Opinion: Southeast Asia Needs to Catch Up to Cybercriminals

8 min read
FILE PHOTO: A man points a finger to the Google Play app logo on his Huawei smartphone in this illustration picture May 20, 2019. REUTERS/Marko Djurica/Illustration/File Photo

In April, an Indonesian woman was recruited via a Facebook message to work in Cambodia with the promise of a good salary and the trappings of a legitimate job. But after arriving in Phnom Penh, she found herself detained in a condo building and forced to create fake Facebook profiles and nurture relationships online to scam strangers into investing in fraudulent cryptocurrency schemes.

This woman, who went by the name Sky to protect her identity in a report by VOD, said that workers who failed to conduct a set number of Facebook conversations had to do 50 push-ups per “client” missing from their daily tasks. Other punishments for people recruited alongside Sky were even worse. Aseng, a 20-year old Indonesian man who came to Cambodia in the same group as Sky, was tased and beaten for a mistake he made.

Sadly, these experiences are not unique. Transnational criminal operations in Southeast Asia are  increasingly relying on online tools like Facebook, Telegram, 58.com and other social media platforms to recruit workers under false pretenses, and to carry out their scam operations. 

If governments and regional actors like Asean do not step up to this law enforcement challenge, and increase their ability to meet these criminal operations where they are — that is, online — then this problem will only grow in scale.

Tech-Savvy Criminals

Criminal organizations operating in this space rely on online networks to advertise misleading job opportunities. The tools they use range from dating apps, to messaging services like WhatsApp, to social media sites like Facebook and WeChat.

These groups use false promises of convenient work and competitive salaries, ranging from $852 up to $2,050 — which is particularly attractive considering the average minimum wage for developing countries in this region is around $200 to $500 per month.

These operations also clearly use platforms like Telegram to carry out the logistics of running their businesses. One Telegram group, named “White Shark,” for example, was a Chinese-language network for transnational gangs to negotiate human trafficking deals and engage in illicit commerce in what was essentially plain sight. This one group once had more than 5,000 subscribers. It has since been shut down by Telegram but is reportedly only one of many similar online channels where these dealings take place, and others continue to operate freely.

This channel alone paints a picture of a semi-underground network of human trafficking that spans Southeast Asia and includes Thailand, Indonesia, Malaysia, the Philippines, Vietnam and Cambodia where people are being bought and sold like livestock.

Scam operations also rely on social media platforms to carry out their financial schemes. Workers, who are often doing so under duress, depend on social media to cultivate relationships with their victims and to then persuade these people to invest more and more money in fraudulent online investments. It’s a scam method that has come to be known as “pig butchering.”

These schemes are financially devastating for victims. In 2021 alone, there were 23,931 scam cases in Singapore which led to scam victims losing $633.3 million, more than double the amount that had been lost in the year before. Around $190.9 million of this was lost to fake investment schemes. In a story from the U.S., one victim alone lost over $1 million to a pig butchering scam originating from Cambodia.

Enforcement Challenge

These online scams require only an internet connection and a computer or smartphone, making it very difficult to police these operations. And it can be nearly impossible for authorities to help the financial victims recoup their losses.

In Cambodia, officials who initially denied this problem existed — even going so far as to accuse forced labor victims of lying to break their employment contracts — have started to finally crack down on these operations, conducting raids on the physical locations that were operating relatively openly as scam compounds in Phnom Penh, Sihanoukville, and elsewhere in Cambodia.

While a crackdown on these criminal organizations is a positive sign, in many ways this step-up in enforcement efforts in Cambodia is unlikely to make the problem go away. Unfortunately, active enforcement is likely to drive these criminal organizations to enter a new, more decentralized, more underground, phase of their operations.

Reports indicate that scam operations are already moving their businesses, and the workers they have trafficked or forcibly detained elsewhere within the region, to Myanmar and to Laos, where they are picking up right where they left off.

This underscores the reality of this problem, that without savvy, region-wide, digital-first efforts to tackle this problem, we are unlikely to see real progress in the fight against the crimes perpetrated by these operations.

A Way Forward

Given the complexity and severity of online scams operating out of Southeast Asia, Asean members need to come together to develop and carry out both short and long-term approaches to combat and prevent the spread of these types of online crimes.

Asean has an established regional body to fight cybercrime. In 2018 Asean launched the Asean Capability desk, which was later renamed the Asean Cybercrime Operations Desk in 2020. The aim of this body is to tackle online scams via intelligence development, investigation, operational coordination with police in Asean member states and by sharing significant information and support.

It is not yet clear, however, in what ways this body plans to act in response to this growing, region-wide criminal presence. The Cybercrime Operations Desk, for instance, makes no mention of “pig butchering” and no special mention of the growing threat from scam operations in Cambodia in its 2021 regional cyberthreat assessment, despite the fact that these trends were already being heavily covered by local and regional journalists throughout that year.

Asean member countries clearly need to step up their work together.

In the short-term it would be valuable to develop and disseminate an information campaign to educate people on the warning signs, both in terms of false job opportunities that lead to human trafficking, and pig butchering schemes, and how to avoid falling victim to these dangers.

The private sector has begun to undertake this kind of work. Meta, the parent company of platforms like Facebook, Instagram and WhatsApp, launched a campaign called “Let’s talk about scams” in Cambodia to educate people about how to protect themselves from these crimes. But governments in the region also need to invest in similar anti-scam campaigns via social media platforms and other avenues.

In the long-term, Asean member governments need to further increase their cooperation and intelligence sharing. More fundamentally, regional governments need to cooperate across borders, and cooperate with actors outside the region to pursue these criminal networks.

Cross-border law enforcement operations have worked in the past. For example, in May of this year a collaboration dubbed “Killer Bee,” undertaken by Interpol, the Nigerian government, 11 law enforcement agencies across Southeast Asia and the Asean Cybercrime Operations Desk, led to the arrest of three suspected malware scammers in Nigeria. This operation worked in part because the agencies in charge were also able to obtain crucial information from private sector partners.

While Killer Bee was a success, it goes to show just how much it takes to bring online scammers to justice — it took international governmental agency collaboration, local police collaboration, and collaboration and data-sharing with the private sector to bring down just three men.

Asean members must also step up efforts to build and share capacity. Earlier this month, Cambodia’s Interior Minister Sar Kheng revealed that Cambodian police do not understand the sophisticated technology used by scammers. He went on to further mischaracterize the scams these groups run as akin to online gambling.

“Regarding the electronic gambling system or what is called online gambling that has a technical way of playing, we do not understand it but it impacts our country directly. Our nationals are not involved with it and our people do not play it, because they play with foreigners abroad, for example Chinese, Thai, Malaysian and Indonesian people and other countries,” Sar Kheng said.

If governments do not understand these scams, and how to crack down on them online, they should invest in learning. Governments across the region must work with regional actors, and international experts to develop systems to make these crimes harder to conduct, and to root out these operations before they can get a foothold in even more countries.

In this light, Asean should use the tools it already has to carry this training out. In 2021, Asean launched its Cyber Capabilities & Capacity Development Project with a budget of $2 million for a period of two years. This project will bring enforcement efforts in countries across the region up to the level needed.

Cybercrime in this region will only grow more complicated and more dangerous if left unchecked. The member governments of Asean need to step up and face this challenge together.

Sokvy Rim is a junior research fellow at the Future Forum, an independent Cambodia-based public policy think tank.

VOD. No part of this article may be reproduced in print, electronically, broadcast, rewritten or redistributed without written permission. VOD is not responsible for any infringement in all forms. The perpetrator may be subject to legal action under Cambodian laws and related laws.