Social Learning Theory

Within the positivist perspective, social learning theory has been proved over the last five decades to be one of the most popular theories utilized by criminologists. The theory, developed by Akers (Reference Akers1998), has been used in countless studies to describe various criminal activities. The origins of the theory date back to the 1960s. It is considered an extension of Sutherland’s (1947) differential association theory. Sutherland (Reference Sutherland1947) argued that individuals gain an understanding of criminal behaviour through time spent with influential criminal groups. Akers (Reference Akers1998) expanded on that notion by arguing that the learning method of any behaviour, especially crime, includes the following four key components: (1) differential association; (2) favourable definitions; (3) differential reinforcement; and (4) imitation.

In terms of cybercrimes, the four key components can also be effectively used to explain the motives behind such criminal behaviour (Stalans and Donner Reference Stalans, Donner and Jahankhani2018). Differential association refers to social exchanges with others who offer motives, reasoning and supportive attitudes to commit cybercrime. Favourable definitions of committing cybercrimes refer to an individual’s attitude created from social interactions with deviant peers who support criminal behaviour (Akers Reference Akers1998). Favourable attitudes refer to an individual’s defiant mindset that the criminal act that they are committing is not immoral and not harmful to others. This reasoning allows individuals to feel that they are not accountable for the subsequent harm caused by their actions (Hinduja and Ingram Reference Hinduja and Ingram2008). Differential reinforcement refers to positive (rewards of cybercrimes) and negative reinforcements (being arrested by the authorities). Lastly, imitation/modelling refers to observing other individuals involved in criminal behaviour, including cybercrimes, and subsequently emulating such behaviour (Akers Reference Akers1998). From a South African perspective, Akers’ (Reference Akers1998) four key components can also be effectively used to explain the motives behind cybersecurity risks faced by South Africa’s smart cities.

The differential association could refer to online social exchanges, reasoning and supportive attitudes that result in individuals committing cybercrime in South African smart cities. The use of social media in South Africa is on the rise and, every day, more people are socializing online. In 2019, there were approximately 22.89 million social network users in South Africa, projected to grow to 26.81 million in 2025 (Statista 2021). Many dedicated websites, website forums and social media groups support subculture groups, enabling them to share information and support the various forms of cybercrime deviance (Stalans and Donner Reference Stalans, Donner and Jahankhani2018). Cybercrime activities in the form of cyberterrorism can be cultivated on websites and social media groups. These “virtual communities of hate” allow individuals to engage with others who may share similar beliefs and nefarious motives and, as such, support Akers’ (Reference Akers1998) differential association component within social learning theory. Research studies have found that hackers appear to function in a global subculture, which exchanges ideas and techniques on how to successfully commit cybercrimes (Holt Reference Holt, Smalleger and Pittaro2009; Holt et al. Reference Holt, Strumsky, Smirnova and Kilger2012). Hackers reported maintaining regular peer relationships with other hackers, either online, offline or both (Decary-Hetu, Morselli, and Leman-Langlois Reference Decary-Hetu, Morselli and Leman-Langlois2012; Holt Reference Holt, Smalleger and Pittaro2009; Holt and Kilger Reference Holt and Kilger2008). Multiple studies have utilized the social learning theory to indicate its ability to explain cybercrimes (Morris and Blackburn Reference Morris and Blackburn2009; Navarro and Marcum Reference Navarro, Marcum, Holt and Bossler2019; Skinner and Fream Reference Skinner and Fream1997). Therefore, the social exchanges, reasoning and support that individuals experience online could be the driving force behind cybercrimes committed in potential South African smart cities.

Favourable definitions could refer to an individual’s change of attitude created by continued visits to websites and social media groups that support and encourage online criminal behaviour in South Africa (Akers Reference Akers1998). The pro-criminal attitude cultivated in such groups could be the driving force behind cybercrimes committed in South African smart cities. Examples include financially motivated (see South African Postbank), politically motivated (see SAPS, South African Presidency), cyber-espionage (see Red October) or privacy breaches (see Ashley Madison) cybercrimes.

Differential reinforcement could refer to the positive reinforcements from the rewards of cybercrimes that could encourage individuals to start or continue to commit cybercrimes in South African smart cities. The rewards and lower consequences of online crimes outweigh the much higher likelihood of being caught in real-world crimes (Stalans and Donner Reference Stalans, Donner and Jahankhani2018). The lucrative opportunities for financial rewards are a major driving factor in committing crimes online rather than in the real world. The positive reinforcements from the rewards of cybercrimes could be the driving force behind cybercrimes committed in South African smart cities.

Imitation applies to individuals in South Africa who observe the successes and financial rewards achieved by their online peers involved in cybercrimes and could subsequently start to emulate such behaviour. This could be an individual’s first and foremost motivation to start criminal activities in South African intelligent cities (Holt and Bossler Reference Holt and Bossler2017). The successful execution of previous cybercriminal incidents in South African cities could motivate individuals to start to emulate such behaviour.

Social learning theory can explain the rise of cybersecurity incidents in South Africa over the last few years. In 2019, South Africa saw a sharp increase in cyberattacks. Internet service providers, utilities, e-commerce platforms and customers were severely affected. Furthermore, social learning theory can also be used to explain the rise in hacking incidents in South Africa over the last few years. Therefore, social learning can explain why cyberattacks in South African cities are committed and continue to rise.

Subculture Theories

Social learning theory emphasizes that peer relationships and individual perceptions of crime contribute significantly to criminal behaviour. However, the theory fails to address criminal behaviour’s influence on individuals (Holt and Bossler Reference Holt and Bossler2017). Researchers utilizing a subcultural perspective have broadened knowledge and placed in perspective the aspects that individuals account for when they commit crimes. Research has been widespread, ranging from gang membership (Miller Reference Miller1958; Short Reference Short1968) to digital piracy (Cooper and Harrison Reference Cooper and Harrison2001). Subcultural theories were developed to explain the societal structures that create oppositional subgroups in society (Stalans and Donner Reference Stalans, Donner and Jahankhani2018). In a criminological and sociological context, subcultures are any group whose values, attitudes and behaviours are at odds with society’s universal laws and values (Brake Reference Brake1980; Kornblum Reference Kornblum1997). Researchers have conducted numerous studies to examine the subcultural values, norms and practices of digital pirates, hackers, online fraudsters and accomplices in the online illicit sex trade (Holt Reference Holt2007; Holt and Copes Reference Holt and Copes2010; Holt, Freilich, and Chermak Reference Holt, Freilich and Chermak2017; Stalans and Finn Reference Stalans and Finn2016).

Neutralization Theory

Sykes and Matza (Reference Sykes and Matza1957) argued that individuals are constantly aware of the obligation to abide by the law. Individuals who commit crimes need to engage in cognitive activity to neutralize their guilt. They developed five techniques to explain how individuals “neutralize” themselves to temporarily lift their guilt and allow individuals to “drift” into committing crimes (Stalans and Donner Reference Stalans, Donner and Jahankhani2018). The techniques are denial of responsibility, denial of injury, denial of the victim, condemnation of the condemners and appeal to higher loyalties. In his study, Morris (Reference Morris, Holt and Schell2010) utilized the theory and concluded that neutralization in combination with the influence of deviant peers was directly linked to hacking.

Additionally, the neutralization of individuals created a shared value of secrecy in the hackers’ subculture. All the members of the hacking group did not want to get caught, so the group created methods like “spot the fed” warnings at hacking conventions to warn other hackers of the presence of undercover law enforcement (Stalans and Donner Reference Stalans, Donner and Jahankhani2018). Moreover, the study found that hackers were inspired by their shared values in the subculture. However, targeting victims for malicious hacking attacks was based on religious and political agendas (Holt et al. Reference Holt, Freilich and Chermak2017).

Smart cities in South Africa face severe cybersecurity risks due to neutralized hackers carrying out malicious cyberattacks. The hackers’ moral disengagement with society, caused by neutralization, enables them to neutralize their guilt and engage in cybercrimes within a smart city’s cyberspace. The five techniques outlined by Sykes and Matza (Reference Sykes and Matza1957) are reviewed in light of their practical implications for cybersecurity risks, especially potential hacking incidents in South African smart cities:

• Denial of responsibility: Individuals may deny responsibility for their behaviour due to disengagement from society and, as a result, detach their sense of responsibility from their moral standards to commit cybercrime. The disconnect created by the Internet enables hackers and other individuals to lose any sense of responsibility. Individuals would possibly not have had the courage to carry out cybercrimes in the “real world”.

• Denial of injury: One of the key components in social learning theory is “favourable attitudes”, which maintains that some individuals create a defiant mindset that the criminal act they are engaged in is not immoral and encourages reasoning on why the cybercrime is not harmful to others. If a hacker perceives the cybersecurity breach that he/she is committing will not harm anyone, then he/she inadvertently denies that there are any affected victims present (Hinduja and Ingram Reference Hinduja and Ingram2008). The attacker could feel that their attack will only affect wealthy organizations, affluent institutions or government agencies, denying that specific individuals will be affected.

• Denial of the victim: Criminals often claim that the victim is deserving of the harm or is partly responsible for the harm (Stalans and Donner Reference Stalans, Donner and Jahankhani2018). This may motivate criminals to engage in cybercrime because the attacker believes “they deserve it”. Hackers often view themselves as a Robin Hood type of character by stealing (hacking) from the rich and giving to the poor (hacking community) (Maurushat Reference Maurushat2019).

• Condemnation of the condemners: Individuals that commit cybercrimes claim that their behaviour is not wrong because those who disapprove of their behaviour engage in more unlawful activities (Stalans and Donner Reference Stalans, Donner and Jahankhani2018). Hacktivists could claim that their actions of website defacement are far less destructive than that of the person or organization they are attacking. Furthermore, empirical studies have shown that in many cases, hackers blame their victims for not having good cybersecurity skills or anti-virus software to prevent them from being victims (Cross, Richards, and Smith Reference Cross, Richards and Smith2016; Taylor Reference Taylor1999).

• Appeal to higher loyalties: Individuals attempt to justify themselves by claiming that their actions are motivated by other more important values. Individuals believe that their actions will benefit their friends, peers or the hacking community and feel the need to protect themselves (Schmalleger Reference Schmalleger2019). The influence of peer relations is key to introducing individuals to the techniques of neutralization to justify their immoral values and criminal behaviours in cyberspace (Bossler and Burruss Reference Bossler, Burruss, Holt, Schell and Hershey2011). Hackers maintain peer relations with other hackers online or offline and often need to prove their loyalty to each other (Holt and Kilger Reference Holt and Kilger2012). These beliefs are a neutralization technique to justify their criminal behaviours in cyberspace.

Over the last few decades, traditional subcultural theories have been applied to studies to explain cybercrime and deviance (Holt and Bossler Reference Holt and Bossler2017). The code of the street theory has proven to be effective in explaining the causes behind specific cybercrimes. The theory and its application to cybersecurity in South African smart cities are reviewed.

Code of the Street Theory

The code of the street theory was developed by Anderson (Reference Anderson1999). The theory argues that a set of informal or “street” rules govern interpersonal relations in depreciated inner-city neighbourhoods struggling with joblessness, racism, poverty, alienation and mistrust of the police. These neighbourhoods are often characterized by a lack of public resources, poor service delivery and a history of racial segregation. Adverse socio-economic situations force youths to choose between believing in traditional values or the “code of the street” values which consist of illegal behaviours to get ahead in life (Stalans and Donner Reference Stalans, Donner and Jahankhani2018). The theory was utilized in numerous studies (Stewart and Simons Reference Stewart and Simons2010), which found that individuals’ loyalty to “street values” is linked to numerous violent crimes.

Henson, Swartz, and Reyns (Reference Henson, Swartz and Reyns2017) applied the code of the street theory to their empirical research to indicate how theory can explain crime in cyberspace. In their study, Henson et al. (Reference Henson, Swartz and Reyns2017) found that when youths started adopting online street-oriented beliefs, it related to online offending. Street-oriented beliefs were supported and shared on platforms such as social media and specific web forums. In another study, Holt (Reference Holt2007) examined the subculture of hackers using interviews with active hackers by examining data from public web forums from Defcon 2004, the largest annual hacker convention in the United States. Holt (Reference Holt2007) identified five general “normative orders” related to hackers. Notably, the establishment of identity within the subcategories of hackers who have shared values on violating laws is similar to that of street-oriented beliefs.

Furthermore, a study by Adeniran (Reference Adeniran, Jaishankar and Boca Raton2011) on the notorious Nigerian “yahoo boys” highlighted the group’s use of the Internet to conduct online criminal activities, including fraud, money laundering and hacking. Poverty, unemployment and deteriorating social lifestyle standards lead to the development of the “yahoo boys” subculture (Adeniran Reference Adeniran, Jaishankar and Boca Raton2011). Interestingly, the hostile socio-economic environment was similar to the environment that led to the creation of the “code of the street” values.

The code of the street theory has proven to be relevant, especially in poverty-stricken areas of the world. The subculture that gave rise to the origins of “street culture” and the online application of the values system by the Nigerian “yahoo boys” both have deep roots in poverty, unemployment and deteriorating social lifestyle standards (Adeniran Reference Adeniran, Jaishankar and Boca Raton2011). South Africa faces similar socio-economic misfortunes. The unemployment rate for the fourth quarter of 2020 escalated to 32.5%, putting the number of unemployed people at 7.2 million (Stats SA 2020). Furthermore, youth unemployment, individuals aged 25–34 years, recorded the highest unemployment rate of 41.2% (Stats SA 2020). Young South African work-seekers are turning to online platforms to enhance their digital literacy to increase their chances of achieving work opportunities (Matli and Ngoepe Reference Matli and Ngoepe2020). Youth unemployment is expected to drive an increased reliance on criminality as a source of income in both the online and offline spheres.

Furthermore, opportunities for cybercrimes have increased due to uncertainty created by the COVID-19 pandemic (Mahadevan Reference Mahadevan2020). The unemployed youth in South Africa can therefore take advantage of the increased cybercrime opportunities created by the COVID-19 pandemic and turn to a life of crime on the “streets” of cyberspace. The potential “street code culture” among the unemployed youth coupled with the many specialized forums and “how-to-do” websites could breed a substantial community of hackers and other cybercriminals in South Africa. This envisioned increase in skilled cybercriminals in South Africa could pose a significant risk to its IoT-interconnected smart cities.

Space Transition Theory

Space transition theory is viewed as one of the newer theories in criminology that have been designed to distinctively address the ever-growing phenomenon of cybercrimes (Holt and Bossler Reference Holt and Bossler2017). Developed in 2007 by Jaishankar (Reference Jaishankar2007b), space transition theory attempts to explain the causation of crimes in cyberspace. He deemed it necessary to create a different theory on cybercrimes due to the inability of traditional criminological theories to suitably deliver a comprehensive explanation of the phenomenon of cybercrimes (Jaishankar Reference Jaishankar, Schmallager and Pittaro2008). Space transition theory is defined as the movement of an individual from one space to another (physical space to cyberspace) and argues that individuals conduct themselves differently when moving from one space to another.

Jaishankar (Reference Jaishankar2007b) offers seven fundamental propositions regarding the behaviour of individuals when they engage online and offline:

• Individuals who control their need to conduct crime in the real world to protect their reputation could tend to engage in crimes in cyberspace.

• Cybercriminals may find it more appealing to engage in cybercrime due to the ability to use multiple identities, keep their location secret, and the absence of deterrence factors in cyberspace.

• Crimes in cyberspace are prone to move into physical space and vice versa.

• Individuals could have the opportunity to cease their criminal activities due to the temporary nature of the Internet and its disengagement from the real world.

• The Internet enables strangers to form online partnerships to plan and commit crimes in the real world and, conversely, allows real-world partnerships to engage in cybercrimes.

• Closed societies could harvest higher levels of online crime than open societies because of the oppressive nature of such regimes.

• The feeling of disengagement from the real world created by the Internet could allow individuals to disengage from their real-world societal norms and values and start engaging in cybercrime.

Space transition theory offers a critical understanding of the behaviour of criminals in cyberspace (Al-Ali, Nimrat, and Benzaid Reference Al-Ali, Nimrat, Benzaid and Jahankhani2018).

The COVID-19 pandemic has expanded the global cyber-landscape by forcing industries and governments to implement a massive and uncoordinated strategic shift to working remotely and relying heavily on the Internet to stay operational and conduct business (Wiggen Reference Wiggen2020). Due to nationwide lockdowns, work-from-home offices in public and private sectors required industries to increase electronic transactions, shift offline data to online databases, and use unproved software to communicate sensitive information (Mahadevan Reference Mahadevan2020). Subsequently, millions of malware and other attacks were experienced between January and August of 2020 (Kaspersky 2020). The COVID-19 pandemic has increased risks for smart cities, businesses and individuals as they adapt to a revised operating model in the “new normal” world. Space transition theory can therefore be utilized to explain the causations of cybercrimes created by the increased movement of individuals from offline spaces to cyberspace due to the COVID-19 pandemic. Additionally, the rise of more sophisticated smart cities in South Africa will only increase and amplify cybercrime opportunities.

Actor-Network Theory

ANT is a theoretical and methodological approach to social theory that claims everything in the social and natural worlds exists through a relationship of continuously shifting networks (Latour Reference Latour2005). This approach was adopted by van der Wagen and Pieters (Reference Van der Wagen and Pieters2015), who argued that the ANT could be explicitly applied to their study on the cybercrimes committed by botnets. They further argue that the ANT could take a social constructionist approach to focus on the role technologies have on specific criminal actions, especially where the technology does not require constant human input to carry out continuous cybercrimes. A botnet attack is a new type of “cyborg crime”, carried out by a combination of human and non-human criminal actions. The ANT is therefore used to draw a parallel perspective on human and non-human interactions in hybrid cybercriminal networks (van der Wagen and Pieters Reference Van der Wagen and Pieters2015). Van der Wagen and Pieter’s (Reference Van der Wagen and Pieters2015) application of the ANT opened a platform for scholars to start the debate over the concept that technological innovations are non-rational actors rather than tools that can be used to commit complex forms of cybercrime. This notion would lead to better insights into empirical research studies (Holt and Bossler Reference Holt and Bossler2017). Furthermore, van der Wagen and Pieters (Reference Van der Wagen and Pieters2015) suggest that the ANT framework would not only be applicable for studying botnets but could also be utilized for understanding how technology affects other forms of cybercrime. Hence, the selection of the ANT framework for application to this paper.

One complex botnet case from the Netherlands was examined for their research study to demonstrate their argument. The study concluded that the human “actor” was not always entirely in control of the deployed technology, as the “botherder” (individual responsible for controlling the botnet) could not consistently predict how the botnet network would interact and carry out actions. Van der Wagen and Pieters (Reference Van der Wagen and Pieters2015) motivated that without the ANT, their analysis and conclusion would have overstated the influence of the human as a rational “actor” managing the botnet network.

As global smart cities have increased their reliance on technology, cybersecurity incidents have increased in sophistication. As a result, more complex forms of cybercrime will be experienced in smart cities. Therefore, smart cities around the globe and in South Africa are at risk for sophisticated cyberattacks like botnet attacks and ransomware. According to ANT, everything in the social and natural worlds exists through a relationship of continuously shifting networks. The theory is used to explain the parallel perspectives that exist between human and non-human interactions within a hybrid cybercriminal network. Furthermore, the ANT explains the causes behind such hybrid cybercriminal networks carrying out sophisticated cyberattacks on smart cities.