Feb 26, 2019 · 36m · a16z
a16z Podcast | The Business of Cybercrime
0:00 / 0:00
▶ Watch on YouTube →
gold bands on the timeline = statements, start to end. Hover to read, click to jump. CC turns on captions
In this episode of the a16z Podcast, industry experts Jonathan Lusthaus and Joel De La Garza analyze how global cybercrime has evolved from lone hackers into a highly organized, corporate-style tech industry driven by market economics, geographic talent pools, and complex operational dynamics.
How this conversation actually went
Every chapter scored 0–10 on four independent dynamics. Hover any point for the reasoning behind the score. How this is scored →
The host as informed peer 2.3 Guest teaching 5.5 Guest disagreement 0.1 The host pushing back 0.0
speaking balance: gold is the host, purple is the guest (3 minute bins)
Sharpest disagreement ▶ 31:26 Clarifying traditional mafia misconceptions
The guest directly pushes back against common public commentary claiming the Russian Mafia is taking over cybercrime, noting that traditional mafia groups lack the necessary technical skill set.
Hardest push from the host ▶ 26:28 Challenging the paradox of brand managementThe host directly identifies and presses on the core contradiction of cybercrime business: needing brand consistency to run a business while avoiding the legal liability of a long-term pseudonym.
Biggest teaching moment ▶ 35:12 Reframing cybercrime as secrets managementThe co-host fundamentally reframes the core nature of cybercrime from a law enforcement issue to an economic secrets management problem caused by credential theft.
The host holds their own ▶ 9:30 Referencing specific book evidenceThe host demonstrates deep preparation by citing a specific table from the guest's book regarding geographical specialization by country.
the scores for every segment, with the reasoning behind each
| Chapter | Topic | The host as informed peer | Guest teaching | Guest disagreement | The host pushing back | Why |
|---|---|---|---|---|---|---|
| Evolution from Lone Hackers to Organized Crime | 2 | 5 | 0 | 0 | The host provides a broad introductory question about the shift from lone hackers to organized crime. The guest and co-host provide foundational history on early cybercrime commercialization. | |
| Application of Traditional Business Principles and Regulatory Arbitrage | 2 | 6 | 0 | 0 | The host asks open-ended questions about business concepts imported into cybercrime. The guest and co-host explain firm-like operational structures and regulatory arbitrage. | |
| Operational Group Limits and Offline Scaling | 2 | 6 | 0 | 0 | The host listens and offers brief supportive reflections while the guest details structural limitations on online group sizes and parallels to traditional mafia protection. | |
| Recruiting, Specialization, and Geographical Talent Distribution | 4 | 5 | 0 | 0 | The host shows direct knowledge of the guest's book by explicitly bringing up a country breakdown table. The guest elaborates on geographical specialization in technical vs cash-out operations. | |
| Money Mules and Unwitting Technical Talent | 3 | 5 | 0 | 0 | The host adds relatable analogies to physical work-at-home flyers and asks how to redirect technical talent. The speakers explain money mules and unwitting developer recruitment. | |
| State Integration, Political Protection, and Targeted Ransomware | 1 | 6 | 0 | 0 | The segment is largely an informative breakdown by the co-host on state integration in Eastern Europe and Chinese ransomware evolution. The host only makes brief interjections. | |
| Case Study of Roman Seleznev and Cybercriminal Demographic Profiles | 3 | 5 | 0 | 0 | The host opens by citing the book's opening case study of Roman Seleznev and asks for demographic breakdowns. The guest explains that cybercriminals range from LA street gangs to elite coders. | |
| Local Roots of Cybercrime and Physical-Digital Crossovers | 2 | 5 | 0 | 0 | The host prompts discussion on how cybercrime connects back to the physical world. The guest and co-host illustrate local trust networks in Romania/Nigeria and armed physical heists for crypto keys. | |
| Managing Anonymity and Pseudonyms as Brands | 3 | 6 | 0 | 0 | The host succinctly articulates the paradox of pseudonyms as necessary business brands vs investigation liabilities. The guest details how vendors eat risk for high-level coders. | |
| Brand Continuity, Communication Platforms, and Code Tracking | 2 | 5 | 0 | 0 | The host prompts on brand signals across platforms. The co-host details tracking code metadata, IP addresses, and digital artifacts for security attribution. | |
| Tech-Native Cybercrime vs. Traditional Mafia and Field Research | 2 | 6 | 1 | 0 | The host asks if cybercrime is fundamentally distinct from traditional organized crime. The guest clarifies that traditional mafia groups are not taking over cybercrime because hacking is outside their core skill set. | |
| Persistent Human Behaviors and Cybercrime as Secrets Management | 2 | 6 | 0 | 0 | The host asks how organizational structures evolve over time. The guest and co-host explain that human behavior remains stable, framing cybercrime fundamentally as a secrets management problem. |
Statements from this episode (26)
De La Garza: Cybercrime rapidly commercialized around 1999 to 2000
“Right around 19 99, 2000, there was just a rapid, rapid commercialization of cybercrime. You could go on to online chat rooms and just see people's personal information scale by, tens of thousands of credit card numbers scaling by, And starting to see kind of …”
Lusthaus: Carder Planet was the first major online cybercrime marketplace
“Carter Planet was the first marketplace where things really started to take off, and if we're looking for that kind of shift, at least in a symbolic way, that's probably the case where it happened, because you started to see for the first time this sort of lar…”
Lusthaus: Cybercriminals maximize profits by structuring themselves like traditional business firms
“And in some cases, these groups look a lot like firms, whether it's a venture capitalist firm, whether it's people selling various products. For criminals, actually, and for cyber criminals, they're also employing a similar structure, which is to have a team o…”
De La Garza: Cybercrime syndicates scaled by exploiting geographic regulatory arbitrage
“The way that we were looking at it back then was that this was essentially a regulatory arbitrage, right? It was, there are these disciplines and practices that you could apply in places where these activities weren't necessarily illegal, and so you saw the pr…”
Lusthaus: Online malware development groups cap out at 8 to 10 members
“Malware groups that generally the, you know, eight to 10 is probably going to be the largest size involved in, you know, kind of malware operation of writing the code and dealing with the code because it becomes quite difficult to actually sustain the group st…”
Lusthaus: Cybercrime entities operate out of physical office spaces like tech firms
“And in some cases we see people operating out of physical office space, and they really begin to look like technology companies, and actually they are technology companies, they're just criminal ones.”
De La Garza: Zeus was the first major banking credential malware
“So the first big malware that kind of got deployed to steal banking credentials was Zeus, and then you started to see people spin out of the Zeus program, and you had this kind of fracturing of that market, right?”
Lusthaus: Former Soviet states dominate underground malware coding and development
“So, basically, if we think about sort of former Soviet Union states, they're very well known for the more technical aspects of cybercrime. So, these are primarily the cybercriminals from here are the ones who are responsible for actually coding the malware, fo…”
Lusthaus: Western cybercriminals specialize in cash-out operations
“I think what the West is known for is cash out experts. So these are people who are primarily responsible for converting these sort of virtual gains into monetary or physical ones.”
De La Garza: Arrested malware authors often work for antivirus companies
“There has been more than one malware author that was arrested and actually it turned out that they were working for an antivirus or anti-malware company. It's really common to find people kind of on both sides of that fence.”
Lusthaus: Eastern European tech graduates enter cybercrime due to capital shortages
“What we're seeing is a massive pool of very, very talented people who are highly educated, actually, have an excellent university system. These are people with, you know, degrees in math, science, technology, Engineering. And what's happening is they're coming…”
De La Garza: Chinese state hackers pivoted to ransomware after Obama's pressure
“Right around the time that President Obama got after the Chinese for their cyber activities against the United States on the intelligence side, a lot of those cyber actors kind of stood down and actually pivoted into cyber crime, right? So you started to see r…”
De La Garza: Cryptocurrency solved money laundering for ransomware syndicates
“Because you've solved, with a bearer asset like a cryptocurrency, you've kind of solved the laundering problem. You don't need money mules. You get the cash.”
De La Garza: A Chinese cybercrime group specifically targets hospitals with ransomware
“There's a Chinese group right now that's focused on ransomware for hospitals, because hospitals pay up, right?”
Lusthaus: Roman Seleznev's cybercrime group made tens of millions in fraud
“He and his group had made tens of millions of dollars out of credit card fraud.”
Lusthaus: Multiple Eastern European cybercriminals have politically connected parents
“I found actually more than a handful of people who were involved in cybercrime in parts of Eastern Europe actually had parents who are very influential people, whether they were law enforcement agents, whether they were political figures.”
Lusthaus: LA Street Gangs Converted Prostitution Networks into Credit Card Fraud Schemes
“One of the most interesting ones I think I encountered was examples of street gangs in LA who basically were traditionally running prostitution operations, but what they would do was from time to time convert these operations into a cashing out scheme. So they…”
De La Garza: US gangs use Uber and Lyft to launder stolen credit cards
“You see several gangs in the United States that are doing similar schemes where they take stolen credit cards and then sign up as Uber drivers and run credit cards through Uber or through Lyft or through various other sort of sharing economy type services.”
Lusthaus: Cybercriminal maintained single online handle over a decade
“So I've encountered one case actually that I talk about in the book of a particular former cyber criminal who's never changed his nickname online. He's basically held the same name, the same nickname, over the course of his entire cyber criminal career. And he…”
Lusthaus: Cybercrime vendors absorb risk by keeping fixed online brands
“But on the other extreme, you get certain cyber criminals who will change their names very regularly. So you might see this particularly around very high level Russian speaking malware coders. So people who are really the top layer of the industry Obviously, I…”
De La Garza: Enterprise buyer inertia applies to cybercrime marketplaces
“Nobody ever gets fired for buying IBM, right? That same kind of inertia applies to the e-crime world.”
De La Garza: Cybercrime attribution is the hardest part of cybersecurity
“Attribution is the hardest part of the whole security ecosystem, like putting fingers on keyboards, that's what governments do.”
De La Garza: Malware code is more immutable than online identities
“It's very easy to shift identities online, but code is something that's relatively immutable.”
Lusthaus: Traditional organized crime is not taking over cybercrime
“So I think, you know, there's a lot of talk about traditional organized crime groups taking over cyber crime. The search I've done, I don't think that's the case. I think they're involved in certain ways, particularly on the money side of things. That's a part…”
De La Garza: Cybercrime represents a greenfield market subject to innovator's dilemma
“Sort of the innovator's dilemma applied to crime, right? They got their incumbency in the rackets that they're running, and they're not really looking to expand. Cybercrime is very much a greenfield opportunity. The same way that technology is, and you do see …”