Hacker communities may not be as unconventional as they seem, with new research suggesting that they mirror many aspects of mainstream capitalist economies as they begin to grow and mature.

Ben Collier, a lecturer of digital methods at the University of Edinburgh, and his colleagues wanted to better understand what happens during the expansion and evolution of alternative subcultures under industrialization — the process by which, generally speaking, an economy is reorganized toward mass production and efficiency-based technical processes. In doing so, Collier and his colleagues became the first to develop the concept of "illicit infrastructure" and explain its crucial role in transforming criminal networks outside the mainstream economy; the research was published April 15 in the British Journal of Criminology. 

Drawing on an extensive analysis of empirical data collected from interviews of 11 individuals involved in the "booter" services industry, which provides denial-of-service attacks for a fee, and the Cambridge Cybercrime Centre's CrimeBB dataset, which archives over 70 million online posts dating back to 2002 from 25 underground cybercrime forums, the researchers discovered that, over time, hacker subcultures' associated illicit economies can replicate the same divisions of labor, cultural tensions and conditions of alienation present in mainstream capitalist economies.

Previous criminology literature suggested that deviant subcultures are initially formed around alternative systems of social, financial and cultural capital — members, who typically don't participate in mainstream culture because of alienation or boredom, are brought together by the attraction and excitement of illicit activities such as hacking. Just as capitalist economies evolve over time, though, so do alternative economies. 

This transformation, from a highly skilled network of lone hackers to multiple smaller clusters of less skilled hackers organized in a top-down manner around a few highly skilled elites, has produced a more organized form of criminality, according to Collier and his colleagues. This creates lower initial barriers to entry for members, though elite hackers' technical skill is still prized over the widespread use of others' tools and software, and a hierarchy remains in place.

Role specialization and the tedious nature of the service economy, produced by industrialization, have in turn led to the rise of illicit infrastructure, the researchers wrote. These systems prioritize the diffusion of risk and stability through organization and administration over a collective hacker identity that was formerly strengthened by social capital.

"Although the image of the hacker is what draws a lot of people in, and there are some who genuinely are interested in playing around with people and technology in creative ways, the majority of the activity seems to be fairly well-worn low-level scams rather than anything creative or [value-centered], and the core culture of many of these places is more about low-level entrepreneurship than tech," Collier told The Academic Times.

A gradual progression from excitement and experimentation to greater boredom and less expansive creativity under industrialization, Collier said, has led to the "business-like" organization of many hacker subculture networks, where members' time is more often spent in supportive, intermediary or administrative roles. 

Just as in mainstream capitalist economies, the researchers noted a shift among the hacker subculture toward tedious, supportive forms of labor, with membership in these groups now less about hackers' "charismatic transgression" and "deviant identity" and more about maintaining stability and diffusing the collective risk of crime through illicit infrastructure.

Collier and his colleagues identify eight specific aspects of illicit infrastructure within the economies of deviant subcultures. As supportive roles take priority over individualism, hacker communities become more supportive of broader illegal activity; pursue stability and transparency; prefer centralization or concentration; develop lower hacker social capital; channel creativity into improved defense against law enforcement; manage and enforce community norms; prioritize the diffusion of risk and culpability; and, perhaps most importantly, contribute to an increase in boredom, which often results in burnout.

According to the study, this boredom-induced burnout, stemming from industrialized hacker communities' shift toward a business management mentality, might be a crucial aspect in understanding why criminals lose motivation during the course of their careers. It is likely that the emphasis on entrepreneurship, competition and tedious support roles present in industrialized systems of labor weakens cultural bonds that once facilitated members' long-term involvement in communities.

"This is about the [industrialization] of low-level cybercrime — much like the switch from bank robbing to fraud, this crime has become less about excitement and identification with 'hacker' values, and more like lots of groups of pals running small businesses," Collier said. "Even for the very high end of exploit development — the really elite hackers — it's mostly boring." 

A new hack, often developed in a research lab, comes along every so often, he said, but it's mostly about taking the same tools and working with software and code to try a series of things, surfacing results "that are often fairly well-understood."

"So things like project management, upscaling, administration, running a team ... in other words, getting things to run smoothly, are more important than coming up with the 'big new thing,'" Collier said.

However, the transformation of hacker communities might not be all bad — illicit infrastructure and industrialization can diffuse individuals' risk of culpability, shifting illegal practices toward maintenance and customer service positions, and encouraging the development of smaller, independent hacker subcultures that incubate greater diversity and creativity.

"I think hacker 'culture' is likely to become less and less important to cybercrime subcultures, particularly as it increasingly revolves around shared services and easy scams," Collier said. He added that this pattern has already been seen in cryptomarkets, where, "Much of the early [value-centered] exciting stuff has given way to a business mentality over time."

According to Collier, hacker "culture" now lies elsewhere. 

"It's in activist groups, people building their own technologies as alternatives to the mainstream, like Tor or [Cwtch], big hacker conventions and little hacklabs where people are doing incredible and creative things with tech," he said. "So, the 'hack' is often more about using technology to change the world in interesting ways. It's also a lot more diverse — both in terms of people, and in terms of core values and politics."

The study, "Cybercrime is (often) boring: Infrastructure and alienation in a deviant subculture," published April 15 in the British Journal of Criminology, was authored by Ben Collier, University of Edinburgh; Richard Clayton and Alice Hutchings, University of Cambridge; and Daniel Thomas, Strathclyde University.