Comment by bee_rider

I’d say 2 is the one doing the actual crime. 1 might be violating their contract with 2, though.

3 and 4 are not involved.