UPI Study › Courses › Criminology › Free lessons › Lesson 17.1 Free with a free account
Cybercrime and Cyber Threats: Definitions, Types, and Examples
Criminology · Chapter 17: Cybercrime and Transnational CrimeSection 17.1 · lesson 73 of 91video coming soon
← Policy Frameworks and International Cooperation in Counter-TerrorismNext lesson: Cyberbullying and Transnational Crime: Definitions, Types, and Examples →
In this lesson
Definitions, categories, legal framework, and why official counts fall short.
- Define cybercrime and distinguish its principal categories.
- Map established offense categories onto computer-mediated conduct.
- Explain how scale, distance, and automation change offending.
- Describe the measurement problems specific to cybercrime.
Transcript
Everything said in the video, section by section (1,762 words). Read along, or search it.
Opening Question
Locked Files and a Fake Invoice
A shop owner, Dev, finds the shop's files locked, and a customer pays a fake invoice. Are those the same crime? Hold that thought. Cybercrime can sound like a strange new world, with its own rules and its own kind of offender. This lesson argues that, legally, most of it is not new at all.
Roadmap
Where This Lesson Is Headed
We begin with the field's standard distinction, between a computer as target and a computer as instrument. Then we sort specific offenses into those two categories. Next comes the legal framework, a broad federal statute layered over state law. After that, we ask what really is different: scale, distance, and automation. We look at how those features bear on neutralization and deterrence theory. Then we trace four filters that keep most cybercrime out of official statistics. We close with victim impact, a return to Dev's shop, and some practice.
Definition
Computer as Target or Instrument
Cybercrime is criminal conduct involving a computer system. The field divides it into two categories. In a computer-as-target offense, the computer system itself is the object of the offense. The harm consists of unauthorized interference with that system. In a computer-as-instrument offense, the computer is simply the means. The offense itself is a long-established category, such as fraud, harassment, or theft, carried out in a new medium. That second point matters a great deal conceptually. Viewed through its legal elements rather than its medium, most cybercrime is a familiar wrong. It is committed through a new instrument, not invented from scratch. So the elements framework from Subchapter two point one continues to apply directly.
Why It Matters
Old Elements Still Govern New Mediums
Here is why the distinction should shape how you approach any new offense involving a computer. There is an instinct to treat every computer-mediated offense as wholly new. On that view, each one would need an entirely new theoretical apparatus. In most instances, that instinct overstates what has actually changed. A fraud committed through electronic communication is still fraud. It is analyzed through the same elements, including material misrepresentation, that Subchapter fourteen point one developed. A threat sent electronically is still a threat, judged by the same elements as one delivered any other way. What has genuinely changed is the scale, distance, and automation the computer medium introduces. Those features change the criminology of the offense. They do not, for most offenses, change the underlying legal analysis.
Target Offenses
Access, Interference, and Misuse of Devices
Computer-as-target offenses are named here strictly as legal categories. There is no technique, tool, or vulnerability content in this lesson, and none is needed. Unauthorized access means accessing a computer system without permission, or in excess of the permission granted. Unauthorized interference means damaging, altering, or disrupting data or system functioning without authorization. The misuse of devices category covers possessing or distributing items primarily designed to facilitate those offenses. Notice that this offense is defined entirely by legal function, not by any technical description. Each of these offenses is complete once its stated legal elements are proven. A prosecutor does not need to explain how the conduct was technically accomplished. Neither does a student analyzing the case.
Instrument Offenses
Familiar Offenses Through Electronic Means
Computer-as-instrument offenses map established legal categories onto conduct carried out through a computer. Fraud applies where a material misrepresentation, made through electronic means, is used to obtain property or a benefit. Identity-related offenses involve the unauthorized use of another person's identifying information. Harassment and threat offenses apply when electronic communications meet the elements those offenses require under applicable law. Intellectual property offenses apply when protected material is unlawfully reproduced or distributed electronically. Offenses against the person can also be committed through communications, from threats to certain privacy violations. Every category is evaluated with the same framework: a guilty act, a guilty mental state, and, where required, causation and harm. The medium changes, but the legal analysis does not. Where children are the victims, Subchapter twelve point three supplies the framework. This lesson refers you there rather than restating or supplementing it.
Quick Check
Deleted Photos in an Online Account
Quick check, with a new case. A man guesses his former partner's password and deletes the photos stored in her online account. Is the computer the target, or the instrument? Pause, and decide. The target. The harm is unauthorized access to, and interference with, the account itself. The system is the object of the offense, not merely the means.
Legal Framework
The Computer Fraud and Abuse Act
The principal federal statute is the Computer Fraud and Abuse Act. It is codified at Title eighteen of the United States Code, section ten thirty. Its reach is broad, covering computers used in or affecting interstate commerce or communication. In practice, that reaches a very large share of connected systems. Litigation has centered on the authorization question: what counts as exceeding authorized access? The hard cases involve someone with a legitimate basis for initial access, who allegedly used it improperly. In twenty twenty-one, in Van Buren versus United States, the Supreme Court narrowed that question. It held that misusing information you are entitled to access does not, by itself, exceed authorized access. Entering parts of a system that are off-limits to you does. The Court left open whether those limits must be technical, or can come from contracts and policies. So the boundary is still developing, and state computer crime statutes overlap with the federal law, sometimes in different words. Sectoral privacy laws, for health or financial data, add further obligations and offenses on top.
Comparison
Target Versus Instrument Across Three Dimensions
Here we compare the two categories on three dimensions. First, the interest harmed: a target offense harms the integrity and availability of the system itself. An instrument offense harms whatever interest the underlying offense protects, such as property, reputation, or safety. Second, the legal framework: target offenses fall under the federal computer crime statute and state computer crime statutes. Instrument offenses fall under the underlying offense's own statute, applied to electronically mediated conduct. Third, the measurement route: target offenses appear mainly through specialized incident reporting, and rarely in conventional crime statistics. Instrument offenses are mixed; some are counted under the underlying offense, and some through specialized reporting. Because state law sits beneath a federal statute of broad but limited reach, no single national rule exists. Faced with a case, ask which jurisdiction applies, and whether federal law, state law, or both are involved.
Key Features
Scale, Distance, and Automation
So what makes cybercrime criminologically distinctive? Three features stand out. Scale is the capacity of a single offender to affect a very large number of victims, in one course of conduct. In most conventional offenses, the ratio of offenders to victims is much closer to one. Distance is the physical, and often jurisdictional, separation between offender and victim. It eliminates the physical proximity that most conventional offense theory quietly assumes. Automation is the capacity of one initiated process to repeat itself against many targets. The person who started it may have only limited ongoing involvement. Together, these features change the basic relationship between one offender and many victims. Most criminological theory was developed with conventional offending in mind, and was built to describe something different.
Theory Link
Neutralization and Deterrence Online
Distance and automation bear directly on two theories from earlier in the course. Neutralization, from Subchapter eight point one, describes how offenders rationalize conduct to reduce felt guilt. Online, physical and social distance already removes much of the direct confrontation that might prompt moral reflection. So neutralization may operate differently when the victim is never seen. Deterrence, developed in Subchapter six point one, rests on the perceived certainty of detection, and the severity of punishment. Distance and automation can change how likely an offender believes identification and apprehension really are. That perception may differ sharply from offending done in physical proximity to a victim. Be careful about the strength of these claims, because they are theoretical implications, not settled empirical findings. No one has established how large either effect actually is.
Measurement
Four Filters Behind Official Statistics
Cybercrime is largely absent from traditional crime statistics, such as the FBI Uniform Crime Reporting Program. Those systems were built around conventional, physically located offenses, as Subchapter three point two described. Where cybercrime is captured, it is usually through specialized reporting, separate from ordinary police reports. Here are four filters between an incident and the official count. At the first filter, the victim never recognizes the incident at all. At the second, the victim recognizes it but decides not to report. At the third, an organization reports to a regulator, not to the police. Organizations often choose internal remediation or regulatory notification, out of reputational concern and doubt about what a report would achieve. At the fourth, data systems built around conventional offense codes fail to record it. Each filter is a different actor's decision. What survives all four is a small, unrepresentative fraction, so official figures substantially underestimate the conduct.
Victim Impact
Financial, Psychological, and Organizational Harm
Victim impact from cybercrime can be described across three dimensions. Financial impact includes direct monetary loss and the cost of remediation. Psychological impact includes the general distress of victimization, as the victimology framework of Chapter five describes. Organizational impact includes operational disruption, reputational consequences, and regulatory exposure. These dimensions frequently interact. Consider a victim of an identity-related offense. That person may lose money, then carry a remediation burden that extends well beyond the incident. They may also feel a lasting sense of violated privacy and diminished control. That distress can persist even after the financial loss is recovered. Treating the dimensions as independent, as if repaying the money closes the case, understates the harm.
Practice
Sorting Offenses into Two Categories
Let's apply the framework. Accessing a system without permission, disrupting it, exceeding authorized access to alter data, and possessing access tools are all computer-as-target offenses. Threatening messages, identity misuse, copyright distribution, and electronic fraud are computer-as-instrument offenses. Each instrument offense corresponds to its traditional, pre-digital category, such as fraud, harassment, or unlawful copying.
Reverse Reasoning
Why Scam Victims Go Unreported
Now work backward. A survey finds that most fraud targets knew they had been scammed, yet the local police logged very few cases. What explains the gap? Pause, and decide. Awareness rules out the first filter, so the gap points mainly to the second: the victim's reporting decision.
Case Revisited
Dev's Two Crimes and Reporting Choice
Back to Dev's shop. The locked files are interference with the system itself, a target offense. The fake invoice is fraud, an instrument offense. So these are two different crimes, each judged by familiar legal elements. Now Dev must choose where to report: the police, a regulator, or a quiet internal fix. Each time a business reports to a regulator instead of the police, the incident drops out of official crime counts. That is the third filter at work.
Key Takeaways
Attacked or Used, Mostly Hidden
Let's pull it together. Cybercrime is either a computer attacked, or a computer used. Familiar legal elements still apply, under federal and state law. Scale, distance, and automation make it distinctive. And four filters hide most of it from official counts.
About Criminology at UPI Study
Criminology (Criminology 150) is a self-paced online course of 91 video lessons in 21 chapters, from classical criminology and crime data to theories of crime, victims, policing, courts and corrections. It carries a NCCRS credit recommendation for 3 semester credits.
Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Enroll now → Course details Download the syllabus Every course with PRO →
Why take it here
Why students take Criminology with UPI Study
Where the credit goes
Universities that work with NCCRS
Criminology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Thomas Edison State UniversitySigned partner
University of the PeopleSigned partner
Charter Oak State CollegeSigned partner
Strayer UniversitySigned partner
Columbia Southern UniversitySigned partner
Indiana TechSigned partner
Penn StateWorks with NCCRS
Southern New Hampshire UniversityWorks with NCCRS
SUNYWorks with NCCRS
+many more cooperating universitiesFind my college →Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.
FAQ
Questions students ask us
About Cybercrime and Cyber Threats: Definitions, Types, and Examples
What is cybercrime, and what are its two main categories?
Is a crime committed online treated as a completely new kind of crime?
How do scale, distance, and automation change offending online?
Why is cybercrime missing from official crime statistics?
About the Criminology course
How many college credits is Criminology?
How much does Criminology cost and what is included?
Which universities accept UPI Study credits?
How long does Criminology take?
How are the exams done?
How do my credits reach my college?
Ready for the full course? Earn 3 credits in Criminology.
91 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.
3 credits · NCCRSEnroll →