Photo credit: Cottonbro Studio
In June last year, Joseph James O’Connor, a UK citizen, also known online as “PlugwalkJoe”, received a five-year sentence in a US federal prison. His cybercrimes spanned from 2019 to 2020, culminating in the infamous Twitter hack of July 2020. In addition to the five years in prison, O’Connor was also sentenced to three years of supervised release and a restitution of nearly $800,000. In the 2020 Twitter hack, he and co-conspirators used social engineering over the phone to gain unauthorised access to the company’s administrative tools to hijack high-profile Twitter accounts and distribute scams. Additionally, O’Connor was involved in extorting public figures using unauthorised access to their TikTok and Snapchat accounts as well as cyberstalking and sending harassing messages to them. He also used SIM swap attacks to steal nearly $800,000 worth of cryptocurrency from a US-based crypto company.
So quite the busy bee O’Connor was.
Photograph: Jon Nazca/Reuters
O'Connor's story begs the question: what leads a young individual down such a notorious path?
The common, often misleading stereotype of computer criminals as socially inept loners fails to encompass the full picture. Research, though scarce, has begun to unveil a correlation between cybercrime and antisocial behaviours. One study where 235 respondents anonymously self-reported a variety of computer criminal behaviours, showed that cybercrime was associated with violent, and nonviolent antisocial behaviour and that cybercrime bore a strong relation to psychopathy, particularly disinhibition, antagonism and narcissism, a state characterized by self-absorption, grandiosity, exploitation of others and lack of empathy.
A good example is Jon DiMaggio's fantastic piece of investigative journalism 'Ransomware Diaries' where he exposes the Ransomware as a Service (Raas) Lockbit group leader's abrasive and sexist personality, devoid of empathy or legal respect. This individual’s response to the recent take-over of the LockBit tools and dashboard by the FBI was:
“I take this as additional advertising and an opportunity to show everyone the strength of my character. I cannot be intimidated… I ask that the FBI hack me more often, so that it can’t happen again.”
Although we obviously can’t diagnose anyone based on a few chat-based interviews, the above just looks like text-book narcissistic behaviour.
In O’Connor’s case, however, there are a few additional theories that might be interesting to consider:
Differential Association Theory
Originally proposed by Edwin Sutherland in 1939 and revised ten years later, the Differential Association Theory suggests that deviant behaviour is learned through interactions with others. O’Connor’s involvement in cybercrime was very likely influenced by his associations with other cybercriminals in online groups and reflected the norms and values of the digital communities he interacted with, where such behaviours are normalised and even celebrated.
Neutralisation Effect
The above is intensified by the neutralisation effect, which results in criminals minimizing their responsibility and the harm caused to others and, in some cases, even believing that victims are deserving of or responsible for the harm.
General Strain Theory
Robert Agnew’s General Strain Theory posits that when people experience negative emotions related to strains, without adequate pro-social coping mechanisms, it may lead them to criminal behaviour. According to this interview with O’Connor’s mother, who pleaded with the judges to show leniency because of her son’s violent and isolated upbringing, O’Connor was exposed to physical violence by his natural father. His older brothers had the benefit of a supportive grandfather, who unfortunately passed away before O’Connor was born, leaving him to grow up without a positive male role model in his life.
He was also bullied in school, which resulted in his mother taking him out of school in the UK and moving him to Spain. During the Covid lockdown period, he was completely isolated, as his mother got stuck in the UK and could not return to look after him. His challenging upbringing, exposure to violence, and isolation during pivotal years suggest a complex interplay of factors that may have nudged O’Connor towards criminality.
An interesting case study of General Strain Theory is the story of ex-cybercriminal, now turned security expert Alex Wood. Alex Wood’s early career was in the music industry, where he toured the world as a violin soloist from the age of 13. At the age of 24, he was faced with repetitive strain injury (RSI) in his right hand forcing him to halt his music career. Faced with mounting debts and no source of income, his criminal career began. His life spiralled out of control, eventually leading to a transformative stint in prison for a multi-million-pound cybercrime offence. I found it interesting that Wood’s RSI injury, (which includes the word ‘strain’) potentially led to General Strain Theory coming into effect.
Photo credit: Scamp Speakers, Alex Wood
Although psychopathy may explain some criminal behaviour, and there are certainly cases of narcissistic leaders amongst cybercrime syndicates, most people are not psychopaths, but complex beings who react in different ways to their environment.
Understanding cybercriminals like O'Connor involves peeling back layers of potential psychological and sociological influences. It emphasizes the need for proactive measures in parenting and education to foster resilience through the teaching of healthy coping mechanisms and social support in young individuals, steering them away from the seductive pull of cybercrime.
As educators and parents, we need to not only learn about how to spot and manage risk factors attracting adolescents into potential cybercrime careers and manage negative peer group pressure but also learn how to cope with strains in a healthy way ourselves.
This is necessary to become positive role models for our kids and perhaps motivate them to join the cybersecurity field rather than a cybercrime group.