Best infosec long reads 4/25: Power moves fastest where institutions fail

Full access to Metacurity's curated infosec long reads is available to paid subscribers. Our goal is simple: make it financially viable to keep investing the time and expertise required to find, vet, and contextualize the most important security journalism each week. Free readers will still get highlights, but subscribers will get the complete, deeply curated set.

Please help support Metacurity achieve our goal by upgrading your subscription to gain full access to this issue and all content published on Metacurity, including the archives.

April 25: This week's long reads are about power concentrating wherever institutions or power are weakest, slowest, or least prepared to respond. In Cambodia, that means criminal syndicates operating as parallel economic and political forces, with cyber fraud becoming both an industry and a source of elite protection. In Iran, it means the state exercising control by deciding whether citizens can connect to the outside world at all, turning internet access itself into an instrument of power. When it comes to child exploitation, it is about the sudden empowerment of predators through cheap, scalable generative tools that allow abuse to expand faster than law enforcement or legal frameworks can keep pace.

A debate over US military cyber operations highlights a bureaucracy struggling to adapt to a domain where speed, technical expertise, and specialization matter more than traditional command structures. Even the fight over a privacy-oriented mobile OS reflects the same theme: a tool built to defend people from institutional surveillance becomes vulnerable to the personal conflicts and failures of the people behind it.

Another common thread is that “cyber” is no longer a niche technical beat. These stories are about labor trafficking, authoritarian control, child safety, military force design, and personal autonomy. Cybersecurity is not the subject so much as the mechanism through which larger political and social struggles now play out.

Happy reading!

How Cybercrime Became a Leading Industry in ‘Scambodia’

Gabriele Steinhauser and Patricia Kowsmann in The Wall Street Journal report that Cambodia has become so deeply entwined with industrialized online fraud—run largely by Chinese-linked criminal syndicates with protection from political elites—that cybercrime now functions as one of the country’s most lucrative shadow industries, generating an estimated $19 billion a year.

Hun Sen, who had been Cambodia’s prime minister since 1985, hosted former President Joe Biden, China’s premier and Southeast Asian leaders in November 2022. To mark the occasion, Hun Sen, an aficionado of luxury watches, gave each leader a $20,000 limited-edition timepiece—donated by Chen Zhi, whose staggering wealth helped gain him entry into Cambodia’s political elite. A Biden spokesman declined to comment.

Like Xu, the sanctioned developer of the Phnom Penh skyscraper, Chen was an émigré from China and a naturalized Cambodian citizen. Within about a decade of his arrival in 2009, Chen had plowed hundreds of millions of dollars into Cambodian real estate, a bank, an amusement park and supermarkets. Companies that the U.S. Treasury alleges were controlled by Chen and his Prince Group conglomerate ran hotels and casinos in the seaside city of Sihanoukville—and a bespoke watchmaker.

In 2020, Cambodia’s king had bestowed upon Chen the title of neak oknha, similar to a lordship. The same year, the prime minister appointed Chen—who was then 32 years old and spoke only basic Khmer—as an official adviser, a post on the level of a minister. 

By the time of the 2022 summit, Cambodia-based activists said in interviews that they had fielded calls from men and women who said they were forced to run scams while confined in casinos, hotels and industrial parks the U.S. alleges were operated by Prince Group.

Despite mounting warnings about Chen and his Prince Group companies, Hun Sen’s son, Hun Manet, retained Chen as an adviser when he succeeded his father as prime minister in 2023. 

A spokesman for the Prince Group companies said Chen made his fortune through legitimate investments in real estate and other assets and that neither he nor Prince Group owned or operated buildings in which online-scam operations or other crimes took place.

Cambodia has been fertile ground for cybercrime, analysts say: It has fast internet, the economy runs mostly on the dollar and top government posts often pass within families from one generation to the next.

Activists and family members trying to free scam workers forced to work at Cambodian scam centers say they struggled to get police to intervene, even when they gave exact locations. When police did act, they often freed only the people who had been reported, leaving behind hundreds or thousands of others held in the same compounds.