What are some of the possibilities mentioned by Schuurman and Eijkman (2013) to compensate for the lack of empirical data in terrorism and counterterrorism research

Lance, a hacker, stole 15,000 credit card numbers and sold them on the black mar-ket, making millions. police caught lance, and two legal actions followed, one civil and one criminal. who will be responsible for bringing the civil case? what will be the outcome if the jury believes that lance was responsible for identity thefts? who will be responsible for bringing the criminal case? what will be the outcome if the jury believes that lance stole the numbers?