By Vanya Petrova

Illicit cross-border financial flows – estimated at US$1–1.6 trillion a year globally – are harming economic development on a national and global level. This is particularly true when such flows originate in heavily étatist economies, with no effective division or independence of the private from the public or state-owned sector. Autocracies have long utilized obfuscated corporate ownership structures and illicit financial flows (IFFs) for nefarious purposes such as bribery, corruption and improper lobbying to secure anything from technologies and know-how to economic and political influence on countries of interest. Russia has established a pattern of malign economic impact in Europe through its cultivation of ‘an opaque network of patronage across the region that it uses to influence and direct decision-making’ in key markets and institutions. IFFs in the Balkan region, in particular, are manifold, multi-directional and, proportionally, large as a percentage of GDP. While global illicit outflows are 3–5% of world GDP, IFFs in the Balkans are estimated at about 6% of the region’s GDP. The common denominator of the Western Balkan countries is their vulnerabilities kindled by institutional weakness and state capture. IFFs promote rent-seeking and criminal behaviour, reduce governments’ capacity to support development and inclusive growth, undermine the rule of law and jeopardize the business environment. Illicit flows drain public resources, reduce the scope and quality of public services and, thus, undermine confidence in state institutions. The Kremlin has repeatedly taken advantage of its integration into the Western financial system to exploit governance gaps through the corrosive effect of illicit finance.7 The brutal invasion of Ukraine shed a harsh light on the sobering dangers of kleptocracy and the risks to which Europe – and the world – has exposed itself by taking a lax approach to dirty money. Russia’s war in Ukraine could exacerbate these circumstances and accelerate further IFFs in the Balkan region – a crucial entry point and essential route for a plethora of illegal activities, such as drug trafficking, human smuggling, illicit trade and contraband.8 Due to imposed travel bans, Serbia is one of the few remaining routes for Russians to establish themselves in the region. Since the start of the invasion of Ukraine, Russian nationals have registered more than 5 000 companies in Serbia, over 1 000 being limited liability companies and nearly 4 000 entrepreneurial businesses.9 The establishment of so many companies in the country offers fertile ground for money laundering.10 As observed in the Serbian national risk assessment by the Administration for the Prevention of Money Laundering, limited liability companies and entrepreneurs pose a particularly high degree of threat with respect to money laundering. Through such means wealthy Russians could seek investment opportunities and use existing connections to launder money in real estate and other sectors traditionally vulnerable to IFFs in the region. The primary goal of this report is to assess the major enablers and vulnerabilities of illicit finance in the eight Balkan countries (Albania, Bosnia and Herzegovina, Bulgaria, Croatia, Kosovo, Montenegro, North Macedonia and Serbia) after Russia’s invasion of Ukraine. More concretely, the study aims to analyze the primary IFFs sources and channels in the region, and identify any emerging trends concerning modus operandi, routes, business models, use of information and communications technology. In addition, the study intends to inspect the pressing challenges to border control, police and anti-money laundering authorities to effectively prevent, investigate and counter organized crime involved in cash smuggling and money laundering. Finally, the report aims to suggest feasible recommendations for improvement. The analysis presented is based on information collected through mixed methods research consisting of qualitative and quantitative desk research and in-depth interviews with key professionals from different organizations and professional affiliations in the eight countries. A total of 15 semi-structured interviews were conducted with experts from regional organizations, customs agencies, national anti-money laundering authorities, national revenue agencies, national customs agencies and NGOs, as well as with journalists and academics. A guiding questionnaire with key questions and topics was shared with the field researchers to facilitate the work and to ensure consistency in the information collection process.

Geneva, SWIT: Global Initiative Against Transnational Organized Crime (GI-TOC)’s , 2023. 24p.

By Angus K Ryan

Crime can evade detection and prosecution by criminal justice systems. This can include safety crime, briefly defined here as violations of law that either do, or have the potential to cause sudden death or injury as a result of work-related activities. Research estimates that 2.3 million people across the globe succumb to work-related incidents and diseases every year, and that safety crime causes nearly 900 annual deaths in Britain. Despite this largescale harm, safety crime fails to attract major political, public, or academic attention. One consequence of the lack of attention to safety crime in policy discussions is a significant gap in the body of knowledge on how to effectively punish safety criminals. This thesis aims to address how the effectiveness of penalties for safety criminals can be improved to reduce safety crime. To fulfil this aim, this study answers: which theories are currently informing the punishment of safety criminals in England and Wales? Which theories are effective at punishing safety criminals and why are they effective? How can penalties be used to effectively punish safety criminals? This qualitative study explores 21 stakeholders’ views on the relationship between the punishment of safety criminals and the prevalence of the theories of deterrence, retributive justice, rehabilitation, and incapacitation in England and Wales. The findings of this study indicate that there is a lack of punishment for safety criminals in England and Wales, and that the theories of deterrence, retributive justice, rehabilitation, and incapacitation can be used in varying degrees of effectiveness against these persons, typically dependent on how penalties are used to achieve these theories. The interview data suggests numerous methods of improving current penalties and effectively punishing safety criminals. This study concludes that a mixture of sanctions in a pyramid of penalties should be used to punish safety criminals more effectively.

Bristol, UK: University of Bristol, 2022. 300p.

By The Organization for Security and Co-operation in Europe

The Organization for Security and Co-operation in Europe (OSCE) is proud to release a practical resource designed to empower law enforcement officers, prosecutors, and stakeholders in tackling cryptocurrency-related crimes. The guide "Decoding Crypto Crime: A Guide for Law Enforcement" simplifies complex concepts like blockchain technology and virtual assets, offering best practices for investigating common crypto crimes such as investment scams, extortion, and phishing.

It provides actionable steps for collecting critical evidence, interacting with Virtual Asset Service Providers (VASPs), and utilizing blockchain analytics tools. Recognizing the challenges victims face, the guide also offers support strategies and emphasizes the importance of cross-jurisdictional collaboration. While not exhaustive, this guide serves as a foundational tool to bridge the knowledge gap and enhance law enforcement’s ability to navigate the rapidly evolving world of crypto crime. Download the guide today to strengthen your capacity to combat digital financial crime and ensure a safer digital landscape.

Prague: OSCE, 2025. 64p.

By United Nations Office on Drugs and Crime (UNODC)

  As defined in the Conceptual Framework for the Statistical Measurement of Illicit Financial Flows,  Illicit Financial Flows (IFFs) are “financial flows that are illicit in origin, transfer or use,that reflect an exchange of value and that cross country borders.”IFFs may arise from criminal activities, but also from some behaviours related to tax and commercial practices. Such flows are either directly generated by illicit income, including cross-border transactions performed in the context of illicit trade of goods such as drugs, or the management of illicit income through investment in financial and non-financial assets. National data on IFFs remain limited worldwide, but significant progress has been made since 2017, when the UN Assembly adopted indicator 16.4.1. ("Total value of inward and outward illicit financial flows") for the monitoring of progress towards Sustainable Development Target 16.4, which aims to significantly reduce illicit financial and arms flows by 2030.  The United Nations Office on Drugs and Crime (UNODC) was entrusted, alongside the United Nations Commission on Trade and Development (UNCTAD), with the custodianship of SDG indicator 16.4.1. The International Classification of Crime for Statistical Purposes (ICCS)  provides definitions of illegal activities generating IFFs. Moreover, since 2017, UNODC and UNCTAD have taken a series of coordinated actions leading to a conceptual framework for the statistical measurement of IFFs, the implementation of pilot measurement exercises and the development of methodological guidelines to measure IFFs from selected illegal market activities. Additionally, in October 2019, the 10th session of the Inter-agency and Expert Group on Sustainable Development Goals Indicators,  held in Addis Ababa, reviewed the methodology and reclassified the indicator from Tier III to Tier II, meaning that the indicator is conceptually clear and has set out internationally established standards, although data are not yet regularly produced by countries. This document details the crime-related IFF estimates resulting from the engagement of UNODC with countries to implement the methodology outlined in the UNODC-UNCTAD conceptual framework.

Vienna: UNODC, 2023. 23p.

By The Financial Action Task Force (FATF)

The market of art, antiquities and other cultural objects has attracted criminals, organised crime groups and terrorists to launder proceeds of crime and fund their activities. Criminals seek to exploit the sector’s history of privacy and the use of third-party intermediaries while terrorist groups can use cultural objects from areas where they are active to finance their operations.

The vast majority of market participants do not have a connection to illicit activities, but there are risks associated with these markets and many jurisdictions do not have sufficient awareness and understanding of them. This results in a lack of investigative resources and expertise, and difficulties with pursuing cross-border investigations.

The report includes a list of risk indicators that can help public and private sector entities identify suspicious activities in the art and antiquities markets, and also highlights the importance of rapidly identifying and tracing cultural objects involved in money laundering or terrorist financing.

The report includes some good practices that countries have taken to address the challenges they face, including the establishment of specialised units and access to relevant databases and cooperation with experts and archaeologists to help identify, trace, investigate and repatriate cultural objects.

Paris: The Financial Action Task Force (FATF), 2023. 60p.

By The Financial Action Task Force (FATF)

Ransomware attacks target individuals, businesses and government agencies, across the world. The impact of these attacks can be devastating for individuals, government agencies and business activity and even disrupt essential infrastructure and services.

This FATF report analyses the methods that criminals use to carry out their ransomware attacks and how payments are made and laundered. Criminals are almost exclusively using crypto, or virtual assets and have easy access to virtual asset service providers around the world. Jurisdictions with weak or non-existent AML/CFT controls are therefore of concern.

The report proposes a number of actions that countries can take to more effectively disrupt ransomware-related money laundering. This includes building on and leveraging existing international cooperation mechanisms, given the transnational nature of ransomware attacks and related laundering. Authorities also need to develop the necessary skills and tools to quickly collect key information, trace the nearly instantaneous financial transactions and recover virtual assets before they dissipate. The multi-disciplinary nature of ransomware also means that authorities must extend their collaboration beyond their traditional counterparts to include cyber-security and data protection agencies.

The FATF also finalized a list of potential risk indicators that can help public and private sector entities identify suspicious activities related to ransomware.

Paris: The Financial Action Task Force (FATF) 2023. 54p.

By Transparency International

Despite international standards and collective commitments, the world’s biggest economies and some key financial hubs remain far too open to corrupt people and other criminals laundering and enjoying their ill-gotten gains through real estate.

To help policymakers address these ongoing challenges, Transparency International and the Anti-Corruption Data Collective (ACDC) developed the Opacity in Real Estate Ownership (OREO) Index. The Index evaluates the ideal framework to protect real estate markets from dirty money, using two pillars. The first pillar assesses the availability and adequacy of real estate data. The second measures the coverage and scope of the anti-money laundering legal framework as it applies to the real estate sector.

The first edition of the index reveals gaps that make global property markets vulnerable to corrupt money flows through assessing and ranking 24 jurisdictions, including 18 G20 member nations plus guest countries Spain and Norway, as well as Hong Kong, Panama, Singapore and the United Arab Emirates (UAE).

No country achieves a perfect mark, with 10 jurisdictions scoring below five out of possible 10 points.

By exposing weaknesses, the OREO Index aims to drive reforms that enhance transparency and accountability in the real estate sector. Both an effective data system and comprehensive anti-money laundering safeguards are essential for effectively preventing, detecting and investigating money laundering, and identifying policy gaps that allow it to go undiscovered.

Berlin: Transparency International, 2025. 49p.

By Vanda Felbab-Brown 

Over the past several decades, the U.S. opioid epidemic has spanned four phases:  Oversupply of prescription opioids in the 1990s.. A significant increase in heroin supply and use in the 2000s.  A supply-driven explosion of fentanyl use after 2012.  Most recently, polydrug use, with fentanyl mixed into/with all kinds of drugs. Since fentanyl entered the U.S. illegal drug market, more than a million people in the United States have died of opioid overdose. The costs of fentanyl use go beyond the tragic deaths and drug-use-related morbidity, however. In addition to having significant implications for public health and the economy, the fentanyl crisis intersects in many ways with U.S. foreign policy. U.S. overdose deaths began declining in 2023. But there is little certainty as to which domestic or foreign-policy interventions have been crucial drivers. The wider availability of overdose-reversal medication is fundamental, as is expanded access to evidence-based treatment. It is also possible that the Biden administration’s actions toward international supply from Mexico and China are contributing to this reduction in overdose deaths: since the start of 2024, China has become more active in suppressing the flow of precursor chemicals, and Mexican cartels, perhaps purposefully, are now trafficking a less lethal version of fentanyl. A wide array of policy measures as well as structural factors outside of policy control could be cumulatively and interactively reducing mortality. The fact that the declines in mortality are not uniform across U.S. ethnic, racial, and social groups or geographic areas suggests the importance of access to medication for overdose reversal and the treatment of opioid use disorder, as well as the influence of structural factors. There is strong bipartisan support for preserving access to medication-based treatments. But crucially, access depends on medical insurance coverage, such as that provided through Medicaid and the Affordable Care Act. There are strong ideological divides about the financing and structure of the U.S. insurance industry as well as other aspects of drug policy. On February 1, President Donald Trump imposed a 25% tariff on imports from Mexico and Canada and a 10% tariff on imports from China until each country stops the flow of fentanyl (as well as migrants, in the cases of Mexico and Canada).1 He gave all three countries a month-long reprieve before implementing the tariffs in March to see if they satisfied his counternarcotics demands. Canada adopted a robust package of anti-fentanyl measures. Mexico too tried to appease the United States through a set of law enforcement actions, though it held out on perhaps the most important form of cooperation—expanding the presence and mandates of U.S. law enforcement agents in Mexico to levels at least approaching those enjoyed during the Felipe Calderón administration. Unlike Mexico or Canada, China did not take any further counternarcotics actions and instead responded with counter-tariffs of its own, even as Trump threatened to add additional tariffs on imports from China of up to 60%.2 On March 4, 2025, Trump dismissed Canada’s and Mexico’s law enforcement actions as inadequate, implementing the 25% tariffs. He also added an additional 10% tariff on China, meaning the second Trump administration has now placed a 20% tariff on Chinese goods.3 Apart from increasing the cost of goods for U.S. customers and driving up inflation, these tariffs will have complex effects on anti-fentanyl cooperation. Any large U.S. tariffs on China will likely eviscerate Beijing’s cooperation with the United States, resetting the diplomatic clock  back to the bargaining of 2018 and noncooperation of 2021-2023. As crucial as it is to induce the government of Mexico to start robustly and systematically acting against Mexican criminal groups, whose power has grown enormously and threatens the Mexican state, Mexican society, and U.S. interests, Mexico has no capacity to halt the flow of fentanyl. Mixing the issues of migration and fentanyl risks Mexico appeasing the United States principally on migration while placating it with inadequate anti-fentanyl actions. Further, U.S. military action in Mexico, which has been threatened by Republican politicians close to Trump, would yield no sustained weakening of Mexican criminal groups or fentanyl flows. It would, however, poison the political atmosphere in Mexico and hinder its meaningful cooperation with the United States. Strong law enforcement cooperation with Canada is crucial. Canada has been facing law enforcement challenges, such as the expansion of Mexican and Asian organized crime groups and money laundering operations in Canada. But disregarding the domestic and collaborative law enforcement efforts Canada has put on the table is capricious. At home, Trump’s favored approach, which renews focus on imprisoning users and drug dealers, and dramatically toughening penalties for the latter, would be ineffective and counterproductive. And while providing treatment is very important, the dramatic effect of treatment modality on effectiveness cannot be overlooked. Approaches to treatment should be designed based on evidence, not ideology.

Washington, DC: Brookings Institute, 2025. 49p.

By Sasha Murray,  Sarah Welland, Madeleine Storry

For victims who have experienced a serious criminal offence in England and Wales, the Crown Court is a vital part of their journey to receive justice. This is where jury trials are conducted to reach a verdict on whether the defendant is guilty of the crime or not. This report comes following a record number of outstanding cases at the Crown Courts in England and Wales. 2 At the end of September 2024, 73,105 cases were outstanding and almost a quarter (23%) of these had been outstanding at the Crown Court for over a year and 8% had been outstanding for over two years. This is a considerable increase since the end of March 2020, when just 7% of cases were outstanding for over a year and 2% of cases were outstanding for over two years. 3 This means an increasing number of victims are waiting extended lengths of time for justice. This report explores how these unprecedented delays in the Crown Court system impact on victims of crime, victims’ services, and the wider criminal justice system. The findings are based on primary research conducted by the Office of the Victims’ Commissioner in 2024, including a survey and interviews with victims and a survey with victim services staff. Based on these findings, the Victims’ Commissioner makes key, actionable recommendations for justice agencies and policy makers to consider. About the research This report aims to: • Understand the experiences of victims of all crime types who are navigating the Crown Court system in England and Wales amidst a record backlog. • Identify the impact of the Crown Court backlog on victims, the criminal justice system and victim services. • Understand victims’ experiences of support and communication whilst navigating the Crown Court backlog. Findings from the research The Crown Court system is experiencing an unprecedented backlog meaning victims commonly face delays and adjournments. • In the latest official statistics, a quarter of trials listed at the Crown Court had to be rearranged on the day of trial. • Further data, provided by HMCTS, showed that the number of completed Crown Court cases that had been rearranged more than three times on the day of trial, was four times higher in 2023/24 than it was in 2019/20. 4 • In our research, we found that of those victims who had been given a trial date, nearly half (48%) had this date changed at some point in their criminal justice journey and 26% of these victims had the date changed four or more times. For  victims often navigating the criminal justice system for the first time, this worsened an already stressful and traumatic process. The delays in the Crown Court cause debilitating stress and trauma for victims. • Our research highlighted how the Crown Court backlog caused immense stress for victims, prompting a deterioration in physical and mental health. Some victims resorted to drug and alcohol use or self-harm to cope, while other victims reported attempting suicide as it was too difficult to continue. • We found that while victims were still involved in the criminal justice process, they were unable to move on and prevented from recovering from the crime. • Additionally, when victims experienced repeated adjournments, the emotional distress and the necessity to re-live the trauma for each additional listing further exacerbated their trauma. The Crown Court backlog damages victims’ lives and futures. • We found that whilst enduring the prolonged waits for Crown Court trials, many victims were unable to maintain their daily functioning. Their lives were subsequently further disrupted by repeated adjournments. • Our findings also highlighted the impact of the Crown Court delays on victims’ employment. Victims often had to take periods of time off work for each trial listing, and some were unable to work or were signed off sick due to the stress of the delays. This had significant financial implications for some victims, particularly those who were self-employed. • The delays also adversely affected younger victims, as it disrupted their education and put their lives on hold during significant periods of their development. Our findings also highlighted the impact on victims’ interpersonal relationships. The turmoil of the Crown Court delays sometimes led to relationship breakdowns, at a time when a victim’s support network was vital. • We also heard how the delays in the Crown Court system impacted on other legal processes. For example, delays to trials concluding caused issues with Family Court proceedings, applications to the Criminal Injuries Compensation Authority (CICA) and eviction orders. The effectiveness of the criminal justice system and victims’ confidence in its ability to deliver justice is at risk due to the delays in the Crown Court system. • Our findings highlighted how increased waiting time for trials heightened the risk of victims’ memories fading and therefore, the quality of their evidence diminishing. • The increased waits also meant supportive prosecution witnesses became more likely to withdraw. • In addition, victims’ faith and trust in the criminal justice system was damaged, leading to disengagement from with the criminal justice process and in many cases, an entire withdrawal. • Where victims persevered with the criminal justice process, they often felt justice did not prevail. We were informed of cases where the time taken for the trial to take place meant the defendants’ sentence had already been served, either on remand or through bail conditions. We were also told of instances where the Crown Prosecution Service had dropped charges due to cases no longer being in the public interest and where defendants had died before the trial could take place. • For many victims, their experiences of the Crown Court backlog left them unwilling to engage with the criminal justice system in the future. High-quality support helps victims to stay engaged with the criminal justice process amidst the Crown Court delays, however the delays impede support organisations’ ability to provide this support. • Despite support being vital for their engagement, we found that for some victims, the delays prevented them accessing support. Some rape and sexual offence victims were advised not to seek therapy until after trial. However, the delays in cases coming to court resulted in long periods without support, further delaying their recovery. • We also found that the delays led to an increased demand for support services. This was due to an increased number of victims waiting for court and increased victim support needs due to the impact of the Crown Court delays. Many staff reported unsustainable caseloads and many support services had to implement waiting lists. Many services also raised concerns about the quality and consistency of support provision being compromised as a result of the overwhelming demand. • Our research highlighted the negative impact of the Crown Court backlogs on the wellbeing and job satisfaction of support staff, with some at risk of burnout and leaving their roles. This further exacerbated issues with support accessibility, quality, and consistency. Poor communication compounds the impact of the Crown Court backlog on victims. • Our research highlighted that poor initial expectation management of how long a case can take to get to trial and a lack of communication whilst victims waited for trial worsened victims’ experiences. • We also found that many victims experienced trials being adjourned at very short notice and with minimal or no explanation. This added to the emotional distress they experienced navigating an already challenging process. Key recommendations This report contains 19 recommendations that are grouped into three overarching aims. We have identified a key recommendation for change to help achieve each of these aims: 1. Improve the victim experience of the criminal justice system. o The government to explore how victims whose case is going to trial might be given a single point of contact to improve communication and ensure their Victims’ Code entitlements are delivered. 2. Make court processes more transparent and efficient. o The restoration of an Independent Courts’ Inspectorate so that the operation of the Court Service is subject to rigorous independent scrutiny. 3. Ensure victim services can provide support to victims as they wait for the case to get to trial. o Providing emergency funding to victim support services to help them cope with increased caseloads arising from the court backlog crisis.  

London: Victims Commissioner, 2025. 73p.

By Jamie MacColl, James Sullivan, Jason R C Nurse, Sarah Turner, Gareth Mott, Edward Cartwright and Anna Cartwright  

The cyber insurance industry has been heavily criticised for providing coverage for ransom payments. A frequent accusation, which has become close to perceived wisdom in policymaking and cyber security discussions on ransomware, is that cyber insurance has incentivised victims to pay a ransom following a cyber incident, rather than seek alternative remediation options. Over a 12-month research project, researchers from RUSI, the University of Kent, De Montfort University and Oxford Brookes University conducted a series of expert interviews and workshops to explore the relationship between cyber insurance and ransomware in depth. This paper argues that there is, in fact, no compelling evidence that victims with cyber insurance are much more likely to pay ransoms than those without. Ransomware remains one of the most persistent cyber threats facing the UK. Despite a range of government, law enforcement and even military cyber unit initiatives, ransomware remains lucrative for criminals. During this research, we identified three main drivers that ensure its continued success: 1. A profitable business model that continues to find innovative ways to extort victims. 2. Challenges around securing organisations of all sizes. 3. The low costs and risks for cybercriminals involved in the ransomware ecosystem, both in terms of the barriers to entry and the prospect of punishment. Despite this perfect storm of factors, the cyber insurance industry has been singled out for criticism with the claim that it is funding organised cybercrime by covering ransom payments. In reality, cyber insurance’s influence on victim decision-making is considerably more nuanced than the public debate has captured so far. While there is evidence that cyber insurance policies exfiltrated during attacks are used as leverage in negotiations and to set higher ransom demands, the conclusion that ransomware operators are deliberately targeting organisations with insurance has been overstated. However, the insurance industry could do much more to instil discipline in both insureds and the ransomware response ecosystem in relation to ransom payments to reduce cybercriminals’ profits. Insurers’ role as convenors of incident response services gives them considerable power to reward firms that drive best practices and only guide victims towards payment as a last resort. But the lack of clearly defined negotiation protocols and the challenges around learning from incidents make it difficult to develop a sense of collective responsibility and shared best  practices around ransomware response. This has not been helped by the UK government’s black-and-white position on ransom payments, which has created a vacuum of assurance and advice on best practices for ransom negotiations and payments. This paper does not advocate for an outright ban on ransom payments or for stopping insurers from providing coverage for them. Instead, it makes the case for interventions that would improve market-wide ransom discipline so that fewer victims pay ransoms, or pay lower demands. Ultimately, this involves creating more pathways for victims that do not result in ransom payments. Beyond ransom payments, cyber insurance has a growing role in raising cyber security standards, which could make it more difficult to successfully compromise victims and increase costs for ransomware operators. Successive years of losses from ransomware have led to more stringent security requirements and risk selection by underwriters. Although the overall effect of this on the frequency and severity of ransomware attacks remains to be seen, by linking improvements in security practices to coverage, cyber insurance is currently one of the few market-based levers for incentivising organisations to implement security controls and resilience measures. However, continued challenges around collecting and assessing reliable cyber risk and forensic claims data continue to place limits on the market’s effectiveness as a mechanism for reducing ransomware risk. This, along with cyber insurance’s low market penetration, makes clear that cyber insurance should not be treated as a substitute for the legislation and regulation required to improve minimum cyber security standards and resilience. Insurers are also commercial entities that primarily exist to help organisations transfer risk, rather than to improve national security and societal cyber resilience. The cyber insurance industry could be a valuable partner for the UK government through increased ransomware attack and payment reporting, sharing aggregated claims data, and distributing National Cyber Security Centre (NCSC) guidance and intelligence to organisations. However, the government has not made a compelling enough case to insurers and insureds about the benefits of doing so. Instead, it has relied on appealing to their general sense of altruism. While insurers will benefit if governments are able to generate more accurate and actionable data on ransomware, albeit indirectly, this needs to be sold to the industry in a more convincing way. Some principles and recommendations for both the insurance industry and the UK government are listed below. These are not designed to solve all the challenges of the cyber insurance market, nor do they present wide-ranging solutions to the ransomware challenge. Instead, they focus on where the cyber insurance industry can have the most impact on key ransomware drivers. This reflects the fact that disrupting the ransomware economy involves applying pressure from different angles in a whole-of-society approach. The recommendations also start from the position that the UK government’s light-touch approach is unsustainable and requires more intervention in private markets that are involved in ransomware prevention and response. While they are specifically aimed at UK policymakers, regulators and insurers, they may be applicable to other national contexts     

London: Royal United Services Institute for Defence and Security Studies, 2023.  84p.

By Jamie MacColl, Jason R C Nurse and James Sullivan 

  GOVERNMENTS AND BUSINESSES are struggling to cope with the scale and complexity of managing cyber risk. Over the last year, remote working, rapid digitalisation and the need for increased connectivity have emphasised the cyber security challenge. As the pursuit of approaches to prevent, mitigate and recover from malicious cyber activity has progressed, one tool that has gained traction is cyber insurance. If it can follow the path of other insurance classes, it could play a significant role in managing digital risk. This paper explores whether cyber insurance can incentivise better cyber security practices among policyholders. It finds that the shortcomings of cyber insurance mean that its contribution to improving cyber security practices is more limited than policymakers and businesses might hope. Although several means by which cyber insurance can incentivise better cyber security practices are identified, they have significant limitations. Interviewees from across government, industry and business consistently stated that the positive effects of cyber insurance on cyber security have yet to fully materialise. While some mature insurers are moving in the right direction, cyber insurance as a whole is still struggling to move from theory into practice when it comes to incentivising cyber security. If this is to change, the insurance industry must overcome significant challenges. One is the competitiveness of the nascent cyber insurance market over the last two decades. Most of the market has used neither carrots (financial incentives) nor sticks (security obligations) to improve the cyber security practices of policyholders. The industry is also struggling to collect and share reliable cyber risk data that can inform underwriting and risk modelling. The difficulties inherent in understanding cyber risk, which is anthropogenic and systemic, mean insurers and reinsurers are unable to accurately quantify its causes and effects. This limits insurers’ ability to accurately assess an organisation’s risk profile or security practices and price policy premiums accordingly. The spectre of systemic incidents such as NotPetya1 and SolarWinds2 has also limited the availability of capital for cyber insurance markets. However, the most pressing challenge currently facing the industry is ransomware. Although it is a societal problem, cyber insurers have received considerable criticism for facilitating ransom payments to cybercriminals. These add fuel to the fire by incentivising cybercriminals’ engagement in ransomware operations and enabling existing operators to invest in and expand their capabilities. Growing losses from ransomware attacks have also emphasised that the current reality is not sustainable for insurers either.

To overcome these challenges and champion the positive effects of cyber insurance, this paper calls for a series of interventions from government and industry. Some in the industry favour allowing the market to mature on its own, but it will not be possible to rely on changing market forces alone. To date, the UK government has taken a light-touch approach to the cyber insurance industry. With the market undergoing changes amid growing losses, more coordinated action by government and regulators is necessary to help the industry reach its full potential. The interventions recommended here are still relatively light, and reflect the fact that cyber insurance is only a potential incentive for managing societal cyber risk. They include: developing guidance for minimum security standards for underwriting; expanding data collection and data sharing; mandating cyber insurance for government suppliers; and creating a new collaborative approach between insurers and intelligence and law enforcement agencies around ransomware. Finally, although a well-functioning cyber insurance industry could improve cyber security practices on a societal scale, it is not a silver bullet for the cyber security challenge. It is important to remember that the primary purpose of cyber insurance is not to improve cyber security, but to transfer residual risk. As such, it should be one of many tools that governments and businesses can draw on to manage cyber risk more effectively.   

RUSI Occasional Paper, June 2021, London: Royal United Services Institute for Defence and Security Studies , 2021. 68p.

By Thorn in partnership with Burson Insights, Data & Intelligence 

Since 2019, Thorn has focused on amplifying youth voices to better understand their digital lives, with particular attention to how they encounter and navigate technologyfacilitated forms of sexual abuse and exploitation. Previous youth-centered research has explored topics such as child sexual abuse material (CSAM)1 —including that which is self-generated (“SG-CSAM”)—nonconsensual resharing, online grooming, and the barriers young people face in disclosing or reporting negative experiences. Thorn’s Emerging Threats to Young People research series aims to examine emergent online risks to better understand how current technologies create and/or exacerbate child safety vulnerabilities and identify areas where solutions are needed. This report, the first in the series, sheds light specifically on young people’s perceptions of and experiences with deepfake nudes. Future reports in this initiative will address other pressing issues, including sextortion and online solicitations. Drawing on responses from a survey of 1,200 young people aged 13-20, this report explores their awareness of deepfake nudes, lived experiences with them, and their involvement in creating such content. Three key findings emerged from this researc.  1. Young people overwhelmingly recognize deepfake nudes as a form of technology-facilitated abuse that harms the person depicted. Eighty-four percent of those surveyed believe that deepfake nudes cause harm, attributing this largely to the emotional and psychological impacts on victims, the potential for reputational damage, and the increasingly photorealistic quality of the imagery, which leads viewers to perceive—and consume—it as authentic. 2. Deepfake nudes already represent real experiences that young people have to navigate. Not only are many young people familiar with the concept, but a significant number report personal connections to this harm—either knowing someone targeted or experiencing it themselves. Forty-one percent of young people surveyed indicated they had heard the term “deepfake nudes,” including 1 in 3 (31%) teens. Additionally, among teens, 1 in 10 (10%) reported personally knowing someone who had deepfake nude imagery created of them, and 1 in 17 (6%) disclosed having been a direct victim of this form of abuse. 3. Among the limited sample of young people who admit to creating deepfake nudes of others, they describe easy access to deepfake technologies. Creators described access to the technologies through their devices’ app stores and accessibility via general search engines and social media 

El Segundo, CA  Thorn, 2025. 32p.

By Gustavo J. Bobonis and Anke Kessler

To what extent can anti-corruption measures serve to limit patronage and corrupt networks effectively and sustainably in clientelist societies with a prevailing norm of corruption? We develop a political agency model in which office holders are motivated to reduce rent seeking behavior through re-election incentives operating via elections and audits (formal institutions), but also through reputational or self-image concerns that are influenced by the prevailing norm on corruption in their peer group (informal institutions). We show that, while the formal institutions of audits and elections have the desired direct effect of reducing corruption, they also affect informal rules of conduct, which can have unintended effects. In particular, in clientelist societies with high levels of corruption, the social concerns work in opposition to formal incentives provided by anti-corruption efforts. Applying the theory to data from Puerto Rico’s anti-corruption municipal audits program, we find evidence consistent with the idea that anticorruption measures are less effective due to social spillovers.

CESifo Working Paper No. 11715, Munich: Munich Society for the Promotion of Economic Research - CESifo GmbH, 2025.

By The  European Union Agency for Fundamental Rights = FRA

This paper sets out some of the key challenges and concrete solutions in the implementation and enjoyment of victims’ rights that have emerged from FRA’s research over the past decade on how victims of crime have accessed their rights in practice across the EU. The findings are intended to inform and support the work of key stakeholders with respect to the revised Victims’ Rights Directive and related legislative files that address various victims’ rights. Those include the Directive on combatting violence against women and domestic violence, the Directive on preventing and combating trafficking in human beings and protection of its victims, the Directive on combating the sexual abuse and sexual exploitation of children and child pornography, the Directive on combatting terrorism, and the Compensation Directive.

Based on existing FRA data, the paper brings together key findings from FRA’s quantitative and qualitative research on victims of crime relating to three areas:

• Reporting crime

• Protection from secondary victimisation

• Victim support services.

The paper highlights challenges and solutions in each of these areas, drawing directly from FRA’s published work.

Empirical evidence concerning victims’ enjoyment of their rights in practice, and the challenges they face, emerges from data that FRA has gathered using a variety of methodologies; namely:

1. Large-scale quantitative surveys collecting data from tens of thousands of victims (based on interviews in person or carried out online; some surveys covering all EU Member States and others a selection of countries); and

2. In-depth qualitative research that involves the testimony of victims but also practitioners who deal directly with victims within the criminal justice system (e.g. police, prosecutors, judges, lawyers, victim support services).

See list of relevant FRA publications at the end of this section.

The solutions outlined in this paper, drawn from existing FRA findings, are based on practices in various EU Member States that have proven to be effective in responding to the practical needs of victims and to improving their ability to access their rights. These findings can assist the EU institutions and Member States in identifying actions that could be taken in these three areas to guarantee the rights, support and protection of victims of crime.

Vienna: European Union Agency for Fundamental Rights, FRA, 2024. 39p.

By Vasiliki Georgoulas-Sherry & Hanna Hernandez

Data is needed to understand and assess the demographic differences—and at times, disparities and disproportionalities—in how the criminal justice system serves our communities and administers justice. Understanding these disparities and disproportionality in the criminal justice system is crucial for addressing systemic inequities. Disparities and disproportionalities within the criminal justice system are present in all stages of the criminal justice system, from arrest to incarceration (Brame et al., 2014; Kim & Kiesel, 2018; Kovera, 2019; Monk, 2019). This topic continues to draw significant attention from a variety of resources such as local, state, and federal government agencies, advocacy groups, policymakers and lawmakers, researchers and scholars, and the community. Evaluating these disparities and disproportionality is critical for addressing systemic inequalities and promoting fairness in the administration of justice. To respond to these impacts, the Criminal Justice Research & Statistics Center. the Washington Statistical Analysis Center (SAC) applied for and received the 2023 State Justice Statistics (SJS) grant from the Bureau of Justice Statistics (BJS) to assess this work. Through the use of publicly available data from the National Incident-Based Reporting System (NIBRS) to evaluate sex and racial disparities and disproportionalities, this report, which is part of a series of NIBRS reports, will endeavor to better understand more about the different demographic groups that are most impacted, and how these trends vary by time. Furthermore, this report will assess the demographic differences in the presence of injury, the presence of bias motivation, the use of weapons and/ or force, and the presence of familiarity in victimization in NIBRS crimes against property (i.e., criminal acts that destroy or deprive another's property against the owner's will - generally considered less serious than crimes against persons, but they can still be felonies).

Olympia: Washington State Statistical Analysis Center, 2024. 74p.

By The World Economic Forum

In a complex cyberspace characterized by geopolitical uncertainties, widening cyber inequity and sophisticated cyberthreats, leaders must adopt a security-first mindset. While the 2024 edition of the Global Cybersecurity Outlook highlighted the growing inequity in cyberspace, this year’s report shines a light on the increasing complexity of the cyber landscape, which has profound and far-reaching implications for organizations and nations. This complexity is driven by a series of compounding factors: – Escalating geopolitical tensions are contributing to a more uncertain environment. – Increased integration of and dependence on more complex supply chains is leading to a more opaque and unpredictable risk landscape. – The rapid adoption of emerging technologies is contributing to new vulnerabilities as cybercriminals harness them effectively to achieve greater sophistication and scale. – Simultaneously, the proliferation of regulatory requirements around the world is adding a significant compliance burden for organizations. All of these challenges are exacerbated by a widening skills gap, making it extremely challenging to manage cyber risks effectively.

Geneva, SWIT: World Economic Forum , 2025. 49p.

By Jack Katz and Nahuel Roldán

Criminology is haunted by state-structured biases. We discuss five. (a) With the spatial boundaries and the binary deontology they use to count crime, governments draw researchers into ecological fog and sometimes fallacy. (b) All legal systems encourage criminologists to promote untenable implications of socially stratified criminality. (c) To degrees that vary by time and place, the scope of criminological research is compromised by methodological nationalism. (d) State agencies use chronologies that repeatedly draw researchers away from examining the nonlinear temporalities that shape variations in criminal behavior. (e) State agencies produce data that facilitate explaining the why of crime, but scientific naturalism would first work out what is to be explained. We recommend a criminology that begins by describing causal contingencies in social life independent of governments’ labeling of crime.

Annual Review of Criminology, Vol. 8:53-73 , January 2025

By Laura R. Blume

Why do drug traffickers sometimes decide to use violence, but other times demonstrate restraint? Building on recent work on the politics of drug violence, this article explores how Central American drug trafficking organizations’ strategies impact their use of violence. I argue that three inter-related political factors—corruption, electoral competition, and the politicization of the security apparatus—collectively determine the type of relationship between traffickers and the state that will emerge. That relationship, in turn, determines the primary strategy used by traffickers in that country. Drawing on over two years of comparative ethnographic fieldwork in key transshipment points along the Caribbean coast of Central America, I show how co-optation strategies in Honduras have resulted in high levels of violence, evasion strategies in Costa Rica have produced moderate levels of violence, and collusion strategies in Nicaragua have generated the lowest levels of drug-related violence.

Comparative Political Studies,Volume 55, Issue 8, July 2022, Pages 1366-1402

Edited by Husrev Taha Sencar, Luisa Verdoliva, Nasir Memon

Media forensics has never been more relevant to societal life. Not only media content represents an ever-increasing share of the data traveling on the net and the preferred communications means for most users, it has also become integral part of most innovative applications in the digital information ecosystem that serves various sectors of society, from the entertainment, to journalism, to politics. Undoubtedly, the advances in deep learning and computational imaging contributed significantly to this outcome. The underlying technologies that drive this trend, however, also pose a profound challenge in establishing trust in what we see, hear, and read, and make media content the preferred target of malicious attacks. In this new threat landscape powered by innovative imaging technologies and sophisticated tools, based on autoencoders and generative adversarial networks, this book fills an important gap. It presents a comprehensive review of state-of-the-art forensics capabilities that relate to media attribution, integrity and authenticity verification, and counter forensics. Its content is developed to provide practitioners, researchers, photo and video enthusiasts, and students a holistic view of the field.

Singapore: Springer Nature 2022, 490p.

By Isabella Voce and Anthony Morgan

The cost of cybercrime is often expressed in terms of the financial loss to individuals, businesses and governments. This report argues that in order to invest the necessary financial, human and technical resources in prevention and response, perceived harm must be widened to include practical, health, social, financial and legal impacts.

The authors propose a harm index for victims, using a novel approach that draws on victim self-report data collected through the Australian Cybercrime Survey. The index provides a measure of the relative severity of each of 17 types of cybercrime, calculated based on victim reports of the prevalence and severity of each harm.

Key findings

Nearly half of all respondents had been a victim of at least one type of cybercrime in the 12 months prior to the survey.

Cybercrime victims experience a range of harms arising from their victimisation. Practical, social and health impacts were the most common harms experienced, followed by financial and legal difficulties.

Most cybercrime harm (71%) is concentrated among victims who did not lose any money in the most recent incident (82% of victims).

Harm can be reduced when incidents are successfully disrupted or steps are taken to minimise the impact on victims.

Certain groups are over-represented as victims, with this over-representation even more pronounced when the level of harm is taken into account.

Repeat victimisation is also common: 11% of individuals accounted for 58% of the harm reported in the survey.

There was a significant relationship between a victim’s total harm score and their likelihood of seeking help from the police.

Trends & issues in crime and criminal justice 706

Canberra: Australian Institute of Criminology, 2025. 21p.