Organized Crime in the Twenty-First Century

Chapter Opening

In May 2021, a ransomware attack shut down the Colonial Pipeline, a critical artery of fuel supply stretching from Texas to New Jersey. For nearly a week, gasoline shortages rippled across the American Southeast, fuel prices spiked, airlines scrambled, and panic-buying emptied station after station. The attack was not carried out by a foreign military, a terrorist organization, or a state intelligence service acting alone. It was the work of DarkSide, a criminal enterprise operating out of servers spread across multiple countries, its members communicating through encrypted channels and demanding payment in cryptocurrency. When the Biden administration and the FBI managed to recover a significant portion of the ransom, they did so not by arresting anyone but by tracing a digital wallet on a blockchain. The episode illustrated, with unusual clarity, what organized crime had become.

The transition from the twentieth century to the twenty-first did not simply update the criminal world with newer tools. It restructured it. The Italian-American Mafia of the mid-twentieth century was, at its core, a hierarchical, territorially rooted, ethnically defined organization that relied on personal loyalty enforced by violence and corruption. It was large and visible enough to be photographed, surveilled, infiltrated, prosecuted, and eventually dismantled in significant part by law enforcement. The criminal organizations that have risen to prominence in the twenty-first century are, by contrast, often decentralized, transnational, technologically sophisticated, and deliberately opaque. They are less like the Corleone family and more like a distributed-ledger system: no single point of failure, no obvious headquarters, no face for a jury to look at.

This transformation has roots in the same forces that reshaped the legitimate global economy over the same period. Globalization, the explosive growth of containerized shipping and international trade, the spread of the internet, the rise of digital finance, and the collapse of borders for the movement of capital all created opportunities that criminal enterprises exploited with remarkable agility. Where legitimate businesses outsourced manufacturing, criminal networks outsourced production and distribution. Where banks moved capital through offshore subsidiaries and correspondent accounts, criminal organizations laundered money through the same instruments. Where technology companies built global platforms for communication and commerce, criminal groups built their own platforms, often on the same infrastructure.

The twenty-first century also brought new criminal commodities and amplified old ones. Synthetic opioids, produced in chemical laboratories on an industrial scale and shipped in quantities small enough to evade detection by customs, killed hundreds of thousands of people in the United States alone in the two decades after 2000. Human trafficking, always a feature of criminal enterprise, expanded dramatically as conflict, climate stress, economic desperation, and tightened legal migration pathways pushed millions of vulnerable people into the hands of smuggling networks. Cybercrime, barely conceivable in the 1990s, had by the 2020s become a trillion-dollar global industry, with professional criminal organizations offering ransomware-as-a-service, stolen identity packages, and corporate espionage contracts to clients who never met their vendors.

The geographic centers of organized crime shifted, too, though the shift was never complete. The Colombian cartels of the 1980s and 1990s gave way, under sustained pressure, to a diffuse landscape of smaller trafficking groups. Mexican cartels rose to unprecedented power, controlling not only drug supply chains but territorial governance across large swaths of their country. Russian organized crime, born from the wreckage of the Soviet Union, became deeply entangled with the Russian state in ways that blurred the line between criminal enterprise and foreign policy. Chinese criminal organizations expanded their reach through cyber fraud operations, money-laundering networks, and narcotics trafficking conducted on a previously unimagined scale. West African fraud networks, long derided as minor irritants, evolved into sophisticated cybercrime enterprises with global reach.

Law enforcement, international institutions, and national governments struggled to keep pace. The legal frameworks designed to prosecute organized crime were built largely for organizations that could be identified by membership, territory, and leadership structure. Prosecuting a ransomware gang whose members had never physically met, operated across a dozen jurisdictions, and were paid in a currency that existed only on a distributed ledger required legal and technical capacities that most governments were only beginning to develop. International cooperation improved but remained constrained by national sovereignty, political tension, and the fundamental difficulty of building consensus among nations with very different legal systems and very different tolerances for criminal behavior by powerful actors on their own soil.

This chapter examines organized crime in the twenty-first century as a historical phenomenon: a product of specific conditions, specific choices, and specific failures, shaped by the same economic, political, and technological forces that shaped the world more broadly. It is also a living challenge, one whose resolution, if it comes, will require not merely better policing but deeper structural changes in the social and economic conditions that make organized crime persistently profitable, persistently adaptive, and persistently difficult to destroy.

Learning Objectives

Guiding Historical Questions

Historical Context

To understand organized crime in the twenty-first century, it is necessary to understand the world in which it operates. The decades since 1990 have witnessed a transformation in the organization of the global economy as profound as any since the Industrial Revolution. The collapse of the Soviet Union and the end of the Cold War removed political barriers to economic integration. The completion of the World Trade Organization framework, the expansion of free trade agreements, and the massive growth of containerized shipping created a global supply chain system of extraordinary efficiency and extraordinary opacity. By the 2000s, tens of millions of shipping containers were moving through the world's ports every year, carrying goods of every kind, and customs agencies could inspect only a small fraction of them. What was a logistical miracle for legitimate commerce was an equally powerful tool for criminal enterprise.

The internet, commercialized in the mid-1990s and diffused across virtually every society on earth by the 2010s, was the single most transformative development for both legitimate and criminal organization. It eliminated geography as a constraint on communication. It created new platforms for commerce that operated across jurisdictions. It made information, including the technical knowledge required for fraud, hacking, drug synthesis, and weapons trafficking, freely available at a scale previously impossible. And it created new forms of currency, most notably Bitcoin and its successors, that allowed value to be transferred across borders without the involvement of regulated financial institutions.

The political landscape of the post-Cold War world also created conditions favorable to criminal expansion. The collapse of states in the former Soviet Union, the Balkans, West Africa, Central America, and parts of Southeast Asia created zones of weak governance in which criminal organizations could operate with relative impunity, corrupting or simply overwhelming local institutions. In Mexico, a transition from single-party authoritarian rule to competitive democracy, while positive in many respects, disrupted the arrangements through which the ruling Institutional Revolutionary Party had managed and contained organized crime for decades, creating a power vacuum that cartels filled with extraordinary violence.

The economic conditions of the twenty-first century also shaped the criminal landscape. Growing inequality within and between countries created large pools of economically desperate people willing to participate in criminal enterprises as producers, couriers, money mules, or consumers. Migration, whether driven by conflict, climate, or economic necessity, created flows of vulnerable people that trafficking networks could exploit. Austerity policies and the retreat of social safety nets in many countries reduced the legitimate economic alternatives available to young men and women in the communities most affected by organized crime. The war on drugs, pursued with extraordinary intensity in the United States and many partner countries, did not reduce the profitability of drug trafficking but did dramatically increase the violence associated with it, by destroying market mechanisms that would otherwise have resolved criminal disputes.

Against this backdrop, the criminal organizations of the twenty-first century emerged as genuinely new kinds of institutions, even as they continued to exploit the same fundamental opportunities, the demand for prohibited or restricted goods and services, the willingness of officials to be corrupted, and the persistence of poverty and desperation, that had sustained criminal enterprise for centuries. Understanding what is new about twenty-first-century organized crime, and what remains stubbornly continuous with the past, is the central analytical task of this chapter.

The Transformation of Criminal Structure

The hierarchical, territorially bounded criminal organization of the mid-twentieth century, epitomized by the Italian-American Mafia and the Colombian cartels, was shaped by the technological and economic constraints of its era. Information moved slowly and unreliably. Money could be moved only through physical means or heavily regulated banking channels. Coordination across distances required physical presence or trusted intermediaries. In this environment, hierarchical organization with clear lines of authority offered advantages: it allowed complex operations to be coordinated, discipline to be enforced, and loyalty to be rewarded and punished.

The digital revolution abolished most of those constraints. Encrypted messaging applications allow criminal conspirators to communicate instantaneously across the globe without physical meetings. Dark web platforms enable buyers and sellers of illegal goods to transact without knowing each other's identities. Cryptocurrency allows value to be transferred without the involvement of regulated institutions. In this environment, the hierarchical criminal organization loses many of its advantages while retaining its vulnerabilities: if a leader is arrested, investigators can often move up the chain and dismantle the organization. The network model, in which multiple loosely affiliated actors cooperate on specific transactions without formal organizational membership, is far harder to prosecute.

Criminologists describe this as a shift from criminal organizations to criminal networks. The distinction is not merely academic. A criminal organization can be prosecuted under racketeering statutes that target the organization as such. A criminal network, in which individuals participate in specific transactions without formal affiliation to a permanent organization, is much harder to address through traditional legal tools. The legal frameworks developed to prosecute the Mafia, built on the model of a defined criminal enterprise with identifiable members, are poorly suited to prosecuting a ransomware gang whose members communicate pseudonymously and have never met.

Chronology Preview

Major Groups, Organizations, and Concepts

Core Vocabulary Preview

The following key terms appear throughout this chapter. Students should understand each before proceeding.

Globalization and Criminal Networks

Globalization, the accelerating integration of the world's economies, communications systems, and populations after 1990, transformed organized crime as fundamentally as it transformed legitimate business. The same forces that created global supply chains for electronics, pharmaceuticals, and consumer goods created global supply chains for narcotics, counterfeit merchandise, and trafficked human beings. The same financial networks that allowed multinational corporations to move capital across borders allowed criminal organizations to launder and invest their proceeds. The same communications infrastructure that connected consumers to e-commerce platforms connected drug buyers to online markets and fraud victims to scammers operating on the other side of the world.

The scale of this transformation is difficult to overstate. In 1990, the world's criminal economy was largely organized around national or regional markets. The Colombian cartels controlled cocaine production and dominated distribution networks into the United States and Europe, but their operations were still geographically concentrated and organizationally identifiable. The Italian-American Mafia operated primarily within the United States, with international connections but a fundamentally American organizational core. The Yakuza dominated criminal markets in Japan but had limited reach elsewhere. Each of these organizations was, at its center, a place-based institution with a defined territory and a recognizable structure.

By the 2020s, this geography had been radically dissolved. A fentanyl tablet sold in Ohio might contain precursor chemicals manufactured in China, combined into the final product in a Mexican cartel laboratory, smuggled across the U.S.-Mexico border by a network of human couriers and concealed in packages shipped through the postal system, distributed by a street-level dealer who purchased from an intermediary with no direct relationship to the cartel, and paid for partly through a digital payment application whose servers were located in yet another country. The criminal value chain was fully globalized, with different nodes of production, processing, transportation, distribution, and finance located in the most advantageous jurisdictions for each function.

This globalization of criminal supply chains had several important consequences. It made interdiction far more difficult, because no single law enforcement action could disrupt all the links in a chain that spanned many countries and many jurisdictions. It made prosecution more difficult, because the actors at each node of the network often had no direct knowledge of or connection to actors at other nodes. It made criminal enterprises more resilient, because the failure of one node, the arrest of a courier, the seizure of a laboratory, the shutdown of a distribution platform, could be compensated for by shifting operations to alternative nodes. The redundancy built into globalized criminal supply chains was not the result of sophisticated strategic planning by criminal masterminds; it was the emergent property of a competitive market in which multiple actors, each motivated by profit, independently adopted the organizational forms best suited to survival in an enforcement environment.

The Networked Organization

The dominant organizational form of twenty-first-century organized crime is not the hierarchy but the network. Where the mid-twentieth-century Mafia was organized like a corporation, with a chairman of the board (the boss of bosses), a board of directors (the Commission), subsidiary companies (the families), middle management (capos), and front-line workers (soldiers), the dominant criminal organization of the twenty-first century looks more like a distributed computing system, a set of nodes connected by communication links, with no single point of control and no fixed organizational chart.

This network model takes many forms. In drug trafficking, it may manifest as a loose alliance of specialized providers, a cartel that controls production in Mexico, a network of wholesale distributors in the United States, and a collection of street-level dealers who purchase from multiple suppliers and operate with considerable autonomy. In cybercrime, it may manifest as a ransomware-as-a-service operation in which the creators of malicious software license it to "affiliates," criminal entrepreneurs who deploy it against targets of their own choosing and share a percentage of the ransom proceeds with the software developers. In human trafficking, it may manifest as a chain of loosely affiliated brokers, recruiters, transporters, document forgers, and exploiters, each performing a specialized function and connected to the others by commercial relationships rather than organizational membership.

The network model offers criminal enterprises several advantages over the hierarchical model. It is more resilient to law enforcement disruption, because there is no single leader whose arrest can decapitate the organization. It is more flexible and adaptive, because individual nodes can be replaced if they are compromised. It allows for greater specialization, with different participants developing expertise in specific aspects of criminal operations. And it is more difficult to prosecute, because it is harder to establish that loosely affiliated individuals who never met and communicated only through encrypted digital channels constitute a single criminal organization subject to enterprise liability under racketeering statutes.

The network model is not without its own vulnerabilities. Networks depend on trust to function, and trust is harder to maintain among strangers than among members of a tightly bound hierarchical organization. The absence of central authority makes conflict resolution more difficult. When disputes arise, there is no boss to appeal to, which can result in violence or in the dissolution of the network. And networks, because they involve communication among multiple parties, create more potential points of surveillance and penetration by law enforcement. When the Dutch and Belgian police cracked the Encrochat encrypted communication platform in 2020, they gained access to messages exchanged by tens of thousands of criminal actors across Europe, producing a wave of arrests that demonstrated both the networks' reliance on digital communication and the scale of damage that a single intelligence success could inflict.

Jurisdictional Arbitrage

One of the most powerful tools available to transnational criminal networks is what scholars call jurisdictional arbitrage, the strategic exploitation of differences between national legal systems to locate criminal activities in the jurisdictions where they face the weakest enforcement risk. A ransomware gang operating from Russia faces virtually no domestic law enforcement risk, because the Russian government has historically declined to prosecute cybercriminals who do not target Russian citizens or institutions. A drug trafficking network can locate its production facilities in countries with weak interdiction capacity and its financial operations in jurisdictions with strict bank secrecy and limited cooperation with foreign law enforcement.

Jurisdictional arbitrage is not new. Prohibition-era bootleggers exploited the difference between American and Canadian or Caribbean legal regimes. Pirate radio stations in the 1960s broadcast from ships in international waters to avoid British broadcasting regulations. But the globalization of the twenty-first century has enormously expanded the range of jurisdictional options available to criminal actors and enormously reduced the logistical costs of exploiting them. A cybercriminal can operate from one country while routing communications through servers in twenty others, accepting payment in cryptocurrency while earning interest on proceeds held in a fourth country entirely. The geography of crime has become as fluid and deterritorialized as the geography of legitimate digital commerce.

Closing the gaps in global governance that make jurisdictional arbitrage possible has proven extraordinarily difficult. International cooperation in criminal matters requires countries to share intelligence, coordinate investigations, extradite suspects, and freeze assets, all of which require that countries trust each other's legal systems and share political interests. In a world in which major powers increasingly compete geopolitically, this kind of cooperation is difficult to sustain. Russia's refusal to extradite cybercriminals who target Western institutions is not merely a legal policy; it is a strategic posture. China's complex relationship with criminal organizations that produce fentanyl precursors or operate cyber fraud networks reflects a similar entanglement of criminal permissiveness with broader geopolitical calculation.

Technology as Criminal Infrastructure

Technology has always been a tool of criminal enterprise. The bootleggers of Prohibition used trucks and speedboats. The Mafia used the telephone to coordinate operations across cities and countries. The Colombian cartels used commercial aviation to ship cocaine. But the digital revolution of the late twentieth and early twenty-first centuries represents a qualitative break with all previous technological eras in its effect on criminal organization, criminal markets, and criminal capability.

The most fundamental technological development was the internet itself. The internet abolished distance as a constraint on communication, created new platforms for anonymous transactions, and provided access to a global information commons in which technical knowledge previously available only to highly trained specialists, how to synthesize drugs, how to exploit software vulnerabilities, how to launder money through offshore entities, could be freely shared and rapidly disseminated. The internet did not create criminal motivations, but it dramatically lowered the technical barriers to criminal activity and dramatically expanded the geographic reach of criminal enterprises.

Encrypted communication was among the most consequential specific technologies for criminal organization. For most of human history, criminal conspiracies were vulnerable to interception of their communications through physical surveillance, informants, or the tapping of telephone lines. Encryption, particularly end-to-end encryption that prevents even the service provider from reading messages, fundamentally changed this equation. Applications like Signal, WhatsApp, Telegram, and purpose-built criminal platforms like Encrochat and Sky ECC allowed criminal actors to communicate with a degree of security previously available only to state intelligence agencies. Law enforcement agencies repeatedly warned, in what became known as the "going dark" debate, that the spread of strong encryption was degrading their ability to monitor criminal communications. Criminal organizations were among the most enthusiastic adopters of encrypted communication.

The smartphone, combining a powerful computer, a high-resolution camera, a GPS receiver, a payment platform, and access to the global internet in a device carried by virtually every person in the developed world, transformed both criminal capability and criminal vulnerability. For criminal enterprises, smartphones enabled coordination, documentation, and market access on an unprecedented scale. Street-level drug dealers could maintain customer lists, manage orders, and coordinate deliveries entirely through their phones. Human traffickers could recruit victims through social media applications, process payments through digital wallets, and communicate with clients through encrypted messaging. For law enforcement, smartphones became a treasure trove of evidence, their location data, communications history, financial records, and contact lists providing investigators with information that would have required months of physical surveillance to assemble in an earlier era.

The Automation of Criminal Markets

One of the most striking features of twenty-first-century criminal technology is the extent to which criminal markets have been automated, with software platforms performing functions that previously required human intermediaries. Dark web marketplaces automate the matching of buyers and sellers, the processing of payments, the escrow of funds pending transaction completion, and the rating of vendors and products, all without any human operator managing individual transactions. Cryptocurrency wallets automate the movement and mixing of criminal proceeds. Phishing kits automate the creation and deployment of fraudulent emails and websites designed to steal credentials or install malware.

This automation has two important consequences. First, it dramatically scales criminal operations. A fraud operation that once required dozens of human employees can, with sophisticated automation, be operated by a handful of technically skilled individuals. A drug marketplace that once required a network of physical intermediaries can be replaced by a software platform that allows producers to sell directly to consumers with minimal human involvement. Second, automation creates a new category of criminal enterprise: the provider of criminal infrastructure, who profits not from engaging directly in crime but from selling or licensing the tools that allow others to do so. The ransomware-as-a-service model, in which developers of malicious software license it to criminal affiliates in exchange for a share of the proceeds, is perhaps the most visible example of this infrastructure model, but it extends across cybercrime more broadly, with markets for hacking tools, stolen credentials, fraudulent documents, and money-laundering services all operating on commercial platforms that require minimal personal contact between buyer and seller.

The automation of criminal markets also created new vulnerabilities for criminal enterprises. Platforms that aggregate large numbers of criminal transactions in a single place are attractive targets for law enforcement disruption. When the FBI and the European law enforcement agency Europol took down the AlphaBay and Hansa dark web markets in 2017, they disrupted hundreds of thousands of criminal transactions and compromised tens of thousands of user accounts. The architectural choice of centralization for efficiency in criminal markets created a single point of failure that, once exploited, inflicted enormous damage on the criminal ecosystem. In response, the criminal marketplace model has continued to evolve toward greater decentralization, with newer platforms designed to distribute the risk of law enforcement disruption across multiple servers and multiple operators.

The Dark Web and Cryptocurrency

The Silk Road, which operated from 2011 to 2013, was not the first attempt to use the internet to sell illegal goods, but it was the first to do so with a sophistication and scale that attracted serious attention from both criminal entrepreneurs and law enforcement. Ross Ulbricht, a young libertarian idealist who called himself "Dread Pirate Roberts" online, built Silk Road on the Tor network, a system originally developed by the United States Naval Research Laboratory to protect intelligence communications by routing internet traffic through multiple encrypted relays, making the source of the traffic virtually impossible to trace. Ulbricht combined Tor with Bitcoin payments, which allowed transactions to occur without either party revealing a bank account or credit card number, to create a marketplace that felt, to its users, genuinely anonymous and genuinely beyond the reach of law enforcement.

Silk Road was eventually shut down by the FBI in October 2013, and Ulbricht was arrested, convicted, and sentenced to life in prison without parole. But by the time it was closed, Silk Road had demonstrated something far more consequential than any single law enforcement success could undo. It had demonstrated that anonymous online criminal markets were viable, profitable, and capable of operating at significant scale. Within weeks of Silk Road's closure, Silk Road 2.0 had opened. Within months, a dozen competing platforms had emerged. Within a decade, the dark web marketplace model had spawned hundreds of successor platforms trading in narcotics, stolen financial data, fraudulent documents, hacking services, and weapons, generating billions of dollars in annual revenue and serving customers in every country with internet access.

The experience of dark web markets illustrates a dynamic that runs throughout the history of organized crime: the resilience of criminal markets in the face of law enforcement disruption. Each time a major dark web marketplace was taken down, its user base migrated to competing platforms, often within days. The operational intelligence gained from taking down one platform was useful for subsequent investigations, but it rarely translated into a lasting reduction in the availability of illegal goods. The market adapted, usually by decentralizing further, improving operational security, and adopting new privacy technologies. By the 2020s, some drug vendors had abandoned marketplaces entirely in favor of direct-to-customer sales through encrypted messaging applications, eliminating the single-point-of-failure risk of a centralized platform entirely.

Cryptocurrency and Criminal Finance

The relationship between cryptocurrency and organized crime is complex and often misunderstood. Popular accounts tend to portray cryptocurrency as primarily a tool of criminality, a way to conduct financial transactions beyond the reach of law enforcement. This is not accurate as a general description: the overwhelming majority of cryptocurrency transactions are legitimate, and cash remains a far more widely used medium for criminal transactions by volume. But for specific criminal use cases, particularly those requiring large transfers of value across borders without the involvement of regulated financial institutions, cryptocurrency offers genuine advantages that criminal organizations have exploited.

The most important use case is ransomware. Ransomware attacks, in which criminals encrypt a victim's data and demand payment for the decryption key, require a payment mechanism that is global, fast, difficult to reverse, and difficult to trace. Traditional payment methods, wire transfers, credit cards, even prepaid debit cards, all involve regulated intermediaries who can freeze transactions, reverse payments, or provide law enforcement with identifying information about the recipient. Cryptocurrency, particularly privacy-focused coins like Monero or Bitcoin mixed through "tumbler" services that obscure the transaction trail, can be received directly, moved rapidly across jurisdictions, and converted to cash through exchanges in countries with limited regulatory oversight.

Cryptocurrency also facilitates money laundering in ways that earlier financial technologies did not. Traditional money laundering required physical infrastructure: cash businesses to commingle criminal proceeds with legitimate revenue, corrupt financial institutions to process wire transfers, and networks of shell companies to obscure the paper trail. Cryptocurrency allowed some of these functions to be automated. A criminal could receive payment in cryptocurrency, pass it through a series of "mixer" or "tumbler" services that obscure the transaction trail, exchange it for a different cryptocurrency, deposit it on an exchange in a jurisdiction with weak anti-money-laundering enforcement, and withdraw it as local currency, all within hours and without meeting a single human accomplice.

Law enforcement response to cryptocurrency crime evolved rapidly in the 2010s and 2020s. Blockchain analytics firms developed sophisticated tools for tracing cryptocurrency transactions, exploiting the fact that all Bitcoin transactions are recorded on a public ledger to identify patterns linking pseudonymous accounts to identified criminal enterprises. Several high-profile seizures, including the recovery of over a billion dollars in Bitcoin associated with the Silk Road by the Department of Justice in 2020, demonstrated that cryptocurrency was not as anonymous as its criminal users often assumed. But the arms race between cryptocurrency privacy technology and blockchain surveillance continued to advance on both sides, with privacy coins, improved mixing technology, and decentralized exchanges offering new tools for criminal evasion even as analytical capabilities improved.

Ransomware and Cyber Extortion

Of all the criminal innovations of the twenty-first century, ransomware may be the one most clearly illustrative of the era's defining characteristics: the use of technology to scale criminal operations, the exploitation of jurisdictional gaps for impunity, the adoption of legitimate business models by criminal enterprises, and the catastrophic vulnerability of interconnected digital infrastructure to determined criminal attack. Ransomware is, at its core, a very old crime, extortion, in a new technological form. What made it unprecedented was not the criminal logic but the combination of global reach, technical sophistication, and near-total impunity that digital infrastructure made possible.

The technical operation of ransomware is relatively straightforward. Criminal actors gain access to a victim's computer network, typically through a phishing email that tricks an employee into clicking a malicious link, or through exploitation of an unpatched software vulnerability. Once inside the network, the attackers move laterally to infect as many systems as possible, then deploy encryption software that locks the victim out of their own data. A ransom demand follows, typically payable in cryptocurrency, with the promise that payment will produce a decryption key. Increasingly sophisticated attacks also involve "double extortion," threatening to publish sensitive stolen data if the ransom is not paid, and "triple extortion," also threatening the victim's customers or partners with data exposure.

The ransomware-as-a-service model transformed the cybercrime ecosystem by separating the technical expertise required to develop effective malware from the operational judgment required to select and target victims. Under this model, a core team of skilled developers creates and maintains the ransomware software and the supporting infrastructure for receiving ransom payments and providing decryption keys. They then license this toolkit to "affiliates," criminal entrepreneurs who take responsibility for penetrating target networks and deploying the ransomware, and share a percentage of any ransom collected, typically sixty to eighty percent, with the affiliates while retaining the remainder. The arrangement allowed the criminal economy to recruit large numbers of less technically skilled participants while reserving the most lucrative software development functions for those with the highest capabilities.

The State-Crime Nexus in Ransomware

Among the most troubling aspects of the ransomware epidemic was the growing evidence of Russian state tolerance for, and in some cases active facilitation of, criminal ransomware operations targeting Western institutions. Russian law enforcement consistently declined to investigate or prosecute ransomware criminals who confined their attacks to non-Russian targets, a policy so consistent and so operationally specific that it could not plausibly be attributed to mere investigative inadequacy. The pattern suggested a tacit bargain: ransomware gangs could operate from Russian territory without prosecution provided they avoided targeting Russian institutions and, in some interpretations, made themselves available for use by Russian intelligence services when required.

This state-crime nexus was not unprecedented in Russian organized crime: as discussed in earlier chapters of this text, the relationship between the Russian state and organized criminal enterprises has been characterized by complex entanglement since the Soviet era. But the ransomware case brought the dynamic into unusually sharp relief, because the victims were high-profile Western institutions and the economic and social damages were substantial and well-documented. The Colonial Pipeline attack, the attack on JBS Foods (the world's largest meat processor), and dozens of attacks on hospitals, school districts, and municipal governments in the United States and Europe in 2020 and 2021 all occurred against this backdrop of Russian state tolerance for the perpetrators.

The North Korean case was even more directly a matter of state sponsorship. North Korean state-linked hacking groups, including the Lazarus Group, used ransomware and cryptocurrency theft as instruments of national finance, generating estimated revenues of hundreds of millions of dollars annually that were used to fund the North Korean weapons program. In this case, the line between organized crime and state action had essentially disappeared: the criminal enterprise was the state enterprise, conducted by government employees pursuing national policy objectives through criminal means. The WannaCry attack of 2017, which disrupted hospitals, telecommunications companies, and manufacturing facilities across the world and caused an estimated four billion dollars in damages, was ultimately attributed to North Korean state actors using tools developed originally by the United States National Security Agency.

Trafficking in the Modern Era

Human trafficking, the recruitment, transportation, and exploitation of people through force, fraud, or coercion, is among the oldest of criminal enterprises, and it has been addressed in earlier chapters of this text in its historical dimensions. In the twenty-first century, trafficking has undergone a transformation driven by the same forces reshaping organized crime more broadly: globalization, technology, and the exploitation of vulnerability produced by inequality, conflict, and climate disruption. The result is a criminal industry that the United Nations estimates generates approximately thirty-two billion dollars annually and victimizes millions of people, making it one of the largest and most profitable criminal activities in the world.

The trafficking ecosystem of the twenty-first century is characterized by its diversity of victims, pathways, and exploitation forms. Labor trafficking, in which victims are forced to work in agriculture, construction, domestic service, fishing, or manufacturing under conditions of debt bondage or coercion, is far more prevalent globally than the sex trafficking that typically receives more media attention. In Southeast Asia, men have been trapped on fishing vessels for years, forced to work under brutal conditions for no pay, while their boats operated in international waters beyond the reach of any jurisdiction's labor laws. In Europe, trafficking victims from Eastern Europe and West Africa have been exploited in agriculture, construction, and domestic service by networks that use debt bondage, document confiscation, and threats of violence to maintain control.

Technology has profoundly shaped both the methods of trafficking and the strategies of those who combat it. Social media platforms have become the primary recruitment tool for traffickers, who use false promises of employment, education, or romantic relationships to lure victims. The digital economy has provided new venues for commercial sexual exploitation, with online advertising platforms replacing the physical street trade and the brothel as the primary marketplace for trafficked victims. Encrypted messaging applications allow traffickers to manage victims, communicate with clients, and coordinate with other criminal actors while minimizing their exposure to traditional surveillance.

Technology has also provided new tools for anti-trafficking efforts. Financial intelligence, tracking the money flows associated with trafficking operations through suspicious transaction reporting and analysis of digital payment records, has allowed investigators to identify trafficking networks that would be invisible to traditional investigative methods. Machine learning tools have been developed to identify trafficking advertisements in the massive volume of online content. Biometric databases and facial recognition technology have helped identify trafficking victims and link them to criminal networks. Non-governmental organizations and technology companies have developed applications that allow potential victims to report suspicious situations and access assistance anonymously. But the exploitation of technology by traffickers has consistently outpaced the application of technology to anti-trafficking efforts.

The Pig-Butchering Phenomenon

One of the most significant and disturbing criminal innovations of the 2020s was the emergence of large-scale "pig-butchering" scam operations in Southeast Asia, particularly in Myanmar, Cambodia, and Laos. The term, a translation of the Mandarin sha zhu pan, refers to a fraud strategy in which victims are cultivated over extended periods, like pigs being fattened for slaughter, before being defrauded of large sums through fake cryptocurrency investment platforms. What made the pig-butchering phenomenon distinctive was not only the scale of losses, estimated in the tens of billions of dollars globally, but the means of its operation: the fraud calls and chats were conducted not by the criminal organizers themselves but by trafficking victims, people who had been recruited with false promises of legitimate employment, transported to compounds in territory controlled by criminal organizations and, in some cases, by armed groups or corrupt local officials, and forced to work as fraud operators under threat of violence.

The pig-butchering phenomenon represents a remarkable convergence of two forms of criminal enterprise. The trafficking supply chain provided the coerced labor force. The cybercrime supply chain provided the fraudulent platforms and the technical infrastructure for moving the proceeds. The victims of the scheme were therefore simultaneously the people defrauded of their savings and the people forced to conduct the fraud, creating a criminal enterprise in which victims were instrumentalized as perpetrators, complicating both legal prosecution and public sympathy. Reports from people who had escaped the scam compounds described conditions ranging from severe labor exploitation to torture, and the geographic and political complexity of the regions in which the compounds were located, often in territory controlled by ethnic armed groups in Myanmar or in the lawless border zones of Cambodia and Laos, made law enforcement intervention enormously difficult.

The pig-butchering crisis illustrates several themes central to this chapter. It demonstrates the continuing importance of weak governance and corruption as enablers of organized crime: the scam compounds could not have operated without the complicity of local officials and armed groups. It demonstrates the increasingly complex relationship between different forms of criminal enterprise, as trafficking, cybercrime, and financial fraud converged in a single operational model. And it demonstrates the global reach of twenty-first-century criminal harm: the victims of the fraud were located in North America, Europe, East Asia, and South Asia, while the perpetrators, who were themselves victims, were concentrated in a handful of borderland zones in Southeast Asia. The criminal enterprise was global even as its physical infrastructure was localized.

Cartels and the Fentanyl Crisis

No aspect of twenty-first-century organized crime has claimed more lives in the United States than the synthetic opioid crisis centered on fentanyl and its analogues. The epidemic represents the convergence of several independent developments into a catastrophe of historic proportions. It was produced by the pharmaceutical industry's aggressive marketing of prescription opioids in the 1990s and 2000s, which created a large population of opioid-dependent Americans. It was accelerated by law enforcement crackdowns on prescription opioid abuse, which pushed dependent users toward heroin. It was transformed into a mass casualty event by the introduction of fentanyl into the North American drug supply by criminal networks that discovered that a product fifty to one hundred times more potent than heroin could be smuggled in quantities small enough to evade detection and cut production costs to a tiny fraction of traditional narcotics.

Fentanyl and its analogues, chemical cousins like carfentanil and acetylfentanyl, were not invented by criminal enterprises. They were developed by legitimate pharmaceutical companies for medical use, and they remain essential medicines for pain management and anesthesia. What criminal organizations discovered was that these synthetic opioids, and dozens of novel analogues that could be synthesized in quantity by chemists operating in industrial-scale laboratories, could be produced far more cheaply than plant-derived narcotics, required no agricultural land, and could be shipped in quantities small enough to be concealed in ordinary parcels. The entire annual supply of fentanyl needed to address the U.S. opioid market weighs only a few hundred kilograms, a fact that transforms the logistics of interdiction: a single intercepted shipment of heroin might represent a significant fraction of the total supply, while the equivalent weight in fentanyl could supply millions of doses.

The supply chain for illicit fentanyl in the United States has been transformed since the early 2010s. Initially, much of the fentanyl reaching American consumers was synthesized in China and shipped directly to the United States or Canada by mail. Under U.S. diplomatic pressure, China implemented regulatory controls on fentanyl production in 2019, and the direct-from-China pipeline was significantly reduced, though not eliminated. Mexican cartels, particularly the Sinaloa Cartel and the Jalisco New Generation Cartel, moved into the resulting vacuum, importing precursor chemicals from Chinese suppliers still operating in the regulatory margins, synthesizing fentanyl in Mexican laboratories, and distributing it across the U.S.-Mexico border through a combination of human couriers, vehicle concealment, and commercial shipping. By the early 2020s, the cartels controlled the majority of fentanyl reaching U.S. consumers and had expanded from distributing pure fentanyl powder to manufacturing counterfeit pharmaceutical pills designed to mimic the appearance of legitimate prescription medications.

The Human Cost

The statistics of the fentanyl crisis are staggering in their human dimensions. Overdose deaths in the United States surpassed one hundred thousand for the first time in 2021 and remained at historically unprecedented levels through the mid-2020s. These deaths were concentrated in specific demographics, young men in rural and post-industrial communities, though the epidemic spread increasingly across geographic and demographic lines, and they had cascading social effects: children left without parents, communities with sharply diminished working-age populations, health systems overwhelmed by overdose cases, and criminal justice systems struggling to balance public health and law enforcement responses.

The fentanyl crisis illustrates with particular clarity the complex role of demand in driving criminal supply. The pharmaceutical industry's opioid epidemic created the demand that the criminal supply chain subsequently served and expanded. Efforts to reduce supply by targeting cartel operations had limited effect on overall overdose death rates, because demand remained high and the criminal supply chain adapted. The introduction of naloxone, a medication that rapidly reverses opioid overdoses, saved hundreds of thousands of lives and demonstrated the potential of harm reduction strategies. Treatment access remained grossly inadequate relative to the scale of need, and the stigmatization of opioid use disorder as a moral failure rather than a medical condition complicated both political and social responses. The cartel supply chain was, in the strictest economic sense, merely serving a market created by forces far beyond its own actions, though this observation is not intended to minimize the moral responsibility of those who profited from mass death.

State-Crime Entanglement

One of the defining features of organized crime in the twenty-first century is the deepening entanglement of criminal enterprise with state power. This entanglement takes multiple forms across different contexts. In some cases, it involves the corruption of state officials by criminal organizations, which pay for protection, impunity, and political access. In other cases, it involves the capture of state institutions by criminal networks that have become so powerful that they effectively determine who holds political office and how state resources are allocated. In still other cases, the relationship is more one of partnership or instrumentalization, with state actors using criminal organizations as tools of foreign policy or domestic political management, and criminal organizations using state protection or state infrastructure for their own commercial purposes.

Mexico provides the most extensively documented case of what political scientists call "criminal governance," the exercise of governance functions by criminal organizations in territories where the state is absent or compromised. In parts of Mexico's most cartel-dominated states, including Sinaloa, Tamaulipas, Michoacán, and Guerrero, cartel organizations have assumed functions normally associated with the state: providing security, adjudicating disputes, taxing economic activity, providing social services, regulating access to land and employment, and controlling movement through the territory. This governance is exercised through a combination of coercion and consent: cartels invest in community services, employ local people, and present themselves as alternatives to a corrupt and ineffective state, while simultaneously using extreme violence against those who challenge their authority.

The Russian case, explored in an earlier chapter, continued to develop in complex directions in the twenty-first century. The Russian government's relationship with criminal enterprise, including cybercrime, dark web operations, sanctions evasion, and money laundering through Western financial institutions, has been characterized by alternating tolerance, exploitation, and occasional performance of enforcement. Russian state actors have used criminal networks to conduct operations with deniable attribution: the Wagner Group, formally a private military company but in practice closely linked to Russian state structures, conducted operations in Syria, Libya, Mali, and the Central African Republic that combined military force, resource extraction, and criminal enterprise in ways that served Russian state objectives while maintaining technical deniability. After the death of Wagner's founder Yevgeny Prigozhin in 2023, the organization was restructured more directly under state control, but the model of using semi-criminal actors as instruments of state power persisted.

Narco-States and Criminal Governance

The concept of the "narco-state," a country whose governmental institutions have been so thoroughly corrupted or captured by criminal organizations that the distinction between government and crime becomes largely meaningless, has been applied, with varying degrees of analytical precision, to a range of countries in the twenty-first century. The most commonly cited cases include Afghanistan under the Taliban after their 2021 return to power, which became the world's largest producer of heroin and, subsequently, opium; Honduras, where successive governments were deeply compromised by cartel payments, leading to the eventual extradition of a former president on drug trafficking charges; Venezuela, where the collapse of legitimate economic governance and the rise of the Maduro government produced an environment in which military and government officials participated in drug trafficking at the highest levels; and Guinea-Bissau and several other West African states, which became transit points for South American cocaine heading to European markets.

The narco-state phenomenon illustrates a fundamental insight about the relationship between organized crime and the state that runs throughout this textbook: criminal enterprises do not simply exist outside or against the state. They operate in dynamic relationship with state institutions, sometimes corrupting them, sometimes being suppressed by them, sometimes replacing them in specific territories or functions, and increasingly, in the twenty-first century, merging with them in ways that defy easy categorization. Where the twentieth-century analysis of organized crime often presupposed a clear distinction between criminal enterprise and state power, the twenty-first century has made that distinction increasingly difficult to sustain as an analytical category.

Emerging Threats

The criminal landscape of the twenty-first century is not static. Criminal enterprises continue to adapt to new environments, exploit new technologies, and identify new markets. Understanding the emerging threats on the criminal frontier is important both for assessing likely future developments and for illuminating the structural conditions that make criminal innovation persistently possible.

Environmental Crime

Environmental crime, the trafficking of wildlife, timber, minerals, and other natural resources through illegal means, has emerged as one of the largest and fastest-growing categories of transnational criminal enterprise. The United Nations Environment Programme estimates that environmental crime generates between one hundred and two hundred billion dollars annually, making it the fourth-largest category of criminal activity globally, behind only drug trafficking, counterfeiting, and human trafficking. The criminal networks engaged in environmental crime overlap significantly with those engaged in other forms of trafficking and often operate in the same geographic zones of weak governance.

Wildlife trafficking, the illegal trade in live animals and animal parts including ivory, rhino horn, shark fin, pangolin scales, and live reptiles and birds, destroys biodiversity, transmits zoonotic diseases, and generates significant criminal revenue. Illegal logging, which accounts for as much as fifteen to thirty percent of the global timber trade by some estimates, accelerates deforestation, undermines legal timber industries, and generates proceeds that finance other criminal activities. The illegal mining of minerals, including cobalt, coltan, gold, and diamonds in conflict zones, provides criminal and armed groups with revenue while inflicting severe environmental damage and often involving forced labor.

Environmental crime is shaped by the same structural conditions as other forms of criminal enterprise: demand in wealthy consumer markets, supply in regions with weak governance and high poverty, and the exploitation of the gaps between national jurisdictions. A shipment of ivory from a poached elephant in Kenya might move through three or four transit countries before reaching a final consumer market in China or the United States, with criminal actors in each country taking a share of the proceeds and the enforcement agencies in each country bearing only a fraction of the investigative burden. The global wildlife trade, legal and illegal, passes through some of the same ports, uses some of the same logistics networks, and exploits some of the same documentation vulnerabilities as other forms of contraband trafficking.

AI-Enabled Crime

Artificial intelligence, and particularly the large language models and voice-synthesis and image-generation technologies that became widely accessible in 2022 and 2023, represents the most recent and potentially most consequential technological development for criminal enterprise. The applications are multiple and mutually reinforcing. Generative AI allows criminal actors to produce convincing phishing emails, fraudulent websites, and social engineering scripts in multiple languages with minimal technical skill. Voice-cloning technology allows criminals to impersonate trusted individuals, including family members demanding emergency wire transfers and corporate executives authorizing fraudulent payments, with a degree of convincingness that previous text-based fraud could not achieve. Deepfake video technology allows the creation of convincing false video evidence that can be used for extortion, disinformation, and manipulation.

The implications for fraud at scale are significant. Many fraud operations have historically been limited by their reliance on human labor: a pig-butchering operation requires human operators to conduct convincing conversations with victims over extended periods. AI-generated personas, capable of conducting realistic romantic and investment conversations with hundreds or thousands of potential victims simultaneously, could in principle eliminate this bottleneck and scale fraud operations by orders of magnitude. Financial institutions have reported a sharp increase in AI-generated fraudulent applications for loans and accounts, in which generative AI tools are used to create convincing false documentation and identity profiles. The emergence of these capabilities will require corresponding advances in detection technology and regulatory framework, but the track record of criminal adaptation to new defensive measures suggests that the defensive advantage is likely to be temporary at best.

Criminal Exploitation of Climate Disruption

Climate change is expected to generate conditions highly favorable to the expansion of organized criminal enterprise over the coming decades. Extreme weather events, sea-level rise, agricultural disruption, and the intensification of conflict over scarce water and land resources are projected to drive large-scale human displacement in sub-Saharan Africa, South and Southeast Asia, Central America, and the Pacific islands. This displacement will create massive flows of people seeking to migrate to more stable regions, and where legal migration pathways are blocked or inadequate to the scale of need, criminal smuggling networks will step into the vacuum, as they have historically done wherever demand for migration services exceeds legitimate supply.

Climate disruption will also create new criminal markets. As agricultural zones shift, criminal organizations may move into the cultivation of prohibited crops in newly viable regions. As competition for fishing grounds intensifies, criminal fishing operations and the criminal networks that support them will expand. As the frequency and severity of disasters increases, criminal exploitation of disaster relief funds, building standards violations, and insurance fraud will grow. The intersection of climate disruption and organized crime is not a distant future prospect; it is already visible in the criminal dynamics surrounding drought-driven displacement in the Horn of Africa, logging in the Amazon, and fishing competition in the South China Sea.

Law Enforcement in the Digital Age

The transformation of organized crime in the twenty-first century has required a corresponding transformation of the law enforcement response, though the pace of institutional adaptation has consistently lagged behind the pace of criminal innovation. The challenge is not simply technical: it is organizational, legal, political, and conceptual. Law enforcement institutions built to investigate and prosecute crimes committed by identifiable individuals on identifiable territory, using evidence gathered through physical surveillance and informant testimony, must now address crimes committed by pseudonymous actors in multiple jurisdictions simultaneously, using evidence that exists primarily in digital form and may be encrypted, distributed, and legally inaccessible without the cooperation of foreign governments and private technology companies.

The most significant developments in twenty-first-century law enforcement response to organized crime have come from the application of digital intelligence and blockchain analytics to previously opaque criminal networks. The FBI's development of sophisticated cryptocurrency tracing capabilities allowed it to recover a significant portion of the Colonial Pipeline ransom and, more dramatically, to seize over three billion dollars in Bitcoin hidden by a Silk Road hacker in 2022. Europol's takedown of the Encrochat and Sky ECC criminal communication networks in 2019 and 2020, achieved by inserting malware into the networks' servers rather than trying to decrypt individual messages, produced the largest single intelligence haul in European organized crime history and led to thousands of arrests. The penetration of the ANOM encrypted phone network by the FBI and the Australian Federal Police, which operated the network as a covert sting operation for several years before revealing their access in 2021, provided intelligence on criminal operations in more than one hundred countries.

These successes demonstrated that digital intelligence, applied with technical sophistication and patience, could penetrate criminal networks that had previously seemed impervious to surveillance. But each success also revealed the limits of the approach. Criminal organizations adapted rapidly, migrating to new communication platforms, adopting new privacy technologies, and restructuring their operations to minimize the information any single point of surveillance could provide. The resources required to conduct these operations, technically skilled analysts, expensive legal processes to ensure evidence admissibility, international diplomatic and legal cooperation, were available only to the largest and best-resourced law enforcement agencies. Smaller agencies in countries with limited technical capacity remained largely unable to address the transnational criminal networks whose operations affected their citizens.

International Cooperation: Advances and Limits

International cooperation in law enforcement has improved significantly in the twenty-first century. Joint investigative teams have produced major prosecutions of cartel leaders, cybercriminals, and trafficking networks that would have been impossible without sustained collaboration across multiple jurisdictions. The Financial Action Task Force has driven improvements in anti-money-laundering standards across dozens of countries. The UNODC has provided technical assistance to countries building their capacity to investigate transnational crime. Bilateral law enforcement relationships, especially between the United States and European law enforcement agencies, have produced important operational results.

But the limits of international cooperation are equally significant. Geopolitical competition between major powers, particularly the United States, Russia, and China, has severely constrained cooperation in the areas where it matters most for addressing the largest criminal threats. Russia's consistent refusal to extradite or prosecute cybercriminals, China's complex relationship with fentanyl precursor production and fraud operations, and the reluctance of many smaller countries to challenge powerful criminal organizations with connections to their own political establishments all represent structural obstacles to the kind of sustained international cooperation that effective transnational crime enforcement requires.

The private sector has become an increasingly important partner in law enforcement responses to organized crime, particularly in the cybersecurity domain. Technology companies, financial institutions, and cybersecurity firms possess technical capabilities and data resources that governments do not have, and voluntary information sharing between the private sector and law enforcement has produced important intelligence on criminal operations. But this partnership is complicated by commercial interests in maintaining user privacy, by legal liability concerns about sharing customer data, and by the fundamental tension between the commercial interest of technology companies in the widest possible adoption of their platforms and the law enforcement interest in ensuring that those platforms are not used for criminal purposes.

Chapter Review and Analytical Checkpoint

This chapter has examined organized crime in the twenty-first century as a historical phenomenon produced by specific structural conditions and shaped by specific technological, economic, and political developments. The central analytical argument is that the criminal landscape of the twenty-first century represents both a transformation and a continuity with the history surveyed in this textbook: new technologies, new organizational forms, and new criminal markets have fundamentally changed how organized crime operates, while the underlying conditions that sustain it, demand for prohibited goods, economic inequality, weak or corrupt governance, and the persistent limits of enforcement-only strategies, remain stubbornly in place.

Students who have mastered this chapter should be able to explain the transformation from hierarchical criminal organizations to networked criminal enterprises; trace the role of the internet, encryption, and cryptocurrency in enabling new forms of criminal market; analyze the fentanyl crisis as a convergence of pharmaceutical, criminal, and public health failures; evaluate the complex relationship between organized crime and state power in the twenty-first century; identify the emerging criminal threats posed by AI-enabled fraud, environmental crime, and the criminal exploitation of climate disruption; and assess the strengths and limitations of twenty-first-century law enforcement responses.

Most importantly, students should be able to connect the analysis in this chapter to the broader argument of this textbook: that organized crime is not an aberration or a pathology external to the social order but an integral feature of societies that generate high demand for prohibited goods, tolerate corruption, produce economic inequality, and maintain governance gaps at national and international levels. Understanding this structural argument is the foundation for any serious analysis of what it would take to address organized crime effectively, and why the enforcement-focused strategies that have dominated policy for more than a century have produced, at best, partial and temporary successes against an adversary that adapts with remarkable speed and creativity.

Research or Library Extension