Crime really does pay
Between recent ransomware attacks like “WannaCry ” and warnings from the Bank of Canada’s June financial review that the country’s bank sector is vulnerable to hacking attacks that could undermine the financial system, cybercrime is getting a lot of attention. But in Canada’s justice system, it’s still not being treated as the serious crime that it is.
PWC’s 2016 Global Economic Crime Survey found that 16 per cent of Canadian organizations r e ported losses due to cybercrime between $ 50,000 and $ 5 million, while another 31 per cent calculated an estimated loss between $ 1,000 and $ 50,000. The category of losses greater than $1 million increased from five per cent in 2014 to 12 per cent in 2016.
As t he problem ge t s worse, it is clear that Canada still isn’t doing enough to combat cyber threats. It has developed a strategy for combating cybercrime consisting of elements such as securing government systems, partnering to secure vital systems outside the f ederal government, strengthening law enforce- ment resources and promoting public awareness. International co- ordination is an important element of the strategy, given that this type of crime is often cross- border presenting challenges for both evidence gathering and prosecution. But the strategy lacks a crucial element. The missing element is evident from Statistics Canada data, which suggest there may be more that can be done to ensure an effective deterrence for economic crimes including cybercrime.
A majority of cybercrime substantiated by police in 2012 was fraud. Statistics on fraud from two separate Statistics Canada surveys paint an alarming picture: Statcan’s Uniform Crime Reporting Survey shows the number of police- reported incidents of fraud has increased by 21.4 per cent between 2011 and 2015 and there is a similar pattern for cybercrime fraud incidents for the years where data are available. While it’s true that some originate outside Canada’s borders, even as the total number of fraud incidents rises dramatically, the numbers of charges, guilty findings, and long sentences have all declined steadily since 2011. Statcan’s Integrated Criminal Court Survey shows that for individuals who are sentenced, over 40 per cent of them will be ordered to serve one month or less while over 80 per cent will get less than six months.
Certainty and severity of punishment are two key elements of deterrence, and many experts such as Daniel Nagin of Carnegie Mellon University have argued the certainty of punishment is a much more effective deterrent than severity. Nagin also argues there is little evidence of lengthy prison sentences having any material deterrence effect. The statistics on fraud in Canada suggest certainty of punishment is weak for white collar crimes like cyber fraud, and getting weaker. Charges laid are a small fraction of reported incidents. But more charges may have limited impact on deterrence given low convictions. Hence in Canada’s case, longer sentences for white- collar crime may be warranted despite Nagin’s conclusions. One recent study found strong deterrence effects from longer sentences when initial sentence lengths are low.
So, does cybercrime pay? Regrettably t he answer seems to be yes for Canadian cyber fraud. The trend will likely continue given that clogged court systems and time l i mits f or prosecutions following the Supreme Court’s Jordan decision may result in fewer white- collar prosecutions. However, the need to curb fraud and commercial cybercrime is rising as a policy issue as the costs to Canadians increase and the economy continues to be more reliant on the Internet. Modestly stiffer sentences will improve deterrence by not only increasing punishment but by sending a signal to prosecutors that these cases are worthwhile, and securing more international co- operation by signalling to other jurisdictions these crimes are being taken seriously.
THE NUMBERS OF CHARGES, GUILTY FINDINGS, AND LONG SENTENCES HAVE ALL DECLINED STEADILY.