Mass Victimisation and Cyber Victimology (Unit X)

Ordinary interpersonal victimisation assumes a single victim, a single offender and a discrete act. Mass victimisation breaks this: it is harm produced simultaneously in large numbers of people by one cause, an earthquake, a factory explosion, a terrorist attack, a genocide, or a data breach affecting millions of accounts at once.

Scale alone is not the test. A city-wide pattern of similar but independent burglaries produces many victims without being mass victimisation, since each act has its own offender and its own causal chain.

Mass victimisation research groups events by cause rather than by harm type, because the cause determines the response needed, which is also why such events typically overwhelm ordinary institutions built to process cases one at a time, and almost always produce a bespoke, temporary institution instead, a compensation fund, a commission of inquiry or an international tribunal.

Natural disasters are the most common source and the furthest removed from criminal intent, though human decisions about housing, warnings and relief still shape the scale of harm. Industrial and transport disasters sit closer to the criminal justice system because they often involve negligence or regulatory failure; the 1984 Bhopal gas leak is a widely studied example combining mass death and injury with a contested compensation process.

Terrorism produces mass victimisation through deliberate attacks designed to maximise casualties and fear, with victims chosen for location rather than any personal trait, which is why dedicated compensation schemes for terrorism victims exist.

War crimes and genocide sit at the most severe end. Genocide, as defined in the 1948 Convention on the Prevention and Punishment of the Crime of Genocide, requires intent to destroy a national, ethnical, racial or religious group in whole or in part, which is what distinguishes it from other mass atrocities.

Crimes against humanity and war crimes, codified more fully in the 1998 Rome Statute that established the International Criminal Court, cover widespread or systematic attacks on civilians that may not meet genocide's intent threshold but still cause victimisation on a comparable scale. These sources often overlap in a single conflict rather than appearing separately.

Four response mechanisms recur across mass-victim events. First, forensic identification of the dead through Disaster Victim Identification, coordinated internationally through bodies such as Interpol, matching remains against dental records, DNA and personal effects; unresolved cases leave families in what researchers call ambiguous loss. Second, dedicated compensation funds, which trade the adversarial rigour of a lawsuit for speed and a fixed schedule of payments, since ordinary tort litigation cannot resolve claims at that volume.

Third, the truth commission, used mainly for atrocity and conflict victimisation. South Africa's Truth and Reconciliation Commission, established in 1995, aimed to document what happened and name responsibility, sometimes offering conditional amnesty for full disclosure, producing an authoritative public record rather than a set of convictions. Fourth, collective memorialisation, memorials and commemorations that convert individual loss into shared public memory and perform a recognised victim-support function even without direct compensation.

Cyber victimology asks victimology's usual questions, who is harmed, by whom, how often and with what consequences, but applies them to harm occurring through networked computers and digital platforms.

Scholars such as K. Jaishankar, who proposed the term cyber criminology in the mid-2000s, argued online offending needs its own theoretical vocabulary rather than a direct transplant of physical-world crime theory, because several foundational assumptions do not hold online: physical proximity between victim and offender is not required, there is no single fixed crime scene, and the line between a single offence and a continuing one blurs, since a leaked image or harassing message persists and can be re-shared indefinitely.

Cyber victimisation frequently has no single identifiable offender at all, as in a mass data breach caused by a security failure, or has an offender population too large and anonymous for individual attribution, as in a pile-on harassment campaign.

Jurisdiction compounds this: a victim, an offender and a hosting platform can each sit in a different country, which is why international instruments such as the Council of Europe's 2001 Budapest Convention on Cybercrime, setting common standards for defining offences and cross-border evidence requests, matter more here than in most domestic victimisation.

Cyber victimisation is a cluster of distinct harms, not one phenomenon. Financial cyber fraud, phishing, business email compromise, romance scams and identity theft, is the most reported category, usually perpetrated by strangers operating at scale, and analytically closer to conventional property crime even though victims commonly also report shame that discourages reporting.

Harassment and cyberstalking form a second category, frequently perpetrated by someone the victim already knows, an ex-partner, a former colleague or an acquaintance, mirroring physical-world stalking more than anonymous cybercrime.

Image-based sexual abuse, the non-consensual creation, taking or distribution of intimate images, is a third category. Legal scholars Clare McGlynn and Erika Rackley proposed this label in 2017 to replace revenge pornography, since many cases involve images obtained by hacking, coercion or covert filming with no revenge motive and no consent at all; it also covers threats to distribute such images, sometimes called sextortion.

A fourth category, reputational harm, defamatory posts, doxxing and coordinated harassment, compounds through repetition and search-engine visibility, so remedies increasingly focus on removal and de-indexing rather than compensation alone.