More than two decades after the publication of Cornish's seminal work about the scripttheoretic approach to crime analysis, this article examines how the concept has been applied in our community. The study provides evidence confirming that the approach is increasingly popular; and takes stock of crime scripting practices through a systematic review of over one hundred scripts published between 1994 and 2018. The results offer the first comprehensive picture of this approach, and highlights new directions for those interested in using data from cyber-systems and the Internet of Things to develop effective situational crime prevention measures.

Abstract-Scripts have been used in different disciplines to characterize how individuals conceptualize the conduct of goaloriented tasks. Cornish introduced this modelling approach to the field of environmental criminology as a more systematic way to identify offenders' decisions during the commission of crime. Despite the growing number of articles about crime scripts, there is limited information about the scripting process itself. In particular, there is no publication describing all of the activities involved in the scripting of crime in a comprehensive manner. As a result, the procedural aspects of physical and cybercrimes are predominantly modelled using intuitive rather than structured methods. To fill in this gap, the current study introduces the concept of crime script lifecycle and examine the stages involved in crime scripting process. Following a bottom-up approach, the research involved searching for information relevant to the production of crime scripts and synthesizing the results into a conceptual model. The resulting description of the crime scripting process should improve crime scripting practice, and create a roadmap for future research in this field.Index Terms-crime script, crime requirements, business process model, modus operandi.

Security decision-making is a critical task in tackling security threats affecting a system or process. It often involves selecting a suitable resolution action to tackle an identified security risk. To support this selection process, decision-makers should be able to evaluate and compare available decision options. This article introduces a modelling language that can be used to represent the effects of resolution actions on the stakeholders' goals, the crime process, and the attacker. In order to reach this aim, we develop a multidisciplinary framework that combines existing knowledge from the fields of software engineering, crime science, risk assessment, and quantitative decision analysis. The framework is illustrated through an application to a case of identity theft.

In recent years, there has been a growing interest in the modelling of crime commission processes, in particular crime scripting, in physical and cyber spaces. This article aims to demonstrate the limits of unstructured scripting approaches, and advocates the development of more systematic techniques. For this, we examined the differences and similarities between various scripts. Twenty-one participants were trained in crime scripting, and tasked to produce individual scripts based on the same video footage of a shop robbery. Content analysis was applied to the scripts, which involved classifying the different steps of the crime commission process and analyzing their distributions. A scoring system was then developed to assess the relative degree of completeness of each script, and linear regression computed using the number of activities included as the predictor variable. This research provides the first evidence of the limits of creating scripts using an intuitive approach, and the need for applying semistructured goal-based methods. 1