The New DOJ Law Enforcement Crypto Reports (TL;DR)
TL;DR? Good news! I’ll read them to you!
On 15 September 2022, the Ministry of Justice released its report “The Role of Law Enforcement in Detecting, Investigating, and Prosecuting Criminal Activity Related to Digital Assets” (66 pages). The first of the nine reports ordered by President Biden’s Executive Order 14067 “Ensuring Responsible Development of Digital Assets” was also released by the DOJ on June 06, 2022, “How To Strengthen International Law Enforcement Cooperation for Detecting, Investigating, and Prosecuting Criminal Activity Related to Digital Assets” (58 pages).
Since then, we have seen the Treasury Department release three reports:
Treasury also provided the White House in July with a “Framework for International Engagement on Digital Assets” described in their press release, but not made public.
Earlier this month, the Department of Commerce released its report:
“Responsible Advancement of US Competitiveness in Digital Assets” (19 pages).
The Office of Science & Technology Policy also released three reports:
In this blog post, we will focus on the two DOJ reports, which we will address in reverse order of release, as it seems necessary to define the role of law enforcement in digital assets before discussing international cooperation. would search in this area.
The role of law enforcement in digital assets
- financial transactions related to the commission of crimes, such as the purchase and sale of drugs or weapons, leasing of servers used in the commission of cybercrime, obtaining funds to support terrorist activity, or ransom, blackmail and extortion.
- money laundering and shielding legitimate activity from tax, reporting, sanctions or other legal requirements, including operating unlicensed, unregistered or non-compliant exchanges.
- crimes, such as theft, that directly implicate the cryptocurrency market itself, such as stealing cryptocurrency from exchanges or defrauding unsuspecting investors.
The original report listed many case studies involving prosecutions, seizures and arrests in the above scenarios, including SamSam ransomware, Welcome to Video and DarkScandal’s child sexual abuse services, terrorist financing both through direct donation and through the sale of fake medical equipment (PPE under COVID ), The Bitcoin Maven case (Theresa Tetley), BTC-e, Operation DisrupTOR (Wall Street Market), DeepDotWeb, DreamMarket, Lazarus group hacks, HeroCoin ATMs, the Helix mixer and others.
The new report points to something I have also recently mentioned. Bitcoin and other blockchain-based cryptocurrencies are neither the first digital currency, nor the first to facilitate much criminal trade. The report mentions E-Gold (1996) and Liberty Reserve (2006) as “pre-crypto” examples of digital currencies, but might as well have mentioned Webmoney (1998) or PerfectMoney (2007). Many of the points in the new report echo the previous ones, although the cases have been updated, such as Bitfinex, Helix and Hydra Market, estimated at one point to perform 80% of all darknet transactions in the market, and Garantex , the Estonia-based exchange which laundered more than $100 million of the funds associated with darknet markets. The Colonial Pipeline ransomware and the use by accused GRU agents of bitcoin, the theft of $600 million by Lazarus Group hackers in March 2022 are all used to update the original report.
Part II of the report discusses DOJ efforts such as the National Crypto Enforcement Team (NCET) and its predecessors, such as the Money Laundering and Asset Recovery Section Digital Currency Initiative, and the International Virtual Currency Initiative. A few interesting statistics from the FBI, including that as of July 2022, the FBI had conducted 1,100 separate investigations across 100 investigative program categories involving a digital asset nexus. Since their first seizure of digital assets in 2014, the FBI has seized $427 million in virtual assets (as valued at the time of the seizure.) In February 2022, the FBI created the Virtual Assets Unit. The Department of Justice has also established a Digital Asset Coordinators Network composed of designated prosecutors in US attorneys’ offices across the country who work closely with CCIPS, MLARS, and NCET. The program is based on the successful CHIP Network (Computer Hacking and Intellectual Property) and the National Security Cyber Specialist (NSCS) Network which each designate prosecutors in each field office to be specially trained and equipped to handle the relevant case types for their office.
Regulatory agencies also play their role, with FinCEN working to enforce Bank Secrecy Act (BSA) guidelines and regulations related to anti-money laundering and counter-financing of terrorism (AML/CFT) requirements. Treasury manages the OFAC office, which includes sanctions crackdowns and government-sponsored cryptohackers. The SEC regulates crypto scams structured as “investment contracts, such as BlockFi Lending LLC or the DeFi Money Market. The Commodity Futures Trading Commission (CFTC) regulates the trading of commodities in interstate commerce. They have filed 50+ enforcement actions against organizations such as Coinbase, Payward Ventures (Kraken ), Blockratize (Polymarket). BitMEX is a cryptocurrency derivatives exchange targeted for CFTC enforcement after $209 million in darknet market transactions were paid through BitMEX, which paid a $100 million fine, with three co-founders pleading guilty to criminal charges and paid a $10 million fine.
A recent organization of note is IVAN, the Illicit Virtual Asset Notification platform, which is being built by FinCEN and the FBI’s National Cyber Investigative Joint Task Force. The goal of IVAN is to be a public-private information exchange to allow industry to collaborate on the timely detection and disruption of the use of virtual assets to promote illegal activity.
Inquiries about legislation
The justice report makes several requests for additional legislation, in five categories:
- extend the subpoena disclosure ban (currently applicable to financial institutions) to VASPs (Virtual Asset Service Providers), strengthen laws against operating an unlicensed money transmission business, and extend the statute of limitations from 5 to 10 years for certain crimes.
- support for initiatives that will help investigators gather evidence
- strengthening the sentencing guidelines for certain BSA violations
- extend the BSA registration rules to VASPs
- ensure that law enforcement has the resources to conduct and staff sophisticated digital asset-related investigations.
International considerations
One of the main observations of the report on international law enforcement cooperation is the standard complaint that mutual legal assistance treaties are too slow, and that faster methods of international law enforcement cooperation, such as the “24-7 network” often do not have a standard way to share requests regarding the Virtual Asset Service Providers. (VASPs).
Although cybercrime laws may not have caught up, the international body that deals with Anti-Money Laundering, the FATF or Financial Action Task Force, are clear thought leaders on the guidelines for virtual assets. (We wrote about the FATF in 2019, see: Money Laundering and Counter-Terrorism Financing: What is the FATF? ) Unfortunately, as of July 2021, only 35 participating nations had implemented the FATF proposals regarding virtual assets and VASPs in their national promises.
My favorite part of the “Strengthening International Law Enforcement” report is Appendix B: “Examples of Successful Cross-Border Cooperation on Digital Asset Investigations.”
Liberty Reserve
BTC-e
Helix
The Silk Road
Operation Bayonet (AlphaBay and Hansa)
Dream market
Wall Street Market
DeepDotWeb
Welcome to video
Operation DisruptOR
Hydra market
Twitter hack
Sodinokibi/REvil Ransomware
NetWalker Ransomware
BitConnect
*** This is a Security Bloggers Network syndicated blog from CyberCrime & Doing Time written by Gary Warner. Read the original post at:
