Why Faster Cybercrime Intake May Not Reduce Case Backlogs
Public Japanese statistics and an explicit queueing model show why faster intake may shift a bottleneck downstream. Evidence preservation, international assistance, and deterrence require distinct measurements.
Il testo dell'articolo non รจ disponibile in questa lingua; viene mostrato l'inglese.
A faster reporting desk is valuable. It does not guarantee a faster investigation when the next queue is already full. Our latest analysis uses Japanese administrative statistics and a small system-dynamics model to examine that distinction.
## What we could verify
The National Police Agency recorded 180,694 cyber-related consultations handled in 2025. This is an administrative activity count, not a cohort of unique criminal cases. It cannot be divided into a separate year's clearances to estimate the chance that a report becomes a case. [NPA original](https://www.npa.go.jp/bureau/soumu/soudan/r07_soudan.pdf)
We also obtained the original 2024 and 2025 prosecution-duration tables. Among the covered disposed suspected-case person records, the share above three months rose from 9.15% to 9.61%. These tables cover multiple offense types and begin at receipt by prosecutors. They do not measure cyber-specific police investigation time. [2024 Table 31](https://www.e-stat.go.jp/stat-search/files?stat_infid=000040302419), [2025 Table 31](https://www.e-stat.go.jp/stat-search/files?stat_infid=000040488781)
The international-assistance table distinguishes outgoing requests from requests accepted from abroad. It contains no cyber-specific completion rate or average response time. Counting requests is useful for understanding activity, but does not establish effective cooperation or deterrence. [MOJ Crime White Paper, Table 2-6-3-1](https://www.moj.go.jp/content/001455836.pdf)
## Follow the bottleneck downstream
Our illustrative model separates initial handling, evidence work, and international coordination. It compares faster intake, more evidence-processing capacity, faster international coordination, and their combination. Each intervention is a hypothesis with explicit assumptions; staffing and costs are not equal across scenarios.
Under the example settings, increasing initial-handling capacity by 50% leaves total pending work at about 543 modeled units after a year. The bottleneck moves to evidence work. Increasing evidence-processing capacity alone reduces pending work to about 389; combined processing changes reduce it to about 251.
These are synthetic workload units. Movement to the model's next stage is not an arrest, referral, indictment, conviction, or reduction in future victimization. The numbers illustrate a queueing mechanism, not the effectiveness of a real police reform.
## Preserve early, then test whether the evidence is usable
Preservation affects a different dimension. Records can disappear before an authorized request secures them. We added an adjustable, hypothetical evidence-remaining index. Earlier preservation raises that index, but does not automatically increase the model's case transitions: the required empirical connection has not been measured.
That separation matters. More retained records do not by themselves establish authorship, criminal intent, a causal connection, or the elements of an offense. Evidence must be lawfully obtained, reliable, and relevant. Foreign preservation requests have their own authority and procedural requirements.
## The missing link is deterrence
Offenders may replace infrastructure, change methods, or continue where expected gains remain attractive. Lawful identification and effective enforcement could change those incentives. We have not estimated that effect from prosecution counts or sentence maxima.
The next useful dataset is a matched, privacy-preserving case cohort: intake, crime recognition, preservation, foreign request and response, referral, disposition, reasons for non-progression, and subsequent victimization. It also needs offense complexity, jurisdiction, staff time, cost, and an appropriate comparison group.
Without that linkage, it is possible to measure administrative throughput while making an unsupported claim about deterrence. Our model keeps the gap visible. The aim is to find where an intervention acts, then collect the evidence needed to test whether it improves outcomes.
[Explore the full analysis, sources, data, feedback loops, and scenario model](https://analysis.mithril.fund/research/cyber-enforcement/).