The effect of online ad campaigns on DDoS‐attacks: A cross‐national difference‐in‐differences quasi‐experiment

• Published date: 01 November 2023
• Author: Asier Moneva,Rutger Leukfeldt
• Date: 01 November 2023
• DOI: http://doi.org/10.1111/1745-9133.12649

DOI: ./- .

SPECIAL ISSUE ARTICLE

CYBERCRIME AND CYBERSECURITY

The effect of online ad campaigns on

DDoS-attacks: A cross-national

difference-in-differences quasi-experiment

Asier Moneva1,2Rutger Leukfeldt1,2

Netherlands Institute for the Study of

Crime and Law Enforcement (NSCR),

Amsterdam, Netherlands

Center of Expertise Cyber Security, The

Hague University of Applied Sciences,

The Hague, Netherlands

Correspondence

Asier Moneva, Netherlands Institute for

the Study of Crime and Law Enforcement

(NSCR), De Boelelaan ,  HV

Amsterdam, Netherlands.

Email: amoneva@nscr.nl

Abstract

Research Summary: European law enforcement agen-

cies have begun to use targeted online ad campaigns to

raise cybercrime awareness among at-risk populations.

Despite their rapid proliferation,there is little research to

support their efficacy and effectiveness. This study uses

a quasi-experimental difference-in-differences design to

evaluate the effect of seven campaigns deployed in 

and  on the volume of (distributed) denial-of-service

or (D)DoS-attacks recorded in six European countries:

Denmark, Finland, the Netherlands, Norway, Sweden,

and Portugal. The results show mixed effects, suggesting

that the campaigns are not clearly effective in reducing

DDoS-attacks in the short term.

Policy Implications: Law enforcement has partly jus-

tified the use of targeted online ad campaigns on the

premise that they reduce DDoS-attacks. However, this

study shows that the evidence in this regard is incon-

clusive. If public support for the use of such campaigns

is to be secured in the long term, law enforcement will

likely need to rely on stronger arguments. The effect of

this type of campaigns needs to be further investigated.

KEYWORDS

Cybercrime, DDoS-attacks, difference-in-differences, online ad

campaigns, quasi-experiment

Criminology & Public Policy. ;:–.©  American Society of Criminology.869wileyonlinelibrary.com/journal/capp

870 MONEVA LEUKFELDT

1 INTRODUCTION

Faced with the growing threat of cybercrime, law enforcement agencies around the world are

stepping up their prevention efforts (e.g., Europol & Dutch National Police, ; Interpol, ;

National Crime Agency, ). However, due to the scarcity of rigorous evaluations, it is unclear

whether currently used cybercrime prevention strategies actually work toreduce cybercrime (e.g.,

Brewer et al., ). The lack of knowledge about the effect that these strategies may have on the

target population is dangerous because it can lead to the oversight of possible negative conse-

quences, such as criminogenic effects, and the wastage of resources. On the contrary,knowledge

about the effects of the strategies contributes to generating an evidence base to determine what

works to reduce cybercrime and make moreeff icient use of resources.Some police strategies have

focused on reducing specific forms of cybercrime, like online ad awareness campaigns against

(distributed) denial-of-service or DDoS-attacks.

DDoS-attacks are a type of cyber attack that uses multiple compromised computer systems

to flood a targeted server or network with Internet traffic, making it unavailable to legitimate

users. Law enforcement agencies specifically focus on this type of cybercrime because it is con-

sidered to be entry level (National Assessments Centre, ; National Cyber Crime Unit, );

in other words, a low-level illicit online activity—often perpetrated by individuals with limited

technical expertise and resources—that may constitute a pathway to a serious criminal career.

In their paper on the effects of police interventions on DoS-attack markets, Collier et al. ()

reported that the online ad campaigns designed by the UK National Crime Agency (NCA) to

raise awareness against cybercrime and deter potential cybercriminals “led to a clear and last-

ing reduction in the number of attacks” (p. ). Building on the work of Collier et al. (), this

paper uses a cross-national quasi-experimental design to evaluate the effect of seven online ad

awareness campaigns, coordinated by the Netherlands Policeand implemented nationwide in six

European countries, which aimed to divert and deter potential cybercriminals from committing

DDoS-attacks and other cybercrimes.

Cybercrime prevention strategies are partofthe national security agenda of an increasing num-

ber of countries around the world. Many of them are aimed at enhancing the cyber resilience of

organizations and individuals, so that they are able to withstand, recover from, and adapt to cyber

attacks (for a definition of cyber resilience, see Dupont, ). For example, at the international

level, Interpol has launched several awareness campaigns (most recently “#YouMayBeNext”) to

encourage online self-protection of users and organizations against cyber extortion threats (Inter-

pol, ). Europol,the Netherlands Police, Kaspersky, and McAfee havecreated the public private

“No More Ransom” initiative to provide ransomware victims with free tools to decrypt their files

(Europol & Dutch National Police, ; see also Filiz et al., ). In the United Kingdom, the

National Cyber Security Centre has developed the “Cyber Essentials” scheme, a toolkit to cer-

tify organizations that adopt basic cyber security measures (BritainThinks, ; see also Kemp,

). These campaigns emphasize the self-protection role that targets of cyber attacks can play,

although this is not the only way of prevention.

Another type of strategy, inspired by focused deterrence(Kennedy, ), focuses on changing

the behavior of individual cyber offenders. Behavioral change would be achieved by combin-

ing an appropriate threat of sanction with the provision of viable prosocial alternatives. In this

vein, the Federal Bureau of Investigation (FBI) of the United States published their “CyberStrat-

egy,” as a statement of intent to deter cybercriminals by increasing both the perceived risk of

their actions and the punishment inflicted on them (Federal Bureau of Investigation, ). In

Europe, together with the Dutch Ministry of Justice, the Netherlands Police implemented the