This Job Post Will Get You Kidnapped: A Deadly Cycle of Crime, Cyberscams, and Civil War in Myanmar

Executive Summary

Following decades of cyclical insecurity in Myanmar, conflict reached a new level following a coup d’etat in 2021 during which Myanmar’s military, the Tatmadaw, deposed the democratically elected National League for Democracy government.¹Meanwhile, criminal syndicates, entrenched primarily in Special Economic Zones (SEZs) like Shwe Kokko within Myanmar’s Karen state,² have expanded and evolved their criminal operations throughout this evolving conflict. The Tatmadaw forces have intertwined themselves in complicated and carefully balanced alliances to support the ongoing conflict, including with the Karen State Border Guard Force (BGF) . As the Tatmadaw and BGF look to sustain themselves and outlast each other, they have found allies of convenience and alternative funding sources in the criminal groups operating in Karen state.³ In the last two years, organized criminal groups in Myanmar have expanded their activities to include forms of profitable cybercrime and increased their partnership with the BGF, which enables their operations in return for a cut of the illicit profits. Since roughly 2020, criminal syndicates across Cambodia, Myanmar, Laos, and Thailand have largely lured individuals with fake offers of employment at resorts or casinos operating as criminal fronts where they are detained, beaten, and forced to scam, steal from, and defraud people over the internet.⁴ The tactics—kidnap-to-scam operations—evolved in response to the pandemic and to the Myanmar civil war, allowing criminal groups to build on existing networks and capabilities. These operations do not require significant upfront investment or technical expertise, but what they do need is time—time that can be stolen from victims trapped in the region’s already developed human trafficking network. The profits that these syndicates reap from victims around the globe add fuel to the ongoing civil war in Myanmar and threaten the stability of Southeast Asia. These groups entrench themselves and their illicit activities into the local environment by bribing, partnering with, or otherwise paying off a key local faction within the Myanmar civil war,⁵ creating an interconnectedness between regional instability and profit-generating cybercrime.

What is unfolding in Myanmar challenges conventional interpretations of cybercrime and the tacit separation of criminal activities in cyberspace from armed conflict. The criminal syndicates, and their BGF partners, adapted to the instability in Myanmar so effectively that each is financially and even existentially motivated to perpetuate this instability.

This paper explores the connectivity between cybercriminal activities and violence, instability, and armed conflict in a vulnerable region, exploring how cybercrime has become an effective vehicle through which nonstate actors can fund and perpetuate conflict. The following section examines the key precipitating conditions of this case, traces the use of cyberscams to create significant financial losses for victims across the world, sow instability across Southeast Asia, exacerbate the violence in Myanmar, and, finally, considers the risks that this model could be adopted and evolved elsewhere. This paper concludes with implications for the policy and research communities, highlighting the ways in which conflict can move, unbounded, between the cyber and physical domains as combatants and opportunists alike follow clear incentives to marry strategic and financial gain.

Introduction

Cybercrime and cyber fraud, from ransomware to financial data fraud and romance scams, have reached a new high in Southeast Asia, according to the United Nations Office on Drugs and Crime (UNODC), driven in part by “the increasing number of available targets and the perception of cybercrime as highly profitable with a relatively low risk of detection.”⁶ Cybercrime is a growing business worldwide; the relative accessibility of cybercrime tools combined with increasing reliance on online banking and the immense geographic reach that the domain provides to create a wealth of opportunity for those eager to exploit others for profit.⁷

Criminal groups increasingly occupy a space between traditional crime and cybercrime, engaging in a multitude of interrelated and cross-supportive criminal activities. For more than a decade, organized criminal groups have moved into new online criminal markets while also engaging in cybercrime “to facilitate offline organized crime activities.”⁸

In Myanmar, the pursuit of cybercrime profits not only facilitates traditional crime, but also directly supports the armed organizations waging civil war across the state. Myanmar criminal groups and ethnic armed organizations (EAOs) are engaged in a symbiotic relationship: criminal operations have flourished in the permissive environment of post-coup, war-torn Myanmar. Within Karen state, these criminal syndicates have in turn provided the Karen State Border Guard Force (BGF)—a key EAO in the conflict aligned with the Tatmadaw—with a desperately needed source of funding for their ongoing war.

A Cycle of Crime and Conflict

Cybercrime and its symbiotic relationship to the Myanmar civil war emerged and evolved within the context of several internal and external shocks. The 2020 outbreak of COVID-19 had a devastating effect on tourism in Southeast Asia, limiting the supply of ready targets for fraud and myriad extortion schemes. Myanmar’s February 2021 coup destabilized a nascent regime and returned the country to a state of sustained conflict.

However, these shocks only served to amplify existing tensions in Myanmar including a deeply fractured governance landscape, a history of corruption across the country, and established regional organized criminal networks. Criminal groups in a chaotic and unstable environment with little to no rule of law sought out a limited, profitable resource—trafficked individuals from across the region—and forced them to engage in cyber fraud. Armed groups seeking to assert power and dominance within Myanmar with little legitimate means of generating income or war materiel sought to establish a symbiotic relationship with criminal groups that could provide a steady source of profit.

These catalysts and precipitating conditions lay the foundation for the model of cybercrime-funded conflict seen in Myanmar. However, it is the cyclical patterns of instability, criminal adaptation, and corrupt entrenchment that have created a self-reinforcing cycle of criminality and conflict—a cycle that may create an exportable model of cybercrime-funded conflict in new regions around the world.

INSTABILTY: The first portion of this cycle analyzes the conflict and instability within Myanmar both before and after the coup in February 2021. This section first provides the background to the insecurity in the country, especially surrounding the February 2021 coup that overthrew Myanmar’s democratically elected government. It lays out the fractured governance landscape of modern-day Myanmar and gives an overview of the key players in the conflict. This section then addresses the financial position of the combatants, and their emerging need to seek alternative funding sources, serving as a transition through which to better understand the relationship of armed conflict and the illicit economy in Myanmar.

CRIMINAL ADAPTATION: This section dives into cybercriminal activity in Karen state’s Shwe Kokko economic zone, examining the emergence of a massive kidnap-to-scam operation. This section examines how, in the context of the previously discussed fractured governance landscape and established criminal networks, criminal organizations operating within Myanmar responded to COVID-19’s shock to their operations. This section delves into what factors made cyberscams an optimal choice for criminal adaptation, namely the accessibility of this type of cyberscam and the existence of robust criminal human trafficking networks able to procure free, forced labor. This section explores the kidnap-to-scam operations as a whole, to better understand the pipeline of criminality that these criminal organizations created.

ENTRENCHMENT: This final section assesses the stability of the symbiotic relationship between cyber-enabled criminality and instability, and the parasitic effects both within Myanmar and without. The clearest example of this is the corrupt, quid pro quo relationship established between an ethnic armed organization, the BGF, and these criminal organizations. This relationship closes the feedback loop and entrenches an environment where multiple actors are incentivized toward instability. The instability within Myanmar provides enrichment and safe haven to sow increased instability in various manners and locales; the scam operations themselves create significant financial losses to individuals around the world, the criminal network supporting and supported by these scams contribute to insecurity across Southeast Asia, and the profits from these scams help purchase weapons and supplies that contribute to the protraction of the civil war in Myanmar. Finally, this method of operation as a whole may to inspire armed groups in insecure regions of the world to pursue a path of cybercrime-funded conflict.

Instability: Conflict and Opportunity

Myanmar has been in a state of cyclical violence for decades before the outbreak of the current civil war. This state of violence has created a sustained environment of instability and fertile grounds that opportunistic actors—both criminal syndicates and EAOs—have turned to their advantage.

Understanding the Conflict

On February 1, 2021, the Tatmadaw—the Myanmar military—deposed the democratically elected government headed by the National League for Democracy (NLD) and detained President Win Myint and State Counsellor Aung San Suu Kyi.⁹ The Tatmadaw declared a state of emergency and called new elections at the end of that year.¹⁰ In the meantime, Commander-in-Chief of Defence Services Min Aung Hlaing took command of the government with a military junta, or military ruling committee.¹¹

The unrest immediately following the coup has since erupted into outright violence between various militarized groups, and against civilians, across Myanmar.¹¹ The primary political challenger to the Tatmadaw government is the National Unity Government (NUG), a shadow civilian government made up of former elected representatives who were ousted or left the Tatmadaw government following the coup. The NUG together with their armed forces, the People’s Defense Force, declared a “people’s defensive war” against the Tatmadaw.¹²

PRECIPITATING CONDITION: History of Insecurity

Myanmar has known little respite from conflict and military coups in its history. After gaining independence from the British empire in 1948, a military coup overthrew the fledgling parliamentary democratic Union of Burma in 1962. The ‘70s and ‘80s saw protectionist policies drive a deteriorating economic situation and simultaneously the explosion of corruption and a black-market economy, specifically in drug-producing frontier areas like the Shan state and trafficking corridors in Karen state.¹³ These same regions featured an ongoing contest of control between the junta and ethnic armed organizations (EAO).¹⁴ Widespread protests in 1988 led to brutal crackdowns by the junta and a promise of multiparty elections in 1988, which did not occur until 1990, and the results of which the junta ignored, arresting opposition politicians and consolidating power.¹⁵ Various forms of junta remained in power through 2015, even after widely celebrated election brought the National League for Democracy into majority rule.¹⁶

Since February 2021, the United States Institute of Peace and Human Rights Watch estimate that 3,000 civilians have been killed, 20,000 civilians have been arrested, and more than one million people have been displaced, both internally and externally.¹⁷ Government control throughout Myanmar is fractured. The junta estimated last year that the Tatmadaw maintained effective control over only 22 percent of Myanmar townships (17 percent of the country’s land area) and partial control over 39 percent of townships ( 31 percent of the land area).¹⁸ Regions across Myanmar controlled by EAOs exploded from a handful in 2021 to large swaths outside of a government-controlled central and southwestern core.¹⁹ The Myanmar government has cyclically engaged in conflict to assert control against ethnic armed groups in various regions.²⁰ Now, both the Tatmadaw and the NUG rely on a series of carefully balanced alliances made up of such regionally aligned EAOs.²¹

In the Karen state, there are two main armed groups: the Karen National Union (KNU) and the Karen Border Guard Forces (BGF). One of the oldest EAOs in Myanmar, the KNU, has controlled key territory in the Karen state along the Thai-Myanmar border since 1949. After cyclical antigovernment violence, the KNU signed a ceasefire in 2015 and led ten other ethnic armed groups in the peace process.²² Following the February 2021 coup, the KNU began fighting in open collaboration with the NUG against the Tatmadaw.²³

On the other side of the conflict, the BGF comprises units of former insurgents that are now aligned with the Tatmadaw and patrol areas of control along the Thai-Myanmar border including important trade corridors. The BGF is seen as a key force multiplier against the KNU and similar groups.²⁴ The commanders of various BGF units operate with relative independence from the junta, often more as protection rackets for businesses—both legitimate and criminal—operating within their jurisdiction.²⁵ The two warring sides, KNU and NUG versus BGF and Tatmadaw, are unwilling to cede an important trade corridor to Thailand and China alongside the legitimate and illegitimate economic opportunities of the area.

The Tatmadaw and antigovernment forces have increasingly relied on alternative funding sources as the civil war grinds on.²⁶ Tatmadaw’s efforts have been guided toward putting pressure on antigovernment funding with the goal of fracturing the NUG’s alliances and networks with EAOs.²⁷ The NUG relies almost exclusively on donations from supporters both within and without Myanmar.²⁸ To cut off the NUG’s social media funding drives, the Tatmadaw in 2022 restricted mobile payments²⁹ and in 2023 passed a cybersecurity law that banned VPN usage, throttled access to social media sites, and forced internet companies to hand over user data to the military.³⁰ Despite protests from businesses and civil society, the cybersecurity law represents a check to the antigovernment forces’ ability to crowdfund and an attempt to diminish the NUG’s social media presence. The Tatmadaw, the NUG, and the various EAOs are competing not only for military and territorial control, but also for access to financial streams that are otherwise unrestrained by the unrelenting instability.

Criminal Adaptation

Criminal syndicates and the power they wield in Myanmar is not a new phenomenon. However, the character of this criminal adaptation in Myanmar’s Karen state exemplifies how cyber tools can provide an alternate path forward for both criminal syndicates and EAOs. Zeroing in on the Shwe Kokko economic zone, these criminal syndicates have responded to their unstable environment and successive shocks by developing a new, large-scale operation using trafficked labor to scam individuals around the world for millions of dollars a year. This adaptation to the instability in Myanmar appears so effective that their profitability is anecdotally positively correlated with diminished rule of law and security.

Illicit Economic Development

The period from 2011 to 2020 saw limited economic and political reforms including amnesty to political prisoners and reinvigorated economic policies to encourage foreign direct investment.³¹ V-Dem Institute‘s Annual Democracy Report in 2019 emphasized that from 2008 to 2018 Myanmar had moved from a “closed autocracy” to an “electoral autocracy,” and through a lifting of sanctions and trade restrictions, the Myanmar economy experienced modest growth through 2016.³² These legitimate attempts to revitalize the economy, however, were frequently coopted by established criminal networks that used the development money to further their own operations.

PRECIPITATING CONDITION: History of Corruption

Illicit markets, especially drag trafficking, produce profits that have directly financed and enabled EAOs to defy and challenge Myanmar government control for many decades, and over that time have in cases been better armed and resourced than the central government.³³ During this time the ease of entry into the opium trade, the widespread demand for opium and heroin, and the lack of law enforcement on both sides of the Myanmar-Thailand border cultivated massive illicit trading networks.³⁴

Decades of fighting with these EAOs was temporarily halted by a 1989 ceasefire following the splintering of the largest drug-funded insurgency, the Burma Communist Party. This agreement, which would subsequently serve as the basis for ceasefires with other insurgency groups, granted the BCP’s successor groups significant political and economic autonomy as well as tangible development economic assistance programs.³⁵ Following the ceasefires, state-controlled banks accepted deposits regardless of the murkiness of the money’s origins in exchange for a 40% (subsequently 25%) fee, helped these organizations and their subsidiaries get business permits and government contracts, and offered lucrative positions in business and government to influential insurgent leaders.³⁶ The fighting stopped, but the EAO’s now effectively had carte blanche to develop their criminal operations unhindered, and the government now profited, too, from the expanded illicit trade. Illicit markets in some areas were so profitable that it dwarfed the formal economies of entire regions, providing little incentive for officials to crack down without heavy federal pressure.³⁷

In 2015, the government began an aggressive economic development effort along its borders using SEZs to drive international investment and foster domestic economic growth. One such economic zone is Shwe Kokko in Karen state, which has since emerged as a center for legal and illegal gambling and illicit trade.³⁸ Shwe Kokko was developed by Yatai International in partnership with BGF’s Chit Linn Myaing.³⁹ Yatai International, a mining and manufacturing company, holds 20 percent stake in the Shwe Kokko development located next door to BGF headquarters.⁴⁰ Yatai International Holding Group is owned by a Chinese national with Cambodian citizenship She Zhijiang and, according to the Yatai’s materials, the development “represents a new chapter for the Belt and Road Initiative”(BRI) within a new Special economic zone.⁴¹

It is unclear, however, how much Yatai’s claims are based in reality. According to the Myanmar Investment Commission, there is no official Special Economic Zone in Shwe Kokko, and legally speaking developments in this area are residential villas.⁴² Additionally, a 2020 US Senate report stated that Shwe Kokko is “an effort by the [People’s Republic of China] to colonize Karen [Kayin] territory … and expand regional BRI investments in Southeast Asia,” and links these investments to a broader Chinese strategy to increase its influence throughout the region through BRI.⁴³ The Chinese government, however, denied any official state investment in Shwe Kokko.⁴⁴

Though SEZs are a legitimate mechanism for driving international investment, those in Myanmar and along the surrounding borders operate more like criminal safe havens with the controlling companies largely shielded from governmental pressures to regulate activities and crack down on criminal organizations.⁴⁵ The National League for Democracy government was, in fact, conducting an investigation into the connections between the Shwe Kokko development and the BGF.⁴⁶ Tensions stemming from the investigation were such that, in 2020, the BGF leadership considered breaking its alliance with the government and resuming fighting in Karen state.⁴⁷ Ultimately, the investigation was never concluded.

The casinos of Shwe Kokko, and the illicit market that flourished alongside them, were a petri dish of criminal activity, connected with a regional illicit economy. Among these criminal activities were cyberscam operations run by Chinese and local criminal syndicates targeting primarily Chinese nationals.⁴⁸ These operations largely fell under the category of pig butchering scams, which combine romance and boiler room (or false investment) scams through fake accounts on social media.⁴⁹ This network of operations would serve as an unexpected foundation for both these criminal syndicates and the BGF in the tumultuous years to come.

Kidnap-to-Scam

In early 2020, the outbreak of COVID-19 almost immediately altered the economic situation on the ground in Southeast Asia. There were no longer visitors to their casinos whose money could be siphoned off through gambling or illegal trade, and profitable trade gates that facilitated traffic between Myanmar and Thailand were forced to close.⁵⁰ Relatively small-scale pig-butchering cyberscams—targeting fewer victims both as forced operators and as cryptoscam marks—were conduct in this area, primarily targeting Chinese nationals. However, the impact diminished due to China’s COVID-19 travel restrictions in 2020 and its counter-cybercrime laws and operations.⁵¹

In this changed environment, criminal syndicates had to adapt to find an alternative, steady income stream. These syndicates still had relative safe harbor and physical headquarters in Shwe Kokko and access through their widespread criminal operations to a human trafficking network with a new pool of victims.⁵² Cybercrime is so appealing for criminals and criminal groups due in large part to the ability to create mass profit with relatively small resource input, from anywhere in the world. Instead of investing in technically sophisticated capabilities, these criminal syndicates instead used the resource they had in near abundance —forced labor—to conduct a global cyberscam operation. Cyberscams, run by these criminal syndicates out of empty hotels and casinos, became a multimillion-dollar criminal enterprise by exploiting thousands of vulnerable people in Myanmar and Southeast Asia and forcing them in turn to exploit people all around the world.⁵³

PRECIPITATING CONDITION: Established Criminal Networks

Transnational organized crime networks across Southeast Asia are engaged in a wide variety of criminal activity, four of the most active including drug trafficking, illegal migration, human trafficking, counterfeit goods and medicines, and environmental crimes.⁵⁴ These criminal syndicates are deeply rooted in locales across Southeast Asia and Myanmar where their operations face minimal threat from governing bodies or law enforcement. The revenue of the drug trafficking out of Myanmar’s Shan state significantly outsizes the state’s legitimate economy.⁵⁵ Chinese criminal syndicates have operated out of areas like Shwe Kokko in Myanmar and Cambodia for more than a decade in a self-reinforcing cycle in part “created by the confluence of Chinese money, Chinese organized crime groups, and a very poor legal environment,” says the head of the Northern Australia Strategic Policy Centre, John Coyne.⁵⁶

The Global Organized Crime Index ranks Myanmar third of 193 countries and first in Asia when it comes to degree of organized criminality.⁵⁷ Myanmar has consistently rated as among the worst rated locations for human trafficking according to the US Department of State Office to Monitor and Combat Trafficking in Persons. The country has been ranked as Tier Three since 2015, meaning that is it included as one of just eleven “governments with a documented “policy or pattern” of human trafficking, trafficking in government-funded programs, forced labor in government-affiliated medical services or other sectors, sexual slavery in government camps, or the employment or recruitment of child soldiers.”⁵⁸ Myanmar’s role as a hotbed of criminality, though briefly reduced in the mid-2010s, goes back decades and for now, any reduction in the strength of organized crime is next to impossible.⁵⁹

Since 2020, the groups kidnapped thousands of individuals from across Southeast Asia and beyond and forced them to engage in cybercriminal scams.⁶⁰ Thousands of people who had moved within the region, unemployed due to the halt in tourism became what labor abuse investigator Khun Tharo called “invisible people,” extremely vulnerable to the lures employed by local criminal syndicates and without protection.⁶¹  Many of the victims are young, well-educated, computer-literate, and multilingual; and while they struggled to find gainful employment during the pandemic, their skills make them desirable targets for this type of work.⁶² Once these individuals arrived at the advertised location, eager to start new skilled positions with the promised competitive salaries, they are forcibly transported to heavily guarded compounds and their phones and passports are taken away.⁶³ Once trapped inside, victims were told that their new role was to engage in a number of online pig butchering scams to generate sufficient profit for their captors. Victims deemed to be disobedient or underperforming are beaten and tortured by electrocution and other inhumane methods.⁶⁴

Pig butchering scams typically require intensive time and relationship building, and trafficked individuals are forced to build these relationships over time, partially through the use of playbooks and scripts made for the kidnapped workforce.⁶⁵ The term pig butchering refers to the scammers’ process of first feeding the victim or ‘pig’ with false information until it is ready for the scam, then the scammer steals, or ‘butchers,’ the victim’s information and money. Typically, these pig butchering scams involve investments in cryptocurrency where the victim will be prompted to download a malicious app or create an account on a web platform that appears trustworthy or as a counterfeit of a legitimate financial institution.⁶⁶ Inside the app or platform, the victim is shown carefully crafted data demonstrating that their ‘financial investment’ has grown and is encouraged to add more funds with the promise they can withdraw at any point. Once the victim has deposited a significant amount of money and shows signs of insolvency, the scammers will shut down the account and disappear, leaving the victim without recourse and often in debt.⁶⁷

Entrenchment

While these cyberscam operations create symbiotic benefit for both criminal groups and EAOs in Myanmar, the operations themselves are intensely parasitic to the global cyber domain, the broader Southeast Asian region, and the population of Myanmar. Finally, this paper explores how this relationship could serve as an analytic model to better understand criminal-combatant relationships elsewhere in the world where similar precipitating conditions and patterns are present.

Global Financial Impact

The 2023 National Cybersecurity Strategy highlighted, along with China, Russia, Iran, and North Korea, the threat that global criminal syndicates pose to US national security, especially those threats emanating from jurisdictions with ineffective or irresponsible rule of law.⁶⁸ Though the strategy’s section on countering cybercrime focuses primarily on ‘defeating ransomware,’ the strategy emphasizes the dangers of cyber operations that target the most vulnerable and least defended. The cyberscam operations run out of Myanmar are not technically sophisticated, and yet generate incredible gross and net profit—underlining the tenuous link between sophistication and the financial yield from cybercrime.

Several studies from governments and nongovernmental groups over the past few years have tried to illustrate the global financial impact of the scams as a whole, and particularly those emanating from Southeast Asia. In 2021, the US Federal Bureau of Investigation’s (FBI) Internet Crime Complaint Center received 4,325 complaints from US residents and citizens regarding pig butchering scams, reporting collective losses over $429 million.⁶⁹ The Global Anti-Scam Organisation (GASO)—founded and maintained by victims of these pig butchering scams—conducted a survey through July 6, 2022, to better understand individual victims’ losses. Within the United States, the survey found that the average victim lost $210,760 and the median victim lost $100,000; outside of the United States the average and median were slightly lower, $155,117 and $52,000, respectively. The study also found that of the surveyed victims, 24 percent lost less than 50 percent, 43 percent lost between 50-100 percent, and 33 percent lost more than their net worth and went into debt as a result of the scam.⁷⁰ In several reported cases, scam victims lost more than $1 million,⁷¹ and in one case a victim lost a staggering $5 million dollars.⁷² These figures, though not comprehensive, clearly telegraph the global economic impact of this relatively simple cyberscam.

Although little research has been conducted on these scams’ profits in Myanmar in particular, figures on related scams coming out of Cambodia may provide a comparative scale, at least, of the profits from similar operations conducted out of Myanmar. According to a 2022 report from VICE News, pig butchering kidnap-to-scam operations operated from Sihanoukville, Cambodia generate approximately $1 billion every year.⁷³ Sean Gallagher, a principal threat researcher at Sophos X-Ops posing as a ’duped’ victim of a one such scam based in Sihanoukville, Cambodia, allowed the scam operator over the course of five months to play out a script of trust building until she provided him instructions in the form of friendly advice for how to invest in cryptocurrency. During his investigation, he found a series of crypto wallets used by the scammers over a five-month period worth a collective $3 million.⁷⁴

Exacerbating Regional Insecurity

These kidnap-to-scam operations have deep regional repercussions and interconnections. Myanmar’s neighbors across Southeast Asia are also the places from which these criminal syndicates pull most of their initial victims, thousands from Thailand, Malaysia, Taiwan, and more.⁷⁵ Victims across the region and beyond are sucked into this multinational human trafficking network—lured to Thailand or other seemingly safe locations, and there, kidnapped and transported to scam compounds in Myanmar.⁷⁶ The criminal syndicates behind most illegal gambling institutions and scam rings remain highly mobile and responsive to law enforcement pressures. These syndicates appear to have strong cross-regional connections that enable them to efficiently move their operation and their victims, and start operations anew—including to Myanmar.⁷⁷ These groups tend to locate within SEZs or tourist hot spots and expand upon traditional criminal activities.

One such location where there are similar kidnap-to-scam operations is Sihanoukville, Cambodia. After years of local and international pressure, in September 2022 the Cambodian government and law enforcement carried out raids on the casinos and hotels where investigators and former victims were forced to run these scams. However, according to one volunteer who helps repatriate Thai victims, criminal syndicates bought out corrupted officials and law enforcement personnel who would inform the syndicates in advance of raids so that authorities would find the location empty.⁷⁸ One victim, initially held in Sihanoukville, Cambodia, reported that he and dozens of other prisoners were moved in the middle of the night and reestablished in Shwe Kokko before his eventual escape.⁷⁹

A concentrated effort by government and law enforcement is required to detain criminals, rescue kidnapped workers, and shutter the bases of operations that these groups use. However, as the case of Sihanoukville shows, the mobility of and interconnection between these criminal groups means that they can respond easily to governmental pressure in one city or region by shifting workers and operations to a new area with weaker rule of law. This effectively means that regardless of how hard other regional governments target this activity, criminal groups have safe havens where local authorities have financial and political interest in facilitating and benefiting from illicit activities.

Perpetuating Civil War

The 2021 coup in Myanmar and resulting instability were a boon for the BGF and their criminal partners across Karen state. The investigation into Shwe Kokko by the previous government was halted by the Tatmadaw, Karen casinos and border trade depots with Thailand have reopened, and the BGF’s multimillion-dollar developments in and around Shwe Kokko were restarted.⁸⁰ The Shwe Kokko casinos resumed operations shortly after the coup in 2021 due to the Karen BGF’s relationship with the Tatmadaw and alleged promises between the parties that profits “would be split in half.”⁸¹ The money from these scams flow mostly to the heads of the crime organizations but also into the pockets of armed ethnic groups or junta-aligned forces that control the areas where the scam centers operate. The commanders of various BGF units operate with relative independence from the Tatmadaw and most operate as protection rackets for businesses, both legitimate and criminal, operating within their jurisdiction.⁸² In areas where Tatmadaw or Tatmadaw-aligned military forces control territory, the criminal organizations bribe military members with large sums of money and pay for taxes⁸³ and yearly licenses to continue operations.⁸⁴ Tatmadaw-aligned individuals have also issued licenses for business operations and land leases to front companies associated with scam groups, often in the form of seemingly legitimate tax payments for land, utility, and building use.⁸⁵ Entrenchment in and control over Shwe Kokko and related criminal activities may have increased following the arrest of Yatai founder She Zhijiang in August 2022, which left an even greater opening for the BGF.⁸⁶

These cryptoscam operations, and those connected with them, have themselves become targets of retaliatory violence. As more information surfaces about money laundering networks, individuals connected with these activities face targeting by anti-regime forces in Myanmar and arrest in other countries.⁸⁷ Minn Tayzar Nyunt Tin, a legal aide who was allegedly “key to money laundering for the Junta,” was assassinated in Yangon in March 2023 as a direct result of those activities. The Yangon guerrilla group allegedly responsible claimed that Tin had facilitated raising millions of dollars for the Tatmadaw.⁸⁸ In April 2023, forces associated with the Karen National Union (KNU)⁸⁹ attacked Shwe Kokko, reportedly because of its role as a criminal base of operations funding the military regime.⁹⁰ This attack, allegedly without KNU approval, sent over 10,000 civilians fleeing into Thailand and initially overran five BGF outposts until BGF and Tatmadaw reinforcements forced them to retreat.⁹¹

After sanctions by the West and increasing international pressure,⁹² the Tatmadaw faces a funding shortfall⁹³ and difficulties in procuring weapons and ammunition.⁹⁴ Russia and China both supply weapons to the Tatmadaw, but Russia’s export of weapons has slowed since its invasion of Ukraine, and China’s contributions are in part counterbalanced by weapon provisions they also make to several rebel EAOs.⁹⁵ Chinese support of the Tatmadaw is being challenged due to the Tatmadaw’s lack of interest or ability to tackle the crime emanating from within Myanmar’s borders. Earlier this year, two Chinese ambassadors urged Myanmar to curtail these harmful illegal activities, possibly in conjunction with the Thai government.⁹⁶ In addition, in early September, the United Wa State Army, carried out a series of raids in in northern Myanmar’s Shan state, arresting “more than 1,200 Chinese nationals allegedly involved in criminal online scam operations” and handing them over to the Chinese police just across the border in China’s Yunan province.⁹⁷These actions show increasing Chinese momentum against this criminal activity, but it is unclear how this might play out in Karen state. Should the Tatmadaw government attempt to crack down on crime in Shwe Kokko, they will likely further fracture their relationship with the BGF, and thus their hold in the region. The estimated millions of dollars produced in Shwe Kokko kidnap-to-scam operations is an invaluable source of funding to enable the BGF to withstand shocks from within Myanmar and from international action, one they will be loath to lose.

A Model for Cybercrime-Driven Conflict

The catalysts, precipitating conditions, and cyclical patterns of the development and entrenchment of cybercrime-funded conflict within Myanmar are unique to that country. However, many of these factors are not unique and are present in similar configurations in other countries and regions around the world. As more and more criminal and armed groups develop cyber capabilities, some may look to Myanmar as an example. In locales with limited rule of law and a strong criminal human trafficking network, like the criminal syndicates in Myanmar, may see these victims as a resource themselves to conduct immensely profitable cyberscams requiring little additional resources or capabilities. INTERPOL, in its June 2023 warning on human trafficking-fueled fraud, warned that “there is evidence that [this modus operandi] is being replicated in other regions such as West Africa, where cyber-enabled financial crime is already prevalent.”⁹⁸ However, this warning does not go far enough. The spread of kidnap-to-scam operations themselves do pose a significant risk to global financial security. With billions of dollars in profit, governments around the world must wake up to the threat of this kind of cyber fraud and its risks to their populations. These operations are rarely confined to one locale, but rather spread across regional criminal networks; when this modus operandi is implemented in a region impacted by violence and instability it creates a self-reinforcing cycle of instability.

Looking Forward – What Can We Do?

Targeting the Point of Collection

Public Awareness

In March 2023, the FBI released a public warning on the rise of pig butchering scams, outlining the basic format of one of these cryptocurrency scams and offering steps for potential victims to protect themselves.⁹⁹ While government notifications like these are important, they do not go nearly far enough to communicate the depth of the threat to the wider public in the United States and beyond. Most of the population does not read government alerts, and so the government must coordinate with companies and nonprofits to find people where they are—and where these scammers find them. According to California prosecutor Erin West, cryptoscam victims are most commonly found on dating apps run by Match, Meta’s Facebook, Instagram, and WhatsApp, LinkedIn, and text messages.¹⁰⁰Sites like these should be the focus of the FBI and the Cybersecurity and Infrastructure Security Agency’s (CISA) alert and education efforts on cryptocurrency scams, and run in cooperation with Match, Meta, LinkedIn, and other social media platforms. Since these cryptoscams do not solely exploit victims in the United States, the United States should engage with its allies and partners to coordinate their public awareness campaigns.

Education regarding the dangers of cryptocurrency scams should go beyond these alerts. The FBI and the Treasury Department should coordinate with companies like Chainalysis and nonprofit organizations like the Global Anti-Scam Organisation (GASO)¹⁰¹ to create guidelines to help people who want to buy and sell cryptocurrency better identify the signs of fraudulent or exploitative sites. These entities should also work in coordination to create guidelines for how people can report suspicious sites or activity below a formal criminal complaint. Most pig butchering cases go unreported, hindering potential prosecution, and leaving analysts without a full picture of their impact on victims.¹⁰²

United States Government

As previously mentioned, the US 2023 National Cybersecurity Strategy places a priority on countering cybercrime, but is too narrowly focused on ransomware as, seemingly, the only criminal strategic threat. Because cryptoscams target individuals rather than companies, the technical means used are often unsophisticated, and the scams themselves are often left unreported; therefore, the threat of this type of cybercriminal activity is underappreciated. As the CISA and FBI implement what has thus far been laid out in the strategy and implementation plan, their efforts must be intentionally expanded to include pig butchering operations. This may include creating a separate Joint Cryptoscam Task Force with a different mix of government and private sector entities to assess the full picture of the threat. It is critical to streamline communication and efforts between different organizations already tracking this. There are pockets of knowledge about this already, the key here is getting those pockets to talk and coordinate efforts. Specifically, the US Government should work with private sector crypto organizations to better identify funding streams of scam organizations and work with law enforcement and financial entities to close loopholes and enforce Know Your Customer rules.¹⁰³

One such tool may be to echo the successes of counter-ransomware operations to directly target the websites facilitating money laundering for cryptoscams. Steps have already been taken in this direction. In 2022, the United States filed a forfeiture complaint worth $2 million against cryptocurrency seized in an investment fraud case using the RiotX platform.¹⁰⁴ In 2023, the FBI announced that it had seized more than $112 million in funds linked to cryptocurrency investment schemes.¹⁰⁵ Once again, this effort should be internationalized so that the United States and its allies and partners are simultaneously applying pressure against the points of cryptocurrency collection for these criminal groups. In particular, the FBI should coordinate with Interpol’s ASEAN desk both to capture and share information and to execute limited, intentional operations against global criminals wherever jurisdiction allows.

The US government should also expand its use of sanctions. In November 2022, the US government, in partnership with the European Union, enacted sanctions against a number of individuals and companies as a result of “the continuing escalation of violence and grave human rights violations following the military takeover [in February 2021],” focusing on government officials, military leaders, and arms dealers.¹⁰⁶ In December 2022, the US government passed the BURMA Act which lays out a series of mandatory and additional sanctions against various individuals and organizations within Myanmar. The mandatory sanctions include senior officials and entities that support the defense sector. The additional “possible” sanctions outlined by this act include:

Within these guidelines, the Department of Treasury’s Office of Foreign Assets Control should assess this connection between criminal groups, EAOs, and the companies operating within Shwe Kokko as outlined in this paper and determine how specific sanctions may aid in weakening the interplay of crime and violence in the state.

Targeting the Source

Further Research

More research is needed to understand the true financial impact of these operations throughout the world. Existing coverage of the prevalence and financial losses of these operations likely underestimates their true impact due to underreporting. Whether scam victims believe that nothing can be done, do not know how to report the criminal activity, or are too embarrassed to tell anyone, underreporting is a significant problem to overcome before governments and concerned actors can truly understand how to effectively respond.¹⁰⁸ Research into the profits that pig butchering groups in Myanmar generated in three distinct time periods—before the COVID-19 outbreak in early 2020, between that date and the 2021 coup, and since the 2021 coup—would provide an indispensable, quantitative view of how different shocks to the population and criminal groups within the country affected these operations.

Regional Cooperation

As the United States takes action against the threats emanating from criminal entities in Southeast Asia, it must work alongside governments in the region that have been most affected, and affected in different ways, by this threat. The Department of State should coordinate with Southeastern Asian government, especially Thailand and Cambodia, to better understand the scope and depth of the problem they face in cross-regional criminal operations like human trafficking. The Department of State’s Office to Monitor and Combat Trafficking in Persons must be more vocal to partners and push nations to release public service announcements, prevent citizens leaving for scam jobs, and work with their embassies to rescue citizens. This may also be an opportunity for the United States and China to cooperate against a common threat. China has been working to counter this problem for years, including in cooperation with Thailand in recent mass arrests.¹⁰⁹ The United States should be clear about the public action it is taking against these groups and attempt, as much as possible, to align these efforts so that they are reinforcing rather than creating redundancies of Chinese and regional efforts.

Conclusion

The kidnap-to-scam operations run by criminal syndicates and enabled by armed combatants in an ongoing civil war, illustrate how cybercrime has become an effective vehicle through which nonstate actors can fund and perpetuate conflict outside of the cyber domain. Criminal syndicates in Myanmar are able to operate effectively due in large part to the vulnerable populations created in unstable environments and the lack of governance and law enforcement oversight. The BGF in Myanmar’s Karen state is able to maintain a level of independence from the Tatmadaw, even as allies, and convert illicit profits from cyberscams into guns and ammunition.¹¹⁰ The profits that these syndicates generate, at the expense of victims around the globe, add a growing source of fuel to the ongoing civil war in Myanmar and threaten the stability of Southeast Asia.

The use of cybercrime to fund conflict and instability could well become more prevalent as the basic relationship is symbiotic and few of the precipitating conditions are unique to Myanmar. This emerging trend poses a significant risk to the United States and its allies, especially where it undermines important and rapidly hardening assumptions about the nature of risk from insecurity in cyberspace.

Conflict is not exclusive to the cyber or physical realms but increasingly moves across and between domains as combatants and opportunists alike follow clear incentives to marry strategic and financial gain. The United States and its allies must work together to create a clearer picture of the global cybercriminal landscape beyond ransomware and technical mitigations, and work with those governments impacted directly by kidnap-to-scam operations to help curtail this problem at its source. In the absence of such information, the next small wars and civil conflicts may be fueled by a powerful set of relationships and criminal incentives never well examined and all the more powerful because of it.

The Atlantic Council’s Cyber Statecraft Initiative, under the Digital Forensic Research Lab (DFRLab), works at the nexus of geopolitics and cybersecurity to craft strategies to help shape the conduct of statecraft and to better inform and secure users of technology.

learn more

Trending Topics