Australian National University · S2 2026 · FACULTY OF SOCIOLOGY

CRIM2010 Cybercrime: an introduction

- one subject, every graph, every model, every mark
11 Chapters55-page Bible
Our own words - no uploaded lecturer files
Built to mirror S2 2026 · updated this semester
The Complete Study & Assessment Guide · S2 2026

CRIM2010 Overview

Cybercrime: an introduction
— how cybercrime works, why people commit it and how societies respond
  • 6 units
  • Semester 2 2026
  • In person
  • POLIS: The Centre for Social Policy Research
  • Quizzes and group work

Cybercrime: an introduction at the Australian National University is a 2000-level undergraduate criminology course, offered by POLIS: The Centre for Social Policy Research in the ANU College of Arts and Social Sciences.

  • Assessed by Two online quizzes worth 55% and three group tasks worth 45%.
  • Quiz shape Multiple choice plus short answers that apply a framework to a case.
  • Hardest step Applying a named theory or framework to every detail of a case.
  • How to prepare Learn the frameworks precisely, then rehearse short timed case answers.
CRIM2010 · Australian National University
An independent, AskSia-authored study guide. AskSia is not affiliated with, endorsed by, or sponsored by Australian National University; the course code and name are used for identification only.
Assessment

How CRIM2010 is assessed

ComponentWeightFormat
Weekly lectorial and workshop activities10%Eight group PBL activities in class; the best six count, 1.67% each
Problem-based learning (PBL) group presentation15%Groups of 4 to 5; presented in class in allocated weeks
Problem-based learning (PBL) group report20%A 1,500 to 2,000-word policy brief, due two weeks after the presentation
Quiz 1: Individual multiple-choice & short answer online test25%Online; completed during the mid-semester break; first half of the course
Quiz 2: Individual multiple-choice & short answer online test30%Online; completed at the end of semester; whole course, emphasis on the second half

These five weights come from the Semester 2, 2026 class summary on the ANU Programs and Courses website and total 100%. The general course page lists an older indicative split written for an intensive offering: 25% for mini group presentations and participation, 15% for the PBL presentation, 20% for the report and 20% for each quiz. The class summary is the record for this offering; check Canvas if the two ever seem to conflict for you.

Group tasks 45%Individual quizzes 55%10%15%20%25%30%ActivitiesPresentationPBL reportQuiz 1 (online)Quiz 2 (online)
Current dates · verify in LMS

Current CRIM2010 dates

DateItemControl
27 July to 30 October 2026Class datesStart and end dates listed for class 8731.
Week 6 to the teaching breakQuiz 1Opens in Week 6 and is due during the teaching break.
Weeks 9 and 10PBL group presentationsGroups present in allocated workshop weeks.
Weeks 10 and 11PBL group reportEach brief is due two weeks after the group’s presentation.
Week 12 to the end of semesterQuiz 2Opens in Week 12 and is due after teaching ends.

Dates are as published in the Semester 2, 2026 class summary and the Canvas course schedule. Confirm exact deadlines and submission settings in the live LMS.

Contents · every chapter, one map

What CRIM2010 covers

Eleven chapters follow the workshop weeks, from defining and measuring cybercrime and the criminological theories that explain it, through history and Australian law, misinformation, scams and identity crime, to darknet markets.

01

What Cybercrime Is and How Australia Measures It

Who, what, why and how · the Australian Cybercrime Survey · quota samples and self-selection · barriers to investigation

This chapter sets up the course’s first question: what counts as cybercrime and how anyone knows how much of it there is.

  • The criminological who, what, why and how
  • Who designed and funded the survey
  • Four categories of victimisation measured
  • Non-probability quota sampling
  • Self-selection and misreporting
  • Why cybercrime outpaces offline crime
02

Classifying Cybercrime: Dichotomies to Taxonomies

Cyber-dependent and cyber-enabled · the Type I to Type II continuum · Wall and Sarre trichotomies · old wine in new bottles

There is no single agreed definition of cybercrime, and no jurisdiction has one offence by that name, so the field relies on classification schemes.

  • Why no definition commands consensus
  • Cyber-dependent against cyber-enabled crime
  • The Type I to Type II continuum
  • Against, using and in the machine
  • Sarre’s third type for AI and bots
  • Old wine, new bottles
03

Learning, Neutralisation and Digital Drift

Differential association · reinforcement and piracy forums · Sykes and Matza techniques · ransomware justifications · affinity and affiliation

Learning theories explain how people acquire both the skills and the justifications for offending.

  • Shared motives, new capacity
  • Differential association and reinforcement
  • Learning in piracy forums
  • The five techniques of neutralisation
  • Ransomware offenders’ justifications
  • Digital drift: affinity and affiliation
04

Self-Control, Deterrence and Opportunity Theories

Self-control and social bonds · certainty against severity · rational choice · routine activities online · situational prevention

Control and opportunity theories ask what restrains offending and when the situation invites it.

  • Low self-control and juvenile hacking
  • Four social bonds
  • Certainty, severity and swiftness
  • Restrictive deterrence and warning banners
  • Bounded rationality among hackers
  • Routine activities in lagged cyberspace
05

Four Phases in the History of Cybercrime

Breaking systems · spreading malware · monetising access · projecting power · the love bug

The history of cybercrime is told as networks becoming social, commercial and strategic.

  • Phase I: breaking what others build
  • Phase II: connectivity spreads malware
  • Phase III: cybercrime becomes a business
  • Phase IV: power and influence
  • Motive, target and scale compared
  • Why phases overlap
06

Cybercrime Offences and Cases in Australian Law

Criminal Code Part 10.7 offences and maximum penalties · Salter · Soyke · Tasker · Sulaiman · Cyber Security Act 2024

Australia’s computer offences sit mainly in Part 10.7, with Parts 7.3 and 10.6, of the Criminal Code Act 1995, introduced after the Cybercrime Act 2001 and aligned with the Council of Europe Convention.

  • Digital traces and the attribution paradox
  • Jurisdiction, anonymity and evidence
  • Criminal Code offences and ceilings
  • Salter: login is not authority
  • Soyke and Tasker compared
  • The Cyber Security Act 2024
07

Misinformation, Disinformation and Fake News

Definitions by intent and form · deepfakes and rumours · motives and impacts · bots, astroturfing and echo chambers

False information is social engineering at the level of a whole community.

  • The infodemic warning
  • Misinformation against disinformation
  • Fake news, deepfakes and rumours
  • Motives behind disinformation
  • Market, political and medical harm
  • Bots, astroturfing and echo chambers
08

Regulating Misinformation and Inoculating Audiences

The voluntary code and ACMA · the abandoned 2024 Bill · community notes · inoculation theory · FLICC techniques

How should a society respond to false information without silencing legitimate speech?

  • The voluntary code and DIGI
  • What ACMA can and cannot do
  • Why the 2024 Bill was abandoned
  • Community notes and their timing
  • Threat and refutational pre-emption
  • FLICC techniques of denial
09

Fraud as a Theatrical Mugging and Scam Prevention

The hook, the line, the sinker and the blow-off · scam types · horizontal and vertical scaling · stage-based prevention

Fraud is a crime of persuasion in which the victim takes part, which is why the lecture calls it a theatrical mugging.

  • Fraud as a crime of persuasion
  • Mark, story, cash-out and scale
  • The hook, line, sinker and blow-off
  • Big, soft and straight hooks
  • Repeat victimisation and vertical scaling
  • Removing hooks and lifting sinkers
10

Identity Crime, Email Compromise and Organised Fraud

From theft to discovery · survey evidence · skimming, pretexting and pharming · business email compromise · organised crime groups

Identity crime has two parts: obtaining someone’s identity and misusing it, most often for fraud.

  • Obtaining an identity and misusing it
  • Theft-to-discovery gap
  • Survey figures on identity crime
  • Skimming, pretexting and pharming
  • Business email compromise
  • Organised crime groups and networks
11

Darknet Markets: Tor, Trust and Evidence

Tor relays and onion services · PGP, escrow and reputation · DrugHub listings · what listings cannot show · takedowns and migration

Darknet markets rebuild the institutions of online shopping among anonymous strangers.

  • Surface, deep and dark web
  • Tor relays and onion services
  • Trust: escrow, reviews and PGP
  • Bitcoin and Monero
  • DrugHub listings by origin
  • What listings cannot show

It asks how cybercrime happens, why people commit it, who is harmed and what governments, businesses, police and individuals can do about it. The convenor describes it as highly interactive: a weekly two-hour workshop and one-hour tutorial work through real cases, current events and problem-based learning, drawing on criminology, law, information security, psychology and public policy.

The early weeks build the toolkit.

You learn how the Internet, anonymity and digital traces shape offending, how the Australian Cybercrime Survey measures victimisation and why its figures cannot be generalised, how cybercrime is classified, and which theories explain it, from differential association, neutralisation and digital drift to self-control, deterrence, rational choice and routine activities.

The course then traces four phases in the history of cybercrime and the computer offences in Australia’s Criminal Code, turns to misinformation, the voluntary industry code and the abandoned 2024 Misinformation Bill, and analyses scams as a hook, a line, a sinker and a blow-off before moving to identity theft, business email compromise and organised fraud.

Weeks 7 and 8 examine darknet markets and online drug trade; later weeks cover money laundering, predatory and content crimes, cyber conflict and the future of cybercrime.

There is no formal final examination.

Two individual online quizzes of multiple-choice and short-answer questions carry 55% of the grade, and group work carries the rest: weekly workshop activities, a problem-based learning presentation and a policy brief on the same topic. This guide follows that shape, with every chapter explaining the ideas, working a complete example and ending in quiz-style practice.

Worked example · free

How long stolen credentials go unnoticed

Q [4 marks]. In a study of 211 identity theft victims helped by IDCARE, misuse of stolen credentials began on average 36 days after they were taken, and victims first found out on average 62 days after. About 68% detected the misuse themselves. How long did offenders typically work unseen, and what does the pattern suggest for prevention? The marks shown are AskSia practice weighting, not a published university scheme.
How long stolen credentials stay hidden.How long stolen credentials stay hidden. Among 211 people helped by IDCARE, misuse began on average 36 days after credentials were stolen, but victims first found out at day 62, leaving the shaded 26-day window in which offenders worked unnoticed.Credentials stolenday 0Misuse beginsday 36Victim finds outday 6226 undetected days
How long stolen credentials stay hidden. Among 211 people helped by IDCARE, misuse began on average 36 days after credentials were stolen, but victims first found out at day 62, leaving the shaded 26-day window in which offenders worked unnoticed.
  • 1Find the unseen window. 62 − 36 = 26, so misuse ran for about 26 days on average before the victim knew.
  • 1Find the total exposure. From theft to discovery took 62 days, roughly two months in which the details could be reused.
  • 1Read the detection figure. With about 68% finding out for themselves, roughly two in three victims were not first alerted by a bank, agency or police.
  • 1State the prevention point. Earlier alerts from organisations, and a simpler path to all three credit reporting agencies, would shorten the window in which misuse goes unseen.
Offenders typically misused credentials for about 26 days before victims noticed, within a 62-day gap from theft to discovery, and most victims found out on their own, so faster organisational detection and simpler reporting would cut the harm.
Sia tip — Subtract the misuse day from the discovery day: that gap, not the full 62 days, is the time offenders act unseen.
Glossary

Key terms

Cyber-dependent crime
An offence that arose with computer technology and cannot exist outside the digital world, such as hacking or ransomware.
Cyber-enabled crime
A traditional offence, such as fraud or trafficking, that technology makes easier, cheaper or faster to commit.
Cyberdeviance
Harmful or norm-breaking online conduct that is not necessarily a crime in every jurisdiction.
Differential association
Sutherland’s theory that criminal skills, motives and justifications are learned through interaction in close groups.
Techniques of neutralisation
Justifications, such as denying injury or condemning critics, that let offenders excuse acts against their own values.
Digital drift
Goldsmith and Brewer’s account of people sliding in and out of online deviance through affinity and affiliation, without joining a subculture.
Routine activity theory
Cohen and Felson’s theory that crime occurs when a motivated offender, a suitable target and no capable guardian converge.
Situational crime prevention
A set of techniques that increase effort or risk, reduce rewards or provocations, and remove excuses for a specific crime.
Misinformation
False or inaccurate information spread by people who do not intend to deceive.
Disinformation
False or manipulated information spread deliberately to mislead, including propaganda.
Inoculation theory
McGuire’s idea that forewarning people and pre-refuting weakened arguments builds resistance to persuasion.
Business email compromise
Fraud in which an offender impersonates or takes over a business email account to divert payments or data.
Onion service
A service reachable only inside the Tor network through a non-standard .onion address.
FAQ

CRIM2010 FAQ

How hard is Cybercrime: an introduction at ANU?

The ideas are accessible, but the marks demand precision. Fifty-five per cent comes from two online quizzes whose multiple-choice items, in the course warm-up, deducted marks for every wrong option ticked, and whose short answers ask you to apply a named framework to a case. The remaining 45% is group work, so steady participation and a well-run group matter as much as revision.

How is the course assessed?

Five tasks make up the grade: weekly workshop activities worth 10%, a problem-based learning presentation worth 15%, a 1,500 to 2,000-word policy brief worth 20%, and two individual online quizzes worth 25% and 30%. The schedule shows no formal examination, so the second quiz, near the end of semester, is the largest single task.

What are the online quizzes like?

Each combines multiple-choice and short-answer questions completed online. Quiz 1 falls in the mid-semester break and covers the first half; Quiz 2 comes at the end of semester and spans everything with extra weight on later weeks. Late submission is not accepted for online quizzes, so plan around the window shown on Canvas.

Are there practice questions for the quizzes?

Yes. A mid-term warm-up set out select-all items with a penalty for each wrong option and two 500-word case questions, one applying Wilson’s scam framework and one combining two theories with situational prevention. Every chapter here ends with original practice in those same formats, and a mixed bank closes the guide.

How does the group project fit together?

Groups of four or five investigate one contemporary cybercrime problem across three linked tasks. Weekly workshop activities build the project, the presentation sets out the problem, trends and solutions, and the policy brief two weeks later critiques an existing policy and makes evidence-based recommendations to decision-makers.

Which theories matter most?

The workshops apply six families repeatedly: social learning and differential association, neutralisation, digital drift, self-control and social bonds, deterrence and rational choice, and routine activities with situational prevention. Quiz case questions ask you to combine at least two, so learn what each explains and where it falls short.

How should I revise in the final weeks?

Build a one-page index of frameworks with a worked case for each, then rehearse timed short answers that name the framework, apply every part and evaluate the recommendation. For multiple choice, drill the definitions that separate similar concepts, such as misinformation and disinformation, or cyber-dependent and cyber-enabled offences.

Chapter questions

Questions students ask in each CRIM2010 chapter

Can Australian Cybercrime Survey results describe all Australians?
Not directly. Respondents came from an opt-in online panel using proportional quota sampling, so selection was not random and the size of any non-coverage bias is unknown. The figures are best used to compare categories, groups and years within the sample rather than to state a national rate. Chapter 01 · What Cybercrime Is and How Australia Measures It
What is the difference between cyber-dependent and cyber-enabled crime?
Cyber-dependent offences arose with computers and cannot happen without them, such as malware or denial of service. Cyber-enabled offences existed before the Internet and are merely made easier by it, such as fraud or trafficking. Researchers and policy makers use this split more consistently than any other. Chapter 02 · Classifying Cybercrime: Dichotomies to Taxonomies
What are Sykes and Matza’s five techniques of neutralisation?
Denial of responsibility, denial of injury, denial of victim, condemnation of the condemners and appeal to higher loyalties. Later research added others, such as the defence of necessity, the metaphor of the ledger, the claim of normalcy and the claim of entitlement. Chapter 03 · Learning, Neutralisation and Digital Drift
Does certainty or severity of punishment deter online offending more?
The evidence is mixed. Higgins and colleagues found certainty reduced piracy, Skinner and Fream found severity reduced hacking, and Bossler’s formal-sanction effects faded once informal sanctions and peers were included. Publicised arrests showed no deterrent effect in Ladegaard’s work. Chapter 04 · Self-Control, Deterrence and Opportunity Theories
What are the four phases of cybercrime?
Breaking systems from the late 1970s, spreading malware through browsers and email, monetising access and stolen data from the early 2000s, and projecting power since 2011 through espionage, ransomware, infrastructure attacks and disinformation. Each widens the motive, target and scale of offending. Chapter 05 · Four Phases in the History of Cybercrime
What did Salter v DPP (NSW) decide?
A police officer who used a work database to look up her partner’s former girlfriends was convicted of 22 offences. The court held that her permission covered legitimate police work only, so the personal searches were unauthorised, and each screen access could count as a separate offence. Chapter 06 · Cybercrime Offences and Cases in Australian Law
What is the difference between misinformation and disinformation?
Misinformation is false or inaccurate content spread by people who do not intend to deceive. Disinformation is spread deliberately to mislead, including propaganda and manipulated material. The same false claim can be either, depending on whether the person spreading it knows it is false. Chapter 07 · Misinformation, Disinformation and Fake News
Did the Senate vote down the 2024 Misinformation Bill?
No. The Bill passed the House of Representatives, but once the Greens confirmed opposition the government said it had no Senate pathway and stopped proceeding. Without Senate passage there could be no Royal Assent, so it never became an Act. Chapter 08 · Regulating Misinformation and Inoculating Audiences
What are the four stages of a scam in Wilson’s framework?
The hook baits the mark, the line builds the story and rapport, the sinker is the point where money changes hands, and the blow-off or cool-out lets the fraudster leave while the victim quietly accepts the loss. The stages need not run strictly in order. Chapter 09 · Fraud as a Theatrical Mugging and Scam Prevention
What did the 2026 survey find about identity crime?
Some 20.6% of respondents reported identity crime or misuse within the past year, and 16.0% had a financial account compromised. Among identity-crime victims, 29.6% lost money and 13.9% paid to deal with the consequences, while breach exposure fell from 25.3% to 19.7%. Chapter 10 · Identity Crime, Email Compromise and Organised Fraud
Is the deep web the same as the dark web?
No. The deep web is any content that search engines do not index, including private databases, email and learning systems, and most of it is legitimate. The dark web is services on darknets such as Tor that need special tools to reach. Chapter 11 · Darknet Markets: Tor, Trust and Evidence
Study strategy

How to prepare for the assessments

Start with the vocabulary that the multiple-choice items test: the dependent and enabled split, Wall’s three groups, the five original neutralisations, the four kinds of false content and the four stages of a scam. Write each on a card with one example from a workshop case. Then turn to frameworks, because the short answers reward application.

For each of Wilson’s stages, the routine activity triangle, the five situational categories and inoculation’s two components, rehearse applying it to a fresh case in about 150 words. Keep a separate sheet of facts worth quoting: the survey sample sizes, the main Criminal Code ceilings, the dates of the 2024 Misinformation Bill and the darknet listing shares.

Finally, practise restraint with evidence: survey results describe a sample and darknet listings describe advertised availability, so write claims at that level. In the group tasks, use the presentation feedback to sharpen the policy brief rather than starting again.

Study CRIM2010 with AI

Your AI Sociology tutor for CRIM2010

Stuck on a hard CRIM2010 question? Sia is AskSia’s AI Sociology tutor — ask any CRIM2010 Cybercrime: an introduction question and get a clear, step-by-step explanation grounded in how the course is actually taught and assessed. Read this whole study guide free, then take your hardest questions to Sia.

A+Everything unlocked
Unlocks this Bible + all 46 of your Australian National University subjects - and 1,000+ Bibles across every Australian university.
Sia - your CRIM2010 tutor, unlimited, worked the way the exam marks it
The full 55-page Bible + practice bank with worked solutions
Chrome extension - sync your LMS so Sia knows your deadlines
Bilingual EN / Chinese on every Bible and every Sia answer
$0.99 Trial
30-day money-back · cancel in one tap · how it works