Is There a Relationship Between Cyber-Dependent Crime, Autistic-Like Traits and Autism?

Is There a Relationship Between Cyber-Dependent Crime, Autistic-Like Traits and Autism? Katy-Louise Payne et al. Journal of Autism and Developmental Disorders, October 2019, Volume 49, Issue 10, pp 4159–4169. https://link.springer.com/article/10.1007/s10803-019-04119-5

Abstract; International law enforcement agencies have reported an apparent preponderance of autistic individuals amongst perpetrators of cyber-dependent crimes, such as hacking or spreading malware (Ledingham and Mills in Adv Autism 1:1–10, 2015). However, no empirical evidence exists to support such a relationship. This is the first study to empirically explore potential relationships between cyber-dependent crime and autism, autistic-like traits, explicit social cognition and perceived interpersonal support. Participants were 290 internet users, 23 of whom self-reported being autistic, who completed an anonymous online survey. Increased risk of committing cyber-dependent crime was associated with higher autistic-like traits. A diagnosis of autism was associated with a decreased risk of committing cyber-dependent crime. Around 40% of the association between autistic-like traits and cyber-dependent crime was mediated by advanced digital skills.

Keywords: Cyber-dependent crime Digital skills Autism Autistic-like traits Explicit social cognition Interpersonal support

Ledingham and Mills (2015) define cybercrime as “The illegal use of computers and the internet, or crime committed by means of computers and the internet.” Within the legal context (e.g. in the USA, UK, Australia, New Zealand, Germany, the Netherlands and Denmark; Ledingham and Mills 2015), there are two distinct types of cybercrime: (1) cyber-dependent crime, which can only be committed using computers, computer networks or other forms of information communication technology (ICT). These include the creation and spread of malware for financial gain, hacking to steal important personal or industry data and distributed denial of service (DDoS) attacks to cause reputational damage; and (2) cyber-enabled crime such as fraud, which can be conducted online or offline, but online may take place at unprecedented scale and speed (McGuire and Dowling 2013; The National Crime Agency: NCA 2016). In England and Wales, all forms of cybercrime were included in the Office for National Statistics crime estimates for the first time in 2016, which resulted in a near doubling of the crime rate. Cyber-dependent crime specifically represented 20% of UK crime (Office for National Statistics 2017) and in England and Wales in 2018, 976,000 cyber-dependent computer misuse incidents were reported (computer viruses and unauthorised access, including hacking: Office for National Statistics 2019). Furnell et al. (2015) propose that it is more important to understand the factors leading to cyber-dependent incidents and how to prevent them, than to focus on metrics such as specific costs to the global economy. Having interviewed cyber-dependent criminals, the NCA’s intelligence assessment (2017) identified that perpetrators are likely to be teenage males who are unlikely to be involved in traditional crime and also that autism spectrum disorder (ASD, hereafter autism) appears to be more prevalent amongst cyber-dependent criminals than the general populace—though this remains unproven. No socio-demographic bias has yet been identified amongst cyber-dependent offenders or those on the periphery of criminality.

This apparent relationship between cyber-dependent crime and autism is echoed in a survey of six international law enforcement agencies’ (UK; USA; Australia; New Zealand; Germany; the Netherlands; Denmark) experiences and contact with autistic1 cybercriminals (Ledingham and Mills 2015), which indicated that some autistic individuals commit cyber-dependent offences. Offences committed included: hacking; creating coding to enable a crime to be committed; creating, deploying or managing a bot or bot-net; and malware (Ledingham and Mills 2015). This was a small-scale study, limiting the generalisability of findings, but it does indicate a presence of autistic offenders within cyber-dependent crime populations, although the link between autism and cyber-dependent crime remains largely speculative as cyber-dependent criminality may be evidenced within a wide range of populations. Further clarification of any relationship between autism and cyber-dependent crime is required before any conclusions can be inferred.

Studies in Asia, Europe, and North America have identified an average prevalence of autism of between 1% and 2% (CDC 2018). Autism is a long-term condition predominately diagnosed in males, characterised by persistent deficits in social communication and interaction coupled with restricted and repetitive patterns of behaviour, interests or activities (American Psychiatric Association 2013; CDC 2018). One possibility is that the anecdotal evidence of apparent autism-like behaviour in cyber-dependent criminals may actually be reflecting people with high levels of autistic-like traits who do not have a diagnosis of autism (Brosnan in press). Autistic-like traits refer to behavioural traits such as social imperviousness, directness in conversation, lack of imagination, affinity for solitude, and difficulty displaying emotions (Gernsbacher et al. 2017). Autistic-like traits are argued to vary continuously across the general population, with studies reporting that autistic groups typically have higher levels of autistic-like traits than non-autistic comparison groups (Baron-Cohen et al. 2001, 2006; Constantino and Todd 2003; Kanne et al. 2012; Plomin et al. 2009; Posserud et al. 2006; Skuse et al. 2009; see also Bölte et al. 2011; Gernsbacher et al. 2017; Ronald and Hoekstra 2011; Ruzich et al. 2015a for meta-analysis). Autistic-like traits are typically assessed through self-report measures such as the 50-item Autism Spectrum Quotient (AQ: Baron-Cohen et al. 2001; see also Baghdadli et al. 2017). Ruzich et al.’s (2015a) meta-analysis of responses to the AQ from almost 7000 non-autistic and 2000 autistic respondents identified that non-autistic males had significantly higher levels of autistic-like traits than non-autistic females, and that autistic people had significantly higher levels of autistic-like traits compared to the non-autistic males (with no sex difference within the autistic sample). A clinical cut-off of a score of 26 on the AQ has been proposed to be suggestive of autism (Woodbury-Smith et al. 2005b), and whilst there are similarities between those with and without a diagnosis of autism who score above the cut-off the AQ, the AQ is not diagnostic. Importantly, there are also differences between those with and without a diagnosis of autism who scored above the cut-off (Ashwood et al. 2016; Bralton et al. 2018; Focquaert and Vanneste 2015; Lundqvist and Lindner 2017; see also Frith 2014).

With respect to cyber-dependent crime, some members of both autistic and high autistic-like trait groups will have developed advanced digital skills that are likely to be required to commit cyber-dependent crime. Indeed a specific relationship between ‘autism and the technical mind’ has been previously speculated by Baron-Cohen (2012; see also Wei et al. 2013). Moreover, computer science students and those employed in technology are two of the groups who typically possess higher levels of autistic-like traits (Baron-Cohen et al. 2001; Billington et al. 2007; Ruzich et al. 2015b). These relationships are potentially significant, as cyber-dependent criminal activity requires an advanced level of cyber-related skills (such as proficiency in programming in Java, C/C++, disassemblers, and assembly language and programming knowledge of scripting languages [PHP, Python, Perl, or Shell]; Insights 2018). Thus, there may be an association between autistic-like traits and the potential to develop the advanced digital skills required for cyber-dependent crime.

Assessing the relationship between autistic-like traits and cyber deviancy in a sample of college students, Seigfried-Spellar et al. (2015) found that of 296 university students, 179 (60%) engaged in some form of cyber-deviant behaviour (such as hacking, cyberbullying, identity theft, and virus writing) and the AQ distinguished between those who did and those who did not self-report cyber-deviant behaviour, with higher AQ scores among those reporting cyber-deviant behaviours. The authors also reported that if they used a cut-off score on the AQ of 26 to indicate high levels of autistic-like traits associated with autism, then 7% of the computer non-deviants and 6% of the computer deviants scored in this range. The authors concluded that ‘based on these findings alone, there is no evidence of a significant link between clinical levels of [autism] and computer deviance in the current sample. Nevertheless, the current study did find evidence for computer deviants reporting more autistic-like traits, according to the AQ, compared to computer non-deviants’. However, ‘cyber-deviant’ behaviour in Seigfried-Spellar et al.’s study included both cyber-enabled crimes such as cyberbullying and identity theft, as well as cyber-dependent crimes such as hacking and virus writing. This requires a more nuanced examination as there may be important differences in the relationship between autistic-like traits and cyber-dependent crime compared with cyber-enabled crime.

Cyber-enabled crime is an online variant of traditional crimes (such as fraud) and shares common motivations such as financial gain, whereas the motivations for cyber-dependent crime can be based around a sense of challenge in hacking into a system or enhanced reputation and credibility within hacker communities (NCA 2017). This may be pertinent for the relationship between cyber-dependent crime specifically and autism or autistic-like traits, since cyber-dependent criminals typically have not engaged in traditional crime (NCA 2017) and autism has been associated with generally being law abiding and low rates of criminality (Blackmore et al. 2017; Ghaziuddin et al. 1991; Heeramun et al. 2017; Howlin 2007; Murrie et al. 2002; Wing 1981; Woodbury-Smith et al. 2005a, 2006). In addition, several studies have suggested that autistic internet-users can demonstrate a preference for mediating social processes online, such as preferring to use social media over face-to-face interaction to share interests (Brosnan and Gavin 2015; Gillespie-Lynch et al. 2014; van der Aa et al. 2016). This may be significant, as it has been suggested that social relationships developed online are key to progressing into cyber-dependent crime, with forum interaction and reputation development being key drivers of cyber-dependent criminality (NCA 2017).

Finally, failing to appreciate the impact of crime upon others may be a relevant factor, as autism has been argued to reflect a diminished social cognition (e.g., theory of mind, Baron-Cohen et al. 1985). It has been suggested that there are two levels of social cognition; namely, a quicker and less conscious implicit social cognition, and a more conscious, slower and controlled explicit social cognition (Frith and Frith 2008; see also Heyes 2014). Autistic individuals are often not impaired in explicit social cognition, but are reportedly impaired on implicit social cognition (Callenmark et al. 2014; see also Dewey 1991; Frith and Happé 1999). This profile is also reflected in non-social cognition such as reasoning (Brosnan et al. 2016, 2017; Lewton et al. 2018) which may be better characterised as impaired processing of automatic, cognitively efficient heuristics (Brosnan and Ashwin 2018; Happé et al. 2017). Explicit social cognition is therefore a more pertinent measure of the potential to consider the impact of crime upon others.

The aim of the present study was to explore the apparent relationship identified by international law enforcement agencies between autistic-like traits and cyber-dependent crime. To do this, we conducted an online survey exploring autistic-like traits, cyber-related activities (legal and illegal) as well as perceived interpersonal support and explicit theory of mind. Our research question addressed whether higher autistic-like traits, lower explicit theory of mind and lower perceived interpersonal support would increase the risk of committing cyber-dependent crime. We also addressed whether autistic-like traits would be associated with cyber-dependent crime and whether this relationship would be mediated by advanced digital skills. Given the findings associating higher levels of law-abiding behaviour with autism, we also speculated that autism may represent a group of individuals with higher levels of autistic-like traits, but without a higher risk of committing cyber-dependent crime.


---

Discussion

International law enforcement agencies report an apparent relationship between autism and cyber-dependent crime, although any such link remains unproven (Ledingham and Mills 2015; NCA 2017). This was the first study to empirically explore whether autism, autistic-like traits, explicit social cognition, interpersonal support and digital skills were predictors of cyber-dependent criminality. Whilst higher levels of autistic-like traits were associated with a greater risk of committing cyber-dependent crime, a self-reported diagnosis of autism was associated with a decreased risk of committing cyber-dependent crime. Around 40% of the association between autistic-like traits and cyber-dependent crime was attributable to greater levels of advanced digital skills. Basic digital skills were also found to be a mediator between autistic-like traits and cyber-dependent crime, although they accounted for a smaller proportion of the association than advanced digital skills.

These findings are consistent with the proposal that the apparent association between autism and cyber-dependent crime identified by law enforcement agencies may be reflecting higher levels of autistic-like traits amongst cybercriminals but that this does not necessarily equate to autism being a risk factor for cybercrime. This confusion may well arise because typically, autistic people do report higher levels of autistic-like traits than the general population (Ruzich et al. 2015a). Cyber-dependent crime may therefore represent an area that distinguishes high autistic-trait non-autistic groups from autistic groups, consistent with proposal that people with autism differ qualitatively from non-autistic people who are nevertheless high in autistic-like traits (see Ashwood et al. 2016; Frith 2014). The finding that autistic respondents were less likely to commit cyber-dependent crime is also consistent with literature suggesting that autistic people are generally as law abiding, if not more so, than the general population. Lower levels of criminality are shown, at least for certain types of crime (Blackmore et al. 2017; Cheely et al. 2012; Ghaziuddin et al. 1991; Heeramun et al. 2017; Howlin 2007; King and Murphy 2013; Murrie et al. 2002; Wing 1981; Woodbury-Smith et al. 2005a, 2006; but see, Rava et al. 2017; Tint et al. 2017).

Thus, there is evidence that higher AQ scores are associated with higher levels of cyber-dependent crime regardless of an autism diagnosis. As this association was independent from the autism diagnosis, there may be something about autistic-like traits beyond the diagnostic criteria for autism that relates to cyber-dependent criminal activity. The mediation analysis suggests that an association between autistic-like traits and advanced digital skills may represent a key factor. We cautiously state above that those reporting an autism diagnosis were less likely to report cyber-dependent crime. Cautiously, as this could be for various reasons beyond high AQ and autism being different things, including a diagnosis of autism leading to some protection (e.g., more support leading to less potential criminal behaviour; see Heeramun et al. 2017). Importantly, however, there are potential selection issues in relation to individuals who respond to an invitation to complete an online survey on this topic, thus the possibility of selection bias cannot be ruled out. We do not know how many did not respond to the invitations (and therefore could not identify a response rate, for example) and the apparent protective effect could be a chance finding due to small numbers. Future research using larger samples can address such concerns and until that time the suggestion that autism may be protective should be considered speculative, especially as the data is self-reported and diagnostic status could not be independently verified in the present study.

Previous research has identified higher levels of autistic-like traits being present within scientific disciplines in which computer science students and employees are included (Baron-Cohen et al. 2001; Billington et al. 2007; Ruzich et al. 2015b). This study is the first to specify a direct relationship between higher levels of autistic-like traits and advanced digital skills. In addition to being a pre-requisite for committing cyber-dependent crimes, these skills are essential for the cyber security industry which will have an estimated 3.5 million unfulfilled jobs by 2021 (Morgan 2018). This study suggests that targeting groups high in autistic-like traits would be a beneficial strategy to meet this employment need. Given the employment difficulties that can be faced by members of the autistic community (Buescher et al. 2014; Knapp et al. 2009; see also Gotham et al. 2015; Hendricks 2010; Howlin 2013; Levy and Perry 2011; National Autistic Society 2016; Taylor et al. 2015; Shattuck et al. 2012) and that around 46% of autistic adults who are employed are either over-educated or exceed the skill level needed for the roles they are in Baldwin et al. (2014), targeting the autistic community for cyber security employment may be particularly beneficial.

Notwithstanding the limitations described above, this may be particularly pertinent as this study found that a diagnosis of autism was associated with reduced cyber-dependent criminality. This would be consistent with perceptions of autistic strengths of honesty and loyalty (de Schipper et al. 2016)—ideal attributes within employment settings. Importantly, this is not to suggest that all autistic people are good with technology, or that all autistic people should seek employment within cyber security industries (see Milton 2018). Rather, this study highlights that in a particularly challenging employment context, some members of the autistic community may be ideally suited to such employment opportunities and emphasises the need for employers to ensure that their recruitment methods and working environments are autism-friendly and inclusive (see Hedley et al. 2017 for review).

The direct link between autistic-like traits and cyber-dependent crime is also consistent with previous research (Seigfried-Spellar et al. 2015) and may extend to a relationship with cyber-enabled crime (such as online fraud). Seigfried-Spellar et al. (2015) explored relationships between autistic-like traits and cyber-deviancy more broadly defined than cyber-dependent crime. Future research could explore whether the level of autistic-like traits, mediated by advanced digital skills, also relates to cyber-enabled crime, and whether there are any direct effects that are specific to cyber-dependent crime. Seigfried-Spellar et al. (2015) and the present study were both cross-sectional studies. The mediation of advanced digital skills between autistic-like traits and cyber-dependent crime has been assumed in the present study, but this could be best established in longitudinal research. Exploring prison populations to identify if ‘traditional’ crime was related to autistic-like traits found no differences between prisoners and the general population (Underwood et al. 2016), which may suggest that autistic-like traits are associated with cybercrime specifically (that is, cyber-dependent crime and potentially cyber-enabled crime).

Sex, age, non-verbal IQ, explicit social cognition and perceived interpersonal support did not significantly relate to cyber-dependent criminal activity, which serves to highlight the salience of autistic-like traits. A potential limitation is that explicit social cognition was assessed, but not implicit social cognition. Based on the autism literature (Callenmark et al. 2014; Dewey 1991; Frith and Happé 1999), we would not necessarily expect difficulties with explicit social cognition in groups with high autistic-like traits. Implicit social cognition was also assessed by Callenmark et al. using interviews after the IToSK. Such interviews, however, do not readily extend to the online context and future research could explore any role of implicit social cognition in cyber-dependent crime. However, recent accounts of implicit social cognition have questioned whether such a system exists and findings from such measures can better be attributed to general attentional processes (Conway et al. 2017; Heyes 2014; Santiesteban et al. 2014, 2015, 2017).

Future research should also focus on autistic communities as well as those convicted of cyber-dependent and cyber-enabled crimes to further develop our understanding of this area, an important aspect of which is the potential strengths some members of the autistic community can bring to cyber security employment.