Our literature review consists of three parts. First, we consider the main juridical and academic definitions of cybercrime. Second, we briefly discuss the different bodies of literature on the cost, impact and harms of crime, as well as the related research design of measuring and assessing them. Third, we critically review the previous studies attempting to estimate the cost, impact and harms of cybercrime.

THE DEFINITIONS OF CYBERCRIME

As many other broad categories of crime, cybercrime too, is a contested concept. There is no consensus regarding the definition of cybercrime, either in the academic literature (e.g., Clough, 2015; Wall, 2007), or in legal and policy documents. As noted in a 2013 review of the UN Office on Drugs and Crime (UNODC, 2013), many of these documents do not even define cybercrime per se, but identify specific acts that constitute cybercrime. To confuse matters further, the terms “computer,” “e-,” “internet,” “digital” and “information crime,” are oft en used substitutes for cybercrime. Hence, for example, Clough (2015: 9) states that “there are almost as many terms to describe cybercrime as there are cybercrimes.” Along similar lines, Van der Hulst & Neve (2008, in Domenie, Leukfeldt, van Wilsem, Jansen & Stol, 2013: 2) conclude:

For researchers, the lack of a clear definition is problematic. A shared definition would not only help delineate the scope of the problem under investigation, but also facilitate discussions among scholars and provide a basis for comparing their research findings (ENISA, 2016a: 82; Gordon & Ford, 2006: 13). This definitional cacophony at least partially reflects the fact that cybercrime is studied from a wide variety of disciplines, ranging from social sciences to computer sciences (Jaishankar, 2010). Computer scientists and security companies, for example, tend to use a rather technical lexicon unfamiliar to many conventional social scientists. In addition, these “technological” studies often emphasize specific techniques (e.g., malware or phishing) that can be deployed in order to commit several offences labelled as cybercrime in criminal law.