Many cybercriminal entrepreneurs lack the skills and techniques to provision certain parts of their business model, leading them to outsource these parts to specialized criminal vendors. Online anonymous markets, from Silk Road to AlphaBay, have been used to search for these products and contract with their criminal vendors. While one listing of a product generates high sales numbers, another identical listing fails to sell. In this paper, we investigate which factors determine the performance of cybercrime products.
To answer this question, we analyze scraped data on the business-to-business cybercrime segments of AlphaBay (2015-2017), consist- ing of 7,543 listings from 1,339 vendors, sold at least 126,934 times. We construct new variables to capture product differentiators and price. We capture the influence of vendor characteristics by identifying five distinct vendor profiles based on latent profile analysis of six properties. We leverage these product and vendor characteristics to empirically predict the performance of cybercrime products, whilst controlling for the lifespan and type of solution. Consistent with earlier insights into carding forums, we identify prevalent product differentiators to be influencing the relative success of a product. While all these product differentiators do correlate significantly with product performance, their explanatory power is lower than that of vendor profiles. When outsourcing, the vendor seems to be of more importance to the buyers than product differentiators.@en

The concept of the smart city increasingly being used but is in fact an umbrella topic covering several disciplines and domains. In the current literature is no agreement on a comprehensive vision of the smart city; perspectives on it vary from purely technological urban development to initiatives addressing societal challenges. We argue that in these perspectives, self-governance is often ignored, yet plays an important role in the smart city idea, bringing together people, technologies, and policies. The objective of this chapter is to provide a framework for the classification of self-governance initiatives on a community level. The framework unites heterogeneous urban initiatives giving a broader understanding of existing self-governance practices that could be used within the smart city.@en

Despite great potential, high hopes and big promises, the actual impact of big data on the public sector is not always as transformative as the literature would suggest. In this paper, we ascribe this predicament to an overly strong emphasis the current literature places on technical-rational factors at the expense of political decision-making factors. We express these two different emphases as two archetypical narratives and use those to illustrate that some political decision-making factors should be taken seriously by critiquing some of the core ‘techno-optimist’ tenets from a more ‘policy-pessimist’ angle. In the conclusion we have these two narratives meet ‘eye-to-eye’, facilitating a more systematized interrogation of big data promises and shortcomings in further research, paying appropriate attention to both technical-rational and political decision-making factors. We finish by offering a realist rejoinder of these two narratives, allowing for more context-specific scrutiny and balancing both technical-rational and political decision-making concerns, resulting in more realistic expectations about using big data for policymaking in practice.

@en

The crowd increasingly plays a key role in facilitating innovations in a variety of sectors, spurred on by IT-developments and the concomitant increase in connectivity. Initiatives in this direction, captured under the umbrella-term ‘crowd-based innovations’ (CBI), offer novel opportunities in all domains of society by increasing the access, reach and speed of services and goods. At the same time, they signify important challenges because these innovations occur in a context of traditional, well-established institutional arrangements. CBI create an ‘institutional void’: existing rules, standards and practices are challenged and renegotiated. This raises questions about the safeguarding of public values such as quality, legitimacy, efficiency and governance of crowd-based innovations. The objective of this perspective piece is to present an interdisciplinary research agenda to address normative challenges for governing CBI. We will argue that such an agenda needs an integrated empirical-normative approach. We will detail three lines of empirical-normative research that together build up towards an interdisciplinary agenda.

@en

Big data promises to transform public decision-making for the better by making it more responsive to actual needs and policy effects. However, much recent work on big data in public decision-making assumes a rational view of decision-making, which has been much criticized in the public administration debate. In this paper, we apply this view, and a more political one, to the context of big data and offer a qualitative study. We question the impact of big data on decision-making, realizing that big data – including its new methods and functions – must inevitably encounter existing political and managerial institutions. By studying two illustrative cases of big data use processes, we explore how these two worlds meet. Specifically, we look at the interaction between data analysts and decision makers. In this we distinguish between a rational view and a political view, and between an information logic and a decision logic. We find that big data provides ample opportunities for both analysts and decision makers to do a better job, but this doesn't necessarily imply better decision-making, because big data also provides opportunities for actors to pursue their own interests. Big data enables both data analysts and decision makers to act as autonomous agents rather than as links in a functional chain. Therefore, big data's impact cannot be interpreted only in terms of its functional promise; it must also be acknowledged as a phenomenon set to impact our policymaking institutions, including their legitimacy.

@en

Context-awareness refers to the ability to sense and adapt to context. With the rise of context-aware systems, designers are struggling with what variables should be sensed from the context. According to the definitions found in the literature, whether something belongs to context, has to do with whether it is relevant. However, what it means to be relevant is left implicit in these definitions. Most work on context-aware systems is based on assumptions of the context that should be taken into account. Hence, it is unclear how to decide whether something belongs to context or should be left out. In this paper, first we analyse what is meant with context and provide a definition. In this definition we introduce the notion of a context variable, defined as an attribute of an object that is relevant. Context is then defined as the set of context variables. We establish explicit criteria for deciding whether an attribute of an object is a context variable based on the proposed definition and the designer’s goal. We also provide a straightforward method to help designers to determine whether the criterion is met and a variable should be included in the context. This method is based on filling out a scheme to describe context variables.@en

The promise of big data in the field of mobility is great, for example for mobility-as-a-service solutions. Having a better sense of the existing flows over the network would allow for much improved modelling of future flows and nudging users into behaviours targeting collectively better outcomes. Because of this promise the interest that cities have in big data for mobility is high. They are looking for ways in which a mobility data platform gathers the relevant data, allow for advanced modelling of current and future network states, and ways to drive travel behaviour. We participated in the EU funded PETRA project that built such a platform for the cities of Haifa, Rome and Venice. In this paper, we are looking for key governance mechanisms that affect the success of mobility data platforms, and how they are related to technical features. The project and an additional study into 10 cases revealed that the more ambitious a platform is on a technical level, the more governance challenges they will encounter, thus the more advanced governance arrangements are necessary. However, many governance arrangements are a given rather than a subject to design. This implies that for success, the technical ambition of the platform should be aligned with the institutions of the city in which the platforms will be implemented.

@en

Citizens interested in the democratization of urban development processes experiment with the co-creation of public spaces. Some of them collect, improve, and share design blueprints and manuals of their projects on the internet with help of free and open source tools. As a result, they produce open source design manuals that can be used freely, modified, and developed further. However, such attempts at opening urban design are still uncoordinated, atomized, and dispersed, and therefore fail to create the value that a more concerted effort might. We argue that open source urbanism practices would benefit from open design platforms that are purposefully designed for the complex domain of urbanism. As a first step, this paper identifies the requirements that such platform should meet. As there are currently no examples of such a platform, we analyze the platforms that are there and partially satisfy the demand to extract the shared underlying requirements @en

Researchers have observed the increasing commoditization of cybercrime, that is, the offering of capabilities, services, and resources as commodities by specialized suppliers in the underground economy. Commoditization enables outsourcing, thus lowering entry barriers for aspiring criminals, and potentially driving further growth in cybercrime. While there is evidence in the literature of specific examples of cybercrime commoditization, the overall phenomenon is much less understood. Which parts of cybercrime value chains are successfully commoditized, and which are not? What kind of revenue do criminal business-to-business (B2B) services generate and how fast are they growing? We use longitudinal data from eight online anonymous marketplaces over six years, from the original Silk Road to AlphaBay, and track the evolution of commoditization on these markets. We develop a conceptual model of the value chain components for dominant criminal business models. We then identify the market supply for these components over time. We find evidence of commoditization in most components, but the outsourcing options are highly restricted and transaction volume is often modest. Cash-out services feature the most listings and generate the largest revenue. Consistent with behavior observed in the context of narcotic sales, we also find a significant amount of revenue in retail cybercrime, i.e., business-to-consumer (B2C) rather than business to-business. We conservatively estimate the overall revenue for cybercrime commodities on online anonymous markets to be at least US $15M between 2011-2017. While there is growth, commoditization is a spottier phenomenon than previously assumed. @en

Business-to-government (B2G) information sharing can benefit government organisations, as well as businesses. Yet, businesses are often reluctant to share, as data sharing might not just provide benefits but also entails risks. Therefore, a system supporting B2G information sharing should provide the appropriate level of openness, such that the advantages of openness and possibilities to control risks for businesses are balanced. At the same time, the information obtained by the government should be useful. We identified three architectural layers at which B2G information sharing architectures can have different levels of openness, viz. the Software Layer, the Access Control Layer and the Data Layer. In this work, we compare three archetypical configurations of architectures for B2G information sharing with different levels of openness. Our aim is to provide insight into their impact on the possibilities for obtaining advantages from information sharing and managing risks of opening up data. We found that the relationship between the different levels of openness and the advantages and risks of information sharing is highly complex. We discuss this complexity and find that different levels of openness are appropriate in different situations.@en

Context-aware systems are systems that have the ability to sense and adapt to the environment. To operate in large-scale multi-stakeholder environments, systems often require context awareness. The context elements that systems in such environments should take into account are becoming ever more complex and go beyond elements like geographic location. In addition, these environments are themselves so complex that it is hard to determine what parts of them belong to the relevant context of a context-aware system. However, insight into what belongs to this context is needed to establish what the design of a context-aware system should be to meet its goal. The ambiguity of what belongs to context in these complex organizational environments causes the design process to become either inefficient or less effective. In this paper, we provide a method to identify what elements of the environment are relevant context and to then base the design on this insight. The proposed method consists of three steps: 1) getting insight into context, 2) determining what components are needed to sense and adapt to context, and 3) determining the rules for how the system should adapt in different situations. To reduce ambiguity by organizations, the method requires a more specified definition of context than the ones in current literature, which we also provide in this paper. In addition to reducing ambiguity, the highly structured way in which the components and rules are derived from insight into context provides a way to further deal with the high complexity of the context. The method was applied for the development of a context-aware system for business-to-government (B2G) information sharing in the container shipping domain. Information sharing in this domain is highly complex, as legislation, many stakeholders, and a mix of cooperation and competition result in a highly complex environment. The development of this B2G information sharing system thus provides an example of how the method can be used to develop a context-aware system in a highly complex environment.@en

Driven by the technological capabilities that ICTs offer, data enable new ways to generate value for both society and the parties that own or offer the data. This article looks at the idea of data collaboratives as a form of cross-sector partnership to exchange and integrate data and data use to generate public value. The concept thereby bridges data-driven value creation and collaboration, both current themes in the field. To understand how data collaboratives can add value in a public governance context, we exploratively studied the qualitative longitudinal case of an infomobility platform. We investigated the ability of a data collaborative to produce results while facing significant challenges and tensions between the goals of parties, each having the conflicting objectives of simultaneously retaining control whilst allowing for generativity. Taken together, the literature and case study findings help us to understand the emergence and viability of data collaboratives. Although limited by this study’s explorative nature, we find that conditions such as prior history of collaboration and supportive rules of the game are key to the emergence of collaboration. Positive feedback between trust and the collaboration process can institutionalise the collaborative, which helps it survive if conditions change for the worse.@en

Supply chain management is hampered by a lack of information sharing among partners. Information is not shared as organizations in the supply chain do not have direct contact and/or do not want to share competitive and privacy sensitive information. In addition, companies are often part of multiple supply chains and trading partners vary over time. Blockchains are distributed ledgers in which all parties in a network can have access to data under certain conditions. Private blockchains can be used to support parties in making their demand data directly available to all other parties in their supply chain. These parties can use this data to improve their planning and reduce the bullwhip effect. However, the transparency that blockchain technology offers makes it more difficult to protect sensitive data. The dynamics between these properties are not well understood. In this paper, we design and evaluate a blockchain architecture to explore its feasibility for reducing information asymmetry, while at the same time protecting sensitive data. We found that blockchain technology can allow parties to balance their need for inventory management with their need for flexibility for changing partners. However, measures to protect sensitive data lead either to reduced information, or to reduced speed by which the information can be accessed.

@en

Business-to-government information exchange has over the past decades greatly benefited from data exchange standards and inter-organisational systems. The data era enables a new shift in the type of information sharing; from formal reporting to opening up full (and big) data sets. This enables new analytics and insights by government, more effective and efficient compliance assessment, and other uses. The emphasis here shifts from establishing formats to deciding what information can be shared, under what conditions, and how to create added value. There are numerous initiatives that explore how to put data to better use for businesses, for government and for their interactions. However, there is limited attention to exactly how these new forms of extensive data sharing affects the supervision relationships. In this paper, we exploratively look across three research projects to identify the implications of information sharing beyond the regulatory requirements (‘over-compliant’). We find that the lack of attention to those implications lead to solutions that are hard to scale up and present unexpected consequences down the line, which may negatively impact the future willingness to explore new potential added value of data sharing.

@en

In recent years, many countries have started to draft strategies and policies related to the data economy. To support new data- driven activities and innovations, the development of a national data infrastructure (NDI) is seen as key. The concept of NDI has entered governmental strategic discussions on data as an asset, the role of data infrastructures in innovation and economic activity, and the role of government therein. However, there is a gap between the ambitions as laid out in the strategies and the actual actions taken towards realizing them. To understand this gap and support NDI development, insight is needed in the components and processes of realizing NDI strategies. In this paper, we study NDI strategies ‘in action’ in the Netherlands and Switzerland using an analytical framework comprising strategies, stakeholders, design, components and governance. Special emphasis is put on the role of government in formulating and implementing strategies. Our cross-case analysis uncovers lessons that seem relevant for NDI development elsewhere, as well as challenges that need to be resolved before NDIs can hope to actually make the impact associated with them.@en

This document represents business model overview for PETRA. The business model is an integral part of the governance handbook, (D7.3), but is also listed as a separate deliverable. For all details, please refer to deliverable 7.3. Here an abbreviated version is presented.
The model uses a business model canvas to look at the main revenue and costs streams, risks and assumptions.
The business model is based on information that was gathered from the demonstrators and literature.
On the revenue side of the business model, the context and policies in place very much drive the expected revenues. Rather than providing an expected outcome, the model proposed existing and well developed approaches to estimate possible revenues, given a specific context.@en

Advanced architectures for business-to-government (B2G) information sharing can benefit both businesses and government. An essential choice in the design of such an architecture is whether information is shared using a thick or a thin information flow. In an architecture with a thick flow, all information is shared via a shared infrastructure, whereas only metadata and pointers referring to the information are shared via the shared infrastructure in a thin flow architecture. These pointers can then be used by parties to access the information directly. Yet, little is known about what their implications for design choices are. Design choices are influenced by the properties of the architecture as well as the situation in which B2G information sharing takes place. In this paper, we identify the properties of architectures with a thin and thick flow. Next, we determine what this implies for the suitability of the architectures in different situations. We will base our analysis on the case of the Shipping Information Pipeline (SIP) for container transport. While both architectures have their pros and cons, we found that architectures with a thin flow are more suitable when non-standardized, and flexible sharing of sensitive information is required. In contrast, we found that architectures with a thick flow are more suitable when in-depth integration is required.@en

The speed and disruptive character of digital innovations affect social structures and practices faster than institutions can keep up with them. This results in an ‘institutional void’, i.e. a gap between the rules and institutions and their ability and the effectiveness of their measures. It also affects the institutional stability that is the basis for the paradigm of collaboration-based types of governance. In this paper, we explore how parties are able to set up collaboration for digital security, which is inherently a topic that transcends organisational boundaries. Yet digital innovations constantly enable new challengers that might not share the same incentives for collaboration. Life in an institutional void is convenient for them and enables new business models. Hence, a key question is whether (institutionalised) collaboration is a sustainable model for addressing shared problems like digital security. We explore this question in the domain of financial cyber fraud. The new (regulatory) space currently being created for innovators suggests that the answer is ‘no’. It is too early to say how this will play out specifically and we argue for further research into the antecedents for collaboration in institutional voids.@en

Toensurepublicsafetyandsecurity,itisvitallyimportantforgovernmentstocol- lect information from businesses and analyse it. Such information can be used to determine whether transported goods might be suspicious and therefore require physical inspection. Although businesses are obliged to report some information, they are reluctant to share addi- tional information for fear of sharing competitively sensitive information, becoming liable and not being compliant with the law. These reasons are often overlooked in the design of software architectures for information sharing. In the present research, we followed a design science approach to develop a software architecture for business-to-government information sharing. Based on literature and a case study, we elicited the requirements an architecture that provides for the sharing of information should meet to make it acceptable to businesses. We then developed the architecture and evaluated it against the requirements. The architec- ture consists of a blockchain that stores events and rules for information sharing that are controlled by businesses. For each event, two parties use their private keys to encrypt its Merkle root to confirm that they know the data are correct. This makes it easy to check whether information is reliable and whether an event should be accepted. Access control, metadata and context information enable the context-based sharing of information. This is combined with the encryption and decryption of data to provide access to certain data within an organisation.@en