The seasonality index of cybercrimes

Komarov Anton Anatolevich ORCID: 0000-0002-1330-4236 PhD in Law Associate Professor; Department of Criminal Law and National Security; Novosibirsk State University of Economics and Management 630099, Russia, Novosibirsk region, Novosibirsk, Kamenskaya str., 52/1, office 503 reise83@mail.ru Other publications by this author

Introduction.

The need to study the dynamic distribution of crime by seasons is determined by the fact that this knowledge can contribute to predictive goals and further enhance the effectiveness of the organization of countering specific types of crime. At the same time, most of the research on this issue remains at the level of the 19th century in its methodological plan. At least when it comes to domestic criminology. So, on the issue of computer crime, such research has not yet been conducted in Russia, which turned out to be the result of an analysis of dissertations in the field of criminology over the past 20 years.

In foreign literature, this issue is much more widely sanctified. The first comments in the works of the famous French criminologist and statistician Henri Michel Guerry date back to the first half of the 19th century. In Russian criminology, priority in this regard should be given to I. J. Foynitsky, E. N. Tarnovsky, and M. N. Gernet. Today, despite the ever-increasing computing power that can contribute to more efficient calculations, there is no deepening (differentiation) of knowledge on the calculation of the seasonality index in relation to specific types of crime. There are general methodological solutions to the problem of all crime. Here we can mention such criminologists as A. A. Kiselyov, A.A. Zhirnov, S. A. Fomin, S. R. Romanov. While there are quite a lot of works in the foreign literature on the seasonality of computer crimes. In this regard, we can refer to Graham Farrell, Matthew Renzon, Rutger Luckfeldt and many others.

Therefore, regarding the subject of our research, it will not be possible to directly compare any known results. Our task is to check for seasonal patterns in the distribution of the statistical totality of "crimes committed using information and communication technologies or in the field of computer information." Identify patterns of seasonality, if they really exist. Compare our own results with foreign ones.

Materials and methods.

The starting point of any criminological research is the factual data that form the basis of theoretical judgments. In this case, we must rely on the available criminal statistics for a number of previous years. Of the reports on the state of crime, we are primarily interested in the indicator of the registration of acts. This can be obtained from open sources: the websites of the Ministry of Internal Affairs of the Russian Federation, the portal of "Legal Statistics" of the Prosecutor General's Office of the Russian Federation. In the latter case, it is worth considering that no information was publicly available after 2022. According to V. V. Luneev, this is a significant disadvantage that negatively affects the involvement of a wide range of volunteer researchers in solving the issue of combating crime ^{[1, p.36]}.

There are no problems with extracting absolute indicators of the volume of crimes registered in Russia. The monthly reports of the Ministry of Internal Affairs "On the state of crime" allow us to identify the necessary values for the previous twenty years. But the data on computer crime is not reflected in the statistics so consistently. Separate rules for summarizing and grouping primary statistical reports have been in place since 2003 (Form 4-VT of the Ministry of Internal Affairs of the Russian Federation). However, after 2018, such data is collected and grouped in accordance with the instructions of the Prosecutor General's Office "On the introduction of lists of articles of the Criminal Code of the Russian Federation used in the formation of statistical reports." The range of acts has now been significantly expanded by including drug crimes and telephone fraud in the accounted array, resulting in a new generalized statistical category of "crimes committed using (using) information and telecommunication technologies or in the field of computer information." These consolidated documents do not represent fully comparable amounts of statistical data. Our own calculations of variation and analysis of the six-year values of the standard deviation of computer crime coefficients for all subjects of the Russian Federation indicate that criminal statistics in this part have been well-established and have been formed fairly uniformly only since 2020 ^{[2, p.39]}. It is this small amount of initial data that is most suitable for examining its problems at the moment.

In this regard, it is worth discussing the issue of the reliable length of the dynamic range of observed criminal phenomena. The special statistical literature ^{[3, p. 56]} and recent studies on the calculation of the crime seasonality index ^{[4, p. 286]} mention a three-year period as the minimum possible. We will have to agree with such a threshold of representativeness. The sample of computer crime data in our case was 6 full years, i.e. 72 months. But is this range comparable to the available amount of information about the state of seasonality of all crime, which can be easily extracted over the past 20 years?

The methodology of statistical research indicates the need to maximize the range of data for the alignment of dynamic series in order to eliminate the error of random deviation in the registration discipline. But at the same time, it is worth considering a number of other features that have not been given much attention in the computational models of criminologists before.

1. The need to expand the dynamic range is countered by the historical variability of crime. Despite the fact that the seasonality index is a relative indicator, the very movement of the volume of registered acts can have a significant impact on the calculations of average values. The larger the range of data we select for averaging, the more it breaks away from reality in the description of the phenomenon ^{[5, p.71]}. Especially if it is multidirectional. In recent years, the crime rate has been decreasing, and the level of computer activity has been increasing, which indicates the existing redistribution of the structure. This leads to greater registration of some criminal manifestations relative to others. Therefore, every year the average monthly values used for calculating the formula decrease for crime in general; for computer crime, on the contrary, they increase.

Statistical science uses different formulas to overcome such contradictions. In the case of a significant change in the volume of the phenomenon or process under study over time, the formula is applied:

, which takes into account such changes. Where the numerator forms the value of the sum (Σn) for a number of years of the ratio of the number of registered crimes in the current (specific) month of the reporting period to the Average.month is the average monthly crime rate for the same year. The denominator contains the number of analyzed n-years. In other words, the average value of the seasonality index for a particular month of the year is formed by averaging such values that have already been calculated for a number of previous years.

In the case of relative stability of crime reproduction, the formula is used. Where Y is the average monthly crime rate for month n for all the studied years; and Yn is the average monthly crime rate for all the studied n-years.

It would seem natural to use the first formula listed above. Some authors, such as A. A. Zhirnov, directly point out the methodological inconsistency of the second method ^{[6, p. 39]}. However, it depends more on the length of the time series. In modern analytical work, few people take as a basis a dynamic series longer than three years ^{[7, p.302]}. In a relatively short period of time, we can observe a fairly stable number of recorded acts. In this case, the use of the second formula is also justified, since discrepancies in the calculation results under such conditions will be minimal. Over a long period of time, a more general trend of development always opens up, which manifests itself in a decrease or increase in the crime rate.

In addition, certain types of crime, in terms of registration, can simultaneously show, as we wrote above, multidirectional trends. It seems to us that not enough attention has been paid to this fact in criminology so far. Given the pronounced trend of changes in the volume of recorded acts, we believe it is advisable to carry out calculations in two ways for comparable periods of the last three years and use only the first formula for the six-year period of statistical monitoring of ICT crimes.

2. Reflecting further on the method, the case can even be described in such a way that the seasonality index manifests itself in details, and its total score (relative to the totality of crimes) reflects only the patterns of accounting and registration discipline. Here are some arguments. One of the pioneers of factor theory in Russian criminology, I. Ya. Foynitsky, writes that the dependence of mercenary and violent crimes on the time of year is not the same ^[8], therefore, it is not possible to build a uniform model of seasonality for all crime, because it will be very abstract. E. N. Tarnovsky established an even more specific, double dependence of seasonality It depends on the sex of the criminal and the type of criminal activity for the same violent and mercenary crimes ^{[9, pp. 365-367]}. Finally, M. N. Gernet in his work "Social factors of crime" (1905) writes that the average monthly prevalence of the total volume of crime differs little from each other in Belgium, England, France, Germany and Russia, unless one takes into account its specific types ^{[10, p. 155]}.

At the same time, the seasonality index, calculated relative to all crime, may have research value when we try to compare a particular crime index of a specific type with it. Then the differences between these two index values will indicate the actual pattern of the temporal distribution of computer crime (as well as any other type of it) relative to the existing "average trend" of accounting and registration discipline.

3. Theoretically, only phenomena with already proven (obvious) manifestations of the sign of seasonality should be subjected to mathematical analysis ^{[11, p. 19]}. Thus, S. A. Fomin writes that there are explicable particular patterns of the formation of seasonality: theft of fur hats in winter, theft from household plots in autumn, etc. ^{[12, p. 35]}. The example is, of course, textbook. However, he also notes that there is no solid logical basis for a number of observed indicators of crime seasonality. More recent works mention the seasonal dependence of reckless crime, in terms of road traffic crimes ^[13], a number of property crimes ^[14], violent crimes, tax crime ^[15] and economic crime in general ^[16].

In those fields of knowledge where such calculations are more common, all phenomena analyzed for seasonality are divided by researchers into at least three types: with a strict (high) degree of dependence on seasonality, medium and low. Such calculations are highly effective in economics, medicine, agriculture, and climatology, i.e. in all areas where cyclicity is observed. However, is cyclicity a property of crime? A positive statement, in our opinion, would be controversial. It would be more correct to say that the way law enforcement agencies generate reports is cyclical. In this regard, it is important to answer the question: is there a seasonal trend in computer crime as such? Are there particular patterns of its seasonal distribution that are not similar to the general patterns of criminal statistics formation?

Calculation model and research results.

The data in Table 1, "Calculations for the three-year period 2023-2021," indicate that the use of two different formulas is reasonable. The seasonality index of all crime does not show significant differences, despite the difference in methods (the values of the Is(N) columns are 1dine. and Is(P)-2stat. in our table). The difference of one tenth of a percent is visible only in April and September. It is logical to assume that this condition is due to the low rates of negative crime growth: in 2023 by -1%; in 2022 by -1.88%; and in 2021 by -1.95%.

Table 1. Calculations for the three-year period 2023-2021

The same cannot be said about the seasonal indices of crimes committed with the help of information and communication technologies (see the columns of IP(KP)-1in. and Is(KP)-2 stats). Here, the difference in calculation methods has a greater impact. At the same time, it should be borne in mind that in 2021-2022 the volume of such crimes was relatively stable. Although the growth rate was positive, it was not so great: 2021 – +1.4%; 2022 – +0.84%. However, in 2023, the volume of registered crime in this part increased by a third (+29.7%), which is presumably due to the allocation of departments in the structure of the Ministry of Internal Affairs of the Russian Federation to organize the fight against the illegal use of information and communication technologies. A similar trend in the number of reported computer crimes continued in 2024 (+14.5% by November 2023). We believe that there is no real increase in computer crime on such a scale as recorded by modern criminal statistics. Rather, a part of latent crime is being transferred to the category of registered crime ^[17]. The growth of detection rates is ensured by the high labor intensity of the newly formed units. The most experienced personnel were recruited into their ranks, and an extraordinary certification of Interior Ministry employees who joined the service was carried out. However, the increase in the statistical totality of crimes committed with the help of ICT cannot last long. Firstly, the Decree of the President of the Russian Federation does not provide for the creation of separate additional staff units in divisions at the territorial level, as well as their additional financing. Therefore, this state of affairs with accounting and registration discipline is based on the "internal reserve" of professionalism of the staff involved. Secondly, it is impossible to maintain such high growth rates with limited human and resource potential from year to year, since the complexity of ensuring indicators will increase exponentially. In part, this can already be seen in the current dynamics indicators. In 2024, the growth rate is twice as low as in 2023. And in 2025 they will be twice as low as they are today. Thus, the final cumulative figure of the volume of registered crimes committed with the help of information and communication technologies should stabilize at around 0.75–0.8 million.

The Ministry of Internal Affairs of the Russian Federation has made unprecedented efforts to reorient law enforcement activities in order to increase the effectiveness of countering computer crime. It is not quite easy to give an unambiguous assessment of such a process.

On the one hand, this has led to a very specific phenomenon: with an increase in the detection rate of ICT crimes, the detection rates of serious and especially serious ordinary crimes have suffered. This was due to the outflow of professional personnel to the newly formed structures for combating computer crime. This state of affairs in conditions of personnel shortage requires a reduction in the volume of registered crimes so that the remaining investigative units and investigative bodies can perform their functions. Therefore, the crime rate formally continues to decrease. Due to this, it was possible to achieve stabilization of the detection rates of serious ordinary crimes in 2024 at the level of 47% (see Fig.1).

Fig. 1. Disclosure indicators.

On the other hand, due to this, the emerging negative trends in the field of borderline education and artificial latency of computer crime were overcome. In December 2021, criminal statistics showed unnaturally low percentages of the seasonality index (55%) for the entire six-year follow-up period. It can be assumed that at this point in time an attempt was made to "curb the statistics" of crimes committed in the information and communication sphere. While December is one of the criminally active months of the year, if you check our chart in Fig. 2 "Index comparison".

Fig. 2. Comparison of indices over a 6-year period.

The differences in the seasonal indices in the presented chart are formed due to a number of reasons. First of all, it is necessary to take into account the specifics of the accounting and registration discipline of individual law enforcement agencies. As a rule, their activities are related to countering certain types of crime. Let's give an example. Thus, economic crime ^{[16, p. 133]}, as well as its part, crime in the consumer market ^{[18, p. 51]}, have a general tendency to register the majority of crimes in the first quarter of each year. After that, the recordability of acts gradually decreases by the end of the reporting period. The registration of crimes related to drug distribution has its own specifics of seasonal distribution. The average monthly deviations of the seasonality index are smoothed out here, since their consumption is carried out by drug addicts all the time. However, in this part, crimes committed with the help of information and communication technologies show a more general trend inherent in crime in general, which indicates the ordinary nature of most crimes committed. In our case, it is not the statement of such a fact itself that is important, but the empirically proven impossibility of classifying the problem of so-called "cybercrime" as a white-collar or economic one. Moreover, here our estimates coincide with the opinion of O. A. Starostenko, who identifies only 8% of white-collar crimes in the structure of computer crime ^{[19, p.175]}. Thus, there are more arguments in defense of this position.

Continuing the reasoning in this direction, it can be assumed that the seasonality index depends on the structure of computer crime.

Separate studies by our foreign colleagues indicate similar trends in the manifestation of the seasonality index for online fraud ^{[20, p. 490]}. Based on the limited amount of data collected in the UK, they revealed sharp spikes in online shopping fraud in October and December, which were linked to consumer activity. Fraudulent schemes related to online dating showed similar dynamics. However, the peak months were August and October.

Therefore, a significant increase in the registration of crimes committed through information and communication technologies in December can also be explained by the increasing consumer activity of the population before the New Year holidays and the development of distance trading, since fraud dominates the structure of modern Russian computer crime.

The noticeable decrease in registration rates observed in January-February of each year is typical both for crime in general and for crimes committed through information and communication technologies. It is associated with a weakening of consumer activity of the population ^{[21, p. 17]}.

However, the connection with computer crime here, as it seems to us, is not direct. It is mediated by the development of economic turnover as such. By the way, I. Ya. Foynitsky first made a note about this at the end of the nineteenth century ^{[22, p. 22]}. It is likely that in the case of fraud, it synchronously responds to seasonal changes in those types of economic activity on which it "parasitizes".

The peak in the registration of ICT crimes, as well as crime in general, falls in October. This is a difficult-to-explain statistical phenomenon that has been repeatedly mentioned by leading researchers ^{[23, pp.387-392; 24, pp. 226-248]}. In criminology, there are several hypotheses that explain this state of crime. However, they primarily concern other issues. G. Farrell's research confirms that the level of street crime correlates with the duration of the dark time of day, which lengthens with the onset of autumn ^[25]. A decrease in serotonin levels due to lack of sunlight increases irritability and aggression in the case of violent crimes ^[26]. In fact, they all boil down to the further development of the theory of routine activity (Cohen & Felson, 1979) ^[27], who argue that everyday patterns of behavior change in the fall: people stay at home more often, and the number of social contacts increases, which increases the likelihood of crime. But it is unlikely that the seasonality of ICT crimes can be explained within the framework of this theory, since the use of "digital" technologies is conditioned by the need for their daily use. M. Ranson's research has shown that the level of common self-serving crime in the United States increases during the warmer months (the peak occurs in July-August), while "cybercrimes" do not have a clearly defined trend in this regard ^[28]. Research by the Dutch criminologist R. Lukfeldt explains this by the fact that ICT crimes depend on technological vulnerabilities and global trends in information security, rather than on the time of year ^[29]. Therefore, phishing attacks on organizations and individuals, in order to seize their property, occur year-round ^[30]. However, it is worth noting that in this case we are talking about crimes in the field of computer information, the proportion of which has so far not been so great as to affect the seasonality index of ICT crimes in Russia. Unfortunately, last year the volume of this type of crime reached its maximum in the history of statistical observations. In total, 105.7 thousand crimes in the field of computer information were registered, 99.5% of which relate to unauthorized access to computer information (art. 272 of the Criminal Code of the Russian Federation). During 2023-2024, there have been multiple growth rates. This makes it virtually impossible to calculate the index, since the values of each subsequent month (sometimes multiple times) exceed the previous one. The existing formulas are unable to account for the exponential increase in crime.

A comparison of our results with foreign ones indicates that such a manifestation of the seasonality index is not a simple statistical error or the result of accounting and registration discipline. From which it can be concluded that it represents a real seasonal manifestation of mass criminal behavior in the field of ICT crimes.

Discussion of the results and conclusions.

Unfortunately, the seasonality of computer crime in Russian criminology is not sufficiently covered. More attention is paid to this issue in foreign science, but the interpretation of seasonality is carried out within the framework of the "Routine Activity Theory". We do not see this state of affairs as entirely satisfactory, since seasonality on a significant scale is far from evident in all criminal phenomena. Therefore, the study of its dynamic distribution by seasons should be carried out in relation to certain types of crime. Such studies will contribute not only to deepening our knowledge of the particular patterns of criminal behavior, but also serve predictive purposes.

The seasonality index helps to better understand the place of computer crime (cybercrime) in the structure of crime in general. The quantitative values of the seasonality index are an expression of the properties of a particular type of crime. The coincidence or difference of this indicator will indicate a genetic link between criminal phenomena. Computer crime here has little in common with economic ("white collar"), street or domestic crime. This alone indicates that computer crime was once fairly singled out as an independent research subject.

A sufficient number of our foreign colleagues indicate that the possibility of committing ICT crimes does not depend on external (seasonal and weather) conditions. We also see that the values of the seasonality index are similar to the patterns of distribution of the entire statistical totality of crimes registered in Russia. This indicates the ordinary nature of most of them. But the internal heterogeneity of the statistical category "crimes committed with the use (application) of information and telecommunication technologies or in the field of computer information" also makes its own adjustments. Therefore, it is reasonable to assume that the seasonality index depends on the structure of computer crime. The peculiarities of the seasonality of ICT crimes are related to the structure of the statistical aggregate, which includes: drug crimes, telephone and Internet fraud, computer information crimes. These are four independent phenomena, the seasonality of which manifests itself in different ways. Drug crimes committed via the Internet have a smoother registration curve throughout the calendar year, and the multiplying volumes of crimes provided for in Chapter 28 of the Criminal Code of the Russian Federation unnaturally distort the picture of seasonality. And with regard to the majority of common computer crimes of a mercenary orientation, we are inclined to assert that they are in an intermediate state relative to street common computer crimes and the totality of crimes in the field of computer information in terms of patterns of formation of the seasonality index.

We have also obtained important results in methodological terms. Statistical analysis requires as much initial information as possible, which entails the need to expand the dynamic range. Such an expansion requires the use of other formulas for calculating the index, since the volume of recorded crime is very mobile. The longer the dynamic series is constructed for factor analysis, the more seasonality becomes dependent on the crime structure. Our research also shows that the existing formulas for calculating the seasonality index are not able to take into account the exponential growth in the volume of registered crime.

The results of our research indicate that the more abstract the statistical aggregate is (for example, we are talking about crime in general), the more it reflects the patterns of the accounting and registration discipline. The seasonality index can indicate interesting properties of crime only if phenomena of a much smaller scale are taken: specific types of crime or even certain types of crimes.

In terms of further development of research on seasonality, it should be borne in mind that the dynamic distribution of crime really depends on geographical criteria: the time of year in different hemispheres, the latitude of the climate zone. Due to these circumstances, the reference to specific months of registration in individual countries cannot coincide, which makes it difficult to conduct comparative studies in order to exclude the influence of such a factor as accounting and registration discipline. Although such studies are being conducted.