I'll also add that you would usually want this to be a civil matter. First, because the standard of proof is far lower ("preponderance of evidence" vs "beyond reasonable doubt", i. e. 50% vs, say, 95%), making actual consequences far more likely.

Secondly, you are more likely to get whistleblowers if you focus on punishing organisations and not individuals.

Thirdly, these really are, almost always, actions by organisations undertaken in a sort of collective delusion, where everyone believes their actions are ok because they see so many others participating in it. None of these people would ever murder someone outright. That they happily do so as a group, thousand times over, needs to inform our reaction: it is a systemic failure, a group dynamic gone awry. Treating it as anything else only diminishes our chances to prevent future cases.