Introduction

Crime scripts have become an increasingly used method in research and practice for examining criminal activity (Alonso Berbotto and Chainey 2021; Dehghanniri and Borrion 2019). Crime scripts are knowledge structures that organize offender decision-making into the sequential logical steps for preparing, undertaking and completing a crime (Cornish 1994), and can be constructed to examine the activities of individual offenders or criminal groups. Crime scripts can be used for better understanding criminal activity, including how decisions that an offender makes are influenced by other decision-making across the activity and how the activities of an individual is associated with that of another because of the roles that each perform. Crime scripts have been used to study many types of criminal activity, including thefts (Alonso Berbotto and Chainey 2021; Morselli and Roy 2008; Tremblay et al. 2001), sex offending (Beauregard et al. 2007; Leclerc et al. 2011), drugs manufacturing (Chiu et al. 2011), arms trafficking (Chainey and Guererro 2019), counterfeit products (Lord et al. 2017), and internal fraud (Willison and Siponen 2009),Footnote 1 with the analysis of crime scripts also leading to the identification of potential intervention opportunities (Chiu et al. 2011; Jaques and Bernasco 2014).

The crime script approach was introduced by Cornish (1994), who set out a process for crime scripting involving scene classifications, organized in relation to facets and choice-structuring conditions to explain the ways in which a criminal activity could be executed. Until 2010, the use of crime scripts was limited (Dehghanniri and Borrion 2019) with several scholars arguing the method for constructing a crime script required clarity, processes for checking data validity, and simplification (Basamanowicz and Bouchard 2011; Brayley et al. 2011; Chiu et al. 2011; Sytsma and Piza 2018; Tompson and Chainey 2011; Vakhitova and Bell 2018). To assist this, Tompson and Chainey (2011) introduced an approach that made the construction of a crime script more practical, without undermining the conceptual principles of Cornish’s original method, and has become a useful template for initiating the crime scripting process.

Although the use of crime scripting has increased in recent years, the guidance about how to populate the content of a crime script with data is still lacking (Dehghanniri and Borrion 2019). This lack of methodical guidance has often required those who have generated crime scripts to use their intuition when selecting data for inclusion in their crime script. Examples of detailed crime scripts exist, but often the authors of these have not been clear about the methods they have used for populating their crime script (Dehghanniri and Borrion 2019). The lack of methodical guidance on how to populate a crime script with data can make it difficult for scripts to be assessed for their quality. It can also inhibit replication, particularly by law enforcement personnel seeking examples from research that demonstrate how the crime script method can be used for better examining criminal activity. Clearer guidance is also required about how different sources of data can be used for populating the content of a crime script, and how these data are categorised and combined. The lack of a structured procedure also means it is difficult to compare or combine the results from different crime scripts. For example, in settings where law enforcement analysts from different geographic jurisdictions examine the activities of the same organized crime group (OCG), the application of a different methodical approach to crime script creation can make it difficult for these different crime scripts to be combined and inhibit the provision of a more comprehensive picture of the OCG’s activities.

Multiple sources of data are often used when creating a crime script. This includes data recorded on information systems (such as law enforcement agency crime recording systems), criminal case investigation files, and data from interview transcripts of victims and offenders. Open sources of intelligence (OSINT) provide another source of data that can be used in crime script analysis. OSINT refer to data that are accessible from publicly available sources, including data from the media (e.g., news articles and television documentaries), online publications, discussion groups, social media, commercial data and technical reports (such as working papers and reports written by think tanks). Data for examining organized crime using OSINT can be valuable (to both researchers and practitioners) because of the clandestine nature to this type of criminal activity. The content of data via OSINT, however, may be less reliable than data from official sources, therefore requires processes to be applied to ensure its validity.

In this paper we describe a methodical process that is designed to help scholars and practitioners improve how they create a crime script of organized crime activity. The process we describe can be applied to organising and quality assuring all types of data that are selected for inclusion into a crime script. In this paper we focus on generating a crime script using OSINT to illustrate the value of this type of data source for examining organized crime activity, and as an illustration of the quality assurance processes we describe for populating a crime script with data. We apply the conceptual principles of Cornish’s (1994) original method, use Tompson and Chainey’s (2011) simplification of this method to create a crime script template which we then populate with data that has been subject to a quality assurance process. The method we propose aims to generate a crime script of good quality, and allow for easy replication. The method also aims to respect the original intentions of crime scripting proposed by Cornish (1994) by demonstrating its value in supporting the generation of detailed crime commission information which is often necessary for properly understanding criminal activity (particularly complex criminal activity). We use theft from oil pipelines in Mexico by OCGs to illustrate the value of the method we describe. Situational crime prevention techniques can be used to counter the decisions that offenders make when committing crime. The final stage of the method we propose involves analysing the decision-making within and between each stage of an organized crime activity, and grouping the decision-making conditions that offenders consider. We illustrate the value of the method we describe for populating and analysing a crime script by illustrating how it can be used to generate a systematic image of the decision-making involved across a criminal activity and how this helps to identify potential measures for crime control and crime prevention.

The focus of this paper is on the method we propose for populating a crime script of organized crime activity, using OSINT as a data source and quality assuring data that are entered into a crime script. Although we illustrate the method using the example of theft of oil from pipelines in Mexico by OCGs, we report in detail in a complementary paper about the problem of theft of oil from pipelines in Mexico (Alonso Berbotto and Chainey 2021). In the sections that follow, we begin by describing how the rational choice perspective forms the theoretical basis for crime scripts. We then describe the proposed method for how a crime script is populated with data, with a focus towards how data via OSINT can be used. We then illustrate the results of this method with a crime script of theft from oil pipelines in Mexico by OCGs, and then discuss our findings, limitations and conclusions in the final sections.

The rational choice perspective and crime scripts

The rational choice perspective (RCP) (Clarke and Felson 1993; Cornish and Clarke 1986) provides a theoretical framework for considering offender decision-making. RCP suggests that criminal behavior involves the purposeful aim of fulfilling needs and desires, with the actions that result being rational means to satisfy goals. This suggests that offenders make decisions when presented with opportunities to commit crime. This decision-making includes estimating the possible costs and benefits associated with criminal actions, while operating under the constraints of time pressures, skills, experience, and access to the resources necessary for actions to be completed. These constraints mean that offender decision-making is often bounded by the circumstances and situations within which the offender operates.

Building on RCP, Cornish (1994) proposed that if criminal activity is goal-oriented, requires the offender to make decisions that draws from knowledge and experience to ensure tasks are completed successfully, then criminal behavior could be a function of its learnt and routinized production. From this, the concept of crime scripts was proposed, borrowing from cognitive science, as a means to better understand crime commission and the decision-making associated with criminal acts. Cornish (1994) also illustrated how crime scripts can be used for examining the sequencing of offender decision-making and the relationships between decisions that are made across crime commission. Crime scripts, therefore, can be used to capture the logical steps adopted by offenders to prepare for, undertake and complete a crime. When examining criminal activity that involves more than one person, crime scripts can also detail the interactions between individuals that are necessary for activities to occur, and identify the roles these individuals perform.

A crime script consists of acts, organized into scenes, involving offenders, facilitators, and settings. Once populated with content, the crime script can be useful for deconstructing crime commission. The use of crime scripts has been illustrated for a range of applications involving single offenders, such as in the commission of stranger rape (Beauregard et al. 2007), and has shown value when examining criminal activities performed by criminal groups (Hancock and Laycock 2010). Most examples of crime scripts use data recorded on information systems (Dehghanniri and Borrion 2019), such as incident reports (Brayley et al. 2011; Tompson and Chainey 2011), police statistics (De Vries 2012), court data (Chiu et al. 2011), or transcripts and survey data (Beauregard et al. 2007; Samonas 2013). Examples of crime scripts of OCG activity most relate to cybercrime, in particular fraud and money laundering (Gilmour 2014; Hiropoulos et al. 2014; Hutchings and Holt 2015; Lavorgna 2015; Lord and Levi 2017; Willison and Siponen 2009), where the main primary data source for these studies—financial transactions—are available on computers and servers. Much OCG criminal activity is, however, clandestine and goes unrecorded on law enforcement and other information systems. OSINT is an additional source of data that can be used for examining criminal activity, but crime scripts using open data (such as Deslauriers-Varin and Beauregard 2010; Lavorgna 2014) have often lacked detail in explaining how the data were selected, evaluated and populated into the crime script.

The approach for generating a crime script originally proposed by Cornish (1994) is detailed, consisting of multiple scene classifications, organised in relation to multiple facets and choice-structuring conditions to explain the ways in which a criminal activity could be executed. The scene classifications introduced by Cornish included preparation, entry, multiple pre-condition functions, initiation, multiple actualization functions, doing, post-condition and exit functions. Facets refer to the “alternative methods of carrying out the action particular to each scene” (Cornish 1994, p. 173). The terminology used in describing these classifications, different facets and conditions was taken from cognitive psychology. To improve the practical use of crime scripts, Tompson and Chainey (2011) introduced an approach that used language that was more universally understood, and modified the crime scripting process without compromising the principles of the original method. This included introducing acts as the key stages involved across a criminal activity, using scenes (rather than facets defined by Cornish) to explain the ways in which an act could be executed, and streamlining the number of scene classifications to four: preparation, pre-activity, activity and post-activity. Although this refinement to crime scripting by Tompson and Chainey has been useful, limited guidance exists on the methodical process to follow when inputting data into a crime script (using official or open sources of data). This in turn can lead to researchers and practitioners being inconsistent in how they select and use data in their crime scripts, raises questions about the quality and reliability of the crime script, and inhibits replication (Dehghanniri and Borrion 2019). Borrion (2013) suggests a quality criterion for what crime scripts should possess, including the need to differentiate between potential, planned and performed scripts. Potential scripts illustrate hypothetical sequences of events, planned scripts describe sequences of actions that someone means to perform, and performed scripts are based on sequences of actions that have been executed. These distinctions are useful as they help clarify how the script has been constructed.

Although Borrion’s (2013) quality criterion are useful for distinguishing between different type of scripts, more rigor is required in the process of populating a crime script with data to ensure the data that are selected for inclusion are of good quality. This is particularly the case with data gathered from open sources. Document analysis can ensure that data that are selected for inclusion in a crime script are of good quality. Document analysis is a qualitative systematic analytic procedure “for reviewing or evaluating documents—both printed and electronic” (Bowen 2009, p. 27) that have been produced for purposes other than for the intended research, and without the researcher’s intervention (Prior 2012). Document analysis involves identifying, selecting, interpreting, and synthesizing information contained in documents to gain empirical knowledge about a subject of study (Bowen 2009; Gross 2018), particularly when data recorded on information systems is inadequate for understanding a problem (Bryman 2012). Document analysis provides a means of quality assuring the data that are to be populated in the crime script. Furthermore, the illicit nature of OCG activity, and the criminal actors involved make document analysis of OSINT unobtrusive, feasible and ethical (Bryman 2012).

Proposed method and data

Tompson and Chainey’s (2011) simplification of the original procedure proposed by Cornish (1994) involves creating a crime script template that is organized into acts, with each act consisting of scenes, a cast, and conditions (see Fig. 1). Acts are the key stages in the crime commission process. Scenes are the settings within which the acts occur and can be divided into four classifications: preparation; pre-activity; activity, and post-activity. The cast describes the participants—individuals or organisations—within each scene, or at least the roles they perform. The conditions within which the criminal activity occurs are described in terms of prerequisites, facilitators, and enforcement conditions. Prerequisites are the preconditions that need to be satisfied before illegal activity is initiated. Facilitators are the factors that make it easy and profitable to engage in the activity. Enforcement conditions refer to the legislation, regulations and licenses that govern the act. The first stage of the proposed method we introduce in this paper follows Tompson and Chainey’s (2011) approach in creating a crime script template. Three stages then follow in the proposed method. Stage two involves the identification of data and the application of document analysis within the crime script process to validate the content of data identified via OSINT. Stage three introduces a coding process to categorise data and populate these data into the relevant sections of the crime script. Stage four involves an axial coding process for examining how categories and subcategories of data relate to each other.

Fig. 1
figure 1

A crime script template, depicting multiple acts for which data are collected about the scenes, cast and conditions

Full size image

The theft of refined oil products (TROP) has experienced significant increases in Mexico in recent years. Oil theft in Mexico is mostly committed via illegal pipeline tapping (IPT)Footnote 2 of Pemex’sFootnote 3 pipeline network. Between 2010 and 2018, IPT incidents increased by 1720 percent (Etellekt Consultores 2015, Pemex 2019), peaking in 2018 when 12,581 new IPTs were discovered. All of Mexico’s main OCGs—Cartel Jalisco Nueva Generación, Los Zetas, the Gulf Cartel, and the Sinaloa cartel—are involved in TROP to some degree (Etellekt Consultores 2016, Guerrero-Gutiérrez 2011, Sáinz 2019). In 2018, OCGs were responsible for the theft of an average of 56,000 barrels of oil per day (Pemex 2019), equivalent to USD 3.9 million per day in lost revenues. Rigorously examining the activities associated with TROP via IPTs in Mexico is challenging because of the complex and clandestine nature of this criminal activity. Data that is recorded about TROP via IPTs does provide information about where the IPT took place, when the IPT was discovered and the amount of oil that was stolen. However, very little data exists about the nature of the criminal activity such as how the activity is planned and committed, how the stolen oil is used or disposed, and the roles that individuals perform. It is likely that TROP via IPTs involves a group of individuals working together to commit this criminal act, but limited data exists about who these individuals are, their associations and the decision-making that takes place, and about the equipment and information that is necessary for the criminal act to be completed successfully (Alonso Berbotto and Chainey 2021). Very few arrests have been made in Mexico for TROP via IPTs, very few of those arrested were charged with sanctions of any great severity (Moreno 2019; Santos 2019), and very little intelligence has been gathered from those who have been arrested to help counter the involvement of OCGs in TROP in Mexico (Alonso Berbotto and Chainey 2021).

Using Borrion’s (2013) criteria, the crime script template was used to create a potential crime script for initiating the data collection process. This began by hypothesising over the key acts involved in TROP via IPTs in Mexico. A performed crime script of TROP via IPTs in Mexico was produced once all stages of the proposed method were completed. The second part of the first stage involved composing a series of questions organized in relation to the crime script template (listed in Table 1) about activities, roles, skills, resources, costs, decisions, and conditions relating to the criminal activity. This process included posing questions about the planning and preparation that was required, the knowledge offenders required for the criminal activity to occur, and the legislation that regulated the activities.

Table 1 Questions guiding the identification and collection of information for a crime script.
Full size table

Stage two (the identification of data) involved examining data from two sources: IPT incidents in Mexico recorded by Pemex and data about TROP and IPTs in Mexico using OSINT. Data on IPT incidents in Mexico recorded between 2017 and 2018 were sourced from Pemex. Two years of data on IPTs was considered sufficient for capturing any changing trends and variations in criminal activity that may be because of variations in oil production and activities against OCGs. The IPT data from Pemex were useful in identifying where and when incidents took place but were limited in providing information about the nature of the criminal activity, such as the number of people involved and the equipment used to extract the oil.

The first part of the process in using OSINT involved conducting a search for data on the internet. The identification of data via OSINT used Google Search to perform key word searches to identify sources of relevance, using a variety of search operations. Searches were conducted in English and Spanish. The search and identification of data was performed using three steps. The first step used two sets of key words relevant to the criminal activity—illegal pipeline tap and oil thief—to perform preliminary searches for primary and secondary sources of data (Gross 2018). This helped to avoid information overload at the outset of the data identification process. The searches were then modified to identify sources of most relevance. This involved a recursive process using additional words and terms relevant to the topic, such as pipeline sabotage and vandalization of pipelines. Data was searched from all forms of open sources such as academic journal articles, Mexican and international media coverage (e.g., El Universal), published journalistic investigations, and publications on TROP and IPT in Mexico from consultancy practices and think tanks. Operators were added to exclude terms, and search strings were amended to yield the greatest quantity of results. 36 keyword combinations in English and 34 keyword combinations in Spanish (Table 2) were used to identify documents for initial consideration.

Table 2 Key words, and combinations of words (in English and Spanish) that were used in stage one of the crime script data identification process
Full size table

The second step of stage two involved applying document analysis to review and evaluate the documents identified via OSINT. First, this involved refining the selection of documents for their relevance, appropriateness of content, and to remove redundancy (Gross 2018). To ensure the documents were temporally and geographically relevant, their selection was restricted to those published between June 2014 to June 2019 and relating to Mexico. The result of the keyword combinations, and relevance restrictions yielded 1,539 information sources. To limit redundancy in the sample, documents reproducing information from other articles were disregarded. To ensure a balanced representation of content, a maximum of two documents per author were allowed (as suggested by Gross 2018). As the type of information sought was of a factual nature, opinion-based editorials were removed to ensure appropriateness.

The next step of stage two refined the selection of documents by assessing for their quality, defined in terms of authenticity, credibility, representativeness, and meaning (Scott 1991). Authenticity refers to the genuineness and soundness of a document’s origin. To meet this criterion, only documents published in peer-reviewed publications, by official sources, in renowned newspapers and magazines, or by respectable think tanks and consultancies were included. Credibility refers to appraising the sincerity and accuracy of a document’s content. The content of documents was checked for consistency, with this content being triangulated with alternative sources to cross-check content. Representativeness refers to whether the document is representative of the general conditions and if the evidence is typical of its kind. Meaning refers to the significance of a document’s content, and its degree of clarity and comprehensiveness. Detailed accounts of TROP via IPTs crime commission process, such as the actors involved, what they did and the equipment used, was the meaning that sought to be extracted from documents. The application of these criteria produced 104 documents for examination.

The third stage, applied to both the recorded IPT incidents (sourced from Pemex) and data from OSINT, involved using content from these data to populate the crime script. In the case of ‘documents’ each was read or watched (in the case of video media). Our proposed method for populating a crime script used a coding process to ensure a systematic approach to data extraction. Data extracted from either of the two sources (recorded IPT incidents and OSINT) were first allocated to the crime script acts (that were determined in stage one). Codes were then created to organize the data within each act based on whether the data referred to a scene, the cast, or a condition. Data for scenes were coded by whether the activity was associated with preparation (activities that need to be conducted to enable subsequent activities within the act), pre-activity (those that took place immediately prior to the main activity), the activity (the main activity), or post-activity (those that took place immediately after the main activity and that allow for transition to the next act). When individuals, organisations, or roles were identified from the data, these were coded as relating to the cast. Where the data were available, information about these cast members (such as their association with other cast members) were also recorded. When conditions associated with the criminal activity were identified (i.e., prerequisites, facilitators, and enforcement conditions), these were also coded. This coding procedure is illustrated in Fig. 2, showing for example that for data that were identified as relating to act 2 and that referred to a cast member, the code A2_C was assigned. The coding and recording of data extracted from Pemex’s information system and OSINT was performed using Microsoft Excel. We used Excel because of its popular use (and to meet with our objective of our proposed approach being easy to replicate). Filtering by codes in Excel also meant it was easy to examine data recorded by act, by categories within each act, and across the crime script.

Fig. 2
figure 2

The coding procedure for recording data extracted from information sources for populating into a crime script

Full size image

The fourth stage involved a coding cycle using axial coding. Axial coding is used when analysing a wide variety of data formats, and helps describe properties and dimensions of document content, while also helping to examine how categories and subcategories of data relate to each other (Saldaña 2009). For the current study, this involved reviewing the data that had been identified and extracted from the previous steps as a whole, rather than as individual items of data. This included reviewing the activities and roles performed within each act, and considering how these roles related to other roles and activities that others performed. This process of axial coding can also result in modifying the acts previously defined (by including others, or removing or combining acts). Axial coding also assists in the triangulation of data from multiple sources by reviewing the data recorded by each code, and synthesizing the same or similar data into a single code. This synthesizing of data was performed where necessarily.

Once a crime script is populated, the content of the crime script should then be subject to analysis. This analytical process should aim to interpret the data and make judgements that explain why the criminal activity is present. To assist the analysis of a crime script, we propose a procedure that examines the decision-making within and between each act, and that groups the decision-making conditions an offender is likely to consider. In turn, this may then help to better identify potential opportunities for intervention. As the rational choice perspective suggests, offender decision-making involves an estimation of the possible costs and benefits associated with their actions. Situational crime prevention (SCP) is the corollary of the rational choice perspective. SCP consists of a number of techniques that make crime commission riskier, less rewarding and more of an effort. SCP techniques can also help remove excuses that influence offender decision-making (such as setting clearer rules), and reducing provocations towards criminal involvement (such as discouraging imitation). To support the analysis of the crime script our proposed method includes a final procedure that codes the data in the crime script with regards to five decision-making considerations associated with risks, rewards, efforts, excuses, and provocations involved in the activity. This procedure is illustrated in Fig. 3, showing for Act 1 that each item of data entered into the crime script is coded as relating to one of the five decision-making considerations. If a decision-making consideration cannot be determined, no code is entered.

Fig. 3
figure 3

Coding procedure applied to data in the crime script with regards to the five decision-making considerations associated with risks, rewards, efforts, excuses, and provocations

Full size image

Results

The first stage, involving the creation of a crime script template and a potential crime script involved hypothesising about the acts associated with TROP and IPT. Six acts were determined—planning, transportation to the extraction site, extraction, transportation from the extraction site, storage, and disposal. Stages two and three involved identifying, selecting, quality assuring, coding, and populating the validated data into the crime script. Tables 3 and 4 contain data that were sourced from Pemex and via OSINT for the first two acts, organized by the activities within each scene, the cast, and conditions associated with each act. Data for the other acts are not included here for purposes of brevity, but are published in an open data repository (Chainey and Alonso Berbotto 2021).

Table 3 Planning act for TROP via IPT in Mexico
Full size table
Table 4 Transportation to pipeline act for TROP via IPT in Mexico
Full size table

Tables 3 and 4 illustrate the high level of detail that was sourced about TROP and IPT performed by OCGs in Mexico. The IPT data from Pemex were useful in identifying where and when incidents took place but were limited in providing information about the nature of the criminal activity. The OSINT data was invaluable in this regard, providing details about how the criminal activity took place, the people who were involved and the roles they performed, the equipment that was used to extract the oil, the arrangements to secure safe transportation to and from the extraction point, how oil extraction was conducted to avoid detection, the arrangements that were made for the secure storage of stolen oil, and its disposal. For example, as shown in Table 3, data relating to the planning act identified that offenders were aware of the profitable opportunities from TROP, and that they perceived an absence or lack of effective surveillance protecting oil pipelines. The high demand for oil products meant that stolen oil could easily be sold, with arrangements often made during this planning act with buyers for which refined oil was a major cost (e.g., transportation businesses). Members of OCGs had the skills to perform many of the required roles associated with TROP, but also recruited individuals during this planning act to perform certain tasks or provide information. Offenders organized and obtained other equipment for conducting TROP during this planning act, such as storage barrels and vehicles.

Axial coding was valuable in reviewing the data in the crime script as a whole. This coding process also further revealed the value of OSINT data for examining the behavior of the OCGs across all acts. Pemex’s data on IPTs was useful in identifying the sections of pipeline that were vulnerable to IPT (see Fig. 4). For example, pipelines crossing the state of Puebla experienced 1,815 IPT incidents in 2018, 15 percent of all IPTs in Mexico. Pemex data, supported by data gathered from open sources, also identified that polyduct sections of pipelines were most affected by IPTs (CartoCritica 2019; Pemex 2018, 2019).

Fig. 4
figure 4

IPTs by state pipeline segment in Mexico in 2018

Full size image

OSINT was responsible for revealing that most IPTs took place at night or at dawn because of OCGs using the cover of darkness to avoid detection from surveillance, and to avoid confrontations with other OCGs. More specifically, taps were installed at times immediately prior to oil being transported along pipelines to ensure the drilling of a pipeline did not result in an explosion. OSINT also identified the criminal activity was most likely led by a lead offender from an OCG that was local to where a pipeline was located, and identified the role played by Pemex employees in TROP. Pemex personnel were recruited by OCGs for information about the scheduling of oil transportation through pipelines, their knowledge of Pemex’s surveillance and detection systems, and technical expertise about drilling into pipelines and installing taps. Numerous examples of data from OSINT indicated that expert drillers charged approximately USD 6,000 per tap installed. Drivers, lookouts (often individuals from local communities) were also recruited, and on occasion security forces were bribed to not intervene or provide armed escort to and from pipeline extraction points. Storage facilities for stolen oil were either leased, borrowed or purchased by OCGs, with the stolen oil being sold to local businesses or local community members. On occasion, local gasoline stations were pressured to sell petroleum and diesel, and industries that were reliant on oil (e.g., mining, cargo transportation) would purchase the stolen oil because of its low black market price.

Tables 3 and 4 (and the tables for each other act [Chainey and Alonso Berbotto 2021]) are comprehensive in their detail, but can be difficult to use to determine how the content of each act relates to each other. Figure 5 is illustrative of how a large volume of data in a crime script can be synthesized into a single graphic. For each act, summary information is provided with the key details about the activities, the cast and conditions. In this visualisation, the cast are drawn to show when each role was active within each act. This illustration acts as a template for how a detailed crime script can be summarised, and to identify the roles performed (and who performs them) at certain stages in a criminal activity.

Fig. 5
figure 5

Crime script visual summary of TROP via IPT in Mexico

Full size image

The final stage of the methodical procedure involved reviewing the data in the crime script in terms of how it had been coded using one of the five decision-making considerations associated with risks, rewards, efforts, excuses, and provocations involved in the activity of TROP via IPT. We illustrate the result of this process in Table 5 for the example of risks, listing information that was extracted from the crime script that was primarily associated with this type of offender decision-making. Coding the content of data in the crime script in this manner results in a more systematic picture of the decision-making involved across a criminal activity. For example, as shown in Table 5, remote areas that authorities found hard to monitor were the specific types of areas exploited by oil thieves because of the low risk of apprehension in these areas. This low level of risk was further compounded by the high levels of impunity associated with TROP and IPT. Additionally, security forces and authorities could be bribed, corrupted or extorted, leading offenders to believe that even if caught, the likelihood of prosecution would be low. Very few offenders engaged in TROP had been arrested for this criminal activity, meaning the risks of being caught were perceived by offenders as low. Instead, offenders were more likely to compare the risks associated with involvement in TROP against other illegal activities, such as the cocaine trade. TROP was considered to be a safer activity as it avoided the risks associated with smuggling illegal products across international borders, and was less costly because of the opportunities to sell stolen oil to the large domestic market. The recruitment of former or current Pemex employees also reduced the OCGs’ risks of unsafe oil extraction and detection because of the knowledge these Pemex employees had of Pemex’s detection systems.

Table 5 Offender decision-making for TROP via IPT associated with risks
Full size table

Organising the data from the crime script in relation to the five decision-making considerations associated with risks, rewards, efforts, excuses, and provocations can then help identify opportunities that counter the behavior of OCGs, and support crime control. Table 6 is ordered by these five decision-making considerations, with descriptions of SCP interventions. The SCP interventions listed in Table 6 are not exhaustive but illustrate how SCP techniques could be used to prevent TROP via IPTs. For example, camera surveillance using drones that repeatedly fly along vulnerable sections of pipeline may increase offender risks, performing checks of oil-dependent industries (such as mining and transportation) that verifies invoices for the oil they have purchased may reduce rewards, steel coating the sections of pipelines that have experienced many IPTs may increase effort, providing the means for Pemex personnel to anonymously report approaches by OCGs may remove excuses, and rapidly removing IPTs may reduce other offenders being provoked to use the IPT.

Table 6 SCP techniques for TROP via IPT in Mexico
Full size table

Discussion

Crime scripting is a useful approach for understanding criminal activity. However, to date, few studies have researched the methods involved in creating a crime script with little guidance available on how data are populated into a crime script. In the current study we describe and illustrate a methodical process for populating the content of a crime script. The example that is used was a clandestine criminal activity, for which we anticipated the identification of data could be problematic. Data recorded on information systems about TROP via IPTs was limited to only describing where and when an IPT was discovered. OSINT data, quality assured using document analysis, provided information about this criminal activity that had previously not been gathered and synthesized to provide a detailed insight into the nature of the criminal activity. This included providing information about individuals who were recruited to perform particular roles, how stolen oil was transported, stored and sold, and the equipment that was used to carry out the criminal activity. We believe, based on our experience from working with law enforcement agencies, that the data that were extracted via OSINT provided a unique insight into criminal behavior that is not routinely captured in these agencies’ information systems. Most law enforcement agencies record intelligence about criminals and criminal groups that provides some insights about their activities. The procedures we introduce in this paper for creating a crime script provide a systematic means of gathering, verifying and synthesizing data that are not captured on these law enforcement information systems (such as roles performed by individuals that are not part of an OCG) or at the very least build on the intelligence that these agencies do record. In the current study, we trusted the data recorded by Pemex as being a credible source of IPT incidents so these data were not subject to the document analysis that OSINT received. However, the document analysis procedure we describe can be applied to all sources of data to ensure the data recorded in the crime script is reliable.

Once a crime script is populated, the content of the crime script should then be subject to analysis. This analytical process should aim to interpret the data, and make judgements that explain why the criminal activity is present. To assist the analysis of a crime script, we included in the proposed method a procedure that examines the decision-making within and between each act, and that groups the decision-making conditions an offender is likely to consider. The introduction of this procedure led us to be able to develop a more systematic picture of the decision-making involved across the criminal activity. Additionally, we suggest that when the decision-making coding procedure is linked to cast members, this procedure can identify who is associated with the decisions that are made. Collectively, the outcomes from this decision-making grouping procedure leads to a better understanding of how the criminal activity takes place. This procedure also resulted in us being able to identify potential opportunities for intervention. For example, to increase the perceived risks of being identified and apprehended in the act of extracting oil via an IPT, vulnerable sections of pipeline could be patrolled using drones to identify suspicious activity that security patrols could then investigate.

Crime script analysis was developed using the principles of the rational choice perspective to consider offender decision-making across a criminal activity, and the relationships between decisions that are made across this activity. This means that the assumptions associated with RCP, such as criminal activity being goal-oriented, routinized and purposeful are embedded into the crime script approach. RCP places an emphasis towards criminal actors maximizing benefits while minimizing costs. Alternative approaches to considering how individuals make decisions to reach their goals includes prospect theory (Tversky and Kahneman 1992) that involves individuals having a preference towards perceived gains that a choice presents over perceived losses that may come from making that choice. This means that our crime script may be limited in its full consideration of offender decision-making because of the underlying assumptions associated with RCP, and we recommend further research that considers other theoretical models of decision-making, such as prospect theory, in the creation of crime scripts. This could include how certainty and uncertainty in the choice options that are presented to offenders influences their decision-making.

A good quality crime script can also be used to prompt additional analysis that further examines the roles performed and associations between people involved in the criminal activity. These data about the cast members could then be used as inputs into illicit network analysis to examine the importance of each member within the criminal group. This hybrid crime script and illicit network analysis approach has already been attempted by Bellotti et al. (2020) but without the benefit of the methodical process we describe. We recommend further research that examines how data about cast members from a crime script can be used in illicit network analysis. Additionally, when crime scripts are populated with data that follow the same methodical procedure, this creates better opportunities for different crime scripts to be compared or combined. We recommend our proposed method is used to create crime scripts about a similar criminal activity, or on the same criminal activity but for different time periods to demonstrate the benefit that the structured methodical procedure we propose offers in comparing and combining crime scripts.

Limitations

Data on TROP via IPTs from Pemex’s information systems was limited, therefore many alternative data inputs were used from open sources, including data from media outlets. Although all data were subject to quality assessment procedures, the authenticity, credibility, representativeness and meaning of some data from media outlets could not be guaranteed. Triangulation using different sources was conducted to address this limitation, and also to reduce subjectivity in data interpretation. Information collected via interviews with experts could have further improved our crime script, but time and funding restrictions prevented us from doing so. Expert opinion was, however, captured in some form because of their role in authoring several of the documents we selected and used in the crime script. So, experts were a source of information for the crime script we produced on TROP via IPTs in Mexico. We suggest that experts could be used in another way in the methodical procedure we describe by reviewing the content of a crime script and cross-checking the findings with their interpretation of the crime script content. A limitation of a structured methodical approach to crime scripting is that in the process of data being disaggregated into acts and scenes, some of the meaning and context of the original data can be lost. Experts can ensure that this original meaning and context is not overlooked, and that information is correctly interpreted. These experts could also be used to identify other potential opportunities for countering the criminal behavior that the crime script has identified.

The document analysis was extensive, but some details about TROP and IPTs may have been missed, resulting in the possibility that certain parts of the crime script were more comprehensive than others. Although the analysis did not distinguish between OCGs in Mexico, the location where these TROP activities took place could be used to infer which OCG was most likely to be responsible. We also recognise the current study provides a snapshot for a given period. Offenders are quick to adapt to challenges that aim to inhibit their criminal activity. Replication of our crime script for TROP and IPTs would reveal any differences to our results. Additionally, a crime script for one period of time or for a particular offender or criminal group could be compared to a crime script for the same activity for a different period of time, different offenders or different groups to reveal differences between them—such as differences in offender decision making and criminal behavior. We encourage the use of crime scripts for examining these differences.

Space limitations for journal articles are likely to restrict the publication of the full data content of a crime script, a detailed analysis of the crime script, and discussion about potential intervention points. To address this, we encourage researchers to publish the data content of their crime scripts in an open data repository (as we have done here - Chainey and Alonso Berbotto 2021). This will help these researchers focus the content of their article to the findings from the crime script, while allowing the content of the crime script to be better scrutinised for their content, and help practitioners and other researchers to better replicate crime script research.

A structured methodical approach to the generation of crime scripts can, however, take time to complete. Crime scripts aim to better understand the specifics of criminal activity, so require some investment of time to generate a crime script that contains information of value. The level of specificity of the crime script can, though, be balanced against the time available for its completion and its purpose. In the current article we illustrate the value of using OSINT to better understand the specific activity of TROP via IPTs. We used numerous types of OSINT, including news articles, television documentaries, academic journal articles, published journalistic investigations, and publications produced by consultancy practices and think tanks. Law enforcement agencies may have less time than academic researchers to examine all forms of OSINT, so the choice of OSINT data to include may need to be more limited.Footnote 4 For example, in the current study we used documents that were published between June 2014 to June 2019 and relating to the whole of Mexico. The amount of OSINT documents that a law enforcement agency considers for inclusion in a crime script could be for a shorter time period and for a specific area (e.g., a certain state in Mexico). The number of OSINT documents to consider could also be reduced by only considering documents from one or two specific sources (e.g., published journalistic investigations and publications produced by think tanks). The method described in the current study is flexible to different levels of specificity.

Conclusions

Crime scripts involve an attempt to think how the offender behaved, by building a detailed structured sequence of events and a picture of the offender’s decision-making. In addition to using crime scripts for better understanding an individual’s criminal behavior, crime scripts can be used to examine criminal group behavior across a criminal activity. Crime scripts involve collecting data to better understand the activities offenders perform, their roles in crime commission, and the conditions that influence their activities. Crime scripts can also identify the involvement of individuals or organisations outside the membership of a criminal group, and whose roles are required to support the criminal activity. Once constructed, a crime script can determine how decision-making and activities that are necessary for crime commission can be countered.

Guidance on the process for generating a high-quality crime script has, however, been lacking. In this paper we address this by describing a structured methodical process to the identification of data and its inclusion in a crime script. The process includes document analysis to validate data to ensure it is reliable, and uses a coding regime that organizes these data into the components—acts, scenes, cast and conditions—of a crime script. The process accommodates the inclusion of data from all types of sources. This includes OSINT which we show can be of value in better understanding the nature of criminal activity, and in particular the activities of OCGs. The process we describe is also flexible for generating crime scripts of different levels of specificity. We illustrated the use of this methodical process for generating a crime script with the example of theft from oil pipelines by OCGs in Mexico, and by doing so show how a complex clandestine criminal activity can be better understood. The methodical process we describe for generating a crime script is a straightforward approach to replicate, and if followed, can lead to the generation of other high-quality crime scripts.