DIGITAL FUTURES PROJECT Follow the Money: Civilizing the Darkweb Economy
Total Page:16
File Type:pdf, Size:1020Kb
DIGITAL FUTURES PROJECT November 2017 Follow the Money: Civilizing the Darkweb Economy By Tom Kellermann, Global Fellow Introduction Digital payment systems and financial services have the global financial system has not been without its become an essential part of modern technological share of problems. The growing use of cyber as a infrastructure, growing exponentially over the past domain for financial activity has inherently expanded three decades and continuously innovating to meet the potential attack surface for would-be cyber crim- the demands of the international financial system.1 inals and the World Economic Forum now estimates These systems and services have already revolu- that the cost to the global economy due to cyber- tionized payments in many parts of the world. Re- crime is roughly $445 billion a year.3 search indicates that widespread adoption and use of digital financial services could provide access to Yet despite this increased potential for wrongdoing, an additional 1.6 billion unbanked and underbanked the pervasiveness of cybercrime that we observe today is not inevitable. Rather, this modern epi- people.2 By 2025, this could increase the GDPs of demic of cybercrime is sustained via the transfer of all emerging economies by 6 percent, or a total of capital associated with virtual currencies. $3.7 trillion. While many digital services implement Anti-Money Despite the real utility that such innovation has Laundering (AML) and Know Your Customer (KYC) delivered, however, the increasing digitization of DIGITAL FUTURES PROJECT November 2017 protocols, criminal entities have demonstrated to successfully transport the illicit goods and ser- innovative rigor in their efforts to continuously abuse vices around the world. The goal of this report is to the loopholes and take advantage of selective en- “civilize” one leg of the stool—the utility of financial forcement and defensive vulnerabilities that plague vehicles to allow for the exchange of illegal goods the financial services sector today. The international and services and the application of AML practices to financial system is constantly facing new threats as curb cybercrime. technology proliferates and diversifies. Increasingly, Before launching into individuals and syndicates use these systems to by- potential policy prescrip- Digital currency is pass traditional indicator and warning systems relied tions, however, in order upon by regulators and law enforcement. Accord- distinct from common to properly understand ing to a recent FBI statistic, “three in four money mediums of exchange why virtual currencies laundering cases involve digital currencies.”4 While are central to the in- because it is not fund- digital currency is still a relatively specialized mar- creasing prevalence of ket, one continuous issue has been the increasing ed by a central bank cybercrime and the seri- number of security breaches and thefts on digital or government. ous financial implications currency exchange platforms.5 This is because there of this, it is useful to are few cryptocurrency exchanges that perform KYC conceptualize what is meant by “digital currencies” procedures and basic security checks, both of which and to examine innovation in the realm of virtual have been commonplace protocols in major ex- currencies and the underlying technology involved changes for over a decade.6 Money laundering can in payment systems. easily take place in these virtual environments, as they can provide high levels of anonymity and low levels of detection. Digital Currencies 101: Money laundering through digital currency and payment systems is just one example of illicit Digital currency is defined as “digital certificates of activity online. Other criminal markets include child ownership of real currencies or precious metals, pornography, weapons and drug sales, hackers and with the digital certificate being the virtual curren- murder for hire, zero day exploits, and false identity c y .” 8 Digital currency is distinct from common medi- documents. The advent of these criminal markets ums of exchange because it is not funded by a cen- enabled by anonymous virtual currencies have creat- tral bank or government. The borderless features of ed a global bazaar for criminals and organized crime the Internet allow this privately issued currency to to reach a mass global market.”7 complete instantaneous transactions worldwide. In regard to digital currency, there are generally two Collectively, these digital infrastructures represent main types: centralized and decentralized. a “3-legged stool” of illicit activity: it allows for the storage of illicit goods and services, it provides Centralized digital currency is stored in a central utility of financial vehicles to allow for the exchange repository, where users can exchange the digital of goods and services, and it develops techniques currency with other account holders.9 When con- DIGITAL FUTURES PROJECT November 2017 Definitions • Virtual Currency: As defined by FATF this includes cryptocurrencies like bitcoin, but also a range of other digital payment systems like the Russian’s WebMoney, the Chinese AliPay, and PayPal as well as many others. • Dark Web: An Internet within the Internet of mainly anonymous sites which include many criminal markets and forums. Accessible through easy to obtain special software. • Deep Web: Password protected and unindexed sites on the regular Internet which in- cludes many criminal sites and forums. • Darkweb: A term which collectively includes the criminal and terrorist sites on the Deep Web and the DarkWeb defined above. • Exchanges: Serving to exchange fiat currency (dollars, euros….) for Virtual Currencies like bitcoin, WebMoney, stored value cards and many others these exchanges are currently regulated in the United States and some other countries. They are the key choke point in the use of these systems for illegal purposes. verting conventional currency into digital currency, itor and verify the creation and transfer of digital these central repositories typically partner with currency between users.12 A log is maintained of currency “exchangers,” who are responsible for the every transaction between users, which is updated conversion. A large quantity of digital currency is by user machines participating in the mining of this purchased from the central repository by the ex- currency. changers, who then credit the account holder after receiving the conventional currency. When account Since their creation, Internet-based virtual currencies holders wish to convert their digital currency to a such as bitcoin, the Chinese AliPay and Russian Web- conventional currency, a reverse transaction is car- Money systems have appreciated with incredible ried out back through the exchangers. speed. Bitcoin’s capitalization is $100B globally, while WebMoney possesses that value in Russia alone. Decentralized digital currency, the most well-known of which is Bitcoin, has no central monetary author- ity and is instead exchanged through a peer-to-peer Modernizations of Money Laundering payment system consisting of its users’ computers and devices.10 This means that the digital currency and Virtual Currencies is a direct exchange, and there are no intermediar- Virtual currencies, alternative payments, and remit- ies. The digital currency is generated, or “mined,” tance systems have been major economic forces by a mathematical algorithm on computers which for the more than 3 billion people living in underde- can execute complex number-crunching tasks.11 The veloped societies around the world.13 One of the network of user computers is used to both mon- DIGITAL FUTURES PROJECT November 2017 most significant aspects of these payment systems money laundering schemes are estimated at 2% to is that they “are part of a thriving ecosystem of not 5% of global GDP, or roughly $1-2 trillion annually only virtual currencies but also other digital, mobile and estimated in the United States at $300 billion in and stored value systems that cumulatively number illicit proceeds.”19 in the thousands.”14 The ecosystem is revolution- izing payment capabilities through the financial Many illicit transactions on the Dark Web take place inclusion and growth of regions such as Africa and using virtual currencies, like Bitcoin. However, the use of more anonymous cryptocurrencies is rap- South Asia.15 Take Kenya for example, which in 2007 idly increasing and gaining market share, including launched M-Pesa—a mobile phone-based platform Monero, Dash, and Zcash.20 for the transfer of money and financial services.16 Many centralized virtual Today, 43 percent of Kenya’s GDP flows through currencies and “the thousands of websites that M-Pesa which has over 237 million person-to-person buy and sell decentralized virtual currencies like bitcoin, lie outside of the western financial system’s transactions.17 network of detection points.”21 Suspicious Activity Reports (SARs) are not generated, and the sheer scale of potential criminal use of the financial ser- vices are unknown. Effective regulatory responses to virtual currencies continue to pose a significant challenge because they operate on a global scale and cut across the responsibilities of many different agencies.22 The modernization of digital payment systems and internet-connected devices is also fueling the growth of both offenders and victims of child por- nography.23 While the vast majority of child sexual But while most new financial technology (FinTech) exploitation material (CSEM) is