Conference Agenda

This paper examines how the integration of artificial intelligence into transnational criminal operations has transformed the Southeast Asian online scam crisis, and what the adequacy of ASEAN’s governance response reveals about the structural limits of regional cybercrime policy frameworks. Through a case study from 2021 to 2026, the paper assesses whether existing regional legal, technical, and institutional architectures are capable of responding effectively to the distinctive challenges posed by technologically sophisticated, cross-border criminal enterprises.

The study adopts a qualitative methodology that combines comparative case analysis, primary document analysis, and policy evaluation. Primary sources include ASEAN Declarations, policy reports, national cybercrime legislation across all ten ASEAN member states, United States Treasury and Department of Justice enforcement records, and technical documentation pertaining to criminal exploitation of advanced language model technologies. Country-level case studies are developed for Laos, Cambodia, Myanmar, and the Philippines, each representing a distinct configuration of state complicity, criminal infrastructure, and enforcement response. The analysis further employs comparative institutional benchmarking of ASEAN’s Mutual Legal Assistance Treaty (MLAT) and AI governance frameworks compared to the Budapest Convention on Cybercrime and the European Union Artificial Intelligence Act, respectively.

The paper presents four principal findings. First, the systematic incorporation of advanced technology has functionally industrialised fraud across the region. The deployment of autonomous agentic systems, multilingual large language models, and synthetic media technologies has eliminated the operational constraints that previously circumscribed the scale of criminal operations. Available industry data indicate that the median daily revenue per scam operation increased nearly tenfold following this technological transition, transforming what were once discrete criminal enterprises into a coordinated regional industry generating an estimated US$64 billion annually. Impersonation fraud alone expanded by approximately 1,400 per cent in 2025, driven by the proliferation of voice synthesis tools capable of producing convincing audio replications from minimal source material.

Second, this paper introduces the concept of the “scam state” to describe jurisdictions in which transnational organised crime has captured or co-opted state institutions sufficiently to afford criminal compound ecosystems de facto institutional protection. The country case studies demonstrate that military fiscal dependency (Myanmar), elite political co-optation (Cambodia), regulatory zone exceptionalism (Laos), and licensing opacity (Philippines) constitute distinct but structurally analogous pathways to this outcome.

Third, ASEAN’s institutional response has been normatively ambitious yet operationally constrained. The 2025 Declaration on Combating Cybercrime and Online Scams, the ASEAN Guide on AI Governance and Ethics, and the operationalisation of the ASEAN Regional CERT represent substantive institutional development. Nevertheless, the foundational norms of the ASEAN Way, namely the principle of non-interference in domestic affairs and consensus-based decision-making, actively impede the coordinated enforcement action necessary to dismantle entrenched criminal infrastructure. The 2004 ASEAN MLAT remains critically deficient in provisions for the expedited preservation of digital evidence and the real-time collection of network traffic data, capabilities that are standard under the Budapest Convention and essential when investigations are compressed by machine-speed criminal activity.

Fourth, the geopolitical dimension materially compounds ASEAN’s institutional constraints. Targeted financial sanctions issued under the Department of Justice indictments directed at Cambodian business conglomerates and China’s selective enforcement activity motivated by domestic political pressures, have filled enforcement gaps that ASEAN’s internal mechanisms have been unable to address. However, this external intervention risks fragmenting regional ownership of the governance response and further constrain ASEAN’s collective capacity to act.

This paper contributes to scholarship on AI policy, cybersecurity governance, and the geopolitics of technology regulation. It contends that the Southeast Asian online scam crisis represents the most consequential real-world test to date for regional cyber policy institutions, rendering governance deficits in legal harmonisation, digital evidence frameworks, AI regulatory bindingness, and political will that academic policy scholarship has long theorised but seldom been able to examine empirically.

The paper concludes with four policy recommendations: the adoption of the 2025 United Nations Convention against Cybercrime as an external anchor for legal harmonisation; the ASEAN Minus X procedural mechanism to advance binding cybercrime standards in the absence of full consensus; the development of a Cyber Initiative for ASEAN Integration, modelled on the established IAI framework; and the amendment of the ASEAN MLAT to incorporate expedited digital evidence provisions equivalent to those contained in the Budapest Convention. Collectively, these measures address not only the immediate crisis but the foundational governance architecture that any regional institution will require to respond effectively to AI-enabled transnational crime in the coming future.