The World Is Rewriting the Rules Against Cyber-Enabled Transnational Crime

Maj. Vineet Kumar and Isharth Kumar

Founder & Global President, CyberPeace and Isharth Kumar (Intern) CyberPeace

PUBLISHED ON

Aug 19, 2026

Introduction

For two decades, cybercrime enforcement was built around a simple assumption: criminals hide behind screens, but they still operate mostly within reachable borders. That assumption has collapsed. Today's fraud economy runs through industrial-scale scam compounds in Myanmar and Cambodia, laundering networks spanning a dozen jurisdictions, and trafficked labour forced to defraud victims thousands of miles away. INTERPOL's own trend reporting has tracked victims from more than 60 countries pulled into scam operations that now stretch well beyond Southeast Asia into Africa, the Gulf, and Latin America. Global losses from this activity are estimated in the hundreds of billions of dollars annually, and the networks rebuild faster than any single government can dismantle them.

A Threat That Outran the Old Playbook

The mismatch is the real story behind a wave of policy moves in 2025 and 2026. The August 12, 2026 U.S. National Security Presidential Memorandum authorising vetted private companies to conduct government-supervised offensive cyber operations against transnational criminal organisations is one data point in that wave, not the whole story. Washington's move sits alongside a broader, still-unfinished experiment: can the international system build cooperative machinery fast enough to match a threat that treats borders as an inconvenience rather than a barrier?

Three Tracks of International Response

Three distinct but overlapping tracks have emerged.

The treaty: The most consequential recent development is the UN Convention against Cybercrime, adopted by the General Assembly in December 2024 and opened for signature in Hanoi in October 2025, where 71 states and the EU signed on. It is the first comprehensive global treaty addressing cybercrime and cross-border evidence sharing, building on the older Budapest Convention framework that has anchored cooperation since 2004. The Hanoi Convention needs 40 ratifications to enter into force; as of mid-2026, only three states (Qatar, Azerbaijan, and Vietnam) had ratified it, and human rights groups continue to warn that its broad scope could be used by authoritarian governments to justify surveillance and cross-border data requests dressed up as cybercrime cooperation. The treaty's fate will hinge on a Conference of States Parties process now being negotiated, where democracies are pushing for genuine multi-stakeholder oversight rather than a rubber stamp.

The operational track: While treaty diplomacy moves slowly, police-to-police cooperation has scaled up dramatically. INTERPOL's Operation First Light, now an annual standing initiative, illustrates the trajectory: its 2026 iteration spanned January to April, generated over 5,800 arrests and roughly $293 million in intercepted funds, and made heavy use of the Global Rapid Intervention of Payments mechanism to freeze illicit transfers before they disappeared into crypto wallets. A parallel operation led by Dubai Police with the FBI and Chinese authorities dismantled nine pig-butchering compounds across Myanmar, Indonesia, Cambodia, and Thailand, seizing more than $701 million. In Europe, Europol's EMPACT framework has entered a new 2026–2029 cycle, deepening ties with Frontex, Eurojust, and regional partners like Ameripol and the EL PACTTO programme in Latin America, effectively building a lattice of standing coordination bodies rather than one-off task forces. These operations demonstrate real capacity, but they also expose the "whack-a-mole" problem: raided compounds in Myanmar's Myawaddy region simply relocated, reconnected via satellite internet, and resumed operations within weeks, according to regional reporting.

The public-private track: This is where the U.S. memorandum fits into a genuinely global pattern rather than standing alone. The United Kingdom's 2026–2029 Fraud Strategy centres on a £31 million Online Crime Centre, opening in 2026, that fuses data from the National Crime Agency, the intelligence community, and private partners across banking, telecoms, and technology into a single coordination hub building on existing arrangements like Stop Scams UK, where telecom operators and banks already share suspicious SIM and account data in near real time. In the U.S., a June 2026 joint action involving the Justice Department, Meta, Microsoft, Google, Apple, and Coinbase froze $3.8 billion in cryptocurrency and disrupted 1.4 million fraud-linked accounts, showing that platform cooperation can move faster than formal treaty processes. Singapore has positioned itself as a hub for this model too, anchoring the Global Anti-Scam Alliance, which now includes ASEAN's own foundation as a member, bringing governments, banks, and tech platforms into shared intelligence loops. What distinguishes the U.S. memorandum is that it goes a step further than data-sharing: it authorises companies to take disruptive technical action, not just contribute intelligence, under a legal theory that folds them into the government's own authority under the Computer Fraud and Abuse Act's law-enforcement exception.

Where the System Still Breaks Down

Despite this activity, structural gaps, like jurisdiction, are the deepest ones. Scam compounds deliberately locate in special economic zones and border regions precisely because territorial control there is contested or weak, leaving no single government with clean authority to act. ASEAN's own policy work acknowledges that nearly every stage of the regional scam value chain crosses at least one border, which is why the bloc has shifted toward standing coordination bodies like its Working Group on Anti-Online Scams rather than relying on bilateral requests.

Attribution and accountability lag behind operational tempo. Financial intelligence and blockchain analytics have improved enforcement precision, but identifying the human traffickers and financiers sitting above front-line scam operators remains slow, uneven, and dependent on political will in host countries.

Governance of the newer public-private authorities is also unsettled. Human rights advocates flag that expanding both the Hanoi Convention's surveillance-adjacent powers and unilateral hack-back authorities like the U.S. memorandum could, without careful oversight, blur the line between fighting organised fraud and enabling broader digital overreach. The U.S. memorandum's own guardrails, which are a ban on operations causing serious injury or rising to a use of force, mandatory federal sign-off, and a $1 million forfeitable bond, reflect an awareness of that risk, but its implementing procedures remain classified, and comparable transparency gaps exist in several other national programs.

The Emerging Consensus

What's notable is not any single instrument but the convergence: nearly every serious national or regional response now combines the same three ingredients deeper platform and financial-sector data sharing, standing multilateral operational coordination, and a cautious expansion of what non-state actors are permitted to do. The countries and blocs making the fastest progress, from the UK's Online Crime Centre to INTERPOL's payment-interdiction tools to ASEAN's regional information-sharing arrangement, are the ones treating cyber-enabled transnational crime as a persistent infrastructure problem rather than a series of discrete crimes to be prosecuted after the fact. Whether that convergence produces durable results or simply better-coordinated whack-a-mole will depend on the unglamorous work still ahead: ratifying treaties, writing classified rulebooks, and building the cross-border trust that lets financial and technical data move as fast as the criminals do.

Conclusion

Transnational cybercrime has outgrown fragmented national enforcement. The emerging combination of international treaties, operational cooperation, and public-private partnerships offers a stronger response, but serious gaps in jurisdiction, accountability, and oversight remain. Ultimately, success will depend on whether states can build cooperation and safeguards capable of matching criminals’ speed, adaptability, and global reach.

Sources

‍

PUBLISHED ON

Aug 19, 2026

Related Blogs

E-Vehicles and Data Privacy: Concerns and Considerations

January 8, 2024

Introduction

The advent of Electronic Vehicles (EVs) represents a transformative leap towards a more sustainable and environmentally conscious transportation future by nations. However, as these vehicles become increasingly connected and reliant on advanced technological systems, a parallel concern emerges—data privacy. Integrating sophisticated technologies in EVs, such as GPS tracking, biometric authentication, and in-car connectivity, raises substantial questions about the collection, storage, and potential misuse of sensitive personal information. This intersection of automotive innovation and data privacy underscores the need for comprehensive solutions and regulatory frameworks to ensure that the benefits of electric vehicles are realised without compromising the privacy and security of their users.

Electronic vehicles primarily record three types of data;

Driving behaviour and patterns: The e-vehicle records braking and driving patterns, including acceleration, speed, and swerve. Some vehicles even track air conditioning usage and airbag deployment to determine the point of failure in the event of a crash.
Location data: The e-vehicles also track GPS systems to gauge the speed and direction of the vehicle.
EV functions and use of telematic services: Monitoring of EV functions includes battery use management, battery charging history, battery deterioration, electrical system functions and software version information.

Data Privacy requirements of companies

Companies manufacturing e-vehicles are saddled with several data privacy requirements as concerns about consumer safety. Data collected by e-vehicles may be sensitive in nature. Location tracking is a key issue that has garnered attention. The constant recording of a driver's whereabouts can lead to the creation of detailed profiles, raising questions about the potential misuse or unauthorised access to this sensitive information. The risk of surveillance, stalking, or even theft of valuable personal data is a genuine concern for EV owners.

Moreover, integrating smart features, such as voice recognition, biometric authentication, and in-car personal assistants, adds another layer of complexity. These features require the collection and processing of personal data. If not handled securely, they may become vulnerable to hacking or unauthorised access, leading to identity theft or other malicious activities. Additionally, Smart charging systems offer convenience by allowing remote monitoring and control of charging, but they also gather extensive data. The geographical data collected during charging may raise concerns about location privacy.

Striking a delicate balance between leveraging this data for enhancing vehicle performance and user experience while safeguarding the privacy of EV owners is paramount. Transparent privacy policies, secure data storage practices, and stringent encryption protocols are essential components of a comprehensive approach to data protection. If a company is eyeing the international market or utilising cloud-based software with decentralised global data storage, it must also navigate international privacy and data protection laws. A prime example is the General Data Protection Regulation (GDPR), a globally recognised and stringent data protection law applicable to both European-based companies and international entities providing goods, services, or monitoring activities of residents within Europe.

Manufacturers of these vehicles are subjected to compliance with this comprehensive legal framework. Obligations on companies are levied by them being data fiduciaries; dual liability may also emanate since some data fiduciaries may also qualify as data processors. Special care must be taken when data is being transferred to third parties.

Further, compliance with consumer safety laws is also an important consideration. In India, the Consumer Protection Act of 2019 safeguards the rights of consumers, holding manufacturers, sellers, and service providers responsible for any harm resulting from faulty or defective products. This extends the Act's coverage to include manufacturers and sellers of internet and technology-based products. When read with the Digital Personal Data Protection Act of 2023 (DPDP Act), the Consumer Protection Act of 2019 takes on additional significance. The DPDP Act, focusing on the security of an individual's digital personal data, introduces provisions such as mandatory consent, purpose limitation, data minimisation, obligatory security measures by organisations, data localisation, and enforcing accountability and compliance. These provisions apply to information generated by and for consumers, offering a comprehensive framework for protecting digital personal data.

Conclusion

The intersection of e-vehicles and data privacy necessitates a careful and comprehensive approach to ensure the coexistence of automotive innovation and user security. As electric vehicles record intricate data related to driving behaviour, location, and telematic services, companies manufacturing these vehicles must navigate a complex landscape of data privacy requirements. The potential risks associated with location tracking, smart features, and the extensive data collected during charging underscore the importance of transparent privacy policies, secure data storage practices, and stringent encryption protocols. Moreover, as companies expand globally, compliance with international privacy laws like the GDPR becomes imperative. Balancing the enhancement of vehicle performance and user experience with the safeguarding of privacy is paramount. Manufacturers, deemed as data fiduciaries, must exercise diligence, especially when transferring data to third parties. Additionally, adherence to consumer safety laws, such as the Consumer Protection Act of 2019, further emphasises the need for a holistic and vigilant approach to ensure the responsible use of data in the evolving landscape of e-vehicles.

References

#FactCheck: Debunking the Edited Image Claim of PM Modi with Hafiz Saeed

June 25, 2025

e-Zero FIR: Accelerating Cybercrime Response to Build a Cyber-Secure Bharat

May 28, 2025

Introduction

Cyber financial offences in India have experienced an alarming surge both in terms of frequency and complexity. Be it phishing attacks or organised fraud syndicates, the nation has been facing a spurt in online financial threats, which leave the victims at their mercy because of procedural lags on the part of law enforcement agencies. To counter this, the Government of India has stepped up measures to create a Cyber-Secure Bharat, focusing on speedy resolution, accountability, and digital empowerment. A key move in this direction is the introduction of the e-Zero FIR initiative, brought forth by the Ministry of Home Affairs (MHA) with Union Home Minister Amit Shah at the helm. This newly developed digital-first system is expected to revolutionise the way cyber financial crimes, particularly those that result in high monetary losses, are handled and investigated.

What Is the e-Zero FIR Initiative?

The e-Zero FIR program is a technology-based platform that enables the automated registration of Zero FIRs for value cyber financial crimes. Led by the Indian Cybercrime Coordination Centre (I4C), Ministry of Home Affairs, the programme is now piloted in Delhi and aims to fill a pressing lacuna: the time lag involved in transitioning cybercrime complaints to First Information Reports (FIRs).

Complaints of financial frauds worth more than ₹10 lakh, reported through the National Cybercrime Reporting Portal (NCRP) or helpline number 1930, will be automatically turned into e-Zero FIRs under this scheme. Such electronic FIRs are directed to the e-Crime Police Station in Delhi, regardless of jurisdiction, and then relayed to the corresponding territorial cybercrime unit. Complainants can visit the cybercrime Police Station within 3 days and get the Zero FIR converted into a regular FIR.

Key Features of the Initiative

Pilot Implementation in Delhi

Launched as a pilot project in Delhi, it will later serve as the first use case for the national rollout. The success of the pilot will determine its implementation in other states and Union Territories.

Seamless Digital Integration

The project provides strong back-end integration between:

NCRP (National Cybercrime Reporting Portal)
e-FIR System (Delhi Police)
CCTNS (Crime and Criminal Tracking Network & Systems – NCRB)

This integrated model enables complaints to pass smoothly between platforms and agencies.

Zero FIR Auto-Registration and Routing

Now, for complaints lodged through 1930 or the National Cyber Crime Reporting Portal related to financial losses exceeding the threshold of ₹10 lakh, the system will automatically register a Zero FIR to the e-Crime Police Station of Delhi and then route it to the concerned territorial cybercrime police station, triggering immediate case processing.

Victim-Centric Conversion Mechanism

Complainants are given 3 days from the time of filing to physically report to the police station and transform the e-Zero FIR into a conventional regular FIR under Section 173 (1) and 1(ii) of the newly enacted Bhartiya Nagrik Suraksha Sanhita (BNSS). This ensures legal redress is quicker and easier.

Impact and Significance: The CyberPeace View

The e-Zero FIR system is a significant change in India's cybercrime enforcement, offering quicker response times and improved recovery opportunities. Cyber fraud reported within the "golden hour" can boost recovery levels of financial fraud. The system also eliminates jurisdictional barriers and procedural bottlenecks, making it more victim-friendly. Union Home Minister Amit Shah emphasised the initiative's alignment with Prime Minister Narendra Modi's vision of a digitally resilient India. The system is a scalable national model of tech-based policing supported by organised digital workflows. The initiative allows for real-time analysis of fraud graphs and detection of fraud syndicates through identification and device-based clustering. This is a step towards more automated, context-aware cyber policing, focusing on AI, identity graphs, and velocity to prevent crimes. The system is a step towards a next-generation cyber law enforcement strategy, focusing on AI, identity graphs, and velocity.

Conclusion

The roll-out of the e-Zero FIR program is a turning point in India's battle against cybercrime. By marrying automation with inter-agency coordination and easy-to-use mechanisms, the government has eradicated one of the major stumbling blocks for victims, the delay in taking legal action. Though its pilot phase targets high-value financial frauds in Delhi, its potential for having a countrywide impact is vast. With digital transactions on the upswing and frauds getting more cunning, efforts like these are the key to making a safe, responsive, and victim-centric cyber environment. CyberPeace commends and welcomes this important move towards establishing a Cyber-Secure Bharat, wherein all citizens can make digital transactions with confidence.

References

‍

The World Is Rewriting the Rules Against Cyber-Enabled Transnational Crime

Introduction

A Threat That Outran the Old Playbook

Three Tracks of International Response

Where the System Still Breaks Down

The Emerging Consensus

Sources

Related Blogs

Introduction

Data Privacy requirements of companies

Conclusion

References

Executive Summary:

The Claim:

Fact Check:

‍

Conclusion:

Introduction

What Is the e-Zero FIR Initiative?

Key Features of the Initiative

Impact and Significance: The CyberPeace View

Conclusion

References

Become a part of our vision to make the digital world safe for all!

Awareness

Engagement

Play your part for CyberPeace