to undertake the actual criminal transaction of taking money from ATMs — outsourcing this riskiest part of the chain was a no-brainer.

The more secretive discussions, where only about fifteen leading carders were present, took place in a small, dingy restaurant down by the sea. The aim of this group was to persuade delegates to establish their own regional networks of CarderPlanet franchises so that its owners could continue to make money, but for less work.

As the meeting started, one of the lesser-known delegates sent an inconspicuous signal to Boa. The man had performed an electronic sweep of the restaurant and detected that hidden video cameras and digital recording devices were active inside the room. In all probability, the SBU, Ukraine’s secret police, were carrying out the surveillance. And if the SBU were monitoring the event, so was Russia’s KGB, who at the time were able freely to exercise the intelligence equivalent of droit de seigneur over the SBU — the right to trawl over pristine data before the collector had even examined it.

The Family, CarderPlanet’s Politburo or Cupola, did not especially fear American and European intelligence and policing operations. But the KGB was another matter, and it was no coincidence that the most important resolution of the conference warned against hostile activities inside Russia and Ukraine. ‘One more time, we stressed the absolute inadmissibility of any action in relations to our billing systems, banks or financial institutions,’ it thundered. If Russian-speaking cyber crim- inals had turned on Russian banks or businesses, the entire project would have been shut down within five minutes.

Instead, CarderPlanet proved more durable. The website existed for nearly four years. It is no exaggeration to say that its creators were responsible for the emergence and consolidation of an entirely new method of engaging in major criminal activity. fraud that could be perpetrated on a huge scale with minimal resources and minimal risk.

CarderPlanet’s primary role (later adopted by its many successors) was to act as a bazaar for stolen data — credit-card numbers and PINs, bank accounts and their passwords — along with other goodies such as viruses and fake documents. Until this point, the exchange of such information generally took place in laborious one-to-one transactions over icq and IRC (the two messaging systems favoured by hackers).

Cybercrime’s perpetrators — so-called carders, spammers, skimmers and virus-makers — already looked like a breed apart from criminals