Twenty-first century criminals increasingly rely on the Internet and advanced technologies to further their criminal operations. According to Europol's Organized Crime Threat Assessment, "Internet technology has now emerged as a key facilitator for the vast majority of offline organised crime activity." For instance, criminals can easily leverage the Internet to carry out traditional crimes such as distributing illicit drugs and sex trafficking. In addition, they exploit the digital world to facilitate crimes that are often technology driven, including identity theft, payment card fraud, and intellectual property theft. The Federal Bureau of Investigation (FBI) considers high-tech crimes to be the most significant crimes confronting the United States. Policy makers have shown an increasing interest in ensuring the federal government has the tools and capabilities to combat modern day crime—particularly those with cyber components—while safeguarding privacy rights. Today's cyber criminals "have evolved their practices to make their crimes more profitable.... [T]hey choose specialties, master their skills, create networks of colleagues, and organize their crimes." These criminals can victimize individuals and organizations alike. They are motivated by self interest and profit. One estimate has placed the annual cost of cybercrime to adults in 24 countries across the globe at $113 billion. In addition to the economic impact, cybercrimes can have public health and national security consequences, among others. U.S. officials face the challenging task of identifying the perpetrators of malicious cyber incidents in which victim and criminal can be far removed from one another. The person or persons behind an incident can range from lone actors to expansive criminal networks or even nation states. This challenge of actor attribution is further compounded by the anonymity afforded by the digital realm. It can sometimes be difficult to determine the actor's motivation—is the criminal driven by greed or glory in the form of recognition among fellow criminals in the cyber world, or does the criminal have broader ideological motives? Finding the answers to these questions is key to distinguishing between cybercrimes and other cyber threats such as cyber attacks, cyber espionage, and cyber warfare. Relevant distinctions exist between these various malicious activities in the cyber domain just as lines have been drawn between their real world counterparts. For over three decades, Congress has been concerned about cybercrime and its related threats. Today, these concerns often arise among a larger discussion surrounding the federal government's role in ensuring cyber security. This report discusses the concept of cybercrime and related cyber threats such as cyber espionage and cyber warfare. While it touches on these related threats, this report only does so in the context of framing the discussion of cybercrime. It questions whether—and under what circumstances—clear distinctions between the various threats should be delineated. The report also outlines how current federal strategies may address cybercrime. It raises issues surrounding the measurement and tracking of cybercrime. Throughout, it discusses whether a clearer understanding of what constitutes cybercrime as well as its prevalence and harm could better equip policy makers to debate the sufficiency of federal law enforcement resources available to counter cybercrime and to conduct oversight in this arena. A singular, agreed-upon definition of cybercrime does not exist. Various definitions have been offered by industry experts and scholars, and several have been formulated within the federal government. Definitions have varied in their levels of specificity and breadth. For instance, one of the largest computer security companies, Symantec Corporation, defines cybercrime as "any crime that is committed using a computer or network, or hardware device." Irrespective of the definition, conceptualizing cybercrime involves a number of key elements and questions, including where do the criminal acts exist in the real and digital worlds (and what technologies are involved), why are malicious activities initiated, and who is involved in carrying out the malicious acts? In the sections below, the questions of where, why, and who are discussed as they relate to cybercrime. This is followed by a discussion of government definitions of cybercrime and a debate on whether or when a common definition of cybercrime may be useful. The notion of location as it relates to cybercrime involves both the physical and digital domains. The relatively clear borders and locations within the physical world, however, are not replicated in the virtual realm. Of course, some distinct boundaries separate the physical and the cyber worlds; keyboard, mouse, screen, and password can all mediate between these physical and virtual realms. Within cyberspace, however, the notion of a border is much more nebulous. This is, in part, because the same geographic borders that exist in the real world do not exist in the cyber world. Even without distinct borders, the digital world is linked to the physical world—as is crime involving the digital world. Take, for instance, point-of-sale (POS) skimming. This high-tech financial fraud involves placing a device over (or sometimes replacing) an existing card slot on a credit card reader or ATM. The device "relies on sophisticated data-reading electronics to copy the magnetic stripe information from [the] credit card or debit card. It can capture both [the] credit card number and [the] PIN." Fraudsters can then retrieve the stolen information by physically collecting the skimming device or by programming the device to broadcast the data to thieves over a network. Researchers have proposed that some cybercrimes may require more technological expertise or heavier use of digital technologies to perpetrate than others. For example, phishing, identity theft, and distributed denial of service (DDoS) attacks necessitate a greater understanding of computing and digital technologies than others, such as cyber stalking and online child pornography, that can be thought of as "point and click" crimes. Those crimes requiring more technological expertise may also be more firmly rooted in the virtual world than others. Regardless, the cyber component may delineate them from traditional crimes. Computers and other advanced technologies may be components of cybercrime through a variety of roles: in some cybercrimes, computers themselves—or data contained therein—are the victims or targets of crime; in other instances, computers or other digital technologies are used as tools for carrying out crimes (victimizing individuals, organizations, or government); and technological devices may serve as repositories for evidence of a cybercrime. All of these issues underscore the salience of location in any conceptualization of cybercrime. Perhaps one way of viewing cybercrimes is that they are digital versions of traditional offenses. It appears that many cybercrimes could be considered traditional, or real world, crimes if not for the incorporated element of virtual or cyberspace. Indeed, many of these so-called cybercrimes can be easily likened to traditional crimes. For instance, identity theft can occur in both physical and cyber arenas. While these crimes may occur through differing mechanisms, in both circumstances the criminal intent (profit) and outcome (stolen personally identifiable information) are the same. In the real world, a criminal can steal a victim's wallet or mail including documents containing personally identifiable information. In one case from March 2014, two defendants were charged for their role in a conspiracy to "steal mail containing credit debit cards.... The defendants then used the stolen debit cards to obtain cash, without the knowledge or authorization of the identity theft victims." In another case, two men were sentenced for leading a criminal enterprise that stole credit and debit cards from mailboxes in affluent neighborhoods in South Florida. The thieves then used the cards to make large purchases and cash withdrawals from the cards, costing victims $786,000. In the cyber world, a computer hacker can easily steal this same PII—electronically rather than physically. In September 2013, two Romanian nationals were sentenced for "participating in an international, multimillion-dollar scheme to remotely hack into and steal payment card data from hundreds of U.S. merchants' computers." Defendants remotely hacked into POS systems and then, also remotely, installed "keystroke loggers." These devices illegally captured victims' credit card information when the cards were swiped by the merchants, and then this information was transferred electronically to the fraudsters. The defendants stole information from more than 100,000 victims and sold this information for a profit. In some instances, it may seem that law enforcement struggles to keep up with developments in the virtual world, which transform routine activities once driven by paper records in the real world. As a result, criminals are often prosecuted using laws intended to combat crimes in the real world. As Department of Justice (DOJ) officials have pointed out, federal laws to prosecute computer-related crimes are not necessarily as ample or broad as those used to confront their traditional counterparts. For instance, computer fraud (18 U.S.C. §1030) is not currently considered a predicate offense for racketeering under the Racketeer Influenced Corrupt Organizations (RICO) Act—one of the primary tools used to prosecute organized crime. As noted, organized criminals are increasingly using the Internet and other advanced technologies to carry out their operations. Yet, the range of crimes carried out by organized crime encompasses both traditional and cybercrimes. The Obama Administration has recommended revising RICO provisions (which can be applied to both criminal and civil cases) so that computer fraud would be considered a predicate offense. Cyber criminal organizations have been targeted under civil RICO, citing predicate offenses such as wire fraud, bank fraud, and access device fraud. It is unknown whether or how adding computer fraud to the list of predicate offenses would further these investigations and prosecutions. In June 2014, the GameOver Zeus botnet, was disrupted through an international law enforcement effort led by the FBI. Law enforcement was authorized to sever communication between infected computers and criminal servers. GameOver Zeus is the most recent variant of the Zeus Botnet, which would steal online banking information and transfer funds to money mules, or U.S. residents with bank accounts, who would move the money out of the United States.