Digital Criminology and Public Policy

Digital criminology and public policy examines how the emerging field of digital criminology — the systematic study of crime, justice, and social harm in digitally mediated societies — informs and should inform the public policy decisions that govern the prevention of cybercrime, the regulation of digital platforms, the governance of surveillance technologies, and the adaptation of criminal justice institutions to a society in which digital technology is constitutive of social life rather than merely instrumental to it. Within Cyber Criminology, the relationship between scholarship and policy is particularly consequential because the pace of technological change creates a persistent gap between the emergence of new digital threats and the institutional capacity to address them — a gap that criminological research can help close by providing the empirical evidence, theoretical frameworks, and evaluative analysis that effective policy requires. Powell, Stratton, and Cameron (2018) articulated the digital criminology project as one that treats technology not as a separate domain of crime but as a constitutive element of the social conditions within which all crime occurs, with implications for how public policy should approach the governance of digital society. This article examines the theoretical foundations of digital criminology as a policy-informing discipline, the major policy domains to which it contributes, the evidence-policy gap that constrains its influence, and the institutional mechanisms through which criminological knowledge is translated into policy action within the broader study of Criminology.

Introduction

The relationship between criminological research and public policy has been characterized by aspiration and frustration in roughly equal measure. The evidence-based practice movement in criminal justice has promoted the use of rigorous research findings to inform policy decisions about policing, sentencing, corrections, and crime prevention, producing notable successes — the adoption of focused deterrence strategies, the expansion of evidence-based correctional programming, the development of risk assessment instruments — alongside persistent failures to translate research findings into institutional change (Welsh & Farrington, 2012; Sherman, 2013). Digital criminology inherits this complex relationship while confronting additional challenges: the rapid pace of technological change, the technical complexity of digital crime and its prevention, the fragmentation of governance responsibility across criminal justice, regulatory, and technology policy domains, and the political dynamics that shape how digital crime is framed and addressed in public discourse.

The policy implications of digital criminology extend well beyond the criminal justice system’s internal operations. Digital crime policy intersects with telecommunications regulation, data privacy law, platform governance, international trade, national security, education, and economic policy in ways that demand interdisciplinary engagement and cross-institutional coordination. A complete policy response to ransomware, for example, involves criminal law enforcement (investigation and prosecution), financial regulation (cryptocurrency oversight and ransom payment policy), cybersecurity regulation (critical infrastructure protection standards), international diplomacy (cooperation frameworks and sanctions against harboring states), and insurance regulation (cyber insurance underwriting standards). Digital criminology’s contribution to this multi-institutional policy landscape lies in its capacity to provide the empirical evidence about crime patterns, victimization dynamics, and intervention effectiveness that policy across these domains requires.

Theoretical Foundations

Digital Criminology as a Policy Science

The conceptualization of digital criminology as a policy-informing discipline draws on the broader tradition of policy-oriented criminology — the application of criminological knowledge to the design, implementation, and evaluation of policies intended to reduce crime and improve justice. Tonry (2010) identified the essential elements of policy-relevant criminology as the production of reliable evidence about what works (and what doesn’t), the translation of research findings into forms accessible to policymakers, and the engagement with the political and institutional contexts in which policy decisions are made. Digital criminology adds to these elements the requirement for technical literacy — the capacity to understand the digital technologies that create criminal opportunities, the investigative tools that address them, and the governance mechanisms that constrain both — and for interdisciplinary engagement with computer science, law, economics, and engineering.

Powell, Stratton, and Cameron’s (2018) framework for digital criminology emphasizes three analytical orientations that have policy implications. First, attention to the structural features of digital society — platform architecture, algorithmic curation, data economies, digital inequality — that create the conditions within which crime occurs, suggesting that structural interventions (platform regulation, data governance, digital inclusion) may be more effective than individual-level interventions (user education, criminal deterrence) for reducing certain categories of digital crime. Second, attention to the experiences and perspectives of those most affected by digital crime — victims, marginalized communities, surveilled populations — ensuring that policy development is informed by the lived realities of those it affects rather than solely by the institutional perspectives of law enforcement and technology companies. Third, attention to the power dynamics that shape digital governance — the concentration of power in technology platforms, the asymmetry between state surveillance capability and individual privacy protection, the global inequalities that structure the distribution of both cybercrime and cybersecurity — recognizing that digital crime policy operates within and potentially reinforces existing structures of social inequality.

Situational Crime Prevention and Digital Design

The application of situational crime prevention (SCP) theory to digital environments provides one of the most directly policy-relevant frameworks in digital criminology. SCP’s focus on modifying the immediate environment of crime — increasing the effort required, increasing the risks of detection, reducing the rewards, and removing excuses — translates naturally into interventions targeting the design and governance of digital platforms, the architecture of authentication and access control systems, and the regulatory frameworks that govern data protection and cybersecurity (Clarke, 1997; Willison & Siponen, 2009).

The concept of “crime prevention through environmental design” (CPTED), which has informed urban planning and architectural design for decades, has a digital analogue in “safety by design” — the integration of crime prevention considerations into the design process for digital products and platforms (Tanczer, Lopez-Neira, & Parkin, 2021). Safety by design proposes that crime prevention is most effective and least liberty-restrictive when it is embedded in the architecture of digital systems rather than imposed after the fact through content moderation, law enforcement investigation, or user education. Platform features that limit the ability of adults to contact minors through direct messaging, authentication systems that make credential theft more difficult, payment architectures that make fraud reversible, and algorithmic designs that do not amplify harmful content all represent safety-by-design interventions that reduce criminal opportunity without restricting legitimate use.

The policy implication of the SCP framework is that digital crime prevention should focus substantially on the environmental conditions that enable crime — platform design, system architecture, data governance — rather than exclusively on the prosecution and deterrence of individual offenders. This orientation shifts responsibility from individual users (who are expected to protect themselves through digital literacy and security practices) toward the institutions that design and operate the digital environments in which crime occurs — a shift that has gained traction in regulatory proposals including the EU’s Digital Services Act, the UK’s Online Safety Act, and the proposed KIDS Online Safety Act in the United States.

Major Policy Domains

Cybercrime Prevention and Enforcement Policy

Digital criminology’s most direct policy contribution lies in the evidence it provides about the effectiveness of different approaches to cybercrime prevention and enforcement. The evaluation literature on cybersecurity interventions — security awareness training, predictive policing, risk assessment instruments, platform content moderation, international cooperation operations — provides the empirical foundation for evidence-based cybercrime policy, though the evidence base remains thinner than policymakers require. Systematic reviews of cybersecurity awareness training (Bada, Sasse, & Nurse, 2019), evaluations of predictive policing (Meijer & Wessels, 2019), and assessments of law enforcement disruption operations (Décary-Hétu & Giommoni, 2017) collectively suggest that the effectiveness of current interventions is modest and variable — a finding that should temper policy enthusiasm for technology-driven solutions while motivating investment in more rigorous evaluation research.

The evidence on deterrence in the cybercrime context — whether the threat of punishment reduces cybercrime participation — is particularly relevant to enforcement policy. Holt, Burruss, and Bossler (2019) found that perceived certainty of punishment was low among potential cybercrime offenders, consistent with the rational choice prediction that low detection probability encourages offending. The policy implication is that enforcement credibility — the perceived probability that cybercriminals will be identified, apprehended, and punished — may be as important as the severity of available sanctions. Operations that visibly demonstrate enforcement capability — marketplace takedowns, public indictments, cryptocurrency seizures — may have deterrent effects that exceed their direct investigative impact by increasing the perceived risk of cybercrime participation.

Data Privacy and Platform Governance

Digital criminology informs data privacy and platform governance policy through its analysis of how data collection practices, platform design decisions, and regulatory frameworks shape both criminal opportunity and criminal justice capability. The criminological evidence that data breaches constitute one of the highest-volume victimization categories — affecting hundreds of millions of Americans annually — supports the case for data protection regulation that mandates security standards, limits data collection and retention, and imposes accountability for failures that result in criminal exploitation of personal data. The evidence that platform design features — algorithmic amplification, anonymity, minimal content moderation — facilitate criminal activity at scale supports the case for regulatory frameworks that impose safety obligations on platform companies.

The relationship between data privacy and crime control is not always complementary: stronger privacy protections may constrain law enforcement access to data that supports criminal investigation, while weaker protections expand both criminal opportunity (more data to steal) and investigative capability (more data to access). Digital criminology’s contribution to this policy tension lies in empirical analysis of the trade-offs — quantifying the crime prevention benefits of stronger data protection against the investigative costs of reduced data availability — and in the development of governance frameworks that manage these trade-offs through proportionate, targeted measures rather than categorical choices between privacy and security (Solove, 2011).

Criminal Justice Modernization

The adaptation of criminal justice institutions to the digital age — the development of digital forensic capability, the training of law enforcement and judicial personnel, the reform of evidence law, and the governance of algorithmic decision-making tools — represents a policy domain in which digital criminology provides both the diagnosis of institutional deficiencies and the evidence for reform proposals. The documented gaps in state and local law enforcement digital forensic capacity, the backlogs in forensic examination laboratories, the disparities in judicial technical literacy, and the bias concerns associated with algorithmic criminal justice tools all represent policy problems that digital criminological research has identified and for which it has proposed evidence-informed solutions (Goodison, Davis, & Jackson, 2015; Ferguson, 2017).

The modernization agenda is constrained by the institutional inertia of criminal justice organizations that were designed for analog crime and that resist the organizational, budgetary, and cultural changes necessary for effective digital adaptation. Police departments organized around geographic patrol beats, courts structured around paper-based docket management, and corrections systems focused on physical custody must all undergo transformation to address digital crime effectively. Digital criminology’s contribution to this transformation is not merely technical but institutional — analyzing how organizational structures, professional cultures, and resource allocation practices shape the criminal justice system’s capacity to respond to digital crime and proposing reforms that address institutional barriers alongside technical ones (Police Executive Research Forum, 2018).

The Evidence-Policy Gap

Barriers to Research Translation

The gap between criminological evidence and public policy — the failure to translate research findings into institutional practice — is a perennial challenge that the digital context intensifies. Several barriers impede the translation of digital criminological research into policy action. The pace of technological change outstrips the pace of research production: by the time rigorous evaluation evidence is available for a specific intervention, the technological context may have changed sufficiently to render the findings of limited applicability. The technical complexity of digital crime and its prevention creates knowledge barriers between researchers, policymakers, and practitioners that impede communication and mutual understanding. The political dynamics of digital crime policy — which is shaped by high-profile incidents, media narratives, and industry lobbying as much as by evidence — create conditions in which policy responses may be driven more by perceived urgency than by empirical analysis (Steinmetz & Gerber, 2015).

The fragmentation of the digital crime policy domain across multiple institutional actors — criminal justice agencies, technology regulators, intelligence agencies, international organizations, technology companies — means that no single institution has the authority, information, or capacity to implement a unified evidence-based response. Research findings that are relevant to cybercrime policy may need to be communicated to and adopted by actors in multiple institutional domains simultaneously — a coordination challenge that exceeds the capacity of the research communication mechanisms that criminal justice researchers traditionally employ.

Strengthening the Research-Policy Connection

Several mechanisms can strengthen the connection between digital criminological research and public policy. The development of rapid-response research capabilities — the ability to produce timely, policy-relevant analysis of emerging digital threats and proposed interventions — can reduce the temporal gap between the emergence of policy questions and the availability of evidence to address them. The establishment of institutional partnerships between academic researchers, law enforcement agencies, and technology companies can improve data access, facilitate applied research, and create channels for the communication of findings to decision-makers. The creation of dedicated policy research centers — such as the RAND Corporation’s cybersecurity research program, the Center for Strategic and International Studies’ Technology Policy Program, and university-based digital crime research centers — provides institutional infrastructure for sustained policy-relevant research that individual researchers cannot maintain (Welsh & Farrington, 2012).

The cultivation of “translational criminology” — the deliberate effort to communicate research findings in forms that policymakers can use — requires attention to the different languages, time horizons, and decision-making processes that characterize academic research and policy development. Research summaries that highlight policy implications, cost-benefit analyses that quantify the trade-offs of different intervention approaches, and engagement with the legislative and regulatory processes through which digital crime policy is developed all represent translational activities that can increase the influence of criminological evidence on policy outcomes. The development of a policy-engaged digital criminology — one that conducts research with policy relevance in mind, communicates findings in policy-accessible formats, and engages constructively with the institutions that make policy decisions — represents the most promising path toward closing the evidence-policy gap (Sherman, 2013).

Institutional Mechanisms for Policy Development

Federal Policy Architecture

The federal government’s institutional architecture for digital crime policy involves multiple agencies whose jurisdictions overlap and whose coordination remains a persistent challenge. The White House’s Office of the National Cyber Director, established in 2021, provides the first dedicated senior policy coordination function for cybersecurity, including the development of the 2023 National Cybersecurity Strategy that articulated national policy objectives for digital crime control. CISA coordinates civilian critical infrastructure protection and cybersecurity incident response. The Department of Justice prosecutes cybercrime and develops enforcement policy. The FTC enforces data protection and consumer fraud protections. The SEC regulates cybersecurity disclosure for public companies. The intelligence community assesses digital threats. And Congress legislates the statutory framework within which all these agencies operate.

The 2023 National Cybersecurity Strategy represents the most detailed articulation of federal digital crime control policy, organized around five pillars: defending critical infrastructure, disrupting threat actors, shaping market forces for security, investing in a resilient future, and forging international partnerships. The strategy explicitly adopts principles that digital criminology research supports — shifting responsibility for cybersecurity from individual users toward the institutions best positioned to reduce risk, investing in the security of digital infrastructure as a public good, and integrating international cooperation into the domestic response framework. The translation of strategic principles into operational policy — through executive orders, regulatory actions, and legislative proposals — represents the ongoing work of institutional policy development.

State and Local Policy Innovation

State and local governments have emerged as important sites of digital crime policy innovation, often leading federal action in areas including data privacy, facial recognition governance, algorithmic accountability, and platform regulation. California’s Consumer Privacy Act, Illinois’s Biometric Information Privacy Act, and the facial recognition bans enacted by San Francisco, Boston, and other cities represent state and local policy experiments that test governance approaches before they are adopted (or rejected) at the national level. The “laboratories of democracy” function that state and local policy innovation serves is particularly valuable in the digital crime context, where the optimal governance approach is uncertain and the diversity of state-level experiments generates comparative evidence about the effectiveness of different policy designs.

The limitation of state and local innovation is the fragmentation it creates: different privacy rules, different surveillance regulations, and different platform governance requirements across jurisdictions create compliance complexity for national organizations and inconsistent protection for individuals who move between jurisdictions. The tension between local innovation and national uniformity — between the benefits of experimentation and the costs of fragmentation — is a recurring theme in American federalism that the digital crime context intensifies because digital activity routinely crosses jurisdictional boundaries that are more relevant to governance than to the criminal activity they attempt to regulate.

Conclusion

Digital criminology and public policy exist in a relationship that is simultaneously essential and imperfect — essential because the digital transformation of crime demands policy responses informed by rigorous evidence and sound theoretical analysis, and imperfect because the institutional, political, and temporal barriers to research translation constrain the influence of criminological knowledge on policy decisions. The field’s most productive contributions lie in providing the empirical evidence about crime patterns and intervention effectiveness that evidence-based policy requires, in developing theoretical frameworks that illuminate the structural conditions driving digital crime, and in analyzing the governance challenges that the intersection of technology, crime, and liberty creates for democratic societies.

The development of a policy-engaged digital criminology — one that conducts research with policy relevance in mind, engages with the institutional processes through which policy is developed, and communicates findings in forms accessible to decision-makers — represents the discipline’s best opportunity to close the evidence-policy gap and to ensure that the governance of digital society is informed by the best available knowledge about the criminal dimensions of the digital transformation.

References

Bada, M., Sasse, A. M., & Nurse, J. R. C. (2019). Cyber security awareness campaigns: Why do they fail to change behaviour? International Conference on Cyber Security for Sustainable Society. https://doi.org/10.48550/arXiv.1901.02672
Clarke, R. V. (1997). Situational crime prevention: Successful case studies (2nd ed.). Harrow and Heston.
Décary-Hétu, D., & Giommoni, L. (2017). Do police crackdowns disrupt drug cryptomarkets? Crime, Law and Social Change, 67(1), 55–75. https://doi.org/10.1007/s10611-016-9644-4
Ferguson, A. G. (2017). The rise of big data policing. NYU Press.
Goodison, S. E., Davis, R. C., & Jackson, B. A. (2015). Digital evidence and the U.S. criminal justice system. RAND Corporation.
Holt, T. J., & Bossler, A. M. (2016). Cybercrime in progress: Theory and prevention of technology-enabled offenses. Routledge.
Holt, T. J., Burruss, G. W., & Bossler, A. M. (2019). An examination of the factors associated with the perceived risk of cybercrime victimization. Deviant Behavior, 40(12), 1494–1510. https://doi.org/10.1080/01639625.2018.1520268
Meijer, A., & Wessels, M. (2019). Predictive policing: Review of benefits and drawbacks. International Journal of Public Administration, 42(12), 1031–1039. https://doi.org/10.1080/01900692.2019.1575664
Police Executive Research Forum. (2018). The changing nature of crime and criminal investigations. PERF.
Powell, A., Stratton, G., & Cameron, R. (2018). Digital criminology: Crime and justice in digital society. Routledge.
Sherman, L. W. (2013). The rise of evidence-based policing: Targeting, testing, and tracking. Crime and Justice, 42(1), 377–451. https://doi.org/10.1086/670819
Solove, D. J. (2011). Nothing to hide: The false tradeoff between privacy and security. Yale University Press.
Steinmetz, K. F., & Gerber, J. (2015). “It doesn’t have to be this way”: Hacker perspectives on privacy. Social Justice, 41(3), 29–51.
Tanczer, L., Lopez-Neira, I., & Parkin, S. (2021). ‘Safety by design’ for smart home Internet of Things devices. In Cybercrime in context (pp. 163–182). Springer.
Tonry, M. (2010). “Public criminology” and evidence-based policy. Criminology & Public Policy, 9(4), 783–797. https://doi.org/10.1111/j.1745-9133.2010.00668.x
Wall, D. S. (2007). Cybercrime: The transformation of crime in the information age. Polity Press.
Welsh, B. C., & Farrington, D. P. (2012). The Oxford handbook of crime prevention. Oxford University Press.
White House. (2023). National cybersecurity strategy. https://www.whitehouse.gov/briefing-room/statements-releases/2023/03/02/national-cybersecurity-strategy/
Willison, R., & Siponen, M. (2009). Overcoming the insider: Reducing employee computer crime through situational crime prevention. Communications of the ACM, 52(9), 133–137.
Yar, M., & Steinmetz, K. F. (2019). Cybercrime and society (3rd ed.). SAGE Publications.

Related Articles