Suda Chonlaket (pictured), a 26 year old Thai woman, is believed to have been murdered in a Cambodian scam compound by being forced to perform repetitive physical exercise as punishment for not meeting her daily revenue target. The Bangkok Post reports that Suda was made to do over 1,000 squats because she collected less than THB100,000 (USD3,100) in scam proceeds that day. When Suda lost consciousness, her captors tried to revive her with electric shocks, then attempted to have her cremated to destroy the evidence of her abuse. If they had succeeded then nobody else would have ever known what happened to Suda.
Suda’s body was discovered by people from the Immanuel Foundation, a volunteer group that has helped over 1,500 people escape from human trafficking. She was found at the Cambodian temple where the cremation would have been performed. The Immanuel Foundation and the Thai Embassy have arranged for the return of Suda’s body to her mother and community so that religious rites can be performed. Meanwhile, Suda’s family complain that the authorities are not doing enough to find her husband, who was also abducted. The Immanuel Foundation says more than a hundred other Thais remain enslaved in the same scam compound that held Suda.
There are so many cases of the maltreatment of prisoners in scam compounds that anyone might reasonably question why this article focuses on Suda’s tragedy instead of the story of a South Korean woman whose body was found on the Vietnamese side of the border with Cambodia, or the Chinese family told that their 15 year old son would be released if they delivered three adults to take his place in the scam compound. The scam crisis is prompting so much human trafficking that we may attempt to count the thousands of people enslaved and murdered, but then we risk a failure to empathize with the suffering of each individual. We can become guilty of reducing human lives to numbers.
I want to keep this article short because the communications industry has lost sight of its moral obligations. Too many people who speak about the consequences of transnational networked crime focus on the financial losses incurred. They routinely present figures in the millions, billions or trillions, but none of those numbers represent the human cost of crime. By talking too generally about crime we lose sight of the need for urgent action that would save lives that are in danger right now. Blurring too many different kinds of frauds together causes us to lose focus on steps that need to be taken immediately, by communications providers everywhere in the world. A clear pattern has emerged with straightforward implications for businesses which are choosing not to see how their profits are tied to the crimes that ensnare individuals like Suda.
- People like Suda are forced to befriend potential victims through the use of online accounts. These may be accounts on OTT comms services like WhatsApp, or dating websites, or online markets, or any internet platform where somebody can assume an identity and seek to engage in conversation with strangers from other countries.
- Internet platforms do a slightly better job of preventing bad people creating fake accounts than they did before. This slight improvement involves requiring users to link online accounts to a phone number.
- Specialized criminal gangs satisfy the demand for fake online accounts by obtaining very large numbers of SIM cards, installing them in simboxes, and using them to receive the one-time passwords required to create online accounts.
European police explicitly stated this was one of the business models for the massive simbox operation raided in Latvia last month. That criminal outfit had 1,200 simboxes and several hundred thousand SIM cards from almost 80 different countries. The police stated these had been used to create over 49 million online accounts.
The big New York simbox operation busted in September was almost certainly performing the same task of receiving messages to create online accounts. That outfit had over 300,000 SIM cards and 300 simboxes. But instead of being candid about the criminal motives for obtaining so many SIM cards, the American authorities encouraged the public to believe a silly story about the United Nations potentially suffering a denial of service attack. It is not just telcos and internet platforms that are ashamed of how they profit from crime; sometimes national authorities are complicit in the cover-up.
The conclusions are so painfully obvious that we should all be ashamed of the communications industry. We know what we need to do.
- Make it harder to obtain SIMs, especially in bulk.
- Introduce registration requirements to enable limits to be placed on how many SIMs can belong to a single user.
- Use data analytics to reveal locations with very many SIMs.
- Use data analytics to identify anomalous user behavior, such as SIMs that only receive SMS OTPs instead of creating any outbound traffic, or SIMs that never seem to change location.
I am tired of the excuses and obfuscation from people who claim to speak on behalf of the communications industry. Speaking to other professionals confirms I am not alone in feeling this way. It is perfectly possible to implement all of the controls listed above. They have been implemented in multiple telcos and multiple countries. It would not take long to implement these controls everywhere, if there was the will to do so. These necessary changes are obstructed by a stubborn block of well-remunerated shills who care more about share prices than the lives of people like Suda.
There is nothing in this article that a regular reader of Commsrisk does not know already, except for the tragic story of how Suda Chonlaket passed away. We have grown used to rationalizing that the comms industry is doing everything possible to tackle crime. That is untrue. Cold calculations about the cost of crime, and the cost of mitigating crime, are not sufficient. We must stoke a fire in the belly of every communications industry professional who knows there is more to life.
