Keeping cybercrime authentic in a thriller

When I started writing the Thorkild Aske series, I knew the technical story behind the crime mattered as much as the human one. Readers who work in IT, cybersecurity, or law enforcement notice when an author gets the small details wrong. Worse, they notice when an author does not even know which questions to ask. So I developed a method for handling cybercrime in fiction that I trust, even when the subject gets pulled into territory I barely understand.

The approach below is part research, part craft, and part humility. It comes from years of writing thrillers across Scandinavia, the Pacific, and Australia, where I researched a setting that resembled both Sydney and Melbourne. None of it is glamorous. Most of it is sitting in cafés reading court case pages until my eyes blur.

Researching hackers without becoming one

The first question is when an author should stop researching and start writing. Spend too long on technical detail and the story stalls. Spend too little and the reader loses trust within a paragraph. I treat research as a layered process. Layer one is reading published cases. I read judgments from the Federal Court of Australia, transcripts from the Australian Cyber Security Centre's annual threat reports, and public findings under the Notifiable Data Breaches scheme. These are not exciting sources. They are dry, legal, and slow. They are also the only sources that tell me what really happens.

Layer two is talking to people who do the work. I correspond with a forensic analyst based in Brisbane who walks me through how a real intrusion looks on a server. I have coffee every few months with a former AFP officer who explains what a search warrant contains and how long a forensic extraction takes. I do not put these conversations directly into a novel. I use them to write a scene an Australian reader will recognise as legitimate. The characters who pass through my pages are on the darker side of the law, but the procedural scaffolding they inhabit is real.

Balancing accuracy with narrative pace

Accuracy has a cost, and that cost is pace. A reader will forgive a small technical shortcut if the story moves. They will not forgive a five-page lecture on encryption protocols. I solve this by choosing two or three technical anchors per novel and then collapsing everything else. In one Aske book, the anchor was a SIM-swap. I spent weeks understanding how Australian telcos handle porting fraud, how the ACSC documents the trend, and how a victim in Sydney actually discovers the swap. Every other cybercrime in that book was loose enough to serve the plot but tight enough to ring true.

I also use narrative compression to mask what I do not know. If a scene needs to look like a database exfiltration, I do not describe the SQL injection. I describe the look on the face of the investigator watching the logs. The reader fills in the rest, and the fiction holds up. There is a long tradition of this in crime fiction, and the influence of film noir on the visual style of my writing is something I have explored in detail elsewhere.

Building characters who understand the code

A thriller needs characters who speak the language of the crime. That does not mean every character needs to be a programmer. It means every character needs a vocabulary that fits their role. A junior analyst in Perth talks differently from a CFO in a Melbourne boardroom. A grey-hat freelancer in Manila talks differently from a federal agent in Canberra.

I give each technical character a profile built from a few recurring pieces.

Their toolset, written in plain language a non-technical reader can skim without losing the story.
Their blind spots, because every expert character needs a place where their expertise fails.
The slang they would actually use, drawn from real forums, court transcripts, and conversations with working analysts.

Sometimes the technical character is the protagonist. More often, the technical character is the one who explains the crime to a non-technical reader. Thorkild Aske is not a hacker. He is a man who has spent too long looking at the wrong side of human nature, and he needs someone to translate. That translator character carries a heavy load in any cybercrime story. Get the translator wrong and the whole story collapses. I spend as much time on that character as I do on the antagonist.

Australia as a cybercrime setting

Setting a thriller in Australia changes the technical story. Australian legislation around cybercrime is its own animal, and the laws that govern data, privacy, and interception shape what a fictional criminal can plausibly do. The Privacy Act and the Notifiable Data Breaches scheme set rules an Australian victim follows. The Telecommunications (Interception and Access) Act sets rules an investigator follows. AUSTRAC sets rules around money movement. A reader in Brisbane knows when an author fudges these. A reader in Sydney knows when an author invents an agency that does not exist.

Local realities matter in smaller ways too. The way an Australian user thinks about the NBN, the way an Australian bank talks about fraud in plain English, the way a small business in Adelaide reacts to a ransomware note. I want the small details to feel lived in. I want a reader to recognise the hold music of their own telco, the phrasing Scamwatch uses, or the phrasing a real AFP media release uses. When an Australian reader finishes a chapter and does not stop to question the procedural detail, I have done my job. A separate reviewer raised similar points about procedural credibility, which is a useful benchmark.

What I keep on the desk while writing

A few items stay open in a tab while I draft. None of them is a hacker's handbook. All of them are sources I trust.

The ACSC Annual Cyber Threat Report for the year I am writing about, so the technical landscape matches the year on the page.
A copy of the relevant state privacy guidance, so I do not accidentally invent a law that does not exist.
A notebook of Australian slang and idiom, refreshed on each trip to Melbourne or Sydney, so the dialogue stays current.
A long-running email exchange with a contact in incident response, who tells me plainly when I have crossed a line.

These are not glamorous tools. They are unglamorous tools, and unglamorous tools are the ones that make a thriller feel real. The aesthetic of cybercrime in fiction should not look like a Hollywood hacker montage. It should look like a quiet afternoon in a Surry Hills office, with someone reading a log file and waiting for the next call.

My next step is a trip to Canberra in spring to walk through the National Archives with a researcher, looking at how Australian federal investigations have been documented over the last two decades.