Artificial Intelligence and Crime - Cyber Criminology

Artificial intelligence and crime examines the bidirectional relationship between AI technologies and criminal activity — encompassing both the criminal exploitation of AI as a tool for committing offenses and the deployment of AI as a resource for crime prevention, investigation, and criminal justice administration. Within Cyber Criminology, the rapid development of machine learning, large language models, generative AI, and autonomous systems has created a new frontier of criminal opportunity and law enforcement capability that is reshaping offense dynamics, investigative methods, and the governance of digital society. Europol’s 2024 Internet Organised Crime Threat Assessment identified AI-enabled crime as the most significant emerging challenge for law enforcement, while the National Security Commission on Artificial Intelligence (2021) warned that AI would fundamentally alter the nature of both cybercrime and national security threats within the coming decade. This article examines how AI is being used to commit crime, how it is being deployed against crime, the governance challenges it creates, and the theoretical implications for criminological understanding, drawing on scholarship across Criminology, computer science, and public policy.

Introduction

Artificial intelligence is not a single technology but a family of computational techniques that enable machines to perform tasks that traditionally required human intelligence — pattern recognition, language processing, decision-making, prediction, and content generation. The current wave of AI development, driven by advances in deep learning, transformer architectures, and large language models (LLMs), has produced systems with capabilities that were theoretical only a decade ago: generating human-quality text, producing photorealistic images and video, engaging in multi-turn conversation, analyzing complex datasets, and writing functional software code (Bommasani et al., 2021). These capabilities are dual-use in the most fundamental sense — every AI capability that serves a legitimate purpose can be adapted for criminal exploitation, and every AI tool deployed against crime can potentially be circumvented by AI-enhanced criminal techniques.

The criminological significance of AI extends beyond its use as a criminal tool. AI is reshaping the environment within which crime occurs by altering economic structures (automation-driven job displacement that may affect crime rates), social interactions (AI-mediated communication that changes interpersonal dynamics), and governance processes (algorithmic decision-making that affects the distribution of criminal justice resources and outcomes). Understanding AI and crime requires attention to these structural effects alongside the more visible applications of AI in criminal operations and law enforcement, situating the technology within the broader social conditions that produce and constrain criminal behavior.

AI as a Tool for Criminal Activity

AI-Enhanced Social Engineering and Fraud

The most immediately consequential criminal application of AI is the enhancement of social engineering and fraud through the automation and personalization of deceptive communications. Large language models can generate phishing emails, romance scam correspondence, and fraudulent customer service interactions that are grammatically flawless, contextually appropriate, and personalized to individual targets — capabilities that dramatically expand the scale and sophistication of social engineering attacks (Hazell, 2023). Prior to generative AI, effective spear phishing required human effort to research targets, craft personalized messages, and maintain convincing correspondence over extended interactions. AI enables the production of convincing deceptive content at machine speed and scale, potentially transforming spear phishing from a labor-intensive targeted operation into a mass-production capability.

Voice cloning technology, which can generate convincing reproductions of specific individuals’ voices from brief audio samples, has been deployed in fraud operations that impersonate executives, family members, and authority figures to direct financial transfers (Stupp, 2019). The 2024 Hong Kong incident in which deepfake video was used to impersonate multiple executives during a video conference, resulting in a $25 million loss, demonstrated the operational maturity of AI-enabled impersonation fraud. The FBI has issued specific warnings about the increasing use of AI-generated voice and video in business email compromise schemes, advising organizations to develop verification protocols that do not rely solely on the apparent identity of communicating parties.

The automation of romance fraud through AI-powered chatbots represents a particularly concerning development. Romance scam operations, which have historically required human operators to maintain individual victim relationships over weeks or months, can be partially automated using conversational AI that sustains emotionally engaging dialogue across multiple simultaneous interactions (King, Aggarwal, Taddeo, & Floridi, 2020). The scalability of AI-driven fraud operations threatens to increase the volume, reach, and sophistication of confidence schemes that already impose billions of dollars in losses annually. The FTC documented over $10 billion in fraud losses in 2023, with romance scams and investment fraud — both candidates for AI enhancement — among the fastest-growing categories.

AI-Generated Malware and Cyber Operations

AI capabilities extend beyond social engineering into the technical dimensions of cybercrime, including the generation of malicious code, the discovery of software vulnerabilities, and the automation of attack processes. Research has demonstrated that large language models can generate functional malware, modify existing malware to evade detection signatures, and produce exploit code for known vulnerabilities — capabilities that lower the skill threshold for technically sophisticated cyberattacks (Guembe, Azeta, Misra, Osamor, Fernandez-Sanz, & Pospelova, 2022). While commercial AI systems implement safety guardrails intended to prevent malicious code generation, these restrictions can be circumvented through prompt engineering techniques, and open-source models without safety restrictions are readily available.

The potential for AI to accelerate vulnerability discovery represents a particularly significant threat. Automated fuzzing — the systematic testing of software with unexpected inputs to discover exploitable flaws — has been enhanced by machine learning approaches that target testing more efficiently than random methods (Böttinger, Godefroid, & Singh, 2018). The prospect of AI systems that can independently discover zero-day vulnerabilities and generate working exploits would fundamentally alter the offense-defense balance in cybersecurity by expanding the supply of exploitable vulnerabilities faster than human-driven patching can remediate them. DARPA’s AI Cyber Challenge, launched in 2023, explicitly explores both the offensive and defensive applications of AI to vulnerability discovery, recognizing that the technology’s deployment is inevitable and that its defensive applications must keep pace.

The concept of “AI-powered autonomous cyberattacks” — in which AI systems conduct the full cycle of reconnaissance, exploitation, lateral movement, and data exfiltration without human intervention — remains largely theoretical but is technically feasible within the trajectory of current AI development (Caldwell, Andrews, Tanay, & Griffin, 2020). Such systems would operate at machine speed, potentially compressing the intrusion lifecycle from the hours or days that human-operated attacks require to minutes or seconds, overwhelming defensive systems designed to detect and respond to human-paced attack activity.

Deepfakes and Synthetic Content Crime

AI-generated synthetic media — deepfake video, cloned audio, generated images — has created criminal applications across multiple offense categories including fraud, nonconsensual pornography, defamation, and disinformation. The production of nonconsensual deepfake pornography has emerged as a significant harm: the accessibility of face-swapping applications and open-source deepfake tools has enabled individuals without technical expertise to generate synthetic intimate imagery depicting any person whose photographs are publicly available (Ajder, Patrini, Cavalli, & Cullen, 2019). The legal response remains fragmented, with several states enacting deepfake-specific statutes and the federal DEFIANCE Act proposed but not enacted.

The evidentiary implications of deepfake technology extend beyond specific criminal applications to affect the criminal justice system’s reliance on visual and audio evidence. Chesney and Citron (2019) described the “liar’s dividend” — the phenomenon in which the existence of deepfake technology enables guilty parties to dismiss authentic evidence as fabricated — as a systemic threat to the evidentiary value of digital recordings. The development of content authentication technologies, including the Coalition for Content Provenance and Authenticity (C2PA) standard for cryptographic content provenance tracking, provides a potential countermeasure, but these technologies are not yet widely deployed and face the challenge of maintaining detection capabilities against continuously improving generation techniques.

The national security dimensions of AI-generated disinformation — the use of deepfake video, synthetic social media profiles, and AI-generated text to manipulate public opinion, undermine trust in institutions, and interfere with democratic processes — represent a further criminal and security concern. The Intelligence Community has warned that foreign adversaries are developing and deploying AI-enhanced influence capabilities that could substantially increase the volume, targeting, and persuasiveness of disinformation campaigns (Office of the Director of National Intelligence, 2024).

AI as a Tool Against Crime

AI-Enhanced Investigation and Forensics

Law enforcement agencies are deploying AI across multiple investigative functions, including the analysis of digital evidence, the identification of patterns in large datasets, the processing of surveillance imagery, and the generation of investigative leads from unstructured data. Machine learning algorithms can analyze network traffic logs, financial transaction records, and communication metadata at volumes that exceed human analytical capacity, identifying anomalies and patterns that may indicate criminal activity (Berk, 2021). The FBI, DEA, and other federal agencies have invested in AI-enhanced analytical tools that support investigations of cybercrime, drug trafficking, financial fraud, and terrorism.

Natural language processing (NLP) capabilities enable the automated analysis of text-based evidence — emails, chat logs, social media posts, darknet forum communications — at scale, identifying investigative leads, mapping communication networks, and detecting indicators of criminal activity or criminal intent (Westlake, 2020). AI-based image and video analysis supports the identification of individuals in surveillance footage, the detection of child sexual abuse material through content classification rather than hash-matching alone, and the reconstruction of events from multiple camera angles and timestamps.

Cryptocurrency investigation has been enhanced by AI tools that analyze blockchain transactions, cluster related addresses, identify suspicious patterns, and trace the flow of funds through complex laundering schemes. Companies including Chainalysis and Elliptic employ machine learning models that can identify potential illicit transactions with increasing accuracy, enabling law enforcement to target enforcement resources more effectively within the enormous volume of legitimate cryptocurrency activity. The IRS Criminal Investigation division’s use of AI-enhanced blockchain analysis has been instrumental in multiple cryptocurrency-related prosecutions and asset seizures.

Predictive and Preventive Applications

AI-based predictive tools are deployed across the criminal justice system for purposes ranging from crime forecasting through risk assessment to resource allocation optimization. Predictive policing systems use machine learning to generate geographic crime predictions that guide patrol deployment. Pretrial risk assessment instruments use statistical models to predict the probability of flight or re-offense. Threat assessment tools analyze behavioral indicators to identify individuals who may be on pathways toward violence (Perry, McInnis, Price, Smith, & Hollywood, 2013).

The effectiveness and equity of predictive AI tools in criminal justice are extensively debated, as discussed in the article on Algorithmic Bias in Criminal Justice within this category. The central tension is between the potential for AI to improve the accuracy of predictions that inform consequential decisions and the risk that AI systems will reproduce and amplify the historical biases embedded in the data on which they are trained. The resolution of this tension — through fairness-constrained optimization, transparent model design, ongoing bias auditing, and appropriate human oversight — represents one of the most important governance challenges at the intersection of AI and criminal justice.

AI-enhanced content moderation on social media platforms represents a preventive application that operates at scale exceeding any governmental capability. Machine learning classifiers detect and flag potential violations of platform policies — including criminal solicitation, terrorist content, child exploitation material, and fraud — enabling the removal of harmful content before it reaches large audiences (Gorwa, Binns, & Katzenbach, 2020). The GIFCT’s shared hash-matching and AI-based detection systems enable the cross-platform identification of terrorist content. Microsoft’s PhotoDNA and similar tools detect known CSAM through both hash-matching and AI-based visual classification. These content moderation systems, while imperfect and subject to the biases inherent in their training data, represent the most scalable existing mechanism for reducing criminal exploitation of digital platforms.

Governance and Regulatory Challenges

The Dual-Use Dilemma

The dual-use character of AI — the fact that the same capabilities that serve legitimate purposes can be adapted for criminal exploitation — creates governance challenges that do not admit simple solutions. Restricting access to AI capabilities to prevent criminal use would simultaneously restrict the legitimate applications that drive economic productivity, scientific research, and social benefit. Conversely, unrestricted deployment of AI capabilities maximizes their beneficial applications while also maximizing their criminal exploitation. The governance challenge is to develop frameworks that preserve the benefits of AI innovation while mitigating the risks of criminal exploitation — a balance that requires nuanced approaches rather than categorical restrictions (Taddeo & Floridi, 2018).

The Biden administration’s 2023 Executive Order on Safe, Secure, and Trustworthy AI established the first U.S. framework for AI governance, requiring safety testing of powerful AI models, establishing standards for AI-generated content authentication, and directing federal agencies to develop AI risk management guidelines. The EU AI Act, enacted in 2024, takes a more prescriptive approach, classifying AI applications by risk level and imposing progressively stringent requirements on higher-risk applications, with specific provisions addressing law enforcement uses of AI including facial recognition and predictive policing.

The governance of open-source AI models presents a particular challenge. Models released under open-source licenses — including Meta’s Llama family and numerous smaller models — can be downloaded, modified, and deployed without the safety restrictions that commercial API-based services impose. Criminal actors who use open-source models to generate phishing content, malware code, or deepfake media operate outside the control of any platform’s safety team, and the distributed nature of open-source software makes restriction or recall effectively impossible. The tension between the innovation benefits of open-source AI and its criminal exploitation potential is one of the defining governance challenges of the current period (Seger et al., 2023).

Liability and Accountability

The question of legal liability for AI-enabled criminal harm — who is responsible when an AI system is used to commit a crime or when an AI system’s error contributes to a criminal justice failure — raises novel legal questions that existing frameworks address imperfectly. When a deepfake generated by an AI tool is used for fraud, the criminal liability of the human who deployed the tool is clear, but the potential civil liability of the AI developer whose tool enabled the fraud is less certain — particularly when the tool was designed for legitimate purposes and the criminal application involved circumvention of safety restrictions.

Product liability frameworks, which hold manufacturers responsible for defective products, could potentially be applied to AI developers whose tools cause foreseeable harm. However, the application of product liability to AI is complicated by the difficulty of defining “defect” for a system whose behavior depends on its inputs (including user prompts), the open-ended nature of generative AI outputs, and the legal distinction between a tool that is used for harm and a tool that is defective. The European Union’s proposed AI Liability Directive addresses some of these questions, but the United States has not enacted AI-specific liability legislation, leaving the allocation of responsibility for AI-enabled harm to the incremental development of case law under existing torts and criminal statutes.

Theoretical Implications for Criminology

Technology as a Criminological Variable

The emergence of AI as a significant factor in criminal behavior requires criminological theory to engage with technology as more than an inert context for human action. Traditional criminological theories treat technology instrumentally — as a tool that offenders use and that environments contain — but AI’s capacity for autonomous action, adaptive behavior, and decision-making that is opaque to both its users and its developers challenges this instrumental framing. When an AI system autonomously discovers a software vulnerability and generates an exploit, the traditional criminological question “why did the offender do it?” becomes complicated by the intervention of a system that acted without direct human instruction at each step.

Routine activities theory, which requires the convergence of a motivated offender, a suitable target, and the absence of a capable guardian, must be reconsidered when AI enables automated offending that operates without a human “offender” present at the point of commission, targets that are selected by algorithms rather than human judgment, and guardianship that is itself algorithmic. The theory’s core logic — that crime occurs when opportunities are present and guardianship is absent — remains applicable, but the operationalization of each element requires substantial revision for AI-mediated environments (Leukfeldt & Yar, 2016).

Strain theory, social learning theory, and control theory similarly require adaptation. If AI-driven automation produces significant job displacement — a possibility that economists debate but that the technology’s trajectory makes plausible — the resulting economic strain could affect crime rates through mechanisms that Merton (1938) and Agnew (1992) would recognize but that these theorists did not contemplate in the context of technologically driven structural change. The social learning of criminal techniques, which Akers (1998) described as occurring through association with criminal others, now extends to learning from AI systems that can provide technical instruction without the social relationship that traditional social learning theory assumes. These theoretical extensions represent productive directions for criminological scholarship that the rapid development of AI capabilities makes increasingly urgent.

The Automation of Crime and Justice

The prospect of substantially automated criminal operations — AI systems that conduct fraud, hacking, or social engineering with minimal human oversight — and substantially automated criminal justice responses — AI systems that detect crime, assess risk, and recommend dispositions — raises questions about the role of human agency, judgment, and accountability in both offending and its governance. If criminal operations become increasingly automated, the traditional focus of criminal law on individual culpability and intent may require revision to accommodate offenses that are initiated by humans but executed by machines in ways that the initiating human may not have specifically intended or foreseen.

The automation of criminal justice decision-making raises parallel concerns about the displacement of human judgment by algorithmic processes. When a risk assessment algorithm informs a judge’s decision about pretrial detention, or a predictive policing system determines where officers are deployed, the human decision-maker’s role is mediated by a system whose logic may be opaque, whose training data may embed bias, and whose accountability in cases of error is uncertain. The challenge for criminological theory and criminal justice governance is to develop frameworks that preserve the benefits of AI-enhanced decision-making while maintaining the human accountability, transparency, and due process protections that democratic criminal justice systems require (Hannah-Moffat, 2019).

Conclusion

Artificial intelligence and crime exist in a relationship that is defined by the technology’s dual-use character — its simultaneous capacity to enhance criminal capability and to strengthen the tools available for crime prevention, investigation, and prosecution. The most immediate criminal applications of AI — social engineering automation, deepfake-enabled fraud, malware generation — are already being deployed and are escalating in sophistication and scale. The defensive applications of AI — investigative analytics, content moderation, predictive tools — provide a partial counterbalance but face the persistent challenge of keeping pace with offensive innovation.

The governance of AI in the criminal context requires frameworks that address the dual-use dilemma, allocate liability for AI-enabled harm, ensure transparency and accountability in AI-assisted criminal justice decisions, and preserve the theoretical and institutional capacity to understand and respond to criminal behavior in an environment where both offense and defense are increasingly mediated by intelligent systems. The development of these frameworks is among the most consequential challenges facing criminology, criminal justice, and technology policy in the current decade.

References

Agnew, R. (1992). Foundation for a general strain theory of crime and delinquency. Criminology, 30(1), 47–88. https://doi.org/10.1111/j.1745-9125.1992.tb01093.x
Ajder, H., Patrini, G., Cavalli, F., & Cullen, L. (2019). The state of deepfakes: Landscape, threats, and impact. Sensity.
Akers, R. L. (1998). Social learning and social structure: A general theory of crime and deviance. Northeastern University Press.
Berk, R. (2021). Machine learning risk assessments in criminal justice settings. Springer. https://doi.org/10.1007/978-3-030-60116-6
Bommasani, R., Hudson, D. A., Adeli, E., Altman, R., Arber, S., von Arx, S., Bernstein, M. S., Bohg, J., Bosselut, A., Brunskill, E., Brynjolfsson, E., Buch, S., Card, D., Castellon, R., Chatterji, N., Chen, A., Creel, K., Davis, J. Q., Demszky, D., . . . Liang, P. (2021). On the opportunities and risks of foundation models. arXiv preprint arXiv:2108.07258.
Böttinger, K., Godefroid, P., & Singh, R. (2018). Deep reinforcement fuzzing. Proceedings of the 2018 IEEE Security and Privacy Workshops (pp. 116–122). https://doi.org/10.1109/SPW.2018.00026
Caldwell, M., Andrews, J. T. A., Tanay, T., & Griffin, L. D. (2020). AI-enabled future crime. Crime Science, 9(1), 14. https://doi.org/10.1186/s40163-020-00123-8
Chesney, R., & Citron, D. K. (2019). Deep fakes: A looming challenge for privacy, democracy, and national security. California Law Review, 107(6), 1753–1819. https://doi.org/10.15779/Z38RV0D15J
Europol. (2024). Internet Organised Crime Threat Assessment (IOCTA) 2024. European Union Agency for Law Enforcement Cooperation.
Federal Trade Commission. (2024). Consumer Sentinel Network data book 2023. https://www.ftc.gov/reports/consumer-sentinel-network-data-book-2023
Gorwa, R., Binns, R., & Katzenbach, C. (2020). Algorithmic content moderation: Technical and political challenges in the automation of platform governance. Big Data & Society, 7(1). https://doi.org/10.1177/2053951719897945
Guembe, B., Azeta, A., Misra, S., Osamor, V. C., Fernandez-Sanz, L., & Pospelova, V. (2022). The emerging threat of AI-driven cyber attacks: A review. Applied Artificial Intelligence, 36(1), 2037254. https://doi.org/10.1080/08839514.2022.2037254
Hannah-Moffat, K. (2019). Algorithmic risk governance: Big data analytics, race and information activism in criminal justice debates. Theoretical Criminology, 23(4), 453–470. https://doi.org/10.1177/1362480618763582
Hazell, J. (2023). Spear phishing with large language models. arXiv preprint arXiv:2305.06972.
King, T. C., Aggarwal, N., Taddeo, M., & Floridi, L. (2020). Artificial intelligence crime: An interdisciplinary analysis of foreseeable threats and solutions. Science and Engineering Ethics, 26(1), 89–120. https://doi.org/10.1007/s11948-018-00081-0
Leukfeldt, R., & Yar, M. (2016). Applying routine activity theory to cybercrime: A theoretical and empirical analysis. Deviant Behavior, 37(3), 263–280. https://doi.org/10.1080/01639625.2015.1012409
Merton, R. K. (1938). Social structure and anomie. American Sociological Review, 3(5), 672–682. https://doi.org/10.2307/2084686
National Security Commission on Artificial Intelligence. (2021). Final report. https://www.nscai.gov/2021-final-report/
Office of the Director of National Intelligence. (2024). Annual threat assessment of the U.S. intelligence community.
Perry, W. L., McInnis, B., Price, C. C., Smith, S. C., & Hollywood, J. S. (2013). Predictive policing: The role of crime forecasting in law enforcement operations. RAND Corporation. https://doi.org/10.7249/RR233
Seger, E., Dreksler, N., Moulange, R., Dardaman, E., Schuett, J., Wei, K., Winter, C., Arnold, M., Ó hÉigeartaigh, S., Korinek, A., Anderljung, M., Barnhart, B., Leung, J., & Avin, S. (2023). Open-sourcing highly capable foundation models: An evaluation of risks, benefits, and alternative methods for pursuing open-source objectives. arXiv preprint arXiv:2311.09227.
Stupp, C. (2019, August 30). Fraudsters used AI to mimic CEO’s voice in unusual cybercrime case. Wall Street Journal.
Taddeo, M., & Floridi, L. (2018). Regulate artificial intelligence to avert cyber arms race. Nature, 556(7701), 296–298. https://doi.org/10.1038/d41586-018-04602-6
Westlake, B. G. (2020). The past, present, and future of online child sexual exploitation: Summarizing the evolution of production, distribution, and detection. In T. J. Holt & A. M. Bossler (Eds.), The Palgrave handbook of international cybercrime and cyberdeviance (pp. 1225–1253). Palgrave Macmillan.
White House. (2023). Executive order on the safe, secure, and trustworthy development and use of artificial intelligence. https://www.whitehouse.gov/briefing-room/presidential-actions/2023/10/30/
Yar, M., & Steinmetz, K. F. (2019). Cybercrime and society (3rd ed.). SAGE Publications.

Related Articles