# Microsoft Digital Crimes Unit **Entity class:** Cybercrime investigation and disruption organization **Architecture:** [[wiki/Signals, Silos, and Sovereign Software|Signals, Silos, and Sovereign Software]] ## Definition The **Microsoft Digital Crimes Unit (DCU)** combines attorneys, investigators, analysts, data scientists, and engineers to disrupt cybercrime and nation-state infrastructure through technical action, civil litigation, referrals, and public-private partnerships. ## Modern Defense and Cybersecurity Role DCU is a mature example of privatized intelligence and enforcement capacity: a technology company uses proprietary telemetry, graph analysis, courts, registrars, hosting providers, law enforcement, and international partners to dismantle hostile infrastructure. ## Chronological Proximity Operating since 2008, DCU developed alongside Microsoft's transformation from software vendor into global cloud, identity, and security operator. ## Relational Proximity [[wiki/Microsoft Threat Intelligence Center|MSTIC]] identifies and characterizes threats; DCU converts evidence and partnerships into disruption; Microsoft products then block or detect the remaining infrastructure. ## Collection Routes [[collections/The Civilian Intelligence Marketplace|The Civilian Intelligence Marketplace]] · [[collections/Terrorism, Counterterrorism, and the Intelligence Environment|Terrorism, Counterterrorism, and the Intelligence Environment]] ## Sources / Provenance - [Primary documentation](https://www.microsoft.com/en-us/corporate-responsibility/topics/cybersecurity/disrupting-cyberthreats-since-2008/)