What Is Cyber Crime

Cyber crime is criminal activity that targets computer systems, networks, or uses digital technology to commit traditional crimes like fraud and theft. It's no longer a fringe threat faced only by large corporations — individuals, small businesses, and organizations of all sizes deal with attempted attacks daily. Understanding what cyber crime is, how it works, and what you can do about it is the first step toward protecting yourself and knowing when to call for help.

This guide covers the core types of cyber crime, real-world examples, the legal framework that prosecutes these offenses, and practical steps you can take if you're targeted. At Universal Investigations Agency, we've worked on cases where a single phishing email led to hundreds of thousands of dollars in losses, and others where victims didn't realize they'd been compromised until months after the initial breach. Professional cyber crime investigation services help businesses and individuals identify the scope of intrusion, preserve digital evidence, and coordinate with law enforcement when needed. The more you understand about how these crimes unfold, the better positioned you are to prevent them — or respond effectively when prevention fails.

What Exactly Is Cyber Crime?

Cyber crime is any illegal activity that involves computers, computer networks, or digital devices as either the target or the tool. The legal definition under federal law, particularly the Computer Fraud and Abuse Act, encompasses unauthorized access to protected systems, theft of data, distribution of malicious software, and using digital means to commit fraud or harassment.

There are two primary categories. First, crimes where technology itself is the target — hacking into a company's network to steal customer data, launching a distributed denial-of-service attack to take down a website, or exploiting software vulnerabilities to gain unauthorized access. Second, crimes where technology is the tool — using email to run phishing schemes, deploying ransomware to extort businesses, or creating fake online storefronts to steal credit card information.

Both categories are prosecuted as serious offenses under federal and state law. The distinction matters because it determines investigative approach, evidence collection, and which agencies have jurisdiction. A data breach affecting a hospital's patient records involves different legal considerations than someone using a stolen identity to file fraudulent tax returns, even though both are cyber crimes.

What Are the Main Types of Cyber Crime?

Cyber crime takes many forms. Some target your money directly; others steal your identity or hold your data hostage. Understanding the major categories helps you recognize threats when they appear and respond appropriately.

Phishing and Social Engineering Attacks

Phishing is the practice of sending fraudulent emails, text messages, or creating fake websites designed to trick you into revealing sensitive information — passwords, credit card numbers, Social Security numbers, or login credentials. These messages often impersonate trusted entities: your bank, the IRS, a shipping company, or even a colleague or family member.

The tactics are consistent. Urgency: "Your account will be locked unless you verify now." Fear: "Suspicious activity detected on your account." Curiosity: "You've received a secure message." The goal is to bypass your rational thinking and get you to click a malicious link or open an infected attachment before you scrutinize the sender.

Phishing is the entry point for most successful cyber attacks. Once a threat actor has your credentials, they can access your accounts, move laterally through a corporate network, or sell your information on dark web marketplaces. Social engineering — manipulating people into breaking security procedures — is more effective than brute-force hacking in the majority of cases.

Ransomware and Malware Infections

Ransomware is malicious software that encrypts your files and demands payment — usually in cryptocurrency — for the decryption key. You boot up your computer and find every document, photo, and database locked, with a message demanding thousands or millions of dollars to restore access.

Ransomware spreads through phishing emails with infected attachments, malicious downloads disguised as legitimate software, and exploitation of unpatched vulnerabilities in operating systems or applications. The impact has escalated dramatically: hospitals forced to divert ambulances because medical records are inaccessible, municipal governments unable to process payroll, businesses shut down for weeks while attempting recovery.

Other malware types include spyware that monitors your activity and steals credentials, trojans that disguise themselves as legitimate programs while creating backdoors for attackers, and keyloggers that record every keystroke to capture passwords and financial information. The common thread is unauthorized software installed without your knowledge or consent, operating in the background while you use your device normally.

Identity Theft and Financial Fraud

Identity theft is the unauthorized use of your personal information — name, Social Security number, date of birth, address — to commit fraud. Criminals use stolen identities to open credit card accounts, take out loans, file fraudulent tax returns to claim refunds, access existing bank accounts, or obtain medical services.

Cyber criminals harvest this data through multiple channels: large-scale data breaches that expose millions of records, phishing schemes that trick individuals into providing information directly, malware that scrapes files from infected computers, or purchasing comprehensive identity packages on dark web marketplaces. A single data breach can provide enough information to impersonate you across dozens of institutions.

The damage extends far beyond immediate financial loss. Victims spend months disputing fraudulent charges, correcting credit reports, proving to banks and creditors that they didn't authorize transactions, and dealing with collection agencies for debts they never incurred. The average recovery time is measured in hundreds of hours, not counting the emotional toll of having your financial identity compromised.

Hacking and Unauthorized Access

Hacking is gaining unauthorized access to computer systems, networks, or individual accounts. The motivation varies: stealing proprietary data for corporate espionage, accessing customer information to sell or exploit, sabotaging a competitor's operations, or simply proving capability and reputation within hacker communities.

Common methods include exploiting weak or reused passwords through credential stuffing attacks (trying stolen username-password pairs across multiple sites), brute-force attacks that systematically try password combinations until one works, exploiting known vulnerabilities in outdated software, or using social engineering to trick employees into revealing access credentials.

There's an important distinction between ethical hacking — penetration testing performed with authorization to identify security weaknesses — and criminal hacking. Organizations hire security professionals to attempt to breach their systems so vulnerabilities can be fixed before malicious actors exploit them. Criminal hacking lacks authorization and violates federal law regardless of whether data is actually stolen or damage is done; unauthorized access itself is the crime.

Distributed Denial-of-Service (DDoS) Attacks

A DDoS attack overwhelms a server, website, or network with massive amounts of traffic from multiple sources, making it unavailable to legitimate users. Think of it as thousands of people trying to enter a store simultaneously, blocking the entrance so actual customers can't get in.

Criminals deploy DDoS attacks for several reasons: extortion (demanding payment to stop the attack), competitive sabotage (taking down a rival's e-commerce site during peak sales periods), or as a distraction while conducting other attacks (stealing data while security teams focus on restoring service). The attacks are often executed using botnets — networks of infected computers and IoT devices controlled remotely without their owners' knowledge.

The business impact can be severe. An e-commerce site down for hours loses direct revenue and customer trust. Financial institutions face regulatory scrutiny when services are unavailable. The cost of mitigation — specialized network security services to absorb and filter attack traffic — adds to the damage.

Online Harassment and Cyberstalking

Cyber crime isn't limited to financial theft or data breaches. Crimes against individuals include cyberstalking, online harassment, threats, doxing (publishing private information to facilitate harm), and sextortion (threatening to release intimate images unless demands are met).

Perpetrators use social media platforms, email, messaging apps, and public forums to intimidate, control, or humiliate victims. The harassment often escalates over time and crosses into physical stalking or violence. These crimes have serious psychological impacts — anxiety, depression, fear for personal safety — and they're prosecutable under both federal law and state statutes.

Law enforcement increasingly recognizes online harassment as criminal behavior, not "just the internet." Documentation is critical: screenshots, saved messages, email headers, timestamps. Many victims wonder can you get arrested for online harassment — yes, and prosecution is becoming more common as courts and investigators develop expertise in digital evidence. Related questions like is cyber bullying a crime have similar answers: the behavior matters more than the platform it occurs on.

How Does Cyber Crime Work?

Most cyber attacks follow a predictable lifecycle, though the timeline varies from minutes to months. Understanding this process reveals why these crimes are so effective and why early detection matters.

Reconnaissance comes first. Attackers gather information about targets — employee names and email addresses scraped from LinkedIn, software versions visible in job postings, organizational structure visible on the company website. The goal is to identify vulnerabilities and craft convincing phishing messages or find unpatched systems to exploit.

Initial compromise is the entry point. This might be a phishing email that delivers malware when an attachment is opened, a malicious link that exploits a browser vulnerability, or a brute-force attack on an account with a weak password. At this stage, the attacker gains a foothold — often on a single computer or account.

Establishing persistence and expanding access follows. Attackers install backdoors so they can return even if the initial entry point is discovered, escalate privileges to access more sensitive systems, move laterally through the network, and disable or evade security software. In corporate breaches, this phase can last weeks or months while attackers map the network and locate valuable data.

Executing the crime is the payoff. Data is exfiltrated, ransomware is deployed, credentials are stolen, or fraudulent transactions are initiated. In many cases, attackers maintain access even after achieving their initial objective, returning later for additional compromises.

Covering tracks is the final phase. Attackers delete logs, remove malware (or leave only dormant code), and use encryption or anonymization tools to obscure their identity and location. This makes attribution difficult and investigation time-consuming.

The critical insight: most successful attacks exploit human behavior, not just technical vulnerabilities. A perfectly patched system is still vulnerable if an employee clicks a phishing link and enters their password on a fake login page. Security awareness and skepticism are as important as security software.

What Are Real-World Examples of Cyber Crime?

Abstract definitions matter less than concrete examples. Here are incidents that illustrate different types of cyber crime and their real-world impact.

The Target data breach in 2013 compromised 40 million credit and debit card numbers plus personal information for 70 million customers. Attackers gained access through credentials stolen from a third-party HVAC vendor, moved laterally through Target's network to reach point-of-sale systems, and installed malware that captured payment card data as customers swiped cards. The breach cost Target over $200 million in settlements, legal fees, and security improvements, plus immeasurable damage to customer trust.

The Colonial Pipeline ransomware attack in May 2021 forced the shutdown of a pipeline supplying 45% of the East Coast's fuel, causing gas shortages and panic buying across multiple states. Attackers used a compromised password to access the company's network and deployed ransomware. Colonial paid $4.4 million in cryptocurrency (later partially recovered by the FBI) to restore operations. The incident demonstrated how cyber attacks on critical infrastructure create physical-world consequences beyond data or money.

IRS tax refund fraud schemes involve criminals filing fraudulent tax returns using stolen Social Security numbers and personal data, claiming refunds that are deposited to accounts they control. The IRS identified $5.8 billion in confirmed identity theft tax fraud in a single year. Victims often discover the fraud only when they attempt to file legitimate returns and are told one has already been filed. Resolution requires proving your identity to the IRS, amending returns, and waiting months for legitimate refunds while the investigation proceeds.

The Equifax breach in 2017 exposed personal information — names, Social Security numbers, birth dates, addresses, and driver's license numbers — for 147 million people. The breach exploited a known vulnerability in web application software that Equifax failed to patch despite public warnings. This incident highlighted how institutional negligence amplifies cyber crime impact: the data stolen wasn't from careless individuals but from a credit bureau holding sensitive information that consumers never chose to provide.

What Are the Effects and Costs of Cyber Crime?

The impact of cyber crime extends far beyond the immediate technical incident. Quantifying costs helps illustrate why prevention and rapid response matter.

For individuals, the FBI's Internet Crime Complaint Center (IC3) reported over $10.2 billion in losses from cyber crime complaints in 2022 alone. Identity theft victims spend an average of 200 hours and over $1,300 resolving fraudulent accounts and repairing credit damage. But these figures miss hidden costs: missed work, emotional distress, relationship strain, and the persistent anxiety of wondering what else might be compromised.

Businesses face even steeper costs. The average data breach costs $4.35 million according to recent industry research, factoring in incident response, legal fees, regulatory fines, notification costs, credit monitoring for affected customers, and lost business. Operational downtime from ransomware or DDoS attacks can run hundreds of thousands of dollars per hour for e-commerce sites or critical infrastructure. Smaller businesses often can't absorb these losses — 60% of small companies that suffer a cyber attack close within six months.

Reputational damage is harder to measure but no less real. Customers who lose trust after a breach take their business elsewhere. Partners and investors question leadership and security practices. Regulatory scrutiny intensifies, especially in healthcare, finance, and industries handling sensitive personal data.

At the societal level, cyber crime threatens critical infrastructure, undermines trust in digital commerce and communication, and creates opportunities for nation-state actors to conduct espionage or sabotage. Healthcare organizations hit by ransomware delay surgeries and divert emergency patients. Municipal governments lose access to property records, payroll systems, and emergency services databases. The interconnectedness that makes modern systems efficient also makes them vulnerable to cascading failures when cyber attacks succeed.

How Is Cyber Crime Investigated?

Investigating cyber crime requires specialized skills and tools. The process differs significantly from traditional criminal investigation because evidence is digital, perpetrators may operate from anywhere in the world, and the crime scene is often dispersed across multiple systems and jurisdictions.

Preserving digital evidence is the first priority. Unlike physical evidence, digital files can be altered or deleted instantly, intentionally or accidentally. Investigators create forensic images — exact bit-by-bit copies of hard drives, servers, or mobile devices — so analysis doesn't modify the original evidence. Chain of custody must be documented meticulously because digital evidence is easily challenged in court if handling procedures are questioned.

Tracing digital footprints comes next. This includes analyzing log files to identify when unauthorized access occurred, tracing IP addresses to determine the source of attacks (acknowledging that sophisticated attackers route traffic through multiple proxies and VPNs), examining email headers to verify sender authenticity, and following cryptocurrency transactions used for ransomware payments or dark web purchases.

Malware analysis reveals how an attack worked. Digital forensics specialists reverse-engineer malicious code to understand its functionality, identify command-and-control servers it communicates with, and determine what data was accessed or exfiltrated. This technical work often provides critical evidence linking specific threat actors to incidents.

Following financial transactions is particularly important in fraud and ransomware cases. Investigators track where stolen funds were transferred, whether money was laundered through cryptocurrency exchanges or shell companies, and which accounts received proceeds. Financial institutions cooperate with law enforcement, but cryptocurrency presents challenges due to pseudonymity and decentralized exchanges.

Coordination with law enforcement agencies is essential for prosecution. The FBI investigates federal cyber crimes and operates the Internet Crime Complaint Center. The Secret Service handles financial fraud and payment card crimes. State and local agencies investigate crimes within their jurisdiction. International cooperation through Interpol and bilateral agreements helps pursue attackers operating from foreign countries.

Private investigators play a distinct role, particularly in corporate incidents or situations requiring discretion before law enforcement involvement. At Universal Investigations Agency, digital forensics and cyber crime investigation often start with securing compromised systems, identifying the scope of intrusion, and determining whether employee misconduct, external attackers, or both are involved. Businesses may need evidence to terminate employees, support civil litigation, or decide whether criminal prosecution is warranted. Sometimes clients ask can private investigators hack social media or digital systems to gather evidence — the answer is no, ethical investigators use legal methods — but we can analyze devices, recover deleted files, and trace digital activity within legal and technical boundaries.

The challenges are significant. Jurisdictional issues arise when attackers operate from countries with weak cyber crime laws or no extradition treaties. Anonymization tools like Tor and encrypted communications make attribution difficult. Encryption protects data in transit and at rest, which is beneficial for privacy but can hinder investigation when applied by criminals. Evidence quality varies — incomplete logs, overwritten data, or compromised systems that were cleaned before investigation began all limit what can be determined with certainty.

What Laws Address Cyber Crime?

Multiple federal statutes criminalize various forms of cyber crime. Understanding the legal framework helps clarify what's prosecutable and what penalties apply.

The Computer Fraud and Abuse Act (CFAA) is the primary federal statute. Enacted in 1986 and amended multiple times, it criminalizes unauthorized access to protected computers, exceeding authorized access, trafficking in passwords, threatening to damage computer systems, and transmitting malicious code. Penalties range from fines to imprisonment up to 20 years for repeat offenses or cases involving significant damage or threats to public safety.

The Electronic Communications Privacy Act prohibits unauthorized interception of electronic communications and accessing stored electronic communications without authorization. This covers wiretapping, email interception, and unauthorized access to cloud storage accounts.

The Identity Theft and Assumption Deterrence Act makes it a federal crime to knowingly transfer, possess, or use another person's identification with intent to commit unlawful activity. Penalties include fines and imprisonment up to 15 years for identity theft in connection with terrorism or other serious crimes.

The USA PATRIOT Act expanded cyber crime provisions, particularly regarding jurisdiction and surveillance authority for terrorism-related cases. It also strengthened penalties for hacking and increased law enforcement capabilities to investigate cyber crimes that cross state or international borders.

State laws complement federal statutes. Every state has enacted computer crime laws, many modeled on the CFAA but with variations in definitions, thresholds for criminal charges, and penalties. States also prosecute cyber-enabled traditional crimes — fraud, harassment, stalking — under existing statutes when technology is the tool rather than the target.

International cooperation is critical because cyber crime rarely respects borders. Extradition treaties, mutual legal assistance agreements, and organizations like Interpol and Europol facilitate cross-border investigations and prosecution. Some countries are more cooperative than others; attackers operating from jurisdictions hostile to U.S. law enforcement face little risk of extradition even when attribution is clear.

Prosecution depends on several factors: jurisdiction (federal vs. state, which agency has primacy), severity of harm (dollar losses, number of victims, threat to critical infrastructure), quality of evidence, and attribution confidence. Civil lawsuits can run parallel to criminal prosecution, with victims suing perpetrators or negligent organizations for damages even when criminal charges are pending.

How Can You Report Cyber Crime to Police or Authorities?

Knowing where and how to report cyber crime improves the chance of investigation and may help recover losses or prevent additional harm. Different agencies handle different types of incidents.

For immediate threats or ongoing crimes — someone actively draining your bank account, stalking or threatening you online, or a crime involving minors — contact local police first. Many departments now have cyber crime units or detectives trained in digital evidence. Local police can also coordinate with federal agencies when cases require specialized resources.

The FBI's Internet Crime Complaint Center (IC3) at ic3.gov is the central federal reporting mechanism for cyber crime. File a complaint if you've been a victim of online fraud, identity theft, hacking, ransomware, business email compromise, or any internet-facilitated crime. The IC3 collects complaints, analyzes trends, and refers cases to appropriate law enforcement agencies for investigation. Filing a report creates an official record even if your individual case isn't immediately investigated.

The Federal Trade Commission handles identity theft reporting through IdentityTheft.gov. This site guides you through a recovery plan, generates an official FTC Identity Theft Report (used to dispute fraudulent accounts), and helps you report to credit bureaus and other relevant organizations. It's not criminal reporting per se, but it creates documentation and initiates resolution processes.

For phishing and email scams, forward the fraudulent message to the Anti-Phishing Working Group at reportphishing@apwg.org. This industry coalition shares threat intelligence to disrupt phishing operations and identify patterns.

If the crime involves financial fraud, notify your bank or credit card company immediately. Federal law provides consumer protections for unauthorized charges, but timely reporting is critical — delays can limit your ability to recover funds or dispute transactions. Banks also have fraud investigation units and may cooperate with law enforcement.

Documentation is essential regardless of which agency you contact. Save everything: screenshots of fraudulent messages, emails with full headers, transaction records, timestamps, correspondence with supposed vendors or contacts, and notes about phone calls or other communications. Digital evidence degrades quickly as emails are deleted, accounts are closed, and logs are overwritten. Capture evidence immediately, even before you know whether you'll file a formal report.

Private investigators can assist with evidence gathering before or alongside law enforcement reporting, especially in corporate cases or situations involving employee misconduct. Businesses may want to determine the scope of a breach, identify responsible parties, and secure systems before making a public report or involving law enforcement. Sensitive cases involving proprietary information, customer data, or potential civil litigation benefit from professional investigation that preserves evidence and builds a case while maintaining discretion.

How Can You Protect Yourself from Cyber Crime?

No security measure offers complete protection, but layered defenses dramatically reduce your risk. These practical steps address the most common attack vectors.

Use strong, unique passwords for every account. A strong password is at least 12 characters with a mix of uppercase, lowercase, numbers, and symbols. Unique means no password is reused across accounts — if one site is breached, attackers can't use that password to access your email, bank, or other services. Managing dozens of complex passwords requires a password manager, software that stores credentials in an encrypted vault and generates random passwords when you create new accounts.

Enable multi-factor authentication everywhere it's available. Multi-factor authentication (MFA) requires a second verification method beyond your password — a code sent to your phone, an authentication app, or a physical security key. Even if attackers steal your password through phishing or a data breach, they can't access your account without the second factor. MFA isn't foolproof, but it blocks the vast majority of automated credential-stuffing attacks.

Keep software and operating systems updated. Security patches fix vulnerabilities that attackers actively exploit. Enable automatic updates for your operating system, web browsers, and applications. The Equifax breach succeeded because a known vulnerability went unpatched despite public warnings; don't let convenience or postponed restarts leave you exposed to preventable compromises.

Recognize phishing red flags. Be skeptical of urgent requests, especially those demanding immediate action or threatening consequences. Verify sender email addresses carefully — phishing emails often use addresses that look similar to legitimate organizations but have subtle misspellings or wrong domains. Hover over links before clicking to see the actual URL. Legitimate organizations don't ask for passwords, Social Security numbers, or financial information via email. When in doubt, contact the supposed sender through a verified channel, not by replying to the message.

Avoid public Wi-Fi for sensitive transactions or use a virtual private network (VPN). Public networks at coffee shops, airports, and hotels are often unencrypted, meaning anyone on the same network can potentially intercept your traffic. VPNs encrypt your connection, protecting data even on untrusted networks. This matters when accessing email, banking, or entering passwords on public Wi-Fi.

Monitor financial statements and credit reports regularly. Check bank and credit card statements at least weekly for unauthorized charges. Small fraudulent transactions often precede larger theft as criminals test whether cards are monitored. Review credit reports from all three bureaus annually (free at AnnualCreditReport.com) to spot accounts opened in your name or other signs of identity theft.

Back up important data offline. Ransomware can't encrypt backups that aren't connected to your network. Maintain offline copies of critical files on external drives stored separately from your computer. Cloud backups are convenient but vulnerable to the same ransomware that encrypts your local files if the backup service is mounted as a drive or accessible through compromised credentials.

Perfect security is impossible. Determined, sophisticated attackers can breach well-defended systems, and new vulnerabilities emerge constantly. But layered defenses — strong passwords plus multi-factor authentication plus updated software plus skepticism about phishing — dramatically reduce the chance you'll be successfully targeted. Most cyber criminals pursue easy targets with weak security; making yourself a harder target shifts their attention elsewhere.

What Role Do Private Investigators Play in Cyber Crime Cases?

Law enforcement agencies investigate cyber crime, but private investigators serve a distinct function in many cases. The difference lies in scope, discretion, and the client's goals.

Corporate cyber incidents often require internal investigation before law enforcement involvement. A company discovers unusual network activity or missing data and needs to know what happened, who's responsible, and what was compromised — immediately, not after waiting weeks for law enforcement to allocate resources. Private investigators with digital forensics expertise can secure systems, analyze logs, identify the entry point, and determine whether the threat was external attackers, employee misconduct, or a combination.

Evidence preservation for civil litigation is another common scenario. If a business intends to sue a former employee for data theft, terminate someone for policy violations involving company systems, or pursue damages from a vendor whose negligence led to a breach, they need documented evidence that will hold up in court. At Universal Investigations Agency, we've handled cases where corporate espionage involved employees exfiltrating proprietary data to competitors — situations where criminal prosecution wasn't the client's priority but civil remedies and protective orders were essential.

Discretion matters when public disclosure would cause additional harm. A data breach triggers notification requirements under various state laws and regulations, but businesses benefit from understanding the scope privately before making public statements. Premature or incomplete disclosure can magnify reputational damage or alert attackers that they've been detected, prompting them to accelerate data exfiltration or cover tracks.

Personal cyber crime cases sometimes fall below law enforcement thresholds or involve issues where police can't intervene effectively. Victims of cyberstalking or online harassment who need evidence for restraining orders, divorce cases involving suspected infidelity documented through digital communications, or parents concerned about inappropriate online contact with minors all benefit from professional investigation that operates within legal boundaries but doesn't require criminal prosecution.

The intersection of cyber crime with traditional investigation is where private investigators add unique value. Employee theft involving company computers, intellectual property theft with digital evidence, divorce cases with digital components, and corporate fraud that leaves electronic trails all require investigators who understand both digital forensics and traditional investigative techniques.

Ethical boundaries are critical. Private investigators cannot engage in hacking, unauthorized access, or other illegal activity to gather evidence — doing so would make the evidence inadmissible and expose the investigator and client to criminal liability. We work within legal frameworks: analyzing devices with proper authorization, recovering deleted files from systems the client owns, and tracing digital activity through lawful methods.

When Should You Contact a Professional About Cyber Crime Investigation?

Understanding cyber crime is the foundation. Knowing how to respond when it happens — or when you suspect it has happened — matters just as much.

If you're dealing with a suspected data breach, unauthorized access to business systems, employee misconduct involving digital evidence, or fraud that's already cost you time and money, professional investigation can help you understand what occurred, preserve evidence, and decide on next steps. The sooner an investigation begins, the more digital evidence is recoverable and the faster you can contain damage.

Learn more about professional cyber crime investigation services at Universal Investigations Agency. We work with businesses and individuals to identify the scope of intrusions, trace digital activity, document evidence for legal proceedings, and coordinate with law enforcement when appropriate. Cyber crime moves fast, but so does an effective response.