Seven years ago, during a night of rioting in London, a 23-year-old student popped into his local Lidl and carried out the “opportunistic” theft of a £3.50 case of bottled water.

He was sentenced to six months in jail. There was an outcry, but he still went to jail. The law was the law. And justice – though punitive and disproportionate – was served.

But that was petty crime. What if the crime is bigger? Much bigger. Too big, possibly, to reckon with. Because last week we discovered other laws may have been broken. Not crimes against a person, or a property, but against our democracy. Crimes that may have been committed by the Vote Leave campaign during the EU referendum. On Wednesday, Matthew Elliott, the CEO of Vote Leave, the campaign headed by Boris Johnson and Michael Gove, both now government ministers, took the extraordinary step of leaking the interim report of an Electoral Commission investigation which is still under way.

This found the campaign guilty of breaking electoral rules and law. Laws which are the bedrock of our entire electoral system.

The timing of the release of this – after midnight, on the night of a World Cup match – an apparent attempt to influence the reporting of an investigation that hasn’t yet concluded raises many questions.

But what Elliott couldn’t spin was this: according to his own account of the report, Vote Leave, the official referendum campaign that was partly funded with taxpayers’ money, looks to have committed what may be one of the biggest incidents of electoral fraud in Britain in more than a century. Back in March, when the Observer reported on compelling new evidence provided by Shahmir Sanni, a Vote Leave whistleblower, Gavin Millar, a QC at Matrix Chambers, an expert in electoral law, told us that this was of a scale and seriousness that simply hasn’t been seen in Britain in modern times.

Arguably, you need to look to the 19th century to find a parallel – a deliberate, premeditated overspend of nearly 10% of the entire campaign budget. But what we saw in the referendum surpassed what happened then in sophistication and complexity, if not scale. Because more than a century ago, a series of hugely corrupt elections led to a reform of our electoral laws: laws designed to control spending in our elections and which – with some updates – have largely stood to this day. But which simply no longer work.

Two weeks ago, the Electoral Commission announced that “urgent action” needed to be taken, that it couldn’t regulate online campaigning, that radical new laws were desperately needed. It’s a huge step forward in terms of safeguarding future elections. But we don’t have these new laws yet. We have the old ones. A feeble legislative framework with almost no powers to compel evidence and the capacity to impose only tiny fines.

Because what the Electoral Commission didn’t say is that the powers that it now admits are inadequate are the same ones it is using to investigate alleged Vote Leave spending and other offences by other campaigns. Multiple offences. Because the investigation into Vote Leave is just one of a number of ongoing inquiries into potential crimes. Many of which were facilitated by new technology. By the tech platforms. By – above all – Facebook. Because – and this is the key point – this is an election that took place in darkness.

Campaigning has moved online, into the black boxes of the tech platforms, where it’s unseen, unaccounted for. And we have no idea which adverts were shown to which people. How people were targeted, and what data it was based on. We don’t know how much money was spent on which ads by whom or even in which country they were based. We don’t know what lies were told to whom, by whom (though we know there were lies told, an Observer investigation proved that).

Facebook Twitter Pinterest Christopher Wylie reveals the extent of Facebook’s involvement in the data breach in the Observer, 18 March this year.

We know none of this. What we do know, however, is that Facebook knows. It’s just not telling us.

The parliamentary inquiry into fake news has summoned Mark Zuckerberg four times to answer these and other questions and four times he has refused. Many of the answers we need are on Facebook’s servers. But it’s not giving us them. Damian Collins, the Tory chair of the committee, has repeatedly said that Facebook’s behaviour is unacceptable and his committee has threatened a standing warrant, an order to arrest Zuckerberg the next time he steps on British soil, for contempt of parliament.

Take stock of that: this is a foreign company that has apparently facilitated crimes – what Vote Leave announced last week were crimes – but refuses to answer to our parliamentarians.

We can’t hold Facebook to account, and our institutions are struggling to hold British campaigners and donors to account, but we can catalogue an ever-growing list of potential crimes and misdemeanours. Because what’s become apparent is that the referendum is where dark money met dark data.

Official investigations under way so far include: overspending by Vote Leave, overspending by Leave.EU, coordination between Vote Leave and BeLeave, the source of at least £12m in donations in gifts and loans by Arron Banks’s company to Leave.EU, the use of data by all campaigns including the role of Cambridge Analytica, its Canadian affiliate, AIQ and Banks’s Eldon insurance company. In addition, there are also pressing and urgent questions about – but no official investigation into – the source of a donation made to the DUP.

And there is the extraordinary and shocking evidence that the Observer has recently unearthed about Banks’s connections to Russia. We know that Banks has lied about his relationship to the Russian government, we know – he has admitted it – that he was offered financial and other inducements by individuals connected to the Russian government, and we have his word that he didn’t take them. But Banks’s word is a debased currency. Today, we report that we have seen documents which suggest he had at least 11 meetings with Russian government officials, seven more than he has previously admitted.

There’s no confirmed investigation into this. Other inquiries have been woefully underpowered and hopelessly delayed. When a 15-month investigation by the Electoral Commission finally found Leave.EU guilty of multiple breaches of electoral law in May, Liam Byrne, Labour’s shadow digital minister, told the Observer that the delay in referring the matter to the police was “catastrophic”.

Facebook Twitter Pinterest Brexit campaign donor Arron Banks, right, and Leave.EU campaigner Andy Wigmore arrive to give evidence to a parliamentary committee. Photograph: Daniel Leal-Olivas/AFP/Getty

In America, where journalists have been at the frontline of what has felt like a state of emergency since November 2016, there has been no doubt about what the Observer’s revelations concerning the main Brexit funder’s relationship to Russia means.

No investigation into this has even opened yet. And the one that has been started by the Electoral Commission, looking into Banks’s finances and whether his holding company “was the true source of donations made to referendum campaigners”, is probably a lost cause.

This is the biggest donation ever made in British politics – at least £12m in gifts and loans – and it’s being investigated by an underpowered body staffed by civil servants with few if any powers. It’s seeking to disentangle a vast web of complex finance structures many of which lead to offshore jurisdictions. It doesn’t have the specialist investigators or powers required to even attempt this. It hasn’t referred the case to a statutory body that could. Justice is not being served.

And if evidence of wrongdoing is uncovered, it will all be too late. By the time any of these investigations is referred to the police, who then have to conduct their own inquiries before deciding whether to bring charges, Britain will have exited the EU.

The only ray of hope is Elizabeth Denham, the UK’s Canadian information commissioner. She’s about to announce the findings of an inquiry – triggered by a report in the Observer in February 2017 – into the use of data in digital campaigning that has become the biggest ever data protection investigation, anywhere, employing more than 60 people and liaising with law enforcement bodies around the world including, it is believed, the FBI. Denham has been vocal in her view that “data crimes are real crimes”.

Data crimes are real crimes. And electoral crimes are real crimes too. It’s vital we remember that our laws are the thin tissue between the world we know and the world we don’t want to be. Because without electoral laws, without respecting them, policing them, safeguarding them, we slip towards becoming another Russia, or at least Turkey.

What has become clear in the nearly two years that I’ve been reporting on this story is that the law will not save us. The laws didn’t work. The regulators couldn’t regulate. The system – built on self-regulation and self-policing – failed. It relied upon goodwill and trust and in the face of a one-off, bitterly divisive issue, that goodwill and trust dissolved. We went into the referendum with the equivalent of Dad’s Army and a couple of vintage rifles to protect us from a hostile new world of data manipulation, black-box platforms and advanced cyber-warfare techniques harnessed by hostile foreign powers.

But this isn’t just a legal or a regulatory failure. It’s a political failure. It’s on the government. It’s on an opposition that is failing to hold the government to account.

The overspending scheme that Shahmir Sanni so compellingly came forward to tell the Observer about – that Vote Leave’s CEO said they’d been found guilty of – involved two of Theresa May’s ministers and two of her closest advisers. Another scandal, uncovered by BBC Northern Ireland last week, involves the party that holds the balance of power in her government: the DUP.

Theresa May came to power off the back of this election. She holds power because of it. Her entire political agenda is based on pushing through the result of it. She will receive weekly briefings from the security agencies about threats to our democracy. But she cannot be trusted to safeguard it. We need questions asked of ministers. Of the prime minister. We need a proper police-led investigation by the National Crime Agency or a similar authority with proper powers capable of investigating complex fraud, offshore finance, Russian subversion techniques. And we need to be not OK with any of this.

You’re looking for a smoking gun but there’s a smoking gun on every table! And no one cares. No one cares! Arron Banks

In the week that article 50 was triggered, in March last year, I met Arron Banks at an investment show held by his friend, the Isle of Man investor Jim Mellon – and Banks told me he held a Belize diplomatic passport, which he now denies. He said that he used his Leave.EU database to promote his insurance products – illegally – which he now denies. And that he didn’t “give a monkey’s what the Electoral Commission says”. His defence? “We were just cleverer than the regulators.”

At the end of the afternoon, he gave me a lift in his chauffeur-driven car and told me in drunken exasperation: “You’re looking for a smoking gun but there’s a smoking gun on every table! And no one cares. No one cares!”

He’s right. There are smoking guns all over the place. But he’s also wrong. Hundreds of thousands of people care. All over social media, people – who have been vocal in support of this investigation – care. Backbench politicians care. This news organisation that has put editorial and legal resources into this story over many, many months, cares. Ordinary voters who feel deceived care.

We care. We just have no idea what to do about it.