Data: The New Capital of Organised Crime

Understanding the transformation of criminal power

Understanding the transformations of contemporary crime requires moving beyond an interpretative perspective based exclusively on the accumulation of material wealth, access to capital and profits derived from illicit activities. Alongside traditional economic resources, a less immediately visible but potentially decisive asset is emerging in the construction and consolidation of criminal power: information and the ability to transform it into actionable knowledge.

Crime does not exist independently of processes of social transformation. Rather, it develops within economic, technological and relational systems, exploiting their opportunities, contradictions and vulnerabilities. The evolution of digital technologies, the increasing interconnectedness of economic activities and the proliferation of tools capable of collecting and processing large volumes of information have transformed not only the methods through which certain unlawful acts are committed, but also the conditions that may facilitate their planning, execution and concealment.

Within this context, data perform a function that extends beyond their role as a mere source of knowledge. Personal information, professional relationships, communications, corporate structures, financial transactions, individual habits and digital footprints can be used to reconstruct networks of relationships, identify vulnerabilities, anticipate behaviour and recognise opportunities for exploitation.

The significance of such information does not necessarily depend on its volume, but rather on the ability to interpret it and connect it within a broader body of knowledge. An apparently insignificant piece of information may acquire considerable importance when combined with other elements, making it possible to identify relationships, economic interests or circumstances that would have little relevance if considered in isolation.

This transformation is reflected in analyses conducted by the principal European institutions responsible for combating crime.

Europol’s Internet Organised Crime Threat Assessment 2025, significantly entitled Steal, Deal and Repeat: How Cybercriminals Trade and Exploit Your Data, identifies the theft, commercialisation and unlawful exploitation of data as structural components of the digital criminal economy. Information is not merely the target of an attack; it can also become a resource used to commit further offences, sustaining a system in which unlawful access to data acquires independent economic and operational value.

The transformation described by Europol does not, however, justify the conclusion that information assets have replaced money as the principal objective of criminal activities. Rather, it suggests that access to information may constitute a prerequisite for acquiring economic resources, exerting pressure, influencing decisions and consolidating positions of advantage.

Data thus become a component of criminal capital, not necessarily an alternative to material wealth, but a resource capable of increasing the opportunities for its acquisition and exploitation.

Data as a resource of power

The central importance of information makes it necessary to distinguish its economic value from the strategic value it may acquire within social relationships and criminal dynamics.

A dataset may be traded, used to commit fraud or exploited to obtain an unlawful competitive advantage. However, its value may also emerge independently of any economic transaction, through the ability to understand behaviour, identify vulnerabilities and influence the decisions of others.

This distinction allows information assets to be understood through three closely interconnected dimensions: the economic dimension, concerning the potential to generate profits; the operational dimension, relating to the capacity to facilitate unlawful conduct; and the relational dimension, associated with the ability to exercise influence, intimidation or control.

Data, therefore, are not merely commodities. They may become instruments through which an asymmetry of power is created between those who possess particular information and those who are unaware of its availability or potential uses.

Knowledge of a company’s financial difficulties, an individual’s personal relationships or an organisation’s decision-making processes may create opportunities for undue influence that derive not directly from access to money, but from the ability to exploit situations of vulnerability.

From this perspective, the relationship between information and power reflects a broader question already present in contemporary sociological and political thought: knowledge is not necessarily a neutral resource, since its unequal distribution may affect the capacity to act and the relationships between individuals and organisations.

Applying this consideration to criminology nevertheless requires certain qualifications.

Not every collection of information constitutes unlawful conduct, just as not every use of data automatically amounts to an abuse. Its legal significance depends on the methods of acquisition, the nature of the information, the purposes pursued and the applicable legal provisions.

Information may originate from publicly accessible sources, be voluntarily disclosed or be obtained through unauthorised access, theft, fraud and other conduct constituting criminal offences. Even data initially collected lawfully may subsequently be used for purposes incompatible with those originally envisaged or to facilitate unlawful activities.

The central issue, therefore, is not simply the possession of information, but the relationship between knowledge, intent and the capacity to produce effects on individuals and social systems.

When directed towards criminal purposes, information assets may become resources for coercion, exploitation and domination.

Mafia organisations and the value of knowledge

The relationship between information and crime becomes particularly significant when examined in relation to mafia organisations, whose capacity to exercise power cannot be explained exclusively by their access to economic resources or their use of violence.

Criminological and sociological scholarship has extensively demonstrated that mafia organisations are also characterised by their ability to establish relationships, control resources, exercise intimidation and penetrate economic and institutional processes.

In Diego Gambetta’s interpretation, the mafia can also be analysed through the production and sale of private protection, while Rocco Sciarrone’s studies have explored the role of relational networks and social capital in the reproduction and expansion of mafia power.

These contributions help explain how knowledge of local environments, economic relationships and individual vulnerabilities has historically constituted an important component of mafia strategies, even before the widespread adoption of digital technologies.

The ability to understand local power structures, identify financially distressed businesses, reconstruct relationships between economic actors or comprehend an administration’s decision-making mechanisms may facilitate the identification of opportunities for infiltration and undue influence.

Information may also increase the effectiveness of intimidation, since knowledge of an individual’s personal, family or professional circumstances can strengthen the capacity to exert pressure and foster conditions of subjugation.

The innovation introduced by digital transformation therefore lies not in mafia organisations discovering the importance of information, but in the expansion of their opportunities to acquire, store, process and interconnect it.

Digital tools may facilitate the reconstruction of economic relationships, ownership structures and organisational dynamics, while the increasing digitalisation of business and administrative activities may create additional opportunities to access relevant information.

This does not mean that mafia organisations have necessarily developed advanced technological capabilities or that traditional mafia organisations have undergone a general transformation into digital criminal structures.

Such a representation would risk conflating different phenomena and attributing operational capabilities to organisations that must instead be established through investigative evidence.

Europol’s EU Serious and Organised Crime Threat Assessment 2025 (EU-SOCTA), which examines the threats posed by serious and organised crime within the European Union, highlights the importance of technological developments and transformations in criminal markets. However, analysing Italian mafia organisations also requires consideration of their specific characteristics, including territorial embeddedness, the intimidating power of the associative bond, and the conditions of subjugation and the code of silence (omertà) referred to in Article 416-bis of the Italian Criminal Code.

The issue, therefore, is not to contrast a supposedly digital mafia with a traditional mafia, but to understand the circumstances in which technological tools and information resources may become integrated into already established criminal structures.

Access to information may reinforce existing operational capabilities without necessarily replacing territorial control, personal relationships, financial resources or intimidation.

From this perspective, a particularly significant consideration emerges: mafia power may be sustained not only by control over economic and territorial resources, but also by the ability to identify and exploit the vulnerabilities of individuals and the environments in which these organisations operate.

The criminal data economy and the specialisation of unlawful activities

The increasing value attributed to information within illicit markets has contributed to the development of a criminal economy in which data, access credentials and technological services can be exchanged and reused for different purposes.

Europol’s 2025 assessment describes an ecosystem in which stolen information may be traded, used to gain unauthorised access to computer systems, employed in fraud or exploited in extortion schemes.

Data theft does not necessarily constitute the final stage of criminal conduct. Rather, it may represent the initial phase of more complex processes involving participants with different skills and functions.

This dynamic reflects the crime-as-a-service model, through which particular criminal capabilities or tools are made available to other actors, reducing the need for each offender to possess independently all the technical expertise required.

The specialisation of activities may encourage a division of functions between those who unlawfully acquire information, those who organise its distribution and those who use it to commit further offences.

This configuration must not automatically be equated with mafia-type organisations as defined under Italian law, since criminal cooperation or the existence of an organised structure does not necessarily establish the constituent elements of a mafia-type criminal association.

This distinction is essential to avoid inappropriate criminological and legal interpretations.

Cybercrime encompasses heterogeneous phenomena involving individuals, temporary groups, structured criminal organisations and transnational networks. Mafia activities, by contrast, display specific characteristics that cannot be inferred solely from organisational complexity or the use of technology.

Nevertheless, potential areas of convergence exist, particularly when technological expertise, economic interests and criminal networks intersect in the commission of fraud, extortion, money laundering or other unlawful activities.

The existence of such connections must be established through concrete evidence, distinguishing documented forms of convergence from interpretative hypotheses.

The criminal data economy therefore constitutes a phenomenon that cuts across different criminological categories without eliminating their distinctive characteristics.

Digital society as a space of opportunity and vulnerability

One of the most significant aspects of the transformation of information assets into criminal resources concerns the possibility of using data as instruments of pressure and blackmail.

The theft of confidential information may generate economic advantages through its commercialisation, but it may also enable threats to disclose personal content, corporate documents or sensitive information.

Extortion practices associated with ransomware attacks clearly illustrate this development.

Whereas more traditional forms of ransomware primarily sought to render computer systems inaccessible through encryption, certain criminal strategies have progressively incorporated the prior theft of data and threats of its subsequent disclosure.

Information assets thus become both the object of the attack and the instrument through which pressure is exerted on the victim.

ENISA reports confirm the significance of these dynamics within the European cybersecurity landscape. The ENISA Threat Landscape 2026, published on 22 September 2026 and covering events observed during 2025, identifies ransomware as one of the threats with the greatest immediate impact and highlights the combined use of encryption, data theft and extortion.

The same report also emphasises the persistence of social engineering techniques, through which attackers exploit individuals’ trust, habits and behaviour to obtain access or information.

The psychological dimension therefore assumes considerable importance.

An organisation’s vulnerability does not depend exclusively on inadequately protected computer systems. It may also arise from insufficient procedures, poorly defined responsibilities or difficulties in recognising deceptive communications.

Criminal actors may exploit these conditions because information security is a process involving the interaction of technology, organisational structures and human behaviour.

The transition from data theft to coercive exploitation also highlights a fundamental characteristic of information assets: their ability to produce effects without necessarily being physically transferred or commercially exchanged.

In certain circumstances, the mere threat of disclosing information may be sufficient to exert substantial pressure on the victim.

Artificial intelligence and new information asymmetries

Artificial intelligence introduces further complexity into the relationship between knowledge, crime and security.

The availability of systems capable of processing large volumes of information, generating convincing content and automating particular activities may alter the methods through which certain unlawful acts are prepared and committed.

Generative artificial intelligence tools may be used to produce linguistically sophisticated fraudulent communications, impersonate individuals, manipulate images and audiovisual content, or make deceptive attempts more convincing.

These possibilities do not necessarily imply the emergence of entirely new categories of crime, but they may increase the scale and effectiveness of already established forms of criminal behaviour.

Europol’s IOCTA 2025 explicitly addresses the use of generative artificial intelligence in social engineering activities, while ENISA’s 2026 analyses highlight the growing interest of malicious actors in these technologies, both as tools supporting unlawful activities and as systems that may themselves become targets of attack.

The central issue concerns the lowering of certain operational barriers.

Activities that previously required specialised expertise can now be partially automated, while the production of deceptive content can become faster and more readily adapted to the characteristics of intended recipients.

At the same time, artificial intelligence may contribute to prevention by identifying anomalies, detecting suspicious behaviour and supporting the analysis of complex information.

This dual function confirms that technology is neither inherently criminal nor inherently preventive. Its significance depends on the purposes pursued, the methods of deployment and the safeguards adopted.

It is also necessary to prevent the use of automated systems in security activities from generating new forms of risk.

Algorithmic processing may identify statistical correlations, but it is not necessarily capable of correctly reconstructing the social and legal significance of the relationships observed.

Correlation does not automatically establish causation, just as statistically anomalous behaviour does not demonstrate the existence of unlawful conduct.

The effectiveness of technological tools must therefore be accompanied by verification, methodological transparency and human accountability.

Information and criminal investigation: Opportunities, limitations and safeguards

The increasing significance of information in criminal strategies is mirrored by its importance in investigative and preventive activities.

The analysis of financial, corporate, documentary and digital data may contribute to reconstructing relationships between individuals, identifying economic interests and understanding the organisational structures involved in unlawful activities.

In combating organised crime, this perspective makes it possible to integrate asset-based analysis with relational analysis, using information to identify connections between individuals, businesses and local environments.

The effectiveness of this approach nevertheless depends on the quality of the information used and the methodological soundness of its interpretation.

A corporate connection does not necessarily demonstrate the existence of a criminal relationship, a personal association does not in itself establish responsibility, and an anomalous financial transaction does not automatically constitute an unlawful operation.

The distinction between information, investigative indications and evidence is therefore fundamental.

Information analysis may guide investigative activities and contribute to the formulation of hypotheses, but it cannot replace the inquiries necessary to establish their validity.

This requirement becomes even more significant when automated tools are employed, since the capacity to process large volumes of data may generate apparently meaningful results that nevertheless require critical interpretation.

Security protection must also comply with the legal limitations governing the collection and use of personal information.

Regulation (EU) 2016/679, commonly known as the General Data Protection Regulation (GDPR), establishes fundamental principles concerning the lawfulness, fairness and transparency of processing, purpose limitation, data minimisation and security.

For processing carried out by competent authorities for the purposes of preventing, investigating, detecting or prosecuting criminal offences, the specific framework established by Directive (EU) 2016/680 applies within its respective scope. This Directive was transposed into Italian law through Legislative Decree No. 51 of 18 May 2018.

Distinguishing between these legal frameworks is essential, since investigative requirements neither entail the indiscriminate application of rules governing ordinary data processing nor permit the safeguards established by the relevant legislation to be disregarded.

The availability of advanced technologies cannot therefore be regarded as sufficient justification for the unrestricted expansion of information collection and analysis.

In a democratic society, the legitimacy of preventive and investigative action also depends on the proportionality of the instruments employed, the existence of appropriate legal bases and the possibility of subjecting the exercise of public powers to effective oversight.

Security and the protection of fundamental rights are not necessarily competing objectives, but dimensions that must be integrated within a system of safeguards consistent with the principles of the rule of law.

The social cost of information vulnerability

The compromise of information assets does not produce exclusively economic consequences.

The unauthorised disclosure of personal information may damage reputations, undermine professional relationships, facilitate discrimination and generate psychological and social vulnerability.

Knowledge of private aspects of an individual’s life may also be used to exert pressure or reinforce relationships of dependency, particularly where the individuals concerned are already exposed to vulnerable circumstances.

Information-related harm has a particularly significant characteristic: its consequences may extend beyond the moment at which the original breach occurs.

Stolen information can be reproduced, transferred and reused in different contexts, making it difficult to restrict its subsequent circulation.

Loss of control over data may therefore produce persistent consequences, even after the original incident has been technically resolved.

For businesses and institutions, these consequences may acquire a collective dimension.

A cybersecurity breach may disrupt services, affect users and suppliers, undermine commercial relationships and diminish trust in the organisation concerned.

ENISA’s analyses highlight how the interdependence of digital infrastructure and services can amplify the effects of incidents, particularly when vulnerabilities affect entities upon which other organisations depend.

Information security cannot therefore be regarded exclusively as a technical issue, since it concerns the continuity of economic activities, institutional reliability and the protection of social relationships.

In the context of criminal organisations, knowledge of others’ vulnerabilities may become a resource for exerting influence.

The ability to identify financial difficulties, organisational weaknesses or sensitive personal circumstances may facilitate opportunistic behaviour and, in environments characterised by the presence of organised criminal structures, contribute to reinforcing relationships of subjugation.

Information assets thus acquire a social dimension that extends beyond their commercial value.

Protecting information also means preserving individual autonomy, freedom of economic choice and the capacity of institutions to operate without undue interference.

Prevention as a shared responsibility

The evolution of criminal strategies requires the development of preventive frameworks capable of integrating technological expertise, knowledge of social contexts and traditional instruments for combating crime.

Protecting information assets first requires public and private organisations to recognise the value of the information they hold, identify the categories most exposed to risk and adopt measures proportionate to their significance.

Restricting unnecessary access, reviewing authorisations, training personnel and establishing incident-management procedures are essential components of an effective security strategy.

Directive (EU) 2022/2555, known as NIS2 and transposed into Italian law through Legislative Decree No. 138 of 4 September 2024, forms part of this process of strengthening cybersecurity by establishing risk-management and incident-reporting obligations for entities falling within its scope.

Security, however, cannot be reduced to a series of formal compliance requirements.

The existence of procedures and technological tools does not automatically guarantee effective preventive capacity, particularly where there is no organisational culture based on risk awareness and accountability among those involved.

In combating mafia crime, this requirement must be integrated with an in-depth understanding of local dynamics, economic vulnerabilities and the conditions that may facilitate criminal infiltration.

The protection of competition, administrative transparency, support for businesses exposed to unlawful pressure and the ability to recognise situations of undue influence are complementary instruments to digital security.

Information analysis may help strengthen these activities, provided that it is conducted within lawful procedures based on verifiable criteria.

Cooperation between institutions, investigative authorities, regulatory bodies, businesses and professionals therefore assumes increasing importance, particularly where criminal phenomena extend across different economic sectors and geographical areas.

Prevention must also include an educational dimension.

Awareness of the value of information concerns not only the need to protect confidential data, but also an understanding of the risks arising from the combination of apparently innocuous pieces of information.

An isolated piece of data may have limited significance, whereas its combination with other elements may enable the reconstruction of behaviour, relationships and personal circumstances.

Protecting information assets therefore requires shared responsibility, in which technical expertise is accompanied by an awareness of the social and legal implications of information use.

From wealth to domination: The criminal value of knowledge

The transformation of information into a strategic resource represents one of the most significant manifestations of the evolution of criminal opportunities in contemporary society.

Money remains a fundamental component of the illicit economy, both as an objective of criminal activities and as an instrument through which organisations are financed, resources acquired and positions of power consolidated.

Economic resources, however, do not exhaust the means through which criminal power can be constructed and exercised.

Information may precede profit, facilitate its acquisition, help identify victims, increase the effectiveness of intimidation and expand opportunities for exerting undue influence.

In the case of mafia organisations, this dynamic acquires particular significance because it operates within systems of power historically founded on the combination of economic resources, social relationships, territorial control and the capacity for intimidation.

Digital transformation does not necessarily eliminate these characteristics, but may provide additional instruments through which they are exercised.

The question, therefore, is not whether data are invariably more valuable than money, a proposition that would lack a general foundation in either economic or criminological terms.

Their value depends on the context, the possibilities for their use and the capacity to convert them into a tangible advantage.

In certain circumstances, however, information may prove more important than immediate access to financial resources because it enables the acquisition of wealth, the influencing of decisions or the exercise of power that the possession of money alone would not make possible.

It is in this capacity to transform knowledge into power that one of the principal challenges of contemporary security becomes apparent.

Combating crime cannot be limited to protecting technological infrastructure, nor can it be based on the assumption that collecting more information automatically produces greater preventive capacity.

What is required is expertise, accountability, institutional cooperation and analytical instruments capable of distinguishing correlations from established facts, vulnerabilities from responsibility, and legitimate security requirements from the risks of indiscriminate surveillance.

The protection of information assets thus acquires a significance that extends beyond the technical sphere and directly concerns the quality of democratic relationships.

The fundamental challenge is not merely to prevent data theft, but to ensure that knowledge of individual and collective vulnerabilities does not become an instrument of domination.

In a society in which information helps determine economic opportunities, social relationships and decision-making processes, understanding who possesses it, how it is used and what consequences its exploitation may produce means confronting emerging forms of power.

For criminal capital is no longer measured solely by what an organisation possesses, but also by what it knows and what, through that knowledge, it is capable of influencing and controlling.

---

References and legal sources

ENISA – European Union Agency for Cybersecurity. (2025). ENISA Threat Landscape 2025. Publications Office of the European Union.

ENISA – European Union Agency for Cybersecurity. (2026). ENISA Threat Landscape 2026. European Union Agency for Cybersecurity.

Europol. (2025). Steal, Deal and Repeat: How Cybercriminals Trade and Exploit Your Data. Internet Organised Crime Threat Assessment (IOCTA) 2025. Publications Office of the European Union. https://doi.org/10.2813/4926508

Europol. (2025). The Changing DNA of Serious and Organised Crime. EU Serious and Organised Crime Threat Assessment (EU-SOCTA) 2025. Publications Office of the European Union.

Gambetta, D. (1993). The Sicilian Mafia: The Business of Private Protection. Harvard University Press.

Sciarrone, R. (2009). Mafie vecchie, mafie nuove. Radicamento ed espansione. Donzelli Editore.

European Union. (2016). Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (General Data Protection Regulation).

European Union. (2016). Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences.

European Union. (2022). Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union (NIS2 Directive).

Italy. (2018). Legislative Decree No. 51 of 18 May 2018. Implementation of Directive (EU) 2016/680.

Italy. (2024). Legislative Decree No. 138 of 4 September 2024. Transposition of Directive (EU) 2022/2555 (NIS2).

Italy. Criminal Code, Article 416-bis: Mafia-type associations, including foreign associations.