The Science of Art Theft: Using Data to Identify Criminal Patterns, 1990–2022

Abstract

Art theft is still a crime surrounded by inaccuracies. From the perception of flashy fictional thieves to unintentionally misleading monetary claims, the general public and some art and security professionals have a distorted vision of the scope of the criminal enterprise. As there is an alarming lack of empirical studies into the matter, this study aims to remedy the issue through the elaboration of a database to find common characteristics and aspects of interest amongst multiple art heists from the last three decades to provide a better understanding of crucial theft traits such as defeated security measures, methods of deception, timing and target selection, use of weapons and insider participation impact. Results indicate thieves tend to use brute force to defeat security measures; diversions and deceptions are a standard, uniform trends are present in absolute timing matters, and neither the use of weapons nor insiders appears to be the norm.

Introduction

Dolnick postulated in 2007 that a museum of stolen masterpieces would rival any of the world’s great treasure houses of art. The Museum of the Missing would include 551 Picassos, 43 Van Goghs, 174 Rembrandts, and 209 Renoirs. Vermeer would be there, and Caravaggio and van Eyck and Cezanne and Titian and El Greco.¹ There are plenty of tales about criminal groups committing heists, also known as caper stories, in the entertainment industry, and high-profile cases of art thefts, forgeries, and fraud have been researched and written about, at times reading like fiction,² so it could be expected that there is sufficient information with regard to how criminals have conducted museum heists in the past. But even with high losses and public fascination, there is a lack of quantitative investigations, and, as such, initiatives could be built on a flimsy foundation of hype and low-quality data, leading to high chances of failure.³

This study aims to be a base to build up from as time goes by and more information becomes accessible in order to fight against art theft and the consequential illicit trade and art as a vehicle for money laundering. Creating a database of 40 cases, analysed in 46 variables each, the purpose of this study is to identify common features or aspects of special relevance in the execution of museum heists, backed by empirical results.

Theoretical framework

In Art Crime Literature: A General Overview, Balcells emphasizes the significance of collecting empirical data to shed light on cultural heritage crimes. However, he notes that discussing art theft using current data is a challenge. Compared to other forms of crime where statistics are much more accessible to researchers, […] the gaps and contradictions are evident, and myths keep appearing in general literature on the topic.⁴ Indeed, one of the first studies that analysed theft tendencies and included art as a target was written by The Rand Corp in 1979 to assess the risk that North American nuclear plants ran of being victims of theft. Because there weren’t enough previous cases of nuclear plant thefts to generate a representative sample, The Rand Corp decided to use high-value thefts as an analogy to nuclear plant thefts.⁵ With the total representation of art theft at 13%, and museums in particular being the target in only 12 of the cases, we can conclude that this particular sample could not be used as a proper art theft risk assessment. Going forward, art theft and museum heists will refer to the “type of property crime that involves one or more people intentionally and fraudulently taking another person’s fine art property – including paintings, photographs, prints, drawings, and sculptures; decorative arts; antiquities; ethnographic objects; Oriental and Islamic art – without permission or consent and with the intent to convert it to the taker’s use, including potential sale.”⁶

In 2015, Sandia National Laboratories decided to conduct a similar analysis with a database of 23 cases from the last three decades of high-value thefts as analogues to nuclear plant thefts. This report was prepared as an account of work sponsored by an agency of the United States Government, operated for the United States Department of Energy.⁷ In this case, the representation of art heists in museums was 8.7%. Therefore, the same need for further representation applies to this study, as the conclusions couldn’t be extrapolated to art theft. Still, this study offers an exemplary way to divide the desired variables to analyse heist tendencies: 1) defeated security measures, 2) deception methods, 3) timing and target selection, 4) weapons employed, 5) resources and risk acceptance, 6) insiders, and 7) failures and mistakes.

In the same year, Kerr delved into the security protocols surrounding the display and transport of art in The Securitization and Policing of Art Theft: The Case of London, particularly focusing on the part law enforcement plays in identifying hazards and the duty of cultural establishments in securing their collections, using a mix of qualitative methods such as interviews, complete observation, and participant observation,⁸ and in 2017, Burmon investigated art theft characteristics in the USA, elaborating an extensive empirical analysis to gain further knowledge into the optimal retrieval of stolen art and how to prevent it through the examination of police case reports.⁹ The database focused on five general categories: 1) general information, 2) suitability of the target, 3) offense profile, 4) guardianship, and 5) recovery tools. Her study concludes that while a general outline can be made throughout, the database needs to be expanded to be properly representative, and more information about art theft needs to be accessible for investigations to continue. Other literature on this area focuses on illegal trading, such as the process of market penetration by illicit goods by using the anonymity of auction mechanisms to place and buy back one’s own looted artifacts, abusing trust among the business by passing looted antiquities or fakes into the market or creating fake export papers to make antiquities appear legally sellable.¹⁰

Databases such as the Art Loss Register, created by the International Foundation for Art Research, help deter the handling of stolen art. This 31-year-old computerized network consists of over 700,000 registered items with detailed descriptions, pictures, and police reports. Its objective is to identify and recover stolen works of art, dissuade art theft, and reduce trade in stolen art by giving access to registered experts, police, insurers, the trade, and the public to a wide database of stolen works.¹¹ Similarly, INTERPOL has the Stolen Works of Art Database, in which they register descriptions and photographs exclusively provided by authorised entities such as UNESCO, while anyone can apply to become an authorised user.¹² Like the Art Loss Register, it aims to prevent the trading of stolen art and illicit markets by improving the recognition of missing pieces by the police, auctioneers, or insurance companies.¹³ The FBI’s National Stolen Art File serves a similar purpose as a national, picture-based database where lost items are submitted for entry to the NSAF by law enforcement agencies in the USA and abroad.¹⁴ The issue with the last three projects is that these only catalogue stolen artwork to prevent thieves from being able to sell it or buyers from being defrauded, and while that’s positive for deterring illegal trading, it is only a remedy for when the base crime, the theft, has already been committed. The key point in this observation is that, at this stage, the thieves already have the stolen items. Contrary to popular belief, art thieves are not usually professional criminals with a deep knowledge of the cultural industry,¹⁵ so the chance that they would be aware that these databases exist as obstacles is slim.

With this, museums run the risk of criminals still stealing just as many artworks and, when realising how difficult it is to gain a profit, destroying the pieces to get rid of the evidence, as has been done before, such as Olga Dogaru, the mother of one of the thieves that broke into the Kunsthal in Rotterdam and stole seven pieces, which she promptly burned in an attempt to protect her son from criminal liability,¹⁶ or Stéphane Breitwieser’s girlfriend and mother, who threw his grand collection of stolen artifacts and paintings at the Rhone-Rhine Canal after he got arrested.¹⁷ To avoid that, the crime needs to be stopped before the items are in the criminal’s possession through the prevention of art theft itself, and, thus, the need for further empirical research is reiterated.

This leads us to discuss the centrepiece of this study: are there common features or aspects of special relevance in the execution of museum heists? One of the most common criminological theories attributed to art theft comes from the criminologist John E. Conklin. In his book Art Crime,¹⁸ he linked the illicit act to the framework of the Routine Activities Theory, developed by Cohen and Felson in 1979.¹⁹ This theory works on the basis that a crime occurs when three conditions are met: there’s a motivated offender, a suitable target, and the absence of a capable guardian. This theory relies on the same rational choice methodology as situational crime prevention techniques,²⁰ where one can reduce a particular type of crime by adjusting various elements that affect the criminal to increase the risks and reduce the benefits.²¹ This would imply that art theft happens when these aspects actively concur. The fact that museums have to deal with creating congruence between security and accessibility that other establishments might not have to figure out opens the possibility that it might lack an adequate guardian or, in this case, an adequate range of security. Criminals might also hold the belief that art can be easily sold for large amounts of money, judging only by its legal market price, due to the general perception of art as a luxury good and the high-class atmosphere surrounding art spaces, such as its usual visitors and their attire.²² Although that is not true, and artwork’s black market prices are at an average of 7 to 10% of their open-market value,²³ lacking this knowledge might make criminals believe artworks are a suitable target. When these two aspects coexist in the same space and are recognized by a motivated offender, the probability that a crime will happen increases.

It is imperative to learn from past museum heists if we want to deter future incidents. Art, due to its illiquid nature and its price speculation potential, is a very attractive vehicle to launder money.²⁴ Much of the artwork used by criminal organisations to launder money is stolen, sometimes selling said art to another dealer or auction house, then turning around and purchasing another piece of work to hide the illicit gains they obtained from the theft of the previous piece.²⁵ Art can also be used to lessen prison sentences, and such was the case for the Galleria d’Arte Moderna Heist (Heist ID: 7), where the thieves waited until the statute of limitations for the theft had expired so they could use it as a way to lessen their sentence for other crimes in exchange for confessing the location of the stolen painting,²⁶ or The Green Vault Heist (Heist ID: 13), where the defence attorney proposed a deal in which the thieves would return the goods and confess, and, in exchange, the state of Saxony would recommend to the judge less time in prison.²⁷ While little is known about the connection between stolen artwork and unethical activities, there is considerable evidence pointing to a correlation between the two. While not all cases are necessarily linked, there has been a definite pattern of stolen art being used in the pursuit of various crimes such as fraud, tax evasion, money laundering, and more.²⁸

Nevertheless, the Routine Activities Theory has certain shortcomings that must be discussed. Although the theory posits the necessity of a motivated offender, scholars have discussed how inclinations differ among perpetrators, and these might not behave as rationally as those that ideate and implement preventative strategies.²⁹ Some contend that the deterrence of a criminal incident does not diminish the probability that a comparable offense will be perpetrated in another moment and area, and it tends to ignore the research literature that associates crime with offender characteristics such as social learning, psychology, identity, and self-esteem.³⁰ The latest iterations of the theory have corrected this by moving toward a more complex and realistic conceptualization of the perpetrator, and Felson rectified the simplistic portrayal of offenders by incorporating the effects of informal social control into the model.³¹

Methodology

The heist database

In order to understand art theft, we have to refer back to the proposed research question. This study intends to create a database through the spreadsheet editor Microsoft Excel, and while it is mainly quantitative, it also utilizes some qualitative methods of investigation such as the analysis of information sources like books, academic papers, police reports, and news reports, in the English language predominantly, albeit some articles were researched in Dutch, Italian, and Spanish. An Open-Source Intelligence (OSINT) framework was used, defined as “intelligence produced from publicly available information that is collected, exploited, and disseminated in a timely manner to an appropriate audience for the purpose of addressing a specific intelligence requirement.”³² The terms utilized in Google and Google Scholar search engines included “art heists,” “art theft,” “museum heists,” and “museum theft,” followed by the name of each of the seven continents and filtering out results published before 1990, or those that didn’t occur in museums or involve the theft of fine art.

The authors recognize that the search using Indo-European languages limits the scope of the study, and given the limited scope and self-selected nature of this sample, it is impossible to make a valid generalization about any broader population, such as the generalization that all museums operate the same way globally when analysing security measures. When considering the differences in parameters across museums, it is imperative to acknowledge the variations resulting from the unique requirements of each nation’s insurance systems. Funding for museums is often also complex and originates from a variety of resources, both public and private, as some museums are owned and run by foundations or private entities but receive public funding, and not all administrative divisions are required to provide a museum service.³³ These discrepancies tend to be rooted in disparate cultural preferences, budgetary constraints, and local regulations governing preservation efforts, all of which have an influence on the protocols for institutions. It is essential to recognize the nuances of these distinct approaches to promote cross-cultural understanding and enhance the effectiveness of museum initiatives against art theft worldwide.

Despite the existence of an international ISO standard for Museum statistics (ISO 18461 2016), providing definitions and counting procedures for all types of resources,³⁴ the classification of museums can vary significantly between nations, and the paucity of data makes cross-national comparisons contentious. Therefore, it is best to refrain from making any assumption on the generalizability of these findings. Due to the exploratory nature of the research, the authors want to once again clarify that its primary goal is not to make definitive, conclusive statements about museum heists across the world. Instead, it aims to generate insights and observations that may inform future research.

Because our understanding of art theft remains elusive, it would be unwise to make assumptions based on inadequate data. For our investigation to have any meaningful merit, it is imperative that we focus on building a more comprehensive picture of the subject matter. It is difficult to establish preconceived hypotheses, as these would largely be based on information that may or may not be relevant, and beginning with a singular theory when one does not have enough information regarding the topic being studied potentially results in a focus so narrow that it misses significant theoretical implications.³⁵ Therefore, this investigation will not make use of hypotheses that usually exist in studies of this nature, instead focusing on generating new data.

HMCD and variables to evaluate

The database takes inspiration from the aforementioned 2015 Sandia National Laboratories’ database, henceforth referred to as HMCD (Heist Methods and Characteristics Database), modified only to provide a more concentrated viewpoint. That specific study was selected due to its pure quantitative approach, as no other paper stands to provide such an in-depth empirical analysis and uses a highly detailed methodology with publicly accessible variables and information.

While the original study divides the variables into seven categories, this study will focus on five of them; 1) defeated security measures, 2) deception methods, 3) timing and target selection, 4) weapons employed, and 5) insider participation impact, which correlate to the three points that make the Routine Activities Theory. When it comes to the two categories that were excluded, resources and risk acceptance included planning time and schedule, practice runs, and testing transportation capabilities, human resources, financial risks and returns, and risk acceptance.³⁶ Such matters are hard to uncover in open-source research, as in some cases thieves have not been caught or refused to share their planning process. Consequently, enough data could not be gathered to offer significant results. The failures and mistakes category included both security failures from the museum and planning failures from the thieves.³⁷ It is a brief section where enough data could not be gathered in research to offer significant results either. For the sake of project limitation, the authors only favored the categories that offered extensive information.

With regard to the categories that were included, they are broken down into 46 variables inside the database.

The first six variables are independent of any of the categories and were created to adequately identify each heist. These include heist ID, name, type, whether the heist was violent or not, motivation, location, and target museum name. In the HMCD, another variable was included, whether the heist was successful or not, but as it seems difficult to pin down the definition of success, this study will refrain from using this variable. The motivation variable was not included in the original HMCD and was added to this database to provide criminological insight into the most common reasons why thieves might be driven to plan and carry out a heist.

Defeated security measures: includes commonly defeated security measures, security measure defeats per heist, and security forces.

Deception methods: presents the multiple types of deception used, deception methods per heist, and getaway vehicles.

Timing and target selection: this section includes the types of target environment, whether there were guard stations, the time of heist and discovery, a stolen items inventory, and whether the artwork was retrieved by the owners. These last two variables were new additions to the study, included to learn more about the average amount of stolen loot and how common it is for artwork to be returned, which could also be considered as how truly damaging a heist is.

Weapons employed: includes types of weapons and weapons used per heist.

Insider participation impact: this section includes the presence of insiders and insider types.

Offender criminal profile: comprising the number of known accomplices, accomplice genders, thieves’ citizenship, citizenship classification, and relation to organized crime. The act of co-offending can be described as a social exchange between offenders, in which material rewards from the crime or social approval is gained.³⁸ Theft in particular entails the possibility of victim resistance, and committing theft with an accomplice helps offenders overcome fear and accomplish the act.³⁹

Criteria of heist selection

The search was limited to heists occurring in museums and not private residences or places of worship, which might use different types of security and would require the need for their own studies altogether. The museums in this study fall under the definition of “(…) a not-for-profit, permanent institution in the service of society that researches, collects, conserves, interprets and exhibits tangible and intangible heritage.”⁴⁰ The cases had to involve the theft of two types of art as established by the International Foundation for Art Research (IFAR), fine and decorative; as during the initial research process, these two types came up as the most commonly stolen in museum heists. Finally, the search was limited to heists committed after 1990, as one of the intents of this study is to observe whether the rise of technologies has had a great impact on how thieves conduct heists. Geographically, it holds no limitations.

Limitations of open-source research

When it comes to quantitative methods of research in criminology, there are three main obstacles:⁴¹ much of the data is not published or made accessible to the public, the information’s level of reliability, and that the variables may not always be collected from the available sources. This study has been made acknowledging these factors as present weaknesses. To counter the first and third obstacles, the focus of the investigation was narrowed to open-source research, elaborating the variables with a mix of the pre-existing HMCD variables, which were already proven to be mostly publicly searchable, and aspects that were found available during the process of constructing the database. To counter the second obstacle, no museum heist case information comes from one single source; instead, the data was cross-checked across different sources, and only the information that appeared consistently was selected. Nonetheless, this study is best suited as a project with the capacity to be continuously modified and updated.

Results

An introduction to art heists

As a preface, Table 1 presents an overview of a few of the variables used to categorize each crime to comprehend their key aspects. Readers should take notice of the first yellow column, the heist IDs, as they will be referenced regularly going forward.

Table 1. Overview of cases (Table by author)

The six types of heists

The heists will be divided into two general types depending on the characteristics of the execution: those being 1) violent/damaging and 2) non-violent/damaging. Moreover, we can divide these two types into six subgroups, which are the same ones present in Sandia National Laboratories’ 2015 analysis. Although these subgroups do not have distinctly approved academical definitions or pertain to a globally used selection to classify types of theft, they have been chosen because they represent a broad array of strategies that thieves might utilize, from overt to covert, employing violence and/or intimidation against people or damaging property. These are necessary to offer a wide representation of the different approaches perpetrators will take so that museums can better protect themselves against art theft.

Regarding the violent/damaging group, we have the subtypes of Smash and Grab, Subdue and Seize, Deceive, Subdue and Seize, and Tiger Kidnapping:

Smash and Grab involves smashing a barrier, grabbing valuables, and then making a quick getaway without concern for setting off alarms or creating noise,⁴² and it is distinguished by overt and substantial damage toward property rather than violence toward people.⁴³ The other types involve some degree of violence against people and the incapacitation or coercion of custodians charged with protecting the targeted items. Tiger Kidnapping involves two separate crimes, the first usually involving the abduction of any person or thing someone highly values. Instead of demanding money, the captors demand that a second crime be committed on their behalf.⁴⁴

Regarding the non-violent group/damaging group, we have the subtypes of Walk Away and Stealth Raid.

In a Walk Away style of heist, thieves passively circumvent security measures without the knowledge of security forces, and, contrarily, in Stealth Raids, thieves actively circumvent security measures without the knowledge of security forces.⁴⁵

As an initial dive into the common characteristics of museum heists, in this study’s database, the Stealth Raid style predominates, with 38.5% of the analysed cases belonging to this subtype (Figure 1). Still, 52.4% of heists do fall under the general category of violent/damaging (that is, towards people and/or property) (Figure 1 in Annex). The second most common style of heist is Smash and Grab, with 28.2%, followed by Subdue and Seize, with 20.5%. Deceive, Subdue and Seize was only present in two cases, the Gardner Museum and the Pretoria Art Museum (Heist IDs: 1 and 24, respectively); likewise, Walk Away was present in two cases, the Jewish Museum and the Tretyakov Gallery (Heist IDs: 25 and 36, respectively). Tiger Kidnapping wasn’t utilized in any of the cases, and the British Museum Heist 2 (Heist ID: 40) didn’t have enough information as to ascertain the modus operandi of the thieves. Moreover, thieves’ motivations are generally driven by profit, as that was the reason for 45% of the cases, followed by commissions with 10%. Art-motivated heists are rare but appear nevertheless as 12.5% (Figure 2 in Annex).

Figure 1. Types of heists (Photo by author)

Figure 2. Offender’s gender (Photo by author)

Criminal profile of offenders

This study also made use of the data gathered for each heist to elaborate an orientative profile of art thieves.

The average amount of known accomplices that participate in a museum heist is 3,225; that is normally the average team is composed of around three people. Only in four known cases did one thief plan and act individually. The biggest team in the database was made up of eight members from the Galleria Nazionale d’Arte Moderna Heist (Heist ID: 21) (Figure 9 in Annex).⁴⁶ Figure 2 displays that the predominant gender is male, with 81.4% of the accomplices belonging to this gender, while female participation is at 1.7%. The rest of the values belong to accomplices, which security forces were unable to identify. In 57.5% of the cases where the gender was known, the criminal groups were made up entirely of men, and none was made up entirely of women.

When it comes to citizenship, 32.5% of thieves were natives of the country where the heist occurred, whereas 17.5% were foreign, and 5% were groups of thieves with both natives and foreigners (Figure 10 in Annex). Lastly, with regard to a connection with organized crime, 27.5% of the thieves had a direct connection to organized crime, 17.5% were suspected of having a connection, for 27.5% of the cases it was confirmed that there was no link to organized crime, and in 27.5% of the cases it was unknown (Annex 11). In the Bode Museum and the Green Vault Museum (Heist IDs: 15 and 13, respectively), two of the thieves present during the former in 2017 were also present in the latter in 2019, when they were still awaiting trial.⁴⁷ It is also believed that the heists in the Fitzwilliam Museum, Fondation Baur, Fontainebleau’s Chinese Museum, Drottningholm Palace, Durham Oriental Museum, and KODE Museum (Heist IDs: 23, 26, 27. 29, 30, 31, and 38, respectively) were all orchestrated by the same group of up to 16 thieves.⁴⁸

Defeated security measures

Following Sandia National Laboratories’ methodology of analysis, the security measures have been divided into four subgroups: Static Barriers, Access Controls, Detectors, and Security Guards.

Table 2 showcases ticked boxes where any of those security measures were defeated or circumvented. In the columns, the number of security measures dealt with per case are presented, while in the rows there’s the total number of times a security measure was defeated in the database. This information was obtained through open-source research, gaining insight into the crime and ticking the boxes when said actions occurred as the crime was carried out throughout multiple sources of information.

Table 2. Defeated security measures (Table by author)

The rightmost column and the last row represent the total sum of deceived security measures, color coded from the least amount in green to the largest amount in red. From this, we can conclude that the heist that deceived most security measures was the Bode Museum Heist (Heist ID: 15), while the cases that deceived the least were both the Drottningholm Palace Heist and the Tretyakov Gallery Heist (Heist IDs: 29 and 36, respectively). It is important to note that the Fontainebleau Chinese Museum Heist 2 (Heist ID: 28) has no defeated security measures because the planned heist was intercepted by the police before it happened.⁴⁹ We can also deduce that the most common defeated security measures were unarmed guards – taking into account that none of the guards present in the database were armed – followed closely by closed-circuit TV cameras, security alerts, and target barriers. None of the cases involved defeating armed guards or access credentials, and only in one case each were combinations and physical tampering sensors involved.

It is also important to underline that in 80% of the cases there was more than one measure defeated. The average of defeated measures per heist is three. Still, the database shows that for 76.9% of the cases, the circumvention equipment’s degree of specialization was rather low, mostly involving brute force and threats, and the remaining 23.1% was of medium specialization, involving deception and basic strategies (Figure 3 in Annex). None of the cases were deemed to be of a high degree of specialization.

Figure 3. Time security forces were aware of heist (Photo by author)

Furthermore, it is important to note that while practically all of the museums had guard stations inside the premises, except for two cases where there was no information available, only in 63.2% of the cases were guards on duty while the heist was taking place (Figure 4 in Annex). Figure 3 illustrates the timing of security forces’ awareness of a heist. In 60% of cases, security forces became aware during the aftermath, while in 32.5% of cases, they became aware during the theft itself. Awareness occurred at the point of entry in only 5% of cases, and in one instance, during the planning phase of the heist. However, awareness alone does not necessarily equate to the ability to react. In many cases, security forces became aware during entry or the theft but were unable to respond effectively because they had been subdued. Therefore, Figure 4 showcases when able security forces could properly respond. As can be observed, 90% of the time security forces were only able to respond in the aftermath, even if they became aware sooner. Only 7.5% of the time, they responded during the theft.

Figure 4. Time able security forces were able to respond (Photo by author)

However, it is also relevant to showcase that the time difference between the commission of the heist and the discovery in this database is 0.06 days; that is, most of the time, it is a matter of hours. Only the Whitworth Art Gallery Heist (Heist ID: 17) took two days to be discovered.⁵⁰ For the rest, the time difference was less than a day.

Deception methods

Deceptions are techniques widely used in all types of heists in all types of settings, occurring in armoured vans, hotels, airports, or banks. According to Sandia National Laboratories’ 2015 study, 91% of the cases in the HMCD involved a certain degree of deception. As Figure 5 shows, within this study, the number lowers to 52.6%. Similar to the prior section, the deception methods have been divided into three groups: physical disguises, activity disguises, and diversions.

Figure 5. Use of deception methods (Photo by author)

Table 3 presents an overview of said deception techniques, with ticked boxes to signify the use of the specific method in each case. In the columns, the number of deception methods used per case is showcased, while in the rows there’s the total number of times a deception method was used in the entirety of the database.

Table 3. Deception methods (Table by author)

The rightmost column and the last row represent the total sum of used deception methods, color-coded from the least amount in green to the biggest amount in red. It can be observed that the heists that involved the most uses of deception, particularly 3, were the Isabella Stewart Gardner Heist, the Musée d’Art Moderne de la Ville Heist, and the Rubens House Heist (Heist IDs: 1, 4, and 14, respectively). It is also important to note that a total of 19 cases did not make use of any deception, representing 47.5% of the database.

In contrast to security measure defeats, it can be appreciated here that 40% of the cases made use of only one deception method, and the average from the total sum of cases is rounded to 0.7 uses of deception per heist.

Most used deceptions involve physical disguises such as hiding age or gender, typically through the use of masks such as hoodies or balaclavas, and the exploitation of outside diversions, where international festivities or museum events work as perfect distractions. These types of common deceptions aren’t particularly intricate. The relaying of stolen goods, a potentially complex method, wasn’t used by any of the cases in the database.

Timing and target selection

With regard to the selection of when and where to commit a heist, it is important to discern absolute timing from relative timing. According to Sandia Laboratories, absolute timing refers to the time of day and month in which heists occur; that is, purely the objective qualities of time. Meanwhile, relative timing refers to the reality that was being lived at that point in time, the situation surrounding the moment the thieves chose to commit the heist, which relies on qualitative analysis.⁵¹ This section will begin by examining absolute timing matters, and relative timing will be discussed in the following segment.

When it comes to the time of day that heists are carried out the most, as observed in Figure 6, during the night is the most habitual, with 54.1% of the cases belonging to the established period from 8 pm to 6 am. Following it, during the work day is the second most common timeframe with 29.7% of cases, comprising the period from 9 am to 5 pm. Evening is the third most common, with 10.8% of the cases happening between 5 pm to 8 pm. Lastly, during the morning is the least typical, with 5.4% of cases being from the period from 6 am to 9 am.

Figure 6. Time of day heists were committed (Photo by author)

When it comes to the day of the week, we can observe in Figure 7 how most cases, eight of them, were carried out on Saturdays, followed by Sundays, and the least number of cases, just one, happened on a Wednesday.

Figure 7. Day of week heists were committed (Photo by author)

When it comes to monthly and seasonal timing, Figure 8 shows that most heists, 5 of them, were carried out during February, and the least happened in January, August, and October. It can also be observed that no heist occurred during September.

Figure 8. Months when heists were committed (photo by author)

Finally, when it comes to target selection, Figure 9 displays a clear preference for urban environments, with 60% of the cases occurring in an urban setting. The second most common is a suburban setting, with 32.5%, and the least common are rural settings, with only 7.5% of the total.

Figure 9. Environment types (Photo by author)

As for the most common type of loot, the options of fine art were divided into the subtypes of paintings, sculptures, artifacts, and jewellery for better insight.

Figure 10 shows that the primary preferred type of loot in museums is paintings, with 52.4% of the cases involving its theft. The second most common are artifacts with 33.3%. Sculptures are present in 9.5%, and lastly, jewellery is the least common, with only 4.2%. It is also important to note that three different cases involved the theft of more than one type of loot; specifically, the Gardner Museum Heist (Heist ID: 1), in which both paintings and an artifact were stolen,⁵² the Moderna Museet Heist (Heist ID: 10), where paintings and a sculpture were stolen,⁵³ and the Museo Chácara do Céu Heist (Heist ID: 20), where paintings and an artifact were stolen.⁵⁴ Therefore, it can be remarked that 85.71% of cases involved the theft of only one type of loot, most typically paintings. The average number of stolen items per theft is seven, the average value of stolen loot per heist is 55,724,901 million euros, and, in 44.7% of the cases, the items were fully retrieved by the owners. In another 39.5%, none of the items were retrieved, and in 15.8%, they were only partially retrieved (Annex 5).

Figure 10. Types of loot (Photo by author)

Use of weapons

Figure 11 shows how, in 70% of the cases, thieves weren’t armed. The other 25% constitute armed thieves, all of them with different types of firearms. As displayed in Figure 12, none made use of explosives, bladed weapons, or blunt weapons as means of intimidation or coercion towards museum staff or visitors. Coinciding with the first observation, in 71.8% of the cases, there were no innocent people coerced with violence or threats during the theft (Annex 6).

Figure 11. Use of weapons in heists (Photo by author)

Figure 12. Specific types of weapons (Photo by author)

It should also be noted that, with regard to attack types, all of them involved physical attacks, 25% involved attacking personnel, and none of them involved any type of cybercrime. The 25% of personnel attacks were also all in conjunction with physical attacks (Annex 7).

Lastly, none of the guards present during the heists in this database had any weapons.

Insider participation impact

Figure 13 displays a lack of insiders in the majority of the heists in this database, with only 15% having the confirmed presence of an insider. Another 5% is attributed to cases in which participation is highly suspected, but cannot be proved. Finally, in 30% of the cases, it was unknown whether there was or wasn’t an insider involved. This leaves 50% of the cases where thieves did not make use of insiders to carry out a museum heist.

Figure 13. Insider participation (Photo by author)

In the circumstance that an insider was involved, or of suspected involvement, Sandia National Laboratories identifies five different types of insiders: coerced, planted, recruited, opportunistic, and unwitting. In this study’s database, the most common type was a recruited insider, which appeared in 42.8% of the cases. The second most common types were planted, coerced, and opportunistic insiders. There were no cases where insiders were unwitting. (Annex 8).

Discussion

Defeated security measures

Table 2 displays a tendency toward the defeat of static barriers and detectors. As mentioned previously, none of the guards in any of the cases were armed, and, despite a major number of thieves not being armed either, the defeat of security guards is present in most cases and is the security measure most commonly defeated. Table 4, which shows the methods thieves used to defeat said security measures in a more detailed manner, shows the three most common methods to defeat security guards. The most widely used was to threaten them with weapons and then subdue them or lock them in other rooms, which resonates with a Subdue and Seize style of heist. The second was the avoidance of contact with guards, a method mostly used in Stealth Raids, in which thieves purposefully attack in areas where guards will not be aware. Lastly, the third consists of acting faster than the guards can react, which can be seen in the majority of Smash and Grabs, where thieves place priority on a quick attack rather than going unnoticed. As it can be appreciated, thieves have found ways to counter the active security measures that are guards in multiple ways, both confronting them and avoiding them. These are methods that have proved to be successful and showcase that the simple presence of a security guard is not enough of a deterrent to prevent art theft.

Table 4. List of defeat methods (Table by author)

It is worth noting that, in the case of detectors such as motion detectors, infrared sensors, physical tampering sensors and security alerts, the key to rendering them useless was not through finding ways to disconnect or circumvent them; rather, thieves were faster stealing the pieces than the sensors alerting security forces and those getting to the museum. This is backed by Figures 3 and 4, which show that while security forces can become aware of a heist during the process, a big majority are only able to properly react in the aftermath. As for CCTV cameras, most thieves also preferred to hide their identities rather than disconnect cameras. This could be linked to the lack of cyberattacks in the database, as, rather than hacking into the museum’s security systems to disconnect detectors, thieves chose a combination of brute force and identity masking to prevent these from proving helpful. These showcase that most thieves are not afraid to trigger alerts and will do so consciously with a strategy to act fast. Other methods of countering detectors include the Bode Museum Heist (Heist ID: 15), where thieves timed the attack within the timeframe when the guard was doing rounds around the museum because he would disconnect the sensors. As the guard carried a flashlight to check areas, thieves were aware the guard was doing rounds by checking the museum’s windows for flashing lights.⁵⁵ In the case of the Gardner Museum Heist (Heist ID: 1), thieves acted as police officers arresting guards to move them away from the panic button under the desk.⁵⁶ Other methods relate to threatening guards and staff to disconnect detectors or noticing beforehand that these were already faulty. The Musée d’Art Moderne de la Ville Heist, the Kunsthal Rotterdam Heist, The Green Vault Heist, the Rubens House Heist, the Fitzwilliam Museum Heist, and the Fondation Baur Heist (Heist ID: 4, 5 13, 14, 24, and 26 respectively) involved the thieves visiting the museum days prior to the theft and surveying the security measures in place.^{57, 58, 59, 60, 61, 62}

It should be highlighted that museums face ample difficulties when it comes to budgeting for security.⁶³ Security in museums is rather lax and lacking in comparison to other common places to steal from, and it should be expected that thieves will also be aware of that fact, making museums a suitable target. In the Museu de Arte de São Paulo Heist (Heist ID: 8), security was incredibly neglected; they lacked an alarm system and sensors. They had video security cameras, but since they had no infrared capability, the images were too obscure to properly identify any of the thieves.⁶⁴ In the Gongju National Museum Heist (Heist ID: 37), infrared sensors weren’t being maintained properly, there was no CCTV in the exhibition room,⁶⁵ and in the Kunsthistorisches Museum Heist (Heist ID: 33), the thief, a security alarm specialist, decided to steal from the museum because, days prior, he attended a tour of it and took notice of the poor security.⁶⁶ Even if control theories such as Foucault’s panopticon theory prove that the simple presence of a surveillance camera might deter a percentage of undesired activity,⁶⁷ if thieves are already willing to be detected for the sake of a fast attack, the mere presence of surveillance will never be deterrent enough.

The degree of specialization is worth discussing as well. A big portion of the database involved a low degree of specialization, that is, using brute force, direct threats, or basic avoidance techniques, with no use of complex strategies. Those cases with a medium degree of specialization involved visiting the museum beforehand, using deceptions, ideating basic strategies or planning, or using innovative methods to gain possession of the targets. One example of the latter would be the Henry Moore Foundation Heist (Heist ID: 19), in which thieves used a crane to lift a two-ton sculpture into a flatbed truck.⁶⁸ A clear preference for simple yet effective methods to steal can be observed, even with cases occurring in the past decade, when the reach and power of technologies became increasingly more advantageous.

Deception methods

When it comes to the methods applied to deceive both active and passive security, Table 3 shows a preference for physical disguises and diversions against activity disguises, which were scarcely used. The most common deception technique was disguising age or gender through masks, hoodies, or balaclavas. This measure has proved to be highly successful in hiding the thieves’ identity, as the majority of times thieves were caught not because they were identified by cameras, but because they attempted to sell the loot afterwards. This means, in the instances where thieves steal art for personal enjoyment or as a commission to an already established buyer, the chances of identifying the thieves could lower significantly.

The second most common technique is the use of outside diversions, which is also related to relative timing selection. Table 5 shows the deception techniques used in greater detail and displays that, for the Gardner Museum Heist (Heist ID: 1), thieves most possibly chose the night after Saint Patrick’s Day to enter the museum with the excuse of fake altercation complaints.⁶⁹ In the Norway National Museum Heist (Heist ID: 3), thieves chose the day of the Opening Ceremony of the XVII Olympic Games because most police would be focused there, and it would take longer for them to react.⁷⁰ For the Galleria d’Arte Moderna Ricci-Oddi Heist (Heist ID: 7), thieves chose the day a lot of paintings were being moved and packaged since the museum was being renovated, and it would take longer for staff to notice the missing painting, assuming it was in storage.⁷¹ For the Museo Chácara do Céu Heist (Heist ID: 20), thieves chose the first day of Carnival celebrations to hinder police efficiency and so there wouldn’t be many people in the museum.⁷² All of this proves thieves take into account the situation surrounding the theft to increase their chances of success by avoiding a quick police response or being surrounded by a lot of people, and, for that reason, museums should be on the lookout specifically during special celebrations or occasions, even at a national level, that will get the police’s and the general public’s attention away from museums.

Table 5. Deception methods list (Table by author)

Nonetheless, it is worth noting how, in comparison to the defeat of security measures, thieves do not tend to make use of a lot of deceptions. The degree of complexity is not particularly high either, with the outliers being the only two cases in the database to use a Deceive, Subdue and Seize style of heist: the Gardner Museum Heist (Heist ID: 1), dressing up as police officers to fool the security guards,⁷³ and the Pretoria Art Museum Heist (Heist ID: 24), pretending to be art students on a school trip.⁷⁴ In the Musée d’Art Moderne de la Ville Heist (Heist ID: 4), thieves changed the window screws for clay alternatives days prior and triggered the motion detectors and walked out beforehand to see if police would react,⁷⁵ and in The Green Vault Heist (Heist ID: 13), thieves climbed a wall two nights before to cut a hole in an iron grille that protected a corner window, and taped back the piece to make the grille seem intact until the theft. A day before the heist, they strolled through the eight rooms of the exhibit.⁷⁶

Timing and target selection

When it comes to the selection of when and where to commit a heist, a rough observation can be made by observing Figures 6, 7, and 8, where it can be stated that the most likely time frame for the commission of a heist is in the periods of 8 pm to 6 am, on either Saturday or Sunday, in the months of February to June. Since 70% of cases occurred in Europe, this would correspond to the duration of spring in the global North.

As for the preferred environment, it is important to highlight that while an urban setting was clearly predominant and a rural setting was hardly ever targeted, that could be related to the placement of the museums per se and not the thieves’ preference. Naturally, museums will choose metropolitan and easily accessible areas to establish their business, which correlates to urban and suburban settings the most, therefore the high number of heists in urban areas could be due to the fact the majority of museums are placed there.

For relative timing, various thieves in this database took advantage of the situation surrounding the heist as a diversion so their chances of success would increase by lowering the number of witnesses and the agility of police response. Likewise, the fact that more than half of the cases occurred at night also implies that thieves tend to prefer situations where there aren’t many people. Another detail worth considering is the timeframes when targets become more desirable. The Galleria d’Arte Moderna Ricci-Oddi Heist (Heist ID: 7) happened soon after an art student noticed that Klimt’s The Lady featured the same pose as the artist’s Portrait of a Young Lady, which hadn’t been seen since 1912. It was uncovered that the second painting was layered over the first, gaining a lot of attention from the media, and the museum arranged an exhibition focused on this piece.⁷⁷ The Kunsthal Rotterdam Heist (Heist ID: 5) happened only nine days after its Avant-Gardes exhibition opened, featuring 150 works by masters of modern and contemporary art owned by the Triton Foundation, which had never before allowed so many of its paintings to be exhibited together.⁷⁸ In the Musée d’Art Moderne de la Ville Heist (Heist ID: 4), thieves included one more painting to their loot after it was known that a Léger had been recently insured for 4 million euros.⁷⁹ Although there are not enough cases to be called a pattern, it is worth considering increasing security measures when exhibitions are being held or news is spread. The key point is that constant surveillance is essential, especially during low-bystander activity and when the museum might be the centre of attention.

Use of weapons

Whilst the use of weapons is not the norm in heists, as can be seen in Figure 10, it is important to note that all uses of weapons included different types of firearms, but no blunt or bladed weapons or explosives. Namely, the most commonly used weapon was a handgun, perhaps because its small size proves easy to conceal in bags or under clothing, yet still works just fine as a means of intimidation. In all cases, the weapons were used to pressure mostly staff, and sometimes witnesses, to comply with the thieves’ orders, yet they were rarely fired. None of the cases in this database involves the death or severe physical injury of either witnesses or thieves during the course of the theft, which could indicate thieves want to avoid causing irreversible harm to people, as then their crimes could escalate into more serious offences.

With regard to attack types, it is worth noting that there were no cyberattacks. A surprising aspect, as over half of the heists in this database occurred no later than the 2000s, once technologies began to exponentially evolve. Indeed, since this type of artwork is physical, a physical attack will always be needed, unlike in cases where money is stolen entirely online. However, the use of cyberattacks to take down security measures or as a way to gain access to passwords, blueprints, future events, or security maintenance information would all prove helpful to increase the chances of success, even revoking the need for an insider. As it appears, thieves prefer traditional methods of theft over sophisticated uses of technology.

Insider participation impact

We cannot establish that insider participation is the norm in museum heists. Although certainly present and suspected in various other cases, there seems to be a certain level of difficulty in establishing whether insiders were used or not. There are plenty of cases where the thieves’ insight on the building layout, the security patrol timings, and the placements of artwork seem to indicate the presence of a knowledgeable insider, and it is to be expected that the contribution of one would greatly increase the chances of success. Yet, unless they are planted, opportunistic, or unwitting, the dangers of being betrayed might be too high to risk.

Out of the cases where there was an insider, the most common was a recruited one; that is, the thieves contacted someone already working in the establishment. Even being one of the riskier types of insiders, it is also the most convenient. Unwitting, coerced, and opportunistic insider participation is left up to chance, and thieves cannot plan around them. Planted insiders require months or perhaps even years of planning; the person should not have any previous alarming criminal records, and they would need to successfully get a job in the targeted establishment. Therefore, when deciding to use one, thieves seem to favor the high-risk/high-reward method of using recruited insiders.

Conclusion

To conclude and recapitulate, the findings of this study showcase that:

1. 1. Thieves mainly defeat security measures through brute force rather than using complex or technological methods. They might be willing to trigger sensors for the sake of a quick attack, and they’ll typically defeat or circumvent an average of four different measures. The presence of security guards and poorly kept sensors are never enough to deter art theft.

2. 2. Deception is a standard for art heists, although it doesn’t tend to require complex strategies or diversions. Thieves will make use of disguising their age and gender through masks and hoodies to hinder identification and will take into consideration outside events to increase their chances of success by lowering bystander numbers and preventing a swift police response.

3. 3. Although we can discern a slight pattern of museum heists increasing in colder seasons and occurring in the timeframe of 8 pm to 6 am, absolute timing characteristics tend to follow a uniform pattern. Urban settings are most commonly attacked. The average amount of loot stolen per heist is 5 pieces, habitually paintings.

4. 4. The use of weapons is not the norm in most heists, yet in the cases where thieves are armed, they use firearms such as handguns. Attacks are physical, some of them involving personnel as well, and none of them are cyberattacks. In all cases, neither thieves nor witnesses suffered from severe injuries or death.

5. 5. Insider participation is also not the norm in most heists. When there is, recruited insiders are most common, signifying that thieves prefer to take the route of high risk/high reward when it comes to obtaining information about the targeted establishment.