Hi and welcome to the A16Z podcast. I'm Hannah and this episode is all about the business of

cybercrime. Joel de la Garza operating partner of information security at A16Z and I talk with

Jonathan Lusthouse, director of the human cybercriminal project at the University of Oxford,

about his new book, Industry of Anonymity inside the business of cybercrime. This conversation is all

about how cybercrime has evolved now into a large-scale global technology industry, an industry

that in a lot of ways, from organizational structures to recruiting to specialization and even certain

greenfield dynamics, looks very much like legitimate technology business, except for being, well,

criminal. From how cyber criminal organizations tend to be structured and function to who those people

are and what drives them, what changes when we begin to understand cybercrime as a large-scale

business industry? So the idea of the lone troublemaker hacker, the kind of hobby hacker,

political activist, is sort of what we, for a long time, have culturally thought of as the cyber

criminal, right? But that's no longer the case. It's now really a much larger, highly organized,

and profit-driven organization. So can you walk us through how that actually happened?

The shift from the loan hacker to the highly organized industry is really one that's taken

place over quite a long period of time. I mean, this is something that actually wasn't criminal

to begin with, really. When it started to become a little bit more of a criminal activity,

that's when we started to see people operating in this kind of lone wolf capacity and causing trouble, you know, sometimes in small groups,

but largely just as individuals. When we start to see something that's far more structured,

organized and profit-driven, really begins to occur mostly in the 90s because this is the period

that we're starting to put things of value online.

So until we have the actual targets there that make it worth people's time to go after them.

Right, it was a hobby because there wasn't any actual value to it. Exactly. See, there wasn't really a reason to be a profit-driven cybercriminal.

...