Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
The Displacement of Transnational Cybercrime Operations
As Southeast Asian governments intensify enforcement against organised cybercrime networks, criminal operators are actively relocating their infrastructure to alternative jurisdictions. Cambodia’s sustained crackdown on scam operations—which once positioned the country as a regional hub for organised cybercrime—is forcing transnational networks to seek new operational bases. Sri Lanka has emerged as a primary target for relocation, presenting a critical test case for how vulnerable governance environments interact with transnational criminal enterprise in the Indo-Pacific region.
This migration pattern reflects a fundamental characteristic of networked cybercrime: operational flexibility. Unlike traditional organised crime, which requires physical territory and local protection arrangements, cybercriminal enterprises can rapidly shift their command-and-control infrastructure, money laundering networks, and recruitment operations across borders. The displacement from Cambodia to Sri Lanka is not anomalous; it represents a predictable response to enforcement pressure and demonstrates the need for coordinated regional security approaches.
Cambodia’s Enforcement Record and Its Unintended Consequences
Cambodia’s crackdown on cybercrime operations, particularly those involved in romance scams, investment fraud, and online gambling networks, has produced measurable disruption. The Royal Cambodian Government, under pressure from international partners including the United States and regional allies, implemented targeted arrests and facility closures beginning in 2021. These operations resulted in the detention of hundreds of foreign nationals and Cambodian facilitators involved in scam networks operating across multiple continents.
However, enforcement success in one jurisdiction creates operational pressure that criminal networks manage through geographic displacement rather than cessation. Sri Lanka’s current vulnerability stems from a convergence of factors: limited cybercrime investigative capacity, economic pressures that create recruitment opportunities for criminal networks, and insufficient bilateral cooperation mechanisms with source countries for cybercriminal operators. The island’s geographic position in the Indian Ocean, combined with its existing telecommunications infrastructure and banking sector, makes it strategically attractive for criminal relocation.
Sri Lanka’s Institutional Vulnerabilities and Criminal Opportunity
Sri Lanka’s capacity to counter transnational cybercrime operations remains constrained by institutional factors. The country’s law enforcement agencies, while professionally staffed, lack specialised cybercrime units comparable to those in developed economies or regional leaders like Singapore and Australia. Critically, Sri Lanka’s recent economic crisis (2022-2023) created acute fiscal pressures that limited government investment in digital forensics capabilities, cyber investigation training, and inter-agency coordination infrastructure.
The recruitment dynamics are particularly concerning. Sri Lanka’s educated English-speaking population and elevated unemployment rates create a labour pool that criminal networks actively exploit. Unlike Cambodia, where foreign operators dominated scam networks, Sri Lankan involvement in cybercriminal enterprise creates structural integration risks—local facilitators develop operational knowledge, establish money laundering networks through legitimate businesses, and create institutional pathways for sustained criminal activity.
The banking sector presents another vulnerability. Sri Lanka’s financial institutions, while regulated, face pressure to process transactions from informal remittance channels and cryptocurrency exchanges that cybercriminal networks exploit. The absence of comprehensive beneficial ownership registries and limited real-time transaction monitoring across smaller financial institutions creates opacity that criminal networks leverage for money laundering.
Regional Security Architecture and Transnational Response
The relocation of cybercrime networks from Cambodia to Sri Lanka exposes critical gaps in regional security cooperation. The ASEAN Regional Forum and bilateral arrangements between individual nations lack binding mechanisms for coordinated cyber investigation, extradition of cybercriminals, and real-time intelligence sharing on criminal infrastructure relocation.
India, as Sri Lanka’s primary security partner and regional power, has capacity to assist in cyber investigation and law enforcement training. The Indian Cyber Crime Coordination Centre (I4C) operates advanced investigation protocols that could be adapted for Sri Lankan institutions. However, effective transfer requires sustained commitment and resource allocation that reflects political prioritisation of cybercrime as a security issue comparable to terrorism or narcotics trafficking.
Australia and New Zealand, as Indo-Pacific security stakeholders, have direct interests in disrupting cybercriminal networks targeting their citizens and businesses. Australian Federal Police and New Zealand Police maintain cybercrime investigation capabilities and bilateral relationships with regional partners. Strategic engagement with Sri Lankan law enforcement through capacity-building initiatives, joint investigation protocols, and intelligence sharing arrangements would address the displacement problem at its source rather than managing its consequences in destination countries.
The Critical Juncture: Institutional Development or Criminal Entrenchment
Sri Lanka faces a strategic decision point. If the government prioritises cybercrime investigation capacity-building, implements beneficial ownership transparency in the financial sector, and establishes extradition protocols with source countries for cybercriminal operators, the island can avoid becoming a permanent fixture in Asia’s cybercriminal infrastructure. This pathway requires sustained investment in specialised law enforcement units, digital forensics laboratories, and inter-agency coordination mechanisms—commitments that demand political will and budgetary allocation during periods of fiscal constraint.
Alternatively, if Sri Lanka’s institutional vulnerabilities persist and criminal networks establish operational permanence, the country risks becoming structurally integrated into transnational cybercrime supply chains. This outcome would generate cascading security consequences: expanded targeting of regional and international victims, deepening financial sector corruption, and creation of criminal-state nexuses that complicate diplomatic relationships and regional stability.
The evidence from Cambodia demonstrates that enforcement pressure alone, without addressing underlying institutional vulnerabilities in destination jurisdictions, produces displacement rather than elimination. Sri Lanka’s response will determine whether it becomes a temporary operational base for mobile criminal networks or a permanent node in Asia’s organised cybercrime architecture.
Strategic Outlook: Regional Implications and Policy Imperatives
The migration of cybercriminal operations from Cambodia to Sri Lanka reflects structural patterns in transnational organised crime that regional security frameworks have not adequately addressed. The Indo-Pacific region requires coordinated policy responses that combine enforcement pressure in source jurisdictions with institutional capacity-building in vulnerable destination countries.
For Australian and New Zealand policymakers, the Sri Lankan case demonstrates that cybercrime disruption cannot be managed through domestic law enforcement alone. Transnational criminal networks operating across multiple jurisdictions require regional security cooperation architectures that establish binding investigation protocols, extradition arrangements, and real-time intelligence sharing. Investment in Sri Lankan law enforcement capacity, while not directly addressing Australian security, prevents the establishment of criminal infrastructure that would ultimately target Australian and New Zealand citizens and institutions.
The immediate policy imperative involves coordinated engagement with Sri Lankan authorities to develop specialised cybercrime investigation capacity, establish beneficial ownership transparency in the financial sector, and create extradition protocols with major source countries for cybercriminal operators. Without sustained commitment to institutional development, Sri Lanka will transition from a temporary refuge for displaced networks to a permanent operational base—a transition that would significantly complicate regional security management and increase costs for Indo-Pacific nations responding to cybercriminal targeting.
