime beyond digital piracy,  Computers in Human Behavior 34 (2014) 165–172.
  * Moon et al. [2010] B. Moon, J. D. McCluskey, C. P. McCluskey,  A general theory of crime and computer crime: An empirical test,  Journal of Criminal Justice 38 (2010) 767–772.
  * Xu et al. [2013] Z. Xu, Q. Hu, C. Zhang,  Why computer talents become computer hackers,  Communications of the ACM 56 (2013) 64–74.
  * Broadhurst et al. [2014] R. Broadhurst, P. Grabosky, M. Alazab, B. Bouhours, S. Chon,  An analysis of the nature of groups engaged in cyber crime (2014).
  * Kerstens and Jansen [2016] J. Kerstens, J. Jansen,  The victim–perpetrator overlap in financial cybercrime: Evidence and reflection on the overlap of youth’s on-line victimization and perpetration,  Deviant Behavior 37 (2016) 585–600.
  * Kranenbarg et al. [2017] M. Kranenbarg, T. J. Holt, J.-L. van Gelder,  Offending and victimization in the digital age: Comparing correlates of cybercrime and traditional offending-only, victimization-only and the victimization-offending overlap,  Deviant Behavior (2017) 1–16.
  * Marcum et al. [2014] C. D. Marcum, G. E. Higgins, M. L. Ricketts, S. E. Wolfe,  Hacking in high school: Cybercrime perpetration by juveniles,  Deviant Behavior 35 (2014) 581–591.
  * Ho et al. [2012] L.-H. Ho, Y.-T. Lin, C.-H. Huang,  Influences of online lifestyle on juvenile cybercrime behaviors in taiwan,  Procedia Engineering 29 (2012) 2545–2550.
  * Kranenbarg et al. [2018] M. W. Kranenbarg, S. Ruiter, J.-L. Van Gelder, W. Bernasco,  Cyber-offending and traditional offending over the life-course: An empirical comparison,  Journal of Developmental and Life-Course Criminology 4 (2018) 343–364.
  * Holt et al. [2017] T. J. Holt, M. Kilger, L. Chiang, C.-S. Yang,  Exploring the correlates of individual willingness to engage in ideologically motivated cyberattacks,  Deviant Behavior 38 (2017) 356–373.
  * Taylor [1999] P. Taylor, Hackers: Crime and the digital sublime, Routledge, 1999.
  * Beveren [2001] J. V. Beveren,  A conceptual model of hacker development and motivations,  Journal of E-business 1 (2001) 1–9.
  * Turgeman-Goldschmidt [2005] O. Turgeman-Goldschmidt,  Hackers’ accounts: Hacking as a social entertainment,  Social Science Computer Review 23 (2005) 8–23.
  * Smyslova and Voiskounsky [2009] O. V. Smyslova, A. E. Voiskounsky,  Usability studies: to meet or not to meet intrinsic motivation.,  PsychNology Journal 7 (2009) 303–324.
  * Nikitina [2012] S. Nikitina,  Hackers as tricksters of the digital age: creativity in hacker culture,  The Journal of Popular Culture 45 (2012) 133–152.
  * Gordon and Ma [2003] S. Gordon, Q. Ma,  Convergence of virus writers and hackers: Fact or fantasy?,  Cupertine, CA: Symantec Security White paper (2003).
  * Kilger et al. [2004] M. Kilger, O. Arkin, J. Stutzman, Profiling. the honeynet project, know your enemy, 2004.
  * Holt [2007] T. J. Holt,  Subcultural evolution? examining the influence of on-and off-line experiences on deviant subcultures,  Deviant Behavior 28 (2007) 171–198.
  * Schell and Martin [2004] B. H. Schell, C. Martin, Cybercrime: A reference handbook, ABC-CLIO, 2004.
  * Jordan and Taylor [2004] T. Jordan, P. Taylor, Hacktivism and cyberwars: Rebels with a cause?, Routledge, 2004.
  * Holt [2009] T. J. Holt,  The attack dynamics of political and religiously motivated hackers,  Cyber Infrastructure Protection (2009) 161–182.
  * Loper [2001] D. K. Loper, The criminology of computer hackers: A qualitative and quantitative analysis., Ph.D. thesis, Michigan State University, 2001.
  * Best [2003] K. Best,  The hacker’s challenge: Active access to information, visceral democracy and discursive practice,  Social Semiotics 13 (2003) 263–282.
  * Williams [2006] M. Williams, Virtually criminal: Crime, deviance and regulation online, Routledge, 2006\.
  * McQuade III [2008] S. C. McQuade III, Encyclopedia of cybercrime, Greenwood Press, 2008.
  * Holt [2013a] T. J. Holt,  Examining the forces shaping cybercrime markets online,  Social Science Computer Review 31 (2013a) 165–177.
  * Holt [2013b] T. J. Holt,  Exploring the social organisation and structure of stolen data markets,  Global Crime 14 (2013b) 155–174.
  * Motoyama et al. [2011] M. Motoyama, D. McCoy, K. Levchenko, S. Savage, G. M. Voelker,  An analysis of underground forums,  in: Proceedings of the 2011 ACM SIGCOMM Internet Measurement Conference, ACM, pp. 71–80.
  * Décary-Hétu and Dupont [2013] D. Décary-Hétu, B. Dupont,  Reputation in a dark network of online criminals,  Global Crime 14 (2013) 175–196.
  * Rogers [2006] M. K. Rogers,  A two-dimensional circumplex approach to the development of a hacker taxonomy,  Digital Investigation 3 (2006) 97–102.
  * Bachmann [2010] M. Bachmann,  The risk propensity and rationality of computer hackers.,  International Journal of Cyber Criminology 4 (2010).
  * Young et al. [2007] R. Young, L. Zhang, V. R. Prybutok,  Hacking into the minds of hackers,  Information Systems Management 24 (2007) 281–287.
  * Leukfeldt et al. [2017] R. Leukfeldt, E. Kleemans, W. Stol,  The use of online crime markets by cybercriminal networks: A view from within,  American Behavioral Scientist 61 (2017) 1387–1402.
  * Rao et al. [2010] D. Rao, D. Yarowsky, A. Shreevats, M. Gupta,  Classifying latent user attributes in twitter,  in: Proceedings of the 2nd international workshop on Search and mining user-generated contents, ACM, pp. 37–44.
  * Peersman et al. [2011] C. Peersman, W. Daelemans, L. Van Vaerenbergh,  Predicting age and gender in online social networks,  in: Proceedings of the 3rd international workshop on Search and mining user-generated contents, ACM, pp. 37–44.
  * Nguyen et al. [2013] D. Nguyen, R. Gravel, D. Trieschnigg, T. Meder,  “how old do you think i am?’ a study of language and age in twitter.,  in: ICWSM.
  * Al Zamal et al. [2012] F. Al Zamal, W. Liu, D. Ruths,  Homophily and latent attribute inference: Inferring latent attributes of twitter users from neighbors.,  ICWSM 270 (2012).
  * Rashid et al. [2013] A. Rashid, A. Baron, P. Rayson, C. May-Chahal, P. Greenwood, J. Walkerdine,  Who am I? Analyzing digital personas in cybercrime investigations,  Computer 46 (2013) 54–61.
  * Rangel et al. [2015] F. Rangel, P. Rosso, M. Potthast, B. Stein, W. Daelemans,  Overview of the 3rd author profiling task at pan 2015,  in: CLEF, sn, p. 2015\.
  * Peersman [2018] C. Peersman, Detecting deceptive behaviour in the wild: text mining for online child protection in the presence of noisy and adversarial social media communications, Ph.D. thesis, Lancaster University, 2018.
  * Malmasi and Dras [2017] S. Malmasi, M. Dras,  Multilingual native language identification,  Natural Language Engineering 23 (2017) 163–215.
  * Malmasi et al. [2017] S. Malmasi, K. Evanini, A. Cahill, J. Tetreault, R. Pugh, C. Hamill, D. Napolitano, Y. Qian,  A report on the 2017 native language identification shared task,  in: Proceedings of the 12th Workshop on Innovative Use of NLP for Building Educational Applications, pp. 62–75.
  * Malmasi and Dras [2015] S. Malmasi, M. Dras,  Large-scale native language identification with cross-corpus evaluation,  in: Proceedings of the 2015 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pp. 1403–1409.


On Invariance Properties of Entries of Matrix Powers

Shalosh B. EKHAD and Doron ZEILBERGER

Abstract: A few years ago, Peter Larcombe discovered an amazing property
regarding two by two matrices. For any such $2\times 2$ matrix $A$, the ratios
of the two anti-diagonal entries is the same for all powers of $A$. We discuss
extensions to higher dimensions, and give a short bijective proof of Larcombe
and Eric Fennessey’s elegant extension to tri-diagonal matrices of arbitrary
dimension. This article is accompanied by a Maple package.

Peter Larcombe’s Surprising Discovery

In [2], Peter Larcombe gave four proofs of a seemingly new amazing property of
a $2\times 2$ matrix, for any such matrix (we denote the $(i,j)$ entry of a
matrix $B$ by $B_{ij}$)

$A_{12}\cdot(A^{m})_{21}=A_{21}\cdot(A^{m})_{12}\quad,$

for all positive integers $m$.

We first observe that, in hindsight (but only in hindsight!) this is not that
surprising. More generally, for a general $n\times n$ matrix $A$, and any
subset $S$ of cardinality $n+1$ of the set of $n^{2}$ entries
$\\{(i,j)\,|\,1\leq i,j\leq n\\}$, there exist polynomials $q_{s}(A)$ in the
entries of $A$ (independent of $m$) such that

$\sum_{s\in S}\,q_{s}\cdot(A^{m})_{s}\,=\,0\quad,$ $None$

for all $m>1$.

This fact follows from the Cayley-Hamilton equation that says that If
$P_{A}(x):=\det(A-x\,I)$ is the characteristic polynomial of $A$, then the
$n\times n$ matrix $P_{A}(A)$ equals the zero matrix ${\bf 0}$ . Writing

$P_{A}(X)=\sum_{k=0}^{n}p_{k}x^{k}\quad,$

we have

$\sum_{k=0}^{n}p_{k}A^{k}={\bf 0}\quad,$

where ${\bf 0}$ is the all-zero matrix. Multiplying by $A^{m}$ we get

$\sum_{k=0}^{n}p_{k}A^{m+k}={\bf 0}\quad,$

for all $m$.

Taking the $ij$ entry, we have that each of the $n^{2}$ sequences
$(A^{m})_{ij}$ satisfy the same $n^{th}$-order linear recurrence equation with
constant coefficients

$\sum_{k=0}^{n}p_{k}(A^{m+k})_{ij}=0\quad.$

It is well-known and easy to see ([1][8]) that any $n+1$ sequences that
satisfy the same recurrence of order $n$, must be linearly dependent. Also, in
order to find the relation, it is enough to find $n+1$ values of the $q_{s}$
for which $(1)$ holds for the $m\,=\,1,\,2,\dots,n$. Then this linear
combination also satisfies that very same linear recurrence, and since it
vanishes at the first $n$ initial conditions it must be identically zero.

If our subset $S$ of entries only consists of non-diagonal entries, we can do
even better, Eq. $(1)$ is true for any set $S$ of $n$ non-diagonal entries.

Note that the Cayley-Hamilton equation implies that

$\sum_{k=1}^{n}p_{k}A^{k}\quad$

is a diagonal matrix (namely $-\det(A)\bf I$), hence for a non-diagonal entry
$ij$ ($i\neq j$), $(A^{m})_{ij}$ always satisfies the same linear recurrence
equation (with constant coefficients) of order $n-1$, hence any $n$ such non-
diagonal entries must be linearly dependent. In the original case of a
$2\times 2$ matrix discussed in [2], it follows that the $(1,2)$ and $(2,1)$
entries of $A^{m}$ always satisfy the same relation as those of $A$, hence we
have yet-another-proof (without equations!) of Larcombe’s amazing discovery.

But what about higher dimensions? Now things get much more complicated, and we
need a computer algebra system (in our case Maple). For example, we have the
following

Theorem: Let $A=(a_{ij})_{1\leq i,j\leq 3}$ be a $3\times 3$ matrix, then for
all $m\geq 1$, we have

$\left(a_{1,2}a_{2,1}a_{2,3}-a_{1,3}a_{2,1}a_{2,2}+a_{1,3}a_{2,1}a_{3,3}-a_{1,3}a_{2,3}a_{3,1}\right)\cdot(A^{m})_{12}$
$+\left(a_{1,2}a_{2,3}a_{3,1}-a_{1,3}a_{2,1}a_{3,2}\right)\cdot(A^{m})_{13}$
$+\left(-a_{1,2}^{2}a_{2,3}+a_{1,2}a_{1,3}a_{2,2}-a_{1,2}a_{1,3}a_{3,3}+a_{1,3}^{2}a_{3,2}\right)\cdot(A^{m})_{21}\,=\,0\quad.$

There are three more such theorems (up to trivial isomorphism) for the $n=3$
case, while there are $27$ inequivalent cases for $n=4$. They can all be found
in the following output file

https://sites.math.rutgers.edu/~zeilberg/tokhniot/oLarcombe1.txt .

We were unable to find the corresponding relations for $n=5$, they got too
complicated!

A bijective proof of the Larcombe-Fennessey theorem about Tridiagonal matrices

Any matrix identity for a fixed dimension is essentially high-school algebra
and can be verified by a computer algebra system, even if the power $m$ is
arbitrary. But the following theorem of Larcombe and Fennessey, regarding
tridiagonal matrices of arbitrary dimension is university algebra and is more
interesting.

Theorem (Larcombe and Fennessey [6]) : Let $A$ be a general tridiagonal
$n\times n$ (for any $n\geq 2$), then for all $1\leq i<n$, and all $m\geq 1$,
we have

$a_{i,i+1}\cdot(A^{m})_{i+1,i}\,=\,a_{i+1,i}\cdot(A^{m})_{i,i+1}\quad.$ $None$

We will give a combinatorial proof. Fix $n$ and let $a_{i,j}$ ($1\leq i,j\leq
n$) be $n^{2}$ commuting indeterminates. It follows immediately from the
definition of matrix multiplication that the $(i,j)$ entry of $A^{m}$ is the
weight-enumerator of the set of $(m+1)$-letter words in the alphabet
$\\{1,2,\dots,n\\}$ whose first letter is $i$ and last letter is $j$, with the
weight

$Weight(w_{1}\dots
w_{m+1}):=a_{w_{1}\,w_{2}}\,\cdot\,a_{w_{2}\,w_{3}}\,\cdots\,a_{w_{m-1}\,w_{m}}\,\cdot\,a_{w_{m}\,w_{m+1}}\quad.$

If our matrix is tridiagonal, then all the words are continuous i.e. after the
letter $i$ can only come one of the (up to) three letters $\\{i-1,i,i+1\\}$.
For example if $n=5$ then the following is a legal word

$2333234333221122112234455443\quad,$

but the following one is not

$233312\quad,$

because after the fourth letter, that is a ‘$3$’, comes the letter ‘$1$’.

Let ${\cal W}_{m}(i,j)$ be the set of legal $(m+1)$-letter words in the
alphabet $\\{1,2,\dots,n\\}$ that start with the letter $i$ and end with the
letter $j$. Its weight-enumerator (i.e. sum of the weights of its members) is
$(A^{m})_{ij}$, where now $A$ is a generic $n\times n$ tridiagonal matrix. For
ease of type-setting let $i^{\prime}:=i+1$.

Note that:

$\bullet$ The left side of $(2)$ is is the weight-enumerator of the set of
words, $i\,{\cal W}_{m}(i^{\prime},i)$, which is the set of legal
$(m+2)$-letter words that start and end with the letter $i$, and whose second
letter if $i^{\prime}$.

$\bullet$ The right side of $(2)$ is is the weight-enumerator of
$i^{\prime}\,{\cal W}_{m}(i,i^{\prime})$ which is the set of legal
$(m+2)$-letter words that start and end with the letter $i^{\prime}$, and
whose second letter if $i$.

We claim that The mapping

$T_{i}\,:\,i\,{\cal W}_{m}(i^{\prime},i)\rightarrow i^{\prime}\,{\cal
W}_{m}(i,i^{\prime})\quad,$

to be defined next, is a weight-preserving bijection.

Let $w=w_{1}w_{2}\dots w_{m+2}$ be a member of $i\,{\cal
W}_{m}(i^{\prime},i)$, then of course $w_{1}=i$ and $w_{2}=i^{\prime}$, and
$w_{m+2}=i$. Let $k$ be the smallest index such that
$w_{k}=i^{\prime},w_{k+1}=i$. Of course it exists (by “continuity”).

Case I: $k=2$.

If $m=1$ then the word must be $i\,i\,^{\prime}i$ and we map it to
$i^{\prime}\,i\,i^{\prime}$.

Otherwise we can write

$w\,=\,i\,i^{\prime}\,i\,u\,i\quad,$

for some $(m-2)$-letter word $u$, and we define

$T_{i}(w):=\,i^{\prime}\,i\,u\,i\,i^{\prime}\quad,$

that of course belongs to $i^{\prime}\,{\cal W}_{m}(i,i^{\prime})$.

Case II: $k=m+1$, then we can write

$w\,=\,i\,i^{\prime}\,u\,i^{\prime}\,i\quad,$

for some $(m-2)$-letter word $u$, and we map it to the

$T_{i}(w):=\,i^{\prime}\,i\,i^{\prime}\,u\,i^{\prime}\quad,$

that of course belongs to $i^{\prime}\,{\cal W}_{m}(i,i^{\prime})$.

Case III: $2<k<m+1$. Then we can write

$w\,=\,i\,i^{\prime}\,u\,i^{\prime}\,i\,v\,i\quad,$

for some words $u$ and $v$, whose total length is $m-2$, and we define

$T_{i}(w):=\,i^{\prime}\,i\,v\,i\,i^{\prime}\,u\,i^{\prime}\quad,$

that of course belongs to $i^{\prime}\,{\cal W}_{m}(i,i^{\prime})$.

Let’s state the inverse mapping

$U_{i}\,:\,i^{\prime}\,{\cal W}_{m}(i,i^{\prime})\rightarrow i\,{\cal
W}_{m}(i^{\prime},i)\quad.$

Let $w=w_{1}w_{2}\dots w_{m+2}$ be a member of $i^{\prime}\,{\cal
W}_{m}(i,i^{\prime})$, then of course $w_{1}=i^{\prime}$ and $w_{2}=i$, and
$w_{m+2}=i^{\prime}$. Let $k$ be the largest index such that
$w_{k}=i,w_{k+1}=i^{\prime}$. Of course it exists (by “continuity”).

Case I: $k=m+1$. If $m=2$ the $w=\,i^{\prime}\,i\,i^{\prime}$ and we let
$U_{i}(w)$ be $i\,i^{\prime}\,i$. Otherwise we can write

$w\,=\,i^{\prime}\,i\,u\,i\,i^{\prime}\quad,$

for some $(m-2)$-letter word $u$, and we define

$U_{i}(w):=\,i\,i^{\prime}\,i\,u\,i\quad.$

Case II: $k=2$. We can write

$w\,=\,i^{\prime}\,i\,i^{\prime}\,u\,i^{\prime}\quad$

and we define

$U_{i}(w):=\,i\,i^{\prime}\,u\,i^{\prime}\,i\quad.$

Case III: $2<k<m+1$. We can write

$w\,=\,i^{\prime}\,i\,v\,i\,i^{\prime}\,u\,i^{\prime}\quad,$

for some words $u$ and $v$ whose lengths add-up to $m-2$, and we define

$U_{i}(w):=\,i\,i^{\prime}\,u\,i^{\prime}\,i\,v\,i\quad.$

Readers are welcome to play with the Maple package

https://sites.math.rutgers.edu/~zeilberg/tokhniot/Larcombe.txt ,

that contains procedure $\tt REL$ to discover generalized Larcombe relations
(mentioned above) and also implements the above bijection (procedures Ti and
Ui, and CheckTi verifies it empirically).

References

[1] Manuel Kauers and Peter Paule, “The Concrete Tetrahedron”, Springer, 2011.

[2] P. J. Larcombe, A note on the invariance of the general $2\times 2$ matrix
anti-diagonal ratio with increasing matrix powers: four proofs, Fib. Quarterly
53, 360-364 (2015).

[3] P. J. Larcombe and E. J. Fennessey, A new tri-diagonal matrix invariance
property, Palest. J. Math. 7, 9-13 (2018).

[4] P. J. Larcombe and E. J. Fennessey, A note on two rational invariants for
a particular $2\times 2$ matrix, Palest. J. Math. 7, 410–413 (2018).

[5] P. J. Larcombe and E. J. Fennessey, On anti-diagonals ratio invariance
with exponentiation of a $2\times 2$ matrix: two new proofs, Palest. J. Math.
9, 12–14 (2020).

[6] P. J. Larcombe and E. J. Fennessey, A formalised inductive approach to
establish the invariance of antidiagonal ratios with exponentiation for a tri-
diagonal matrix of fixed dimension, Palest. J. Math. 9, 670-672 (2020).

[7] P. J. Larcombe and E. J. Fennessey, A short graph-theoretic proof of the
$2\times 2$ matrix anti-diagonal ratio invariance with exponentiation, Palest.
J. Math. 10, 102-103 (2021).

[8] Doron Zeilberger, The C-finite Ansatz, Ramanujan Journal 31 (2013), 23-32.
https://sites.math.rutgers.edu/~zeilberg/mamarim/mamarimhtml/cfinite.html .

Shalosh B. Ekhad and Doron Zeilberger, Department of Mathematics, Rutgers
University (New Brunswick), Hill Center-Busch Campus, 110 Frelinghuysen Rd.,
Piscataway, NJ 08854-8019, USA. Email: [ShaloshBEkhad, DoronZeil] at gmail dot
com .

Written: July 27, 2021.