Two documents made public in the final week of October 2026 approach industrial-scale online fraud from opposite directions. A Lawfare essay published on October 30 asks whether a state that tolerates scam operations run from its territory incurs responsibility under international law. An FBI affidavit sworn on October 23 in the District of Columbia, underlying charges against six Africa-based defendants tied to China that the Justice Department's Scam Center Strike Force lists among its latest actions, shows how the United States is answering the same problem through domestic criminal process. Read together, they suggest that due diligence and attribution offer a vocabulary for describing state tolerance of "scam centers" but few remedies, and that the practical response has migrated to extraterritorial prosecution, asset restraint, and consent-based cooperation.
The factual baseline
The scale of the problem is no longer seriously contested. A February 2026 report by the Office of the UN High Commissioner for Human Rights, titled "A wicked problem," cited credible estimates of at least 300,000 people working in scam operations across Southeast Asia and found that victims from at least 66 countries had been trafficked into compounds as of March 2025. Satellite imagery placed 74 percent of compounds in the Mekong region. The report described collusion between syndicates and officials, including immigration officers fast-tracking trafficked recruits through immigration in apparent coordination with recruiters and police accepting payments, and characterized corruption in these operations as "deeply entrenched." The UN summary of the report also notes observers' warnings that crackdowns tend to be ad hoc, with compounds resuming or relocating after raids.
The U.S. government's account is consistent. In March 2026 testimony to the Joint Economic Committee, Strike Force director Karen Seifert described compounds in Burma, Cambodia, and Laos run by Chinese organized crime syndicates and "enabled by lack of government regulation," and noted that in November 2025 the Treasury Department sanctioned the Democratic Karen Benevolent Army, a belligerent in Burma's civil conflict, for supporting scam centers targeting Americans. A Council on Foreign Relations analysis published October 19 put U.S. losses to Southeast Asia-based operations at $18.2 billion in 2025 and reported that operators have responded to raids by decentralizing and moving to smaller, more remote sites.
Due diligence as a duty of conduct
The Lawfare essay, by Tymur Mykhailov, examines a different theater: call centers in Ukraine reportedly targeting Russians, which the author labels "fraudfare." The piece is careful to state that there is no evidence of formal state sponsorship and treats Russian claims of state policy as likely cognitive warfare. Its doctrinal analysis, however, applies directly to the Southeast Asian compounds.
Mykhailov starts from the due diligence principle associated with Corfu Channel and restated in Tallinn Manual 2.0 Rules 6 and 7, while acknowledging that states disagree about whether the principle binds them in cyberspace at all. On his reading, the obligation is "a duty of conduct, not of result." The question is whether a state, once aware that its territory is being used to harm others, acted reasonably and in good faith. Resource constraints, enforcement priorities, and even corruption within a prosecutor's office bear on that assessment without automatically establishing breach, and the author credits Ukraine with some diligence on the strength of prosecutions and the closure of call centers.
Applied to Cambodia or Burma, the same framework cuts less favorably but still inconclusively. The OHCHR findings on official collusion and ad hoc enforcement, and the CFR account of raids that followed pressure from affected governments, are relevant to reasonableness. But a duty of conduct is satisfied by genuine effort rather than results, and a government that can point to periodic raids will argue that it has met the standard even as compounds relocate.
Attribution and the line between tolerance and adoption
The essay's treatment of attribution is where the limits become clearest. Under the "effective control" test of the International Court of Justice in Nicaragua and Bosnia, reflected in Article 8 of the Articles on State Responsibility, a state is responsible for private conduct only if it directed the specific operation. The more permissive "overall control" test from Tadić and the Tallinn Manual rules on state organs and adoption of private conduct (Rules 15 and 17) do not reach much further. Mykhailov concludes that "Mere hesitation to prosecute, even if it exists, would not qualify as state ratification," and he doubts that cover provided by corrupt officials amounts to overall control.
That conclusion matters for the Southeast Asian cases. Individual officials accepting payments, as OHCHR describes, is complicity by persons, not direction by the state, and the entities the United States has sanctioned for hosting compounds in Burma are armed groups and companies rather than state organs. Unless evidence emerges that a government directed or publicly adopted particular operations, the attribution route remains closed, and the harm is legally a matter of transnational crime rather than an internationally wrongful act.
Countermeasures fit poorly
If attribution fails, countermeasures are unavailable, and the essay argues they would be a poor fit even if it succeeded. Countermeasures must respond to conduct attributable to a state, be proportionate and reversible, and not involve force; tolerated fraud against civilians, in Mykhailov's words, "fits poorly within this framework." The necessity defense is described as narrow and likely unavailable. The essay also notes that cyber fraud probably does not qualify as an "attack" under the Tallinn definition because it causes no injury, death, damage, or destruction, so the distinction and proportionality rules would bite only if fraud were classified as an attack, which the essay doubts.
The domestic track
The Strike Force affidavit illustrates what fills the gap. It charges six defendants with wire fraud conspiracy under 18 U.S.C. §§ 1343 and 1349 for a cryptocurrency investment scheme run from a compound in Madagascar between roughly January 2025 and April 2026, relying on 18 U.S.C. § 3238 for venue because the offenses were committed outside any district. In August 2026, an FBI team deployed to Madagascar at the invitation of that country's Ministry of Justice and National Police to help triage approximately 3,200 devices seized from thirteen compounds. Malagasy authorities had taken roughly 400 people into custody, including about 40 Chinese nationals; the FBI was told that those identified as leaders had been repatriated to China before they could be interviewed, or were no longer in Malagasy custody. Witnesses said they had been moved from Cambodia in May 2026, partly because of police activity there and the Cambodia-Thailand armed conflict.
The Strike Force page, updated October 29, reports more than $1 billion in cryptocurrency restrained since the initiative's launch. Seifert's testimony identified two statutory gaps in this model: trafficking and forced-labor statutes make prosecution of non-U.S. nationals abroad difficult, and forfeiture law does not reach property used as an instrumentality of fraud without a separate money-laundering showing.
What the two tracks reveal
The international-law track yields an obligation of conduct that tolerant states can plausibly claim to satisfy, an attribution standard that official corruption does not meet, and a countermeasures regime designed for a different kind of harm. The domestic track yields charges, restrained assets, and sanctions, but depends on host-state consent and on where host states send suspects, which the affidavit's account of leaders repatriated from Madagascar to China or released from custody shows is not assured. Mykhailov's observation that governments "cannot tolerate organized cybercrime, even when it is purportedly motivated by patriotism" states the principle; the Madagascar affidavit shows how much of its enforcement currently rests on one state's long-arm jurisdiction rather than on the law of state responsibility.
Sources
- Fraudfare: Weaponized Fraud Under International Law — lawfaremedia.org/article/fraudfare--weaponized-fraud-under-international-law
- Scam Center Strike Force (U.S. Attorney's Office for the District of Columbia) — justice.gov/usao-dc/scam-center-strike-force
- Affidavit in Support of Criminal Complaint and Arrest Warrant, United States v. Chui Kok Wa et al. — justice.gov/usao-dc/media/1468811/dl
- Statement of Karen P. Seifert, Director, Scam Center Strike Force, Before the Joint Economic Committee — justice.gov/ola/media/1432801/dl
- UN report exposes torture, rape in Southeast Asia's multi-billion-dollar scam centres — news.un.org/en/story/2026/02/1167012
- AI Is Supercharging Cyber Scams and Human Trafficking in Southeast Asia — cfr.org/articles/ai-is-supercharging-cyber-scams-and-human-trafficking-in-southeast-asia