Appendix A — The World's Investigators
Who does this work, with what mandate, and where a skilled individual can plug in. All entries retrieved 2026-08-29.
State and inter-state bodies
| Body | Scope | Mandate and current detail |
|---|---|---|
| INTERPOL | 196 member countries | Does not investigate. Facilitates cross-border cooperation through Notices and Diffusions between National Central Bureaus. Usually the first contact point for a country pursuing an international case. [ESTABLISHED] (GIR guide) |
| Europol — EC3 | EU | European Cybercrime Centre, established 2013. Three strands: expertise and stakeholder management, forensics, operations against cybercrime, payment fraud and dark-web crime. Publishes the annual IOCTA threat assessment. Held its second Cyber Innovation Forum, The Hague, 13–14 Nov 2025. No consolidated 2025–26 operations report located. [ABSENT] on that document. (Europol) |
| FBI — IC3 | USA, accepts international complaints | Internet Crime Complaint Center. 2024 annual report: 859,532 complaints, $16.6 billion in reported losses — a 33% rise over 2023. Investment and crypto fraud alone exceeded $6.5bn; victims aged 60+ filed 147,127 complaints totalling $4.8bn. [ESTABLISHED] (IC3 2024 report PDF) |
| UK NCA — NECC | UK | National Economic Crime Centre, established 2018 inside the National Crime Agency. Multi-agency: NCA, Serious Fraud Office, City of London Police, HMRC, CPS, FCA, Home Office. Mission: reduce fraud, end the UK's use as a haven for illicit finance, increase confiscation. [ESTABLISHED] (NCA) |
| Singapore Police Force — ASC / ASCom | Singapore | Anti-Scam Centre established 18 June 2019 under the Commercial Affairs Department as the nerve centre for rapid freezing and recovery; Anti-Scam Command operationalised 22 March 2022, unifying investigation, incident response, intervention, enforcement and analytics. Reports S$730m+ recovered since 2019 [CLAIMED]. A new Cyber Command was announced May 2026. (SPF) |
| Japan NPA | Japan | Cyber Affairs Bureau and National Cyber Unit created 1 April 2022. The 2026 white paper describes a ransomware-recovery tool and international joint cyber investigations. [ESTABLISHED] (Japan Times, Aug 2026) |
| Korea NPA — Cyber Terror Response Center | South Korea | Investigates cybercrime and cyberterrorism; provides digital forensics. Documented at 900+ staff as of 2008 — no current figure found. [ABSENT] on anything recent. |
| Netherlands Politie | Netherlands | Internationally known for data-driven policing: the Crime Anticipation System, piloted in Amsterdam 2014 and rolled out nationally 2017, predicting hotspots at 125 m² grid resolution from crime, municipal and demographic data. Read with the counterweight: the related Sensing Project in Roermond was criticised by Amnesty International and AlgorithmWatch for discriminatory design. A double-edged reputation, not unambiguous praise. [CONTESTED] (Oxford Academic; Amnesty) |
| Australia — AFP / ACIC | Australia | The Australian Criminal Intelligence Commission collects and analyses national criminal intelligence on organised crime, cybercrime, financial crime and national security, and runs shared police information systems. A recent independent review recommends narrowing it back toward a pure intelligence role, away from operational work. [ESTABLISHED] |
| Thailand — ACSC / AOC 1441 / CCIB | Thailand | See Appendix B in full. |
Non-state investigators
| Body | What it is | Method |
|---|---|---|
| Bellingcat | Open-source investigative outlet | Geolocation, satellite imagery, social-media forensics; publishes its own toolkit. Method and its legal boundary are examined in Chapter 8. |
| OCCRP | Journalist network, organised crime and corruption | Co-investigated the Panama Papers and the Pandora Papers; 70+ OCCRP journalists among 600+ reporters across 117 countries on the latter. (OCCRP) |
| ICIJ | International consortium of investigative journalists | Coordinated Panama (2016) and Pandora (2021). Method: ingest leaked documents — only about 4% of the Pandora files were structured data — into a shared searchable platform with graph analysis, then parallel reporting. The closest existing analogue to what Chapters 4 and 5 describe, run by journalists rather than police. (ICIJ) |
| GASA | Global Anti-Scam Alliance, The Hague | Public-private coalition, 100+ member organisations across financial institutions, technology companies and governments. Partnership with Microsoft announced May 2025. Publishes survey data on scam prevalence, including Thailand. (GASA) |
| UCL Jill Dando Institute | UK academic | Founded 2001; the first university institute devoted to crime science as a discipline distinct from criminology — engineering, geography, computer science and psychology applied to reducing crime. The academic route into this field. |
Where a skilled individual plugs in
| Entry point | What it is | Typical requirement |
|---|---|---|
| OSINT analyst / investigator (junior) | Open-source data collection and processing for financial, criminal or state investigations. Due-diligence work is described as the most accessible entry. | A relevant degree helps but is often not mandatory; early on, tool fluency and demonstrable work matter more. (SANS) |
| Certified Fraud Examiner (CFE) | Credential covering fraud examination, evidence handling, interviewing | Open to newer entrants aiming specifically at investigation rather than compliance. |
| Certified Anti-Money Laundering Specialist (CAMS) | The standard AML compliance credential | Not an entry credential. ACAMS positions it for people already holding 18–24 months of financial-crime experience. |
| Technical / data track | Python, command-line tooling, cryptocurrency tracing layered onto investigative work | Increasingly the differentiator. Self-taught and portfolio-demonstrable counts more than any single certificate. |
| Academic | Crime science, e.g. UCL JDI | Postgraduate study. |
The honest note on all of the above. Every route in this table is an institutional one, and Ice's position — an independent person with a machine and a language advantage — matches none of them cleanly. The two things that transfer regardless of route are a portfolio of work someone can check, and the ability to state the lawful basis for every method used to produce it. Chapter 8's Move is not only ethics; it is the credential available to someone who has no other.
บทถัดไป · 16 / 19Appendix B — The Thailand File