3.1 Crime-as-a-Service - Recommendations
- A co-ordinated EU-wide undertaking is required to disrupt or dismantle the top identified criminal forums and marketplaces. This should be an intelligence-led endeavour combining the efforts of law enforcement, judicial authorities, Europol and Eurojust, and utilising initiatives such as the Joint Cybercrime Action Taskforce (J-CAT) under EC3.
- Law enforcement should target individuals with high reputations on the underground forums. Successful prosecution of top tier cybercriminals would not only have considerable impact on the cyber community but may provide many other investigative leads and sends a strong message to the criminal community that nobody is untouchable.
- Where it is not possible to target top tier cybercriminals due to lack of attribution or jurisdictional issues, law enforcement should focus on targeting those providing key support services. There are often only limited numbers of skilled and experienced individuals providing the more technical services, who may not be quickly or easily replaced should they be removed.
- Where possible law enforcement should similarly focus on targeting criminal infrastructure such as the servers where cybercriminals host their content or communications.
- Where national legislation allows lawful, targeted surveillance possibilities, these options should be utilised where appropriate to identify high threat underground forums used by cybercriminals and to gather intelligence and evidence. This may require law enforcement to increase or adapt its language capacity.
- Law enforcement should take full advantage of successful operations to increase their visibility and presence online. Attributing themselves to successful website takedowns and domain seizures with the likes of branded splash pages increases the impact of the activities. Following this, further prevention activities such as LE-badged emails to forum members, will act as further deterrents.
