Crime prevention

Situational crime prevention (SCP) is a relatively new concept that employs a preventive approach by focusing on methods to reduce the opportunities for crime. It was first outlined in a 1976 report released by the British Home Office.[3] SCP focuses on the criminal setting[4] and is different from most criminology as it begins with an examination of the circumstances that allow particular types of crime. By gaining an understanding of these circumstances, mechanisms are then introduced to change the relevant environments with the aim of reducing the opportunities for particular crimes. Thus, SCP focuses on crime prevention rather than the punishment or detection of criminals and its intention is to make criminal activities less appealing to offenders.[5]

SCP focuses on opportunity-reducing processes that:

• Are aimed at particular forms of crime;
• Entail the management, creation or manipulation of the immediate environment in as organised and permanent a manner as possible; and
• Result in crime being more difficult and risky or less rewarding and justifiable.[5]

The theory behind SCP concentrates on the creation of safety mechanisms that assist in protecting people by making criminals feel they may be unable to commit crimes or would be in a situation where they may be caught or detected, which will result in them being unwilling to commit crimes where such mechanisms are in place. The logic behind this is based on the concept of rational choice - that every criminal will assess the situation of a potential crime, weigh up how much they may gain, balance it against how much they may lose and the probability of failing, and then act accordingly.

Situational Crime prevention can be applied using twenty-five opportunity reducing techniques:

• Increase the Effort: Includes target hardening (e.g. Tamper-proof packaging), controlling access to facilities (e.g. Electronic card access), applying screen exits (e.g. Electronic merchandise tags), deflecting offenders (e.g. dispersing pubs) and controlling tools or weapons (e.g. Disabling stolen mobile

phones).

• Increase the Risks: Includes extending guardianship (e.g. neighbourhood watch), Assisting natural

surveillance (e.g. adequate street lighting), Reducing anonymity (e.g. compulsory taxi identification cards), utilising place managers (e.g. rewarding vigilance) and strengthening formal surveillance (e.g. Security guards).

• Reduce the Rewards: Includes concealing targets (e.g. unmarked bullion trucks), removing targets (e.g. women's refuges), identifying property (e.g. cattle branding), disrupting markets (e.g. monitoring of pawn shops) and denying benefits (e.g. speed humps).
• Reduce Provocations: Includes reducing frustrations and stress (e.g. efficient queues and polite service), avoiding disputes (e.g. Separate enclosures for rival soccer fans), reducing emotional arousal (e.g. controls on violent pornography), neutralising peer pressure (e.g. targeting and removing troublemakers from a school) and discouraging imitation (e.g. V-chips in televisions).
• Remove the excuses: Includes setting rules (e.g. rental agreements), posting instructions (e.g. 'No Parking' signs), alerting conscience (roadside speed display boards), assisting compliance (e.g. easy library check-out) and controlling drugs and alcohol (e.g. alcohol free zones)[6]

One example of SCP in practice is automated traffic enforcement. Automated traffic enforcement systems (ATES) use automated cameras on the roads to catch drivers who are speeding and those who run red lights. Such systems enjoy use all over the world. These systems have been installed and are advertised as an attempt to keep illegal driving incidences down. As a potential criminal, someone who is about to speed or run a red light knows that their risk of getting caught is nearly 100% with these systems. This completely disincentivizes the person from speeding or running red lights in areas in which they know ATES are set up. Though not conclusive, evidence shows that these type of systems work. In a Philadelphia study, some of the city's most dangerous intersections had a reduction of 96% in red light violations after the installation and advertisement of an ATES system.[7]

Another aspect of SCP that is more applicable to the cyber environment is the principle of safeguarding. The introduction of these safeguards is designed to influence the potential offender's view of the risks and benefits of committing the crime. A criminal act is usually performed if the offender decides that there is little or no risk attached to the act. One of the goals of SCP is to implement safeguards to the point where the potential offender views the act unfavourably. For example, drivers approaching a traffic junction where there are speed cameras slow down if there is a nearly 100% chance of being caught trying to run a red light. The use of crime "scripts" has been touted as a method of administering safeguards.[4] Scripts were originally developed in the field of cognitive science and focus on the behavioural processes involved in rational goal-oriented behaviour. Hence scripts have been proposed as tool for examining criminal behaviour. In particular the use of what is termed a "universal script" has been advanced for correctly identifying all the stages in the commission process of a crime.

It has been suggested that cybercriminals be assessed in terms of their criminal attributes, which include skills, knowledge, resources, access and motives (SKRAM).[8] Cybercriminals usually have a high degree of these attributes and this is why SCP may prove more useful than traditional approaches to crime. Clarke proposed a table of twenty-five techniques of situational crime prevention, but the five general headings are:

1. Increasing the effort to commit the crime
2. Increasing the risks of committing the crime
3. Reducing the rewards of committing the crime
4. Reducing any provocation for committing the crime
5. Removing any excuses for committing the crime[9]

These techniques can be specifically adapted to cybercrime as follows:

Increasing the effort

Reinforcing targets and restricting access- the use of firewalls, encryption, card/password access to ID databases and banning hacker websites and magazines.

Increasing the risk

Reinforcing authentication procedures- background checks for employees with database access, tracking keystrokes of computer users, use of photo and thumb print for ID documents/credit cards, requiring additional ID for online purchases, use of cameras at ATMs and at point of sale.

Reducing the rewards

Removing targets and disrupting cyberplaces – monitoring Internet sites and incoming spam, harsh penalties for hacking, rapid notification of stolen or lost credit bankcards, avoiding ID numbers on all official documents.

Reducing provocation and excuses

Avoiding disputes and temptations – maintaining positive employee-management relations and increasing awareness of responsible use policy.[10]

Many of these techniques do not require a considerable investment in hi-tech IT skills and knowledge. Rather, it is the effective utilization and training of existing personnel that is key.

It has been suggested that the theory behind situational crime prevention may also be useful in improving information systems (IS) security by decreasing the rewards criminals may expect from a crime. SCP theory aims to affect the motivation of criminals by means of environmental and situational changes and is based on three elements:

• Increasing the perceived difficulty of crime;
• Increasing the risks; and
• Reducing the rewards.[11]

IS professionals and others who wish to fight computer crime could use the same techniques and consequently reduce the frequency of computer crime that targets the information assets of businesses and organisations. Designing out crime from the environment is a crucial element of SCP and the most efficient way of using computers to fight crime is to predict criminal behaviour, which as a result, makes it difficult for such behaviour to be performed. SCP also has an advantage over other IS measures because it does not focus on crime from the criminal's viewpoint. Many businesses/organisations are heavily dependent on information and communications technology (ICT) and information is a hugely valuable asset due to the accessible data that it provides, which means IS has become increasingly important.[12] While storing information in computers enables easy access and sharing by users, computer crime is a considerable threat to such information, whether committed by an external hacker or by an ‘insider’ (a trusted member of a business or organisation).[13] After viruses, illicit access to and theft of, information form the highest percentage of all financial losses associated with computer crime and security incidents.[13] Businesses need to protect themselves against such illegal or unethical activities, which may be committed via electronic or other methods and IS security technologies are vital in order to protect against amendment, unauthorised disclosure and/or misuse of information.[13] Computer intrusion fraud is a huge business with hackers being able to find passwords, read and alter files and read email, but such crime could almost be eliminated if hackers could be prevented from accessing a computer system or identified quickly enough.[14]

Despite many years of computer security research, huge amounts of money being spent on secure operations and an increase in training requirements, there are frequent reports of computer penetrations and data thefts at some of the most heavily protected computer systems in the world.[15] Criminal activities in cyberspace are increasing with computers being used for numerous illegal activities, including email surveillance, credit card fraud and software piracy.[16] As the popularity and growth of the Internet continues to increase, many web applications and services are being set up, which are widely used by businesses for their business transactions.[17]

In the case of computer crime, even cautious companies or businesses that aim to create effective and comprehensive security measures may unintentionally produce an environment, which helps provide opportunities because they are using inappropriate controls.[18] Consequently, if the precautions are not providing an adequate level of security, the IS will be at risk.[18]

Smallbone et al.’s Integrated Theory of Child Sexual Abuse posits that it can be useful to study child sexual abuse as a situationally specific incident, and that on any particular occasion, a variety of different factors can influence whether that incident is likely to occur. One set of factors is situational factors, which form the immediate backdrop to the setting in which the abuse takes place. Situational factors, it is argued, can influence not just whether a person abuses a child, but whether the idea of abusing occurs to them in the first place. The particular opportunities and dynamics of a situation are said to present cues, stressors, temptations and perceived provocations, which trigger motivation. The consideration of situational factors leads to the argument that some offenders may be considered as ‘situational’, marking them out from other types. The ‘situational offender’ is someone who is not primarily attracted to children. Instead, he is stimulated to offend by specific behavioural cues or stressors, often while performing care-giving duties. The authors of the theory argue that modifying the situations experienced by children, through situational crime prevention strategies, could lower the likelihood of abuse, irrespective of the disposition of people who are likely to come into contact with children. The authors concede that there has been little testing of situational interventions, which means there is little evidence to demonstrate their effectiveness.[19]

An evaluation of a programme which worked work mothers in London to reduce situational risk of child sexual abuse in the home illustrated some of the challenges that mothers faced in identifying and reducing situational risk:

1. Increasing understanding about abuse, how and where it happens.
2. Accepting the possibility of abuse at home and in the family.
3. Accurately assessing the risks posed to one's own children.
4. Lowering known risks by negotiating with family members.[20]

In computer systems that have been developed to design out crime from the environment, one of the tactics used is risk assessment, where business transactions, clients and situations are monitored for any features that indicate a risk of criminal activity. Credit card fraud has been one of the most complex crimes worldwide in recent times and despite numerous prevention initiatives, it is clear that more needs to be done if the problem is to be solved. Fraud management comprises a whole range of activities, including early warning systems, signs and patterns of different types of fraud, profiles of users and their activities, security of computers and avoiding customer dissatisfaction. There are a number of issues that make the development of fraud management systems an extremely difficult and challenging task, including the huge volume of data involved; the requirement for fast and accurate fraud detection without inconveniencing business operations; the ongoing development of new fraud to evade existing techniques; and the risk of false alarms.

Generally, fraud detection techniques fall into two categories: statistical techniques and artificial intelligence techniques.

Important statistical data analysis techniques to detect fraud include:

• Grouping and classification to determine patterns and associations among sets of data.
• Matching algorithms to identify irregularities in the transactions of users compared to previous proof
• Data pre-processing techniques for validation, correction of errors and estimating incorrect or missing data.

Important AI techniques for fraud management are:

• Data mining – to categorise and group data and automatically identify associations and rules that may be indicative of remarkable patterns, including those connected to fraud.
• Specialist systems to programme expertise for fraud detection in the shape of rules.
• Pattern recognition to identify groups or patterns of behaviour either automatically or to match certain inputs.
• Machine learning techniques to automatically detect the characteristics of fraud
• Neural networks that can learn suspicious patterns and later identify them.[21]