The Weakest Link

The recent Metropolitan Police operation that recovered £500,000 worth of suspected stolen goods was a successful enforcement action. Arrests were made, assets were seized, and a criminal network was disrupted. Actions like this play a vital role in protecting communities, while also generating intelligence that can support wider investigations.

Throughout my career in policing, one lesson became increasingly clear. Arresting offenders and disrupting criminal activity are critical law enforcement tools, but on their own they may not always be enough to deliver long-term impact. The strongest and most enduring networks are designed to absorb disruption, replace people and continue operating. Understanding the wider network behind the offending is often what determines whether an operation delivers short-term disruption or lasting impact.

During my time at the National Crime Agency, some of the most complex investigations rarely sat neatly within a single force area, crime type or jurisdiction. The offending might be concentrated in one location, but the money, facilitators, communications and decision-makers often sat elsewhere. Understanding those connections was frequently the difference between disrupting an offender and understanding the wider criminal enterprise.

If organised crime functions as a system, the question is no longer simply who committed the crime, but how the system operates, what allows it to survive, and where it is most vulnerable to disruption.

An industrial-scale business

Many people still picture organised crime as a hierarchy led by a handful of senior figures directing activity from the top. Yet today, it often functions more like a supply chain.

These networks increasingly rely on specialist actors performing distinct functions within a wider criminal ecosystem. Some manage logistics and transportation, others facilitate money laundering, communications or financial transactions. Much like legitimate businesses, criminal groups can access expertise on demand, drawing on specialist providers that enable them to operate at scale.

Technology has lowered barriers to entry, while criminal marketplaces allow individuals to buy services, tools and expertise they would previously have needed years to develop themselves.

At the same time, organised crime no longer sits neatly within a single category. Money laundering networks, for example, may service organised crime groups, cyber criminals and hostile state actors simultaneously. Criminals do not operate in silos, and the infrastructure that enables them often supports multiple forms of illicit activity at once.

This convergence makes criminal networks more scalable, resilient and difficult to disrupt. It also means investigators cannot afford to view threats in isolation. Traditional approaches that treat fraud, cybercrime and organised crime as separate disciplines risk missing the broader picture.

Invisible targets

It is vitally important to pursue offenders. In many investigations, arrests are necessary to protect the public, safeguard victims and create opportunities to gather intelligence. The difficulty is ensuring that operational activity contributes to a broader understanding of the network, rather than viewing individual offenders in isolation.

However, one of the biggest challenges for investigators is that the individuals carrying out criminal acts are not always those creating the greatest threat.

A recent example can be seen in the NCA’s Operation Destabilise, which targeted sophisticated money laundering networks that were facilitating organised crime on a global scale. Rather than focusing solely on those committing predicate offences, investigators disrupted the financial infrastructure that enabled criminal groups, cybercriminals and even hostile state-linked actors to move and conceal funds.

The operation resulted in dozens of arrests and exposed how a small number of financial facilitators were supporting a far wider network of criminal activity.

This is what makes modern criminal networks so difficult to dismantle. Individuals can be replaced, routes can be altered, and roles can be reassigned. Effective disruption depends on identifying the infrastructure and enablers that keep the network functioning and targeting the points where intervention will have the greatest impact.

Cross-border collaboration

The supply-chain model becomes even more apparent when organised crime crosses international borders. Goods may originate in one country, pass through several others and ultimately be distributed in the UK.
Criminal profits may move through multiple jurisdictions in a matter of minutes, while key actors never set foot in the same country. Law enforcement partnerships have become increasingly effective at sharing intelligence and coordinating action. However, criminal networks often operate seamlessly across borders while enforcement powers remain tied to jurisdictions.
This is becoming a challenge for police leaders. Organised crime groups organise themselves around opportunity, markets and access to criminal services, not force boundaries or national jurisdictions. Investigations therefore need to be structured around understanding the network itself, with intelligence, tasking and enforcement activity coordinated across the areas where that network operates.
Meaningful disruption requires intelligence, evidence and operational activity to be coordinated across the wider network, not just one part of it.

Intelligent disruption

The future of organised crime enforcement lies in understanding networks rather than simply pursuing offenders.

Throughout my experience investigating serious and organised crime, the most successful operations focused on relationships, dependencies and critical enablers within a network. Sometimes that meant intervening early to manage risk or secure intelligence; at other times it meant building a fuller picture of the network before taking action.

Decisions about when to intervene were guided by risk intelligence and the potential impact on the wider criminal enterprise, rather than simply pursuing the first arrest available. That means moving beyond the immediate offence to understand how a criminal enterprise functions. Investigators need to identify who connects different groups, how money, information and commodities move through the network, which actors enable activity at scale, and where the critical dependencies lie.

Rather than asking who can be arrested next, forces should ask which intervention will cause the greatest disruption. Can the network still recruit, move money, communicate securely or distribute criminal goods? If so, enforcement activity may have addressed the symptom rather than the underlying problem.

Intelligence-led investigations help uncover these critical vulnerabilities. Advances in analytics, automation and AI can support this process by connecting disparate information, revealing hidden relationships and helping investigators identify patterns at scale.

Effective disruption also depends on intelligence being shared, trusted and acted upon. Investigators, analysts and decision-makers need a common understanding of the threat landscape to identify emerging risks and target the enablers that keep criminal networks operating.

Success is not about collecting more information but connecting the dots faster and turning intelligence into action that disrupts a network’s ability to function and regenerate.

Lasting disruption

Organised crime is becoming more specialised, interconnected and resilient. As a result, success can no longer be measured solely by arrests and seizures.

The most effective organisations will be those that understand how criminal networks operate, identify the enablers that keep them functioning and target the dependencies they cannot easily replace. This requires intelligence, technology and collaboration working together to reveal the bigger picture.

Ultimately, tackling organised crime requires both effective action against offenders and a sustained focus on the systems that sustain them. Arrests, seizures and disruption activity remain important tools, but they are most effective when used alongside intelligence-led efforts to identify the facilitators, infrastructure and dependencies that criminal networks rely on.

Matt Horne is Director of Intelligence and Investigations at Clue Software, a UK provider of investigation and case-management software used across law enforcement and the public sector.