Magical Thinking: Why So Many Cybercriminals Seem To Believe They Will Never Be Identified or Arrested

Written by Tim Pappa, Senior Behavioral Consultant

Introduction

The past few months have featured a handful of cybercriminals and dark web market administrators who were arrested or identified publicly.

All these cybercriminals have believed they would not be caught or identified, in fact, some have claimed publicly they could not be identified or offered a reward daring someone to find them. 

There is a common narrative about cybercriminals that they are narcissistic in terms of some personality disorder to believe they would never be caught or identified. 

When I was a profiler with the FBI’s Behavioral Analysis Unit (BAU), I would not and could not diagnose anyone with a disorder because I was not a licensed psychologist or psychiatrist, and because I lacked complete medical and personality records for the target.  I also usually did not have the opportunity to conduct any kind of assisted battery of psychological tests. 

However, I did recognize that there are life events and trauma and stress that shape people and that there are likely other mental health issues and relationships and environments that influence someone’s sensemaking and their decision making.

For example, there are other behavioral frameworks that might explain even in the absence of information about someone’s life why they believe something like ‘I will never be caught’.

This article introduces Magical Thinking as a plausible explanation for why many cybercriminals believe they can stay hidden online and never be arrested, despite a lifestyle and environment online full of risk and threat from competitors and law enforcement.

“They thought they were far too clever to be caught…”

In May, a Taiwanese information technology specialist for a Taiwanese embassy in the Caribbean identified as the founder and operator of dark web site Incognito Market was arrested.  This administrator not only later began extorting his own market users, but he provided training to law enforcement in a Caribbean country on cyber crime and cryptocurrency and promoted that training he provided on his true name LinkedIn account.

This administrator was traveling freely in the United States when he was arrested, despite criminal investigations into his market and dark web researchers tracking his pseudo, Pharoah.

Two administrators who ran the dark web market AlphaBay were arrested this past year, but recently were charged again while in custody for also running the dark web market Empire Market for several years during the same period.  Both have pled not guilty.

These dark web markets sold more than $430 million worth of drugs, stolen credit card information, counterfeit currency, and malware.  The recent charges were related to conspiracy related to drug trafficking, computer fraud, and money laundering.

Another former administrator of AlphaBay back in 2021 gave an interview to Wired in which he detailed some of his operational security measures described as “extreme” to make sure there would not be any incriminating data on any of the devices he used.  He claimed that even if his operational hardware was seized, he couldn’t be implicated with the data on that hardware.

Perhaps the most recognizable example of a cybercriminal claiming no one could identify him is LockBitSupp, the recently identified founder of the LockBit ransomware enterprise.  He once offered a reward of millions of dollars to anyone who could identify him.

LockBitSupp was identified recently in a law enforcement operation.

Going back over a decade, so-called British hacktivists tied to Anonymous who attacked PayPal and Mastercard claimed they believed they would never be identified or caught. 

The British judge sentencing them stated at the time, “The defendants were actually rather arrogant…They thought they were far too clever to be caught and used various methods to try to cloak and preserve their anonymity”.

Giving the illusion of control and meaning in life

Magical Thinking is an established phrase in research as common as the phrase seems to be.  Magical thinking can give someone the illusion of control and meaning in their life.

Handelman et al. noted that magical thinking was a cognitive distortion, where people irrationally invoke mystical almost supernatural forces to cope with stressful situations. 

But they recognized that people see the world as interconnected or interrelated, and that magical thinking is sometimes participatory and shaped by culture and close relationships with others, such as what they believe or do or what they think about what you do.

There is research on piracy behaviors that explores how relationships with others in a group can influence the belief of (the lack of) consequence for doing something illegal and the belief that something criminal may not hurt anyone, but magical thinking is much more individual.Israeli naval psychologist Giora Keinan found that magical thinking is often found in the thinking and narratives of people who are facing considerable stress and ambiguity in their lives and who have limited control of the personal events that seem to create that stress and ambiguity. 

He sampled Israelis with questionnaires who had experienced the threat of or attack of Iraqi missiles during the Gulf War in the early 1990s and found that people who have a lower tolerance for ambiguity and stress appeared to be more prone to magical thinking.  He explained that magical thinking is a coping mechanism.

Keinan referred to Zusne and Jones in his research who defined magical thinking as a belief that there is some “transfer of energy or information” between people or something physical that happened only because of some unexplained similarity or connection in time and space, or that something that someone thinks or says or does creates or results in some outcome “in a manner not governed by the principles of ordinary transmission of energy or information”.

Keinan explained magical thinking much more simply as a way someone can understand their environment better because whatever they think of it provides some explanations for the phenomena that they believe they are experiencing or have experienced.

For others who express more superstitious beliefs or magical rituals, they may believe they can increase their control over the sources of threat they might be facing.

Examples could include everything from ‘there is something about my ability to resist temptation that is keeping me from eating these donuts’ to ‘there is something special or divine about me that keeps me safe from missiles hitting my home’ or in the context of this article, magical thinking might be ‘there is something special about me that keeps anyone from identifying me’.

Motivated by more than just money

This article suggests that not just cybercriminals, but everyone may engage in magical thinking.

Beyond even some of the generally claimed motivations of making money, there are also behavioral frameworks that may explain in greater detail the sensemaking of cybercriminals in the context of motivations.

People have preferred conclusions and preferred strategies for reaching their conclusions.  Molden and Higgins described two general classes of motivational influences they called directional outcomes and nondirectional outcomes.

Self-evaluations are a good example of directional outcomes, where someone engages in strategies of searching and evaluation and explaining information and how they organize knowledge about themselves and others.  That sensemaking is motivated by some outcome.

Nondirectional outcomes in comparison also influence how people think and process information, but namely how much time they spend thinking and evaluating that information.  That experience is motivated by some outcome as well that they likely want.

Many people even reconstruct recent or longer-term memories based on these evaluations.  Conway and Ross found in a study of students recalling scores of their peers on exams that the peers they liked seemed to have scored higher than a previous score on their exams while the peers they did not like seemed to have scored lower than a previous score on their exams.  These recollections were not necessarily accurate, in fact how much they liked or disliked someone seemed to influence how well they seemed to recall if that student did better or worse on an exam, suggesting that someone who scored lower on the exam was a poorer student.

People have also been found to engage in counterfactual thinking, imagining “if only” scenarios despite information that indicates something would not be possible.

There is a body of research on mitigating factors in all these motivation scenarios, such as how people weigh loss or how they evaluate actual risk or what they anticipate feeling in some outcome. 

Magical Thinking provides a framework for starting to understand the phenomena of cybercriminals continuing to believe they will not be identified or arrested at some point.  Without knowing everything possible in their lives, we can look for public and private expressions or demonstrations of magical thinking that may suggest they are more vulnerable than others to believing in these unseen forces that protect them or single them out as special because they may struggle to manage or process ambiguity and stress in their lives.