The Cyberbrein.nl Foundation provides guidance, education, and collaboration with ethical hackers to make young people aware of the legal implications of their actions.
Everyone generates data all day long. Whether it's a purchase or a ride on public transportation, a child's exam grades, or the logistical data shared between businesses. These bits of information often don't have much value on their own. However, when linked together in a large database, they gain added value. These collections of data can be used legitimately or for criminal purposes.
But how do such data collections come about? It turns out that young people also play a role in this. Research from the WODC shows that nearly 20 percent of minors themselves reported in 2020 having done something that could be considered cybercrime.
Enjoyment in collecting
It often starts very innocently. Many young people are interested in gaming. Most play the games as they are offered. However, some games offer the possibility to create things in the digital world. This sparks an interest in programming for some children, often from an early age in elementary school. Young people also enjoy collecting things. For example, they might search for voices on the internet to use artificial intelligence to create something. These are the talents that the IT world is looking for. 'But criminals are just as interested in young people who have a bit more skill in this area,' says Henk van Ee, co-founder of the Cyberbrein.nl Foundation. The foundation supports young people who are potential targets for criminals. They simply discover, through experimentation, that they can access someone's school account. 'That gives them a thrill. Is it illegal?' they ask. So we engage in conversation. It's important not to judge immediately. They want to show that they have achieved something. It's cool to talk about it. If you immediately say 'You shouldn't do that,' they tune out. So we ask further questions: How did you manage that? How far did you go? Then it's early enough to say, 'Do you also know that this is illegal?'
Trade in Data
There are various ways to become a data provider, not only for young people. Van Ee mentions, for example, an organisation that manages coporate data , that provided to request some data from a single company. There are built-in limitations to prevent abuse. However, imagine writing a script that allows you to automatically retrieve information for a large number of companies; you could potentially build a shadow database of said company. 'There is a lot of interest in that. For instance, you could look up all companies in any municipality involved in the installation industry, or apply any other filter you wish.' This database may not be comprehensive, but someone else may have information that provides an interesting complement. 'Ultimately, this leads to a large flow of information. There is a thriving trade in such data, often obtained from data breaches and shared on platforms like the dark web or Telegram. Think of a database containing all mobile phone numbers of people aged 50 and older, along with their profiles, merged from various data sources.
Young people are often very creative, and it starts as a joke. 'An example is when they order an IP camera online, carefully unscrew it, replace the firmware, and install additional software. Then they return it neatly. The camera is resold, and then they can tap into the images online. Sometimes, there's a criminal friend who thinks: Damn, if this works, we can do it on a large scale too, and before you know it, those camera images are actively offered on various data markets.'
Thin line
Young people with these kinds of interests are often vulnerable. Like everyone else, they want friends, recognition, and to be taken seriously. This can be quite challenging in elementary school if your hobby is thinking up and executing SQL injections. 'If someone comes along who finds that very interesting and is willing to pay for it, then the line becomes very thin, so to speak.'
The Cyberbrein.nl Foundation, founded by Henk van Ee and his colleague Will Moonen, aims to make these young people aware of the ethical and legal implications of their data collection and use. They work on cyber resilience projects, for instance by involving them in collaborations with professional hackers from the network of the DIVD Academy (Dutch Institute for Vulnerability Disclosure). 'Very often, the young people we work with are involved in very innocent things. But occasionally, they come across a serious vulnerability, like discovering discount codes for an online ordering service, for example. They are often a bit scared because they know it's illegal: reporting it could essentially incriminate themselves. What we do in those cases is guide them in ethically reporting it [responsible disclosure]. Sometimes, we report it ourselves to protect the child. However, sometimes companies offer bug bounties. In those cases, we ensure that the reward goes to the young person who discovered the issue.'
Dealing with cyber brain
Van Ee indicates that the activities are still in their infancy. He has been involved himself for about five years, but the foundation was only established in April 2023. Currently, around twenty young people receive intensive guidance, and there is a community around them with approximately 100 to 150 active youths. They range in age from eight to the mid-twenties. 'We always involve the parents and/or caregivers, especially with the younger ones, so we ensure the parents are okay with us engaging in conversation. We also provide workshops for parents on how to handle such a cyber brain, for instance at the re_B00TCMPs organized throughout the country.'
In addition to online guidance, the foundation also aims to focus on education in schools. They are trying to establish regional locations where young people can physically meet to brainstorm and engage in 'cool activities' under senior supervision that understands this specific target group. However, this requires personnel and funding. The foundation currently operates on various subsidies, including those from the Ministry of Justice and Security. With the municipality of Almere, the foundation participates in a City Deal project aimed at early recognition of young cyber brains and using this knowledge to provide education to parents and professionals in the upbringing context of such young cyber brains. 'I also give masterclasses and lectures on this topic, and the income from these goes to the foundation. Part of the funding still comes from our own pockets, Will's and mine. If we feel something really needs to happen, we provide upfront financing, but sometimes that's as far as it goes.' Van Ee believes this needs to change. He is currently working on setting up fundraising efforts and applying for ANBI status, a recognition by the Dutch Tax and Customs Administration that allows donors to deduct their gifts from income tax. Van Ee and Moonen would like to move towards a social enterprise where everyone is simply an employee and gets paid. 'But first, we want to make sure there is something substantial in place.'
Data Expo
At the upcoming Data Expo, there will be a strong focus on data governance, AI and security. At the Jaarbeurs on Wednesday, September 11, and Thursday, September 12, you can gain essential knowledge, explore technological possibilities, and make valuable contacts to take new steps forward. Visiting Data Expo will help you find answers to all your data-related questions. Visitor registration is free and can be done here.
You also might like: 8 Ways to Manage data Sustainably
