Virtual Currencies: Safe For Business And Consumers Or Just For Criminals?

Introduction
The potential societal benefits of virtual currencies include mobile banking systems in developing countries, decreased transaction costs to merchants, and elimination of fees associated with normal bank accounts – all practical benefits for most businesses and consumers. (1)

However, there is significant risk of large-scale criminal use of these same virtual currencies because of a lack of universal regulation, a gap in critical industry-based checks against money laundering, decentralized administrations, and the anonymity of transactions.

Already, criminal investigators are aggressively confronting the use of virtual currencies in the online sale of illicit goods. But financial regulators and law enforcement are being challenged as they continue to observe use of virtual currencies to conceal criminal transactions and their proceeds.

Governments, and the innovators of virtual currencies themselves, could easily implement existing solutions to prevent exploitation by transnational criminal organizations or terrorist groups of this emerging technology. Concomitantly, these solutions would enhance the trust and reliability of virtual currencies as conduits of online commerce.

Background
Perhaps the most commonly known virtual currency is Bitcoin. Bitcoin has arguably become the “Xerox machine” or “Scotch tape,” of currencies operating in cyberspace.

But it would be inappropriate to single out one entity in a discussion about criminal exploitation of an emerging technology because criminals do not favor any one company in furtherance of their criminal activity.

Moreover, focusing on a single currency model could cause an underestimation of the scope of the potential criminal problem. In March 2013, the U.S. Financial Crimes Enforcement Network (FinCEN) noted the existence of multiple virtual currencies other than Bitcoin.

However, examining Bitcoin and its development adds to the understanding of how some virtual currencies operate. Introduced in 2009, Bitcoin’s unit of currency is “an electronic coin as a chain of digital signatures.” (2) A Peer-to-Peer (P2P) network verifies transmission from the sender to recipient, each of who can select a one-time address associated only with the single transaction. The P2P authentication within the virtual financial system creates a public log of the transaction, making it impossible for the owner to twice “spend” the same coin. (3)

The most significant justification claimed for establishing a crypto-graphic currency was to reduce costs associated with a “trust based model” in which the buyer must be wary of fraud and the seller of cancelled payments. Bitcoin transactions are irreversible. So, a third-party financial institution is not needed to settle disputes because there is no remedy available in the payment system.

Because the decentralized system relies upon a P2P network, the transactions are perpetually visible to all on the system. However, to preserve the anonymity of the transactors, not all portions of the transaction are visible. (4)

This paper makes no comment or conclusion about the practicality or security of virtual currencies. Widely reported has been the alleged theft of $480 million worth of bitcoins from the exchange Mt. Gox, which subsequently filed for bankruptcy protections in February 2014. (5)

Perhaps foreshadowing its future difficulties, U.S. law enforcement seized financial accounts of a subsidiary company of Mt. Gox in May 2013. Bitcoins were repeatedly exchanged back and forth into U.S. dollars through the subsidiary company and Mt. Gox. However, neither company fulfilled the legal obligation of registering as a Money Services Business (MSB) as required by law. (6)

While failing to register may seem a mere technical violation, there are obligations for an MSB to implement anti-money laundering measures and file Suspicious Activity Reports as well as Cash Transaction Reports. These reports are an integral part of a well-established regulatory framework designed to identify money laundering by criminal or terrorist organizations.

We know that virtual currencies are already favored by those engaged in cyber crime. In June 2011, the online hacking group LulzSec used virtual currencies Bitcoin and Liberty Reserve, in combination, to launder funds donated by supporters. (7) According to the FBI, LulzSec used part of these funds to purchase a botnet. French cybersecurity researchers recently proclaimed that Bitcoin “holds a privileged position” as currency among cybercriminals, who “recommend it and praise its reliability.” (8)

A 2013 academic study examined 25,000 web addresses accessible on The Onion Router (Tor). Of those 25,000, 28 % were classified as hacking sites and another 23 % as cybercrime sites. A majority of these 25,000 TOR sites, selected by researchers at random, engaged in illegal activity. (9) And according to U.S. FinCEN, virtual currencies were their payment method of choice.

In 2013, criminal charges were filed in the U.S. against the administrator of the Silk Road website, with allegations that the site sold hundreds of kilograms of illegal narcotics and other illicit services, collecting over 9.5 million bitcoins. (10)

Importantly, when the crimes allegedly occurred, only about four million bitcoins may have been in circulation. (11) Therefore, it is quite likely the vast majority of available bitcoins in the world cycled through the hands of narcotics traffickers.

In January 2014, U.S. prosecutors charged two men with money laundering and operating an unlicensed money transmitting business in connection to the underground sale of bitcoins to Silk Road customers. One of the men was reportedly Vice Chairman of the Bitcoin Foundation, which is “dedicated to promoting the Bitcoin virtual currency system.” (12)

Also in January 2014, U.S. federal agents filed a criminal complaint alleging the sale of a deadly toxin, with the express knowledge it would be used to kill a human being, in exchange for bitcoins after the product was advertised on the Tor site Black Market Reloaded.

All of the above criminal enforcement occurred in less than one calendar year. There are, unfortunately, even more examples of criminal exploitation of virtual currencies. Based on this track record, absent changes to the business model and being brought under regulation, the public and law enforcement have good reason to believe criminal use of virtual currencies will continue.

This concern is not confined to one country. The European Central Bank has declared virtual currencies “could represent a challenge for public authorities, given the legal uncertainty surrounding these schemes, as they can be used by criminals, fraudsters and money launderers to perform their illegal activities.” (13)

Apply existing anti-money laundering regulations and laws to virtual currencies
Robust anti-money laundering (AML) obligations and strong financial regulatory systems frustrate the ability of criminal and terrorist organizations to finance their activities or launder proceeds. This has proven to be true with traditional brick and mortar banking institutions, which have reasonably recognized the fulfillment of their AML responsibilities as enhancing their professional reputations. (14) There is no rational reason not to apply such provisions to the virtual world.

In early 2012, the Financial Action Task Force (FATF) concluded that money or value transfer services (MVTS), such as virtual currency exchanges, should be licensed and registered. (15) The FATF also recommended that governments ensure MVTS have in place proper AML controls and that all MVTS have agents accessible to authorities.

Because of the anonymity within some virtual currency transactions, only the “cashing out” into fiat currency allows law enforcement to link funds to a specific individual or account. This makes virtual currency exchanges relevant choke points to observe potential criminal activity and money laundering activities. But they must have AML controls in place and exercise due diligence to be effective.

In 2013, U.S. FinCEN issued guidance that regulated Money Services Businesses (MSBs) including individuals or companies engaged as businesses in the issuance of virtual currency or in the exchange of virtual currency for fiat (16) currency. (17) However, the largest bitcoin exchange at the time, Mt. Gox not only failed to register, but its subsidiary actually claimed it was not a business engaged in money services. (18) Registration would be followed by implementation of AML programs, including filing of Suspicious Activity Reports (SARS).

SARS provide critical information to law enforcement about financial and banking activities seemingly not supported by a business or lawful purpose. However, SARS must be mandated globally for virtual currencies. U.S. FinCEN identified only about 70 SARS filed between 2009 and 2013 associated with virtual currencies, but this number increased to approximately 1,400 following issuance of FinCEN’s guidance that virtual currencies must comply with existing regulations.

Importantly, AML measures are not voluntary for financial institutions and they must be undertaken proactively within the virtual currency industry to strengthen the reputation of virtual currencies as legitimate tools of international commerce, while imposing a minimal burden.

Regulation Must be Universal
The regulation by U.S. FinCEN of virtual currencies, and aggressive law enforcement actions in the U.S., may lead to a decampment of such businesses from the United States. (19) Therefore, as noted by the FATF, there must be a broad international regulatory scheme to control for regionalized regulation.

Further, regulatory action should be harmonized with other countries so innovative, start-up companies offering virtual currencies, or related services, are not faced with contradictory guidelines or gaps in regulatory oversight that might hamper growth. Similarly, law enforcement would benefit from reciprocal money laundering laws.

Fortunately, it seems that innovators within the virtual currency community are publicly recognizing the importance of regulation to preserve the credibility of virtual currencies as a financial system, particularly in the wake of the collapse of Mt. Gox, once the largest bitcoin exchange. (20)

Virtual currency innovators must end anonymity in transactions
Tellingly, anonymity in transactions was not a claimed justification for creation of Bitcoin, but was built into the business model. Nonetheless, as virtual currencies advance, this anonymity will continue to attract criminal activity and pose a significant obstacle to law enforcement’s ability to “follow the money.” When appropriate legal process is provided to a financial institution for relevant records, the identities of those transferring funds should be readily available to investigators.
A disturbing trend is entrepreneurial services within virtual currency communities which “auto-launder” currency units for users, advertising even greater anonymity through shell accounts. Virtual currencies must discourage these vendors by establishing systems where use of those services precludes payment transfers.

Further, virtual currencies should implement “know your customer” practices that require true identities and addresses of account holders. It is desirable to have privacy in financial transactions. But we have already determined as a society to balance privacy with transparency to prevent the use of financial institutions by criminal or terrorist organizations.

Virtual currencies must end decentralized administrations
There must be self-imposed centralized control within virtual currencies to ensure integrity of the transactions, to initiate AML monitoring, and to provide a single point of contact for regulatory and law enforcement authorities.

Bitcoin uses a P2P network to verify transactions, a function normally performed by a centralized authority in other financial institutions. The decentralized administration cannot implement AML policies, exercise due diligence, or provide relevant records of account holders to law enforcement or regulators.

While the business model and underground supporters favor decentralization, it is highly relevant that this new technology is not merely another social network or “app” to display photos. Virtual currencies are engaging in significant financial transactions that impose appropriately commensurate responsibilities on the developers and supporters. Reportedly, on November 22, 2013, bitcoins worth $147 million were transferred, without being cashed out for fiat currency. (21) That transaction, the value of which was only 1.6% of the bitcoins in existence, may have been a bookkeeping measure by a bitcoin exchange. But the exchange reportedly refused comment, leaving commentators to claim, correctly, that the largest ever bitcoin transfer was completely anonymous.

Conclusion
Application of reasonable, industry-imposed reforms coupled with enforcement of existing regulations by government authorities would strengthen the reputation of virtual currencies as appropriate facilitators of online commerce while preserving them from exploitation by criminal organizations and terrorist groups.

The author:

Erik R. Barnett is currently the Attaché to the European Union for U.S. ICE Homeland Security Investigations (HSI), the primary investigative arm of the U.S. Department of Homeland Security. The views expressed are solely those of the author and are not intended to represent the views of any agency of the U.S. government.

 

1 T. Carmody. Money 3.0: How Bitcoins May Change the Global Economy. National Geographic Daily News. Oct. 14, 2013. news.nationalgeographic.com/news/2013/10/131014-bitcoins-silk-road-virtual-currencies-internet-money/

2 S. Nakamoto. Bitcoin: A Peer-to-Peer Electronic Cash System, 2008. Bitcoin.org/bitcoin.pdf

3 bitcoin.org/en/faq

4 S. Meikeljohn, et. al. A Fistful of Bitcoins: Characterizing Payments Among Men with No Names. Oct. 2013. cs.gmu.edu/~mccoy/

5 C. Daugherty and G. Huang. Mt. Gox Seeks Bankruptcy After $480 Million Bitcoin Loss. Bloomberg Businessweek. Feb. 28, 2014. businessweek.com/news/2014-02-28/mt-dot-gox-exchange-files-for-bankruptcy

6 Affidavit in Support of Seizure Warrant. In the Matter of the Seizure of the contents of one Dwolla account. 13-1162 SKG. U.S. District Court for the District of Maryland news.cnet.com/8301-13578_3-57584511-38/homeland-security-cuts-off-dwolla-bitcoin-transfers/

7 P. Olson. We Are Anonymous, pages 304-06. Little Brown & Company, 2012.

8 M. Even, A. Gery, B. Louis-Sidney. Virtual Currencies and Cybercrime: Current State of Play and Future Prospects Compagnie Européenne d’Intelligence Stratégique (CEIS), 2013.

9 P. Paganini et. al. Infosec Institute, project Artemis. resources.infosecinstitute.com/project-artemis-osint-activities-on-deep-web/

10 Sealed Second Post Complaint Protective Order. U.S. v. Ross William Ulbricht, CIV6919. U.S. District Court for the Southern District of New York. justice.gov/usao/nys/pressreleases/October13/SilkRoadSeizurePR.php

11 S. Meikeljohn, et. al. A Fistful of Bitcoins: Characterizing Payments Among Men with No Names. Oct. 2013. cs.gmu.edu/~mccoy/

12 Press release. Manhattan U.S. Attorney Announces Charges Against Bitcoin Exchangers, Including CEO Of Bitcoin Exchange Company, For Scheme To Sell And Launder Over $1 Million In Bitcoins Related To Silk Road Drug Trafficking. Jan. 27, 2014. justice.gov/usao/nys/pressreleases/January14/SchremFaiellaChargesPR.php

13 European Central Bank, Virtual Currency Schemes, ECB Report, Oct. 2012. ecb.europa.eu/pub/pdf/other/virtualcurrencyschemes201210en.pdf

14 Remarks of FinCEN Director Jennifer Shasky Calvery, The Virtual Economy: Potential, Perplexities and Promises, June 13, 2013, Washington, D.C. fincen.gov/news_room/testimony/

15 Financial Action Task Force. International Standard of Combating Money Laundering and the Financing of Terrorism & Proliferation The FATF Recommendations. 2012. http://www.fatf-gafi.org/media/fatf/documents/recommendations/pdfs/FATF_Recommendations.pdf

16 “Fiat” currencies are backed by central governments and, usually, widely recognized internationally as currency.

17 FinCEN. Application of FinCEN’s Regulations to Persons Administering, Exchanging, or Using Virtual Currencies. Mar. 18, 2013. fincen.gov/statutes_regs/guidance/html/FIN-2013-G001.html

18 Affidavit in Support of Seizure Warrant. In the Matter of the Seizure of the contents of one Dwolla account. 13-1162 SKG. U.S. District Court for the District of Maryland news.cnet.com/8301-13578_3-57584511-38/homeland-security-cuts-off-dwolla-bitcoin-transfers/

19 Testimony of Patrick Murck, Senate Committee on Homeland Security and Governmental Affairs. Nov. 18, 2013. hsgac.senate.gov/hearings/beyond-silk-road-potential-risks-threats-and-promises-of-virtual-currencies

20 F. Manjoo. For Bitcoin, Secure Future Might Need Oversight. New York Times. Mar. 5, 2014. nytimes.com/2014/03/06/technology/personaltech/for-bitcoin-a-secure-future-might-require-traditional-trappings.html

21 T. Lee. Here’s who (probably) did that massive $150,000,000 Bitcoin transaction. Washington Post. November 23, 2013. washingtonpost.com/blogs/the-switch/wp/2013/11/23/heres-who-probably-did-that-massive-150000000-bitcoin-transaction/