Lakehead University CRIM 3370 Cybercrime and Digital Forensics: Assessment 2 Group Research Presentation with Narrated Slides

Record a 12-minute group research presentation on one approved cybercrime problem, delivered in 8 to 10 narrated slides with 150 to 200 words of speaker notes per content slide. CRIM 3370 at Lakehead University carries Assessment 2 at 15 percent of the final grade, and groups of two or three students present from Week 7 onward.

Assessment Context

Lakehead University runs CRIM 3370 Cybercrime and Digital Forensics through the Department of Criminology, and the group research presentation is the mid-term applied task that sits between the multiple-choice midterm and the individual research paper. Groups of two or three students pick a topic that touches cybercrime, cybersecurity, emerging trends, controversies, law enforcement practice, or legal questions, submit it for instructor approval by Week 2, and record their presentation for the Week 7 to Week 9 window. The published course outline weights the presentation at 15 percent and caps each student’s live delivery at 5 to 10 minutes, which is why the recorded format here allows 12 minutes for a two-person group and 14 minutes for a three-person group. Course materials live inside D2L, so this brief works from the outline Lakehead posts openly and projects the deadlines onto a standard 12-week fall term. Assessment 2 tests whether students can carry a criminological argument into a technical domain without either drowning the audience in jargon or flattening the analysis into a list of attack types.

Students routinely lose marks in two places. Groups describe what ransomware does and never explain why offenders keep choosing hospitals, municipalities, and school boards as targets. Narration then reads the slide aloud instead of arguing over it. Both problems come from treating the task as a summary of reading rather than as an evidence-based claim that a criminological framework can carry.

Learning Outcomes Assessed

• Apply at least one criminological framework, such as situational crime prevention, routine activity theory, crime scripting, or subcultural theory, to a documented cybercrime problem.
• Assess the reliability of evidence drawn from peer-reviewed criminology, computer security research, and Canadian public data.
• Translate technical material for a non-specialist audience without losing precision.
• Design slides that carry the argument visually rather than reproducing paragraphs.
• Deliver a recorded presentation as a coordinated group, with clear division of labour and consistent voice.

Task Instructions

1. Form a group of two or three students by the end of Week 2 and submit the Topic Approval Form in D2L. Name the cybercrime problem, the population or organisation affected, the criminological framework you will apply, and three sources you have already read.
2. Choose one approved stream. Stream A covers ransomware against public infrastructure, including hospitals, municipal systems, and school boards. Stream B covers business email compromise and payment fraud. Stream C covers cybercrime-as-a-service markets, including access brokers and initial access sales. Stream D covers fraud against older adults, including romance and investment fraud. Instructors may approve a defensible alternative.
3. Build the argument around a single claim that the slides must prove. Write that claim as one sentence on the second slide, then let every following slide supply evidence for it or answer an objection to it.
4. Assemble 8 to 10 slides. Six content slides is the minimum a two-person group can defend in 12 minutes; eight is the ceiling before narration starts running over the time limit.
5. Record narration over the slides and submit the recording with the notes visible. The speaker notes are part of the submission, not a private script.
6. Close with two discussion questions for the class, drawn from the argument rather than from the reading list.
7. Submit a one-page contribution statement signed by every group member, naming the slides and research each person built. Unequal contributions lower the individual component of the delivery mark.

Presentation Architecture

Required Slide Sequence

• Slide 1, title slide. Course code, presentation title, group members, instructor, date.
• Slide 2, claim and roadmap. One sentence stating the argument, plus the three questions the presentation answers.
• Slide 3, the problem in numbers. One chart or table with a source line, drawn from Canadian data, an industry incident report, or a peer-reviewed study.
• Slides 4 and 5, offenders and opportunity structure. How the crime is organised, who does which task, and which opportunity conditions make it repeatable.
• Slides 6 and 7, framework application. Apply the chosen criminological framework step by step. A crime script must show stages and decision points. A situational prevention analysis must name the technique and the mechanism.
• Slide 8, response and its limits. Assess one policing, regulatory, or organisational response and state plainly what it fails to prevent.
• Slide 9, discussion questions. Two questions that a class can argue about.
• Slide 10, references. APA 7th edition, hanging indent, 8 to 12 entries.

Speaker Notes Requirements

• 150 to 200 words per content slide, written in full sentences rather than bullet fragments.
• At least one in-text citation in the notes of every evidence slide. Notes carry the evidence; slides carry the claim.
• Notes must include a spoken signpost for the transition into the next slide.
• No note reads the slide text aloud. A note that repeats the visible bullet earns no credit under the narration criterion.

Source Standards

• Eight to 12 references, with at least five peer-reviewed journal articles from criminology, criminal justice, or computer security outlets.
• Canadian public data is permitted and encouraged. Use Statistics Canada releases, Canadian Anti-Fraud Centre bulletins, or RCMP National Cybercrime Coordination Unit material where the claim concerns Canada.
• Vendor marketing pages, blog posts, and AI-generated summaries do not count toward the reference requirement.

Submission, Formatting, and Integrity

• Submit the slide file and the recorded narration as two uploads in the D2L assignment folder by 11:59 p.m. Eastern on your assigned presentation date.
• Use 16-point body text or larger on every slide. A slide that fails this test loses marks under visual communication.
• Late submissions lose 5 percent per day, matching departmental practice for written work in the course.
• Generative AI tools may support outlining and grammar checking. Fabricated citations, invented statistics, or unedited generated narration count as an academic integrity breach and are reported under the Lakehead University Student Code of Conduct.

Marking Criteria

Criterion and Weight	Level 1, 0 to 49%	Level 2, 50 to 64%	Level 3, 65 to 79%	Level 4, 80 to 100%
Problem framing and evidence, 25%	Topic is a description of a crime type with no claim; statistics unsourced or invented.	A claim appears but drifts; one or two sources carry the whole deck; data is dated or uncited.	Claim is clear and consistent; Canadian and peer-reviewed evidence support the main points.	Claim is narrow, contestable, and proved slide by slide; evidence mixes public data with current peer-reviewed work and each source earns its place.
Criminological analysis, 25%	No framework named; assertion replaces analysis.	Framework named but applied as a label; terminology used loosely.	Framework applied to specific features of the crime; connections between theory and behaviour are explained.	Framework does analytic work, including a limitation or a competing explanation that the group answers; theory and evidence are in genuine dialogue.
Slide design, 15%	Slides are dense paragraphs; font too small; no source lines.	Usable slides with crowded sections and inconsistent formatting.	Clean layout, readable type, tables or charts used where numbers matter.	Visual hierarchy guides the argument; charts are labelled and honest; nothing on a slide competes with the spoken point.
Speaker notes and narration, 20%	Notes missing, thin, or copied from the slides; narration reads text aloud.	Notes exist but summarise; citations rare; delivery uneven between members.	Notes argue in full sentences with citations; delivery is clear and evenly shared.	Notes build a spoken argument with signposts and evidence; narration sounds like expert testimony and stays inside the time limit.
Group coordination and response, 15%	One member does the work; discussion questions are generic; contribution statement missing.	Roles split unevenly; questions restate the topic; handovers are abrupt.	Balanced delivery with clean handovers; two discussion questions invite argument.	Coordination is invisible because transitions are seamless; questions open a genuine disagreement the class can pursue.

Example Student Response

Our claim is that ransomware against Ontario hospital networks persists because the offenders rent capability rather than build it, so disruption of one crew leaves the surrounding market untouched. Regional reporting shows repeated incidents against hospital groups since 2023, and the pattern matters more than any single attack. Reading offenders as a coordinated team of skilled hackers misplaces the skill. The market described in Cybercrime is (often) boring runs on an illicit infrastructure where access brokers sell entry, affiliates rent encryptors, and negotiators handle payment conversations, which means each actor can be replaced without breaking the chain (Collier et al., 2021). Situational prevention gives us the lever. Denying the initial access route, whether through unpatched remote services or stolen credentials, raises effort at a single stage that every downstream actor depends on. Awareness training alone leaves that stage open, because the route into a hospital network rarely runs through a distracted employee. Our recommendation therefore targets credential hygiene, mandatory multifactor authentication on remote access, and offline backup testing on a published schedule.

Canadian Data Sits Behind the Argument

Groups that ground the claim in Canadian figures score higher on the evidence criterion, and the sources are open. Statistics Canada publishes police-reported cybercrime counts and survey estimates of cyber incidents against businesses, both searchable through the Juristat catalogue, and the Canadian Anti-Fraud Centre reports fraud losses that dwarf the police-reported total because most incidents never reach a police service. Numbers from those sources expose the reporting gap rather than closing it, which makes an honest slide harder and more valuable than a bar chart of global losses. A presentation that states the gap, then explains why victim reporting behaviour varies by sector, demonstrates the analytic judgment examiners reward. Ransomware estimates drawn from incident reporting carry the same caution, since firms under-report for reputational reasons and insurers shape what becomes public. Students who name that distortion in one speaker note look like researchers rather than aggregators.

1. Cite the table number or release title for every figure, not the news article that reported it.
2. Separate police-reported counts from victimisation survey estimates and say which is which on the slide.
3. State the year of collection, because a 2023 figure presented as current misleads the audience.
4. Flag any estimate the group could not trace to a primary source, then drop it if it cannot be verified.

Why Awareness Campaigns Keep Missing

Students searching for help on this presentation often ask why cybercrime prevention advice keeps recommending training when the evidence points elsewhere. A systematic review of 352 studies found that situational techniques receive uneven attention and that linkages between specific techniques and reduced opportunity are rarely tested, which leaves practitioners repeating the ones that are easy to measure (Ho et al., 2022). Holt’s assessment of the field reaches a compatible conclusion: criminological work on cybercrime has grown fast but remains uneven in method and theory, so claims about what works deserve caution (Holt, 2022). Pushing further, the practical split is between interventions that change the offender’s cost calculation and interventions that ask a user to behave differently under time pressure. Spear-phishing research and business email compromise cases show that social engineering defeats training when the request arrives from a plausible sender at a plausible moment. A stronger slide pairs one opportunity-reduction measure with one detection measure and states what each can and cannot achieve. Groups that make that comparison in a table earn marks that a paragraph of advice never will.

Where Groups Lose the Delivery Mark

Narration separates a strong presentation from a competent one, and the failures repeat. Recorded narration that runs to 14 minutes when the brief allows 12 loses marks under time discipline, so rehearse against a timer before the final take. Notes that duplicate the visible bullets waste the format, since a viewer can read faster than a presenter can speak. Handovers matter more in a recording than in a live room, because an abrupt cut between speakers reads as two separate presentations stitched together. Coordination shows in small choices: a shared opening sentence, a signpost that names the next speaker, and a closing that returns to the claim on slide two. Recording in one take with a prepared script beats six takes edited together, because the group’s command of the material is what the marker is judging.

Final Position on the Task

Assessment 2 rewards a group that makes one claim and defends it with evidence a reader can check. Choosing a narrow crime problem beats covering the whole of cybercrime, because twelve minutes runs out quickly once the group starts explaining terminology. Building the deck around a framework forces the analysis past description, and the framework earns its keep when it exposes something the audience would otherwise miss. Canadian data adds credibility as long as the reporting gap is named rather than hidden. Narration deserves as much rehearsal as the slides, since notes that argue aloud carry more marks than notes that restate bullets. Every choice in this brief pushes toward the same outcome: a recorded presentation that an instructor could use as an exemplar next term.

References

Collier, B., Clayton, R., Hutchings, A., & Thomas, D. R. (2021). Cybercrime is (often) boring: Infrastructure and alienation in a deviant subculture. The British Journal of Criminology, 61(5), 1407–1423. https://doi.org/10.1093/bjc/azab026

Ho, H., Ko, R. K. L., & Mazerolle, L. (2022). Situational Crime Prevention (SCP) techniques to prevent and control cybercrimes: A focused systematic review. Computers & Security, 115, 102611. https://doi.org/10.1016/j.cose.2022.102611

Holt, T. J. (2022). Understanding the state of criminological scholarship on cybercrimes. Computers in Human Behavior, 107493. https://doi.org/10.1016/j.chb.2022.107493

Lakehead University. (2024). CRIM 3370 Cybercrime and digital forensics: Course outline. Department of Criminology. https://www.lakeheadu.ca/sites/default/files/uploads/249/Internal/Criminology/CRIM%203370%20WAO.pdf

Statistics Canada. (2025). Police-reported crime statistics in Canada (Juristat, Catalogue no. 85-002-X). https://www150.statcan.gc.ca/n1/en/catalogue/85-002-x

Ransomware Against Canadian Healthcare: Why Opportunity Reduction Must Precede Awareness Training

Ransomware against Canadian healthcare organizations persists because attackers exploit predictable weaknesses in remote access, credential management, and recovery planning. The problem is therefore not simply that hospital staff lack cybersecurity knowledge; it is that healthcare networks continue to offer offenders accessible entry points, valuable data, and strong pressure to restore services quickly. Canadian healthcare systems hold sensitive patient records, depend on continuous access to clinical systems, and often cannot tolerate prolonged downtime. These conditions make hospitals attractive targets for ransomware groups seeking both financial payment and operational leverage.

The central argument is that Canadian hospitals can reduce ransomware harm more effectively by removing criminal opportunities through layered technical controls than by relying primarily on employee awareness training. Situational crime prevention offers a useful framework because it examines how offenders select targets, enter systems, and convert access into ransom demands. Evidence from the Communications Security Establishment shows that ransomware remains a persistent threat to Canadian organizations, with healthcare particularly exposed because attacks can interrupt patient care and force manual workarounds (Communications Security Establishment [CSE], 2023). The analysis below examines the scale of the problem, the organisation of ransomware offending, the opportunity structure surrounding hospitals, and the limits of current prevention responses.

The problem in Canadian context

Ransomware is a form of extortion in which offenders encrypt systems or steal data, then demand payment for decryption, non-publication, or both. In healthcare, the harm extends beyond financial loss. A successful attack can delay appointments, disrupt diagnostic imaging, prevent access to patient records, and force clinicians to revert to paper-based procedures. CSE notes that more than 400 healthcare organizations in Canada and the United States experienced ransomware attacks between March 2020 and the publication of its 2023–2024 assessment (CSE, 2023).

Canadian data also reveal a broader reporting problem. Statistics Canada recorded 225 police-reported cybercrimes per 100,000 Canadians in 2024, more than double the comparable 2018 rate of 91.9 per 100,000 (Statistics Canada, 2025). Fraud accounted for 46,301 cyber-related incidents in 2024, representing almost half of all cybercrime incidents reported to police (Statistics Canada, 2025). These figures do not measure ransomware directly, but they demonstrate that cyber-enabled offending has become a substantial and growing category of police-reported crime.

The reporting gap matters. The Canadian Anti-Fraud Centre received 108,878 fraud reports in 2024 and recorded reported losses exceeding $638 million; it also estimated that the number of victims was likely much higher than the number of reports received (Canadian Anti-Fraud Centre [CAFC], 2025; Royal Canadian Mounted Police [RCMP], 2025). A hospital ransomware incident may therefore appear in public reporting only when it causes a major service disruption, triggers a regulatory notification, or becomes commercially visible through an insurer or vendor. Groups should treat published incident counts as a minimum estimate rather than a complete measure of victimisation.

Offenders and opportunity

Ransomware offending is rarely the work of a single technically skilled actor. Contemporary ransomware operations often divide labour across initial-access brokers, malware developers, affiliates who deploy encryption tools, negotiators, and money-laundering specialists. Collier, Clayton, Hutchings, and Thomas (2021) describe this arrangement as an illicit infrastructure: offenders rely on shared services, marketplaces, and specialist roles rather than building every capability themselves. The practical consequence is that arresting or disrupting one group does not necessarily remove the market that supplied its access, tools, or payment infrastructure.

This division of labour explains why ransomware remains commercially attractive. An access broker may obtain credentials through phishing, credential theft, or the purchase of compromised accounts. An affiliate can then use that access to move through a network, identify valuable systems, disable backups, and deploy encryption. Payment negotiators manage communication with the victim, while laundering networks convert cryptocurrency payments into usable funds. Each participant can be replaced without dismantling the entire operation.

Hospitals fit this model because they combine high-value data with urgent operational needs. Patient records, billing systems, diagnostic equipment, and scheduling platforms create multiple points of potential leverage. An attacker does not need to understand clinical medicine to disrupt care; access to scheduling, imaging, or electronic record systems can create enough pressure to make payment appear attractive. The 2021 cyber incident affecting Newfoundland and Labrador’s Eastern Health region illustrates this risk, as the compromise forced staff to rely on paper-based procedures and delayed thousands of appointments and medical procedures (CSE, 2023).

Applying situational crime prevention

Situational crime prevention assumes that crime becomes more likely when opportunities are easy, rewards are high, risks are low, and excuses are available. In a hospital setting, the relevant question is not whether employees can be persuaded to behave cautiously. It is whether the organisation has made initial access, lateral movement, encryption, and payment difficult enough to change the offender’s cost-benefit calculation.

Ho, Ko, and Mazerolle (2022) reviewed situational crime prevention techniques for cybercrime and found that prevention research often focuses on easily measured interventions without testing whether particular techniques actually reduce criminal opportunities. Their finding is important for healthcare policy. Mandatory cybersecurity training is easy to deliver and document, but it does not remove the technical route through which ransomware actors enter a network. A hospital can train staff to recognise phishing messages while leaving remote desktop services exposed, passwords reused across systems, or administrative accounts protected only by a password.

A more defensible prevention strategy begins at the point of entry. Hospitals should require multifactor authentication for remote access, restrict administrative privileges, segment clinical networks from administrative systems, and monitor abnormal login behaviour. These measures increase offender effort because stolen credentials alone no longer provide reliable access. They also reduce anonymity and increase the chance of detection because unusual access patterns become visible to security teams.

Backup protection addresses a different stage of the crime script. Ransomware groups often attempt to delete or encrypt backups before deploying the final payload, because intact backups reduce the victim’s incentive to pay. Offline, immutable, and regularly tested backups therefore reduce the expected reward of an attack. A hospital that can restore essential systems quickly faces less pressure to negotiate, even if attackers have encrypted part of its network.

Why awareness training has limits

Awareness training remains necessary, but it cannot carry the main burden of ransomware prevention. Staff education may reduce some phishing successes, particularly where messages are obvious or poorly targeted. However, ransomware operators increasingly use convincing impersonation, urgent requests, and compromised legitimate accounts. In such cases, the employee receives a message that appears credible because the attacker has already obtained access to a real mailbox or supplier relationship.

The limitation is structural rather than moral. Training asks individuals to make correct security decisions under pressure, whereas situational prevention changes the environment in which those decisions occur. A clinician should not need to identify a sophisticated phishing message to prevent a network-wide ransomware event. The organisation should ensure that a compromised mailbox does not provide access to critical systems, and that a single employee error cannot disable backups or encrypt an entire hospital network.

Peer-reviewed healthcare research supports this broader view. A systematic review of cybersecurity and ransomware research in healthcare found that technical and organisational vulnerabilities interact with human factors, meaning that no single intervention adequately addresses the risk (Kumar et al., 2024). The review’s implication is not that training is useless. It is that training must sit alongside access controls, network design, recovery testing, and incident-response planning.

Response and its limits

Canadian policy has correctly identified ransomware as a persistent national threat. CSE’s 2025–2026 assessment reports that ransomware incidents affecting healthcare have increased worldwide and that the sector faces rising exposure because attacks directly disrupt essential services (CSE, 2025). The Canadian Centre for Cyber Security also identifies targeted ransomware, sometimes called “big game hunting,” as a major threat to healthcare, governments, and other critical infrastructure providers (CSE, 2023).

Law enforcement responses can disrupt infrastructure, seize criminal proceeds, and gather intelligence, but they cannot prevent every initial intrusion. International cooperation is necessary because ransomware groups often operate across jurisdictions, use hosting services in permissive jurisdictions, and convert proceeds through global payment networks. Domestic policing faces a further constraint: many incidents are never reported, while others are reported only after systems have already been compromised.

Organisational prevention therefore carries greater immediate value. Hospitals cannot eliminate ransomware risk, but they can make successful attacks slower, less profitable, and less damaging. Mandatory multifactor authentication, privileged-access management, network segmentation, offline backups, and recovery testing reduce the opportunity structure that offenders depend upon. These controls do not require every employee to become a cybersecurity expert; they make secure behaviour the default condition of the system.

Discussion questions

• Should Canadian hospitals be required to demonstrate offline backup recovery through regular public reporting, or would such requirements divert resources from direct patient care?

• If ransomware groups increasingly purchase initial access rather than develop it themselves, should Canadian policy focus more on disrupting access-broker markets than on prosecuting individual affiliates?

Conclusion

Ransomware persists in Canadian healthcare because hospitals offer offenders a high-value target, an urgent need for restoration, and technical entry points that remain too easy to exploit. Situational crime prevention shifts the response away from individual blame and toward the conditions that make an attack possible. Multifactor authentication, restricted privileges, segmented networks, and tested offline backups each remove a distinct opportunity in the ransomware process. Awareness training retains a supporting role, but it cannot substitute for controls that make compromise harder, detection faster, and recovery more reliable. A hospital that reduces criminal opportunity reduces both the likelihood of ransomware and the pressure to pay when an incident occurs.

References

Canadian Anti-Fraud Centre. (2025). 2024 annual statistical report. Government of Canada. https://antifraudcentre-centreantifraude.ca/annual-reports-2024-rapports-annuels-eng.htm

Collier, B., Clayton, R., Hutchings, A., & Thomas, D. R. (2021). Cybercrime is (often) boring: Infrastructure and alienation in a deviant subculture. The British Journal of Criminology, 61(5), 1407–1423. https://doi.org/10.1093/bjc/azab026

Communications Security Establishment. (2023). National cyber threat assessment 2023–2024. Government of Canada. https://www.cyber.gc.ca/en/guidance/national-cyber-threat-assessment-2023-2024

Communications Security Establishment. (2025). National cyber threat assessment 2025–2026. Government of Canada. https://www.cyber.gc.ca/sites/default/files/ncta-2025-2026-e.pdf

Ho, H., Ko, R. K. L., & Mazerolle, L. (2022). Situational Crime Prevention (SCP) techniques to prevent and control cybercrimes: A focused systematic review. Computers & Security, 115, 102611. https://doi.org/10.1016/j.cose.2022.102611

Holt, T. J. (2023). Understanding the state of criminological scholarship on cybercrimes. Computers in Human Behavior, 139, 107493. https://doi.org/10.1016/j.chb.2022.107493

Kumar, S., et al. (2024). Vulnerability to cyberattacks and sociotechnical solutions for cybersecurity in healthcare: A systematic literature review. Journal of Medical Internet Research. https://pubmed.ncbi.nlm.nih.gov/38820579/

Royal Canadian Mounted Police. (2025). The cost of fraud exceeds financial loss, victims say. Government of Canada. https://rcmp.ca/en/gazette/cost-fraud-exceeds-financial-loss-victims-say

Statistics Canada. (2025). Police-reported crime statistics in Canada, 2024 (Juristat, Catalogue no. 85-002-X). https://www150.statcan.gc.ca/n1/daily-quotidien/250722/dq250722a-eng.htm

The post Situational crime prevention for hospital ransomware in Canada appeared first on EssayBishops.