Cybercrime & cyberwarfare : cyberspace's grey frontiers and their implications for digital evidence

Since the inception of nation states, the territory of war and crime has been mostly clearly distinguished from one another. Even so that the security architectures of the Western world are built on this distinction between external and internal security. In essence, whereas external security is to be provided by the armed forces and their (military) intelligence services, internal security is the field of the police and (civilian) intelligence. However, this distinction is less clear on the most novel battleground, namely cyberspace, as nation-states have been observed to operate next to and even deploy cyber criminals. A ransomware attack by a cybercrime group on a port could be an ideal outsourced cover-up for a strategic attack by a nation-state. These kinds of cyber mercenary activities are highly useful in the hybrid wars of the 21st century, as it blurs the lines between cybercrime and cyberwarfare. Hence, our contemporary knowledge of our pillarized security concepts is challenged in cyberspace. An operational distinction between the internal and external dimensions is necessary to gain insights into the possible governance of cyberspace. To date, a thorough distinction between cybercrime and cyberwarfare remains elusive and hence, hinders effective governance strategies. Therefore, this chapter will develop an analytical framework to distinguish cybercrime from cyberwarfare through an extensive literature review and validating expert interviews. As such, it provides the fundaments for further research on the cybercrime-cyberwarfare nexus, in particular to help explain activities committed by cyber mercenaries, and the realm of the governance applicable.