The Pulse | Security | South Asia

As Cambodia Cracks Down, Cyberscam Networks Test Sri Lanka

What happens next will determine whether the island is a temporary refuge for foreign cybercriminals or becomes part of Asia’s cybercrime infrastructure.

Sri Lanka’s beach towns and apartment blocks are not the first places one associates with Southeast Asia’s cyberscam epidemic. But recent arrests of foreign cybercriminals suggest that scam networks, increasingly pushed out of Cambodia and other Southeast Asian hubs, are now testing Sri Lanka as a new base.

This, however, does not mean Sri Lanka has replaced Cambodia as the region’s main haven for cybercriminals. Cambodia’s scam economy grew over several years, drawing strength from casinos, real estate, tycoon networks, weak enforcement, and political protection. Sri Lanka is not there yet, but recent detections show that thousands of foreign cybercriminals have arrived at this Indian Ocean island.

Sri Lankan authorities have arrested more than 1,000 people this year in connection with suspected cyberscam operations, many of them foreign nationals. Some raids have taken place in coastal areas popular with tourists, while others have taken place in apartment buildings and properties near Colombo. In one April raid on the west coast of the island, police found more than 150 foreign nationals allegedly running a cyberscam operation. Days later, another raid near Colombo led to the arrest of about 120 foreign nationals. In May, 221 foreigners were arrested in the Southern Province.

In Sri Lanka, it is impossible to operate remote jungle compounds, given that the state has control over the entire territory, which drew global attention to Cambodia and Myanmar.

Criminals have chosen less conspicuous locations on the island where it’s easy to blend in, where the presence of foreign nationals will not raise questions. They have rented houses, hotel spaces, apartment blocks and office buildings that can be occupied quickly, wired for operations, and abandoned when police pressure increases. Many tourists come to Sri Lanka in groups and Sri Lankans are used to seeing large number of them renting out properties together. This gives scam networks mobility and makes them harder to detect.

But why are cybercriminals moving into Sri Lanka? Chief Information Security Officer at Sri Lanka Computer Emergency Readiness Team (SLCERT), Nirosh Ananda, said a combination of harsh action against cybercriminals in Southeast Asia and China as well as Sri Lanka’s lax visa rules are the main reasons driving this influx.

Cambodia, one of the region’s most notorious centers for online fraud is cracking down on cybercriminals following Chinese and U.S. pressure. Online scam networks have stolen trillions of dollars from victims across the world. They have also relied on trafficked workers, many lured by fake job offers and then forced to defraud strangers online. Following international pressure, Cambodian officials have targeted hundreds of suspected scam locations, shut down most of them, opened legal cases against alleged ringleaders and associates, and repatriated thousands of foreigners.

However, one must not forget that Cambodia’s scam industry did not grow because foreign criminals arrived with laptops and phones. It grew because they found shelter and powerful partners. Casinos, property projects, special economic zones and politically connected business networks provided space and cover for cybercriminal networks. Scam operations moved into buildings left idle after the collapse of online gambling and the shock of the COVID-19 pandemic. Politicians and local businessmen made certain areas in Cambodia safe spaces for crime.

Sri Lanka is attractive for several reasons. It offers relaxed entry for visitors from many countries and wants to expand visa-free access to support tourism. It has good telecommunications infrastructure, widespread connectivity and easy access to urban and coastal rental........

© The Diplomat