Version 1

This study utilized a sample of approximately 1,900 threads from 13 web forums where criminals and hackers buy, sell, and trade stolen financial and personal information. Eight of the sites sampled were publicly accessible, in that the entire site could be accessed by anyone in the general public. The five remaining sites required that an individual create a registered user account within the site in order to access the content of the sub-forums related to data sales. In order to capture the forum content across all sites, the researchers created usernames for each forum but did not interact with other registered participants to reduce the potential for contamination. Researchers utilized both qualitative and quantitative methods to address the research questions of this study. Specifically, quantitative analysis techniques were used to examine the economy of the market, while qualitative grounded theory analyses were used to explore the social organization of the market. Finally, quantitative social network analyses were used to assess the relationships between participants in these markets. For the Economic Data Coding (ICPSR Submission Economic File SPSS.sav), content analysis techniques were applied to classify the various products, resources, and materials sold or sought out in these forums. The content of each ad was coded based on the detail provided. Each item was coded individually, such that an advertisement where an individual was selling credit card numbers as well as PayPal accounts were coded as a single instance of each activity. In addition, any additional advertisements or updates in a thread were coded as new cases to capture variations in pricing and products over time. The Social Network Analysis (Social Network Analysis File Revised 04-11-14.mdb) allowed researchers to visualize and quantify the information on large networks and complex relationships. Network analysis allowed both the visualization of users' communications, as well as the extraction of network connectivity. The exchanges between individuals in these forums allowed for the identification of network structures within and across all the forums. This type of analysis allowed for the identification of global patterns in the otherwise hidden networks of data market participants, and connectivity between participants. In addition, social network analysis enabled researchers to consider connections between participants based on their role in both the forum and in the course of any sales or exchanges noted in a thread. Applying social network analysis techniques to forum data, individual posters became network vertices, while their forum interactions established connections between them. The username for each poster, regardless of what forum it appeared in, served as a basis to assess connections between individuals, and consider the flow of information from one agent, or vertex, to another. This allowed researchers to build a set of arcs, or connections between hackers.