Continuing terror attacks around the world indicate law enforcement and intelligence agencies face difficulty in trying to identify and disrupt the plans of globally disparate and loosely affiliated entities. Terrorist groups have adapted to each step security services take against terror, including the severing of financial lifelines. With growing terrorist presence on the internet, groups could eventually turn to virtual currencies such as bitcoins to bankroll their operations. The Cipher Brief’s Levi Maxey spoke with David Carlisle, an associate fellow at the Royal United Services Institute's Centre for Financial Crime and Security Studies, about what a turn to terrorist use of virtual currencies could look like, and how it would align with the physical collaboration with criminal networks already taking place.
The Cipher Brief: Have terrorist groups used virtual currencies in the past, and if it has been minimal, why do you think that is?
David Carlisle: The public record suggests that terrorists are interested in what virtual currencies – in particular cryptocurrencies, such as bitcoin – have to offer as a financing tool. However, public accounts of terrorists using virtual currencies are limited and generally anecdotal. There is no concrete indication in the public record that terrorists are using bitcoin with regularity or on a widespread basis. When it comes to other types of digital payment systems that fall under the broad category of “virtual currencies” – such as WebMoney and other centralized schemes, or game-based virtual currencies, such as Linden Dollars – the picture of terrorist usage is almost entirely unverified. Those other forms of virtual currencies generally receive less attention than bitcoin, and studies of their possible use in terrorist financing are essentially nonexistent.
As with any terrorist financing method, there is certainly the possibility – even a probability – that terrorists are using virtual currencies more widely than the public record suggests. Intelligence agencies could certainly be operating with blind spots. The Indonesian government indicated earlier this year that Indonesian members of ISIS have utilized bitcoin – as well as Paypal – to bypass the formal banking system, but the precise scale and nature of this activity was not specified. Otherwise, however, governments have generally been cautious in making attributions of terrorist use of virtual currencies. In its most recent national financial crime risk assessment, the UK government described the overall money laundering and terrorist financing risks of virtual currencies as low.
The most likely reason virtual currencies have not caught on as a major terrorist financing tool is that terrorists don’t require them with urgency. Terrorists have ample access to numerous other funding sources and money transfer methods – whether in the form of cash, traditional money service businesses, welfare payments, student and payday loans, and prepaid cards.
TCB: Do you see groups turning to virtual currencies more in the future? What form could this take?
Carlisle: Three factors will likely influence whether terrorists adopt virtual currencies more broadly, and the rate at which that may happen.
First will be the prevalence of virtual currencies more generally. It stands to reason that if virtual currencies become more widespread in their use among the general public – and as digital payments proliferate – terrorists would have greater opportunity to utilize them.
Second will be the rate at which terrorists increase their use of technology. Terrorist groups, and in particular ISIS, have been strategically increasingly their online presence, and there’s little reason to think this won’t continue to accelerate. As that occurs, the likelihood of terrorists turning to not just virtual currencies, but to other forms of online or mobile payments or methods, such as crowdfunding, will likely increase.
Third will be whether more well-established terrorist funding methods continue to be readily available.
Again, reporting on terrorists’ use of virtual currencies is limited to anecdotal accounts focused on bitcoin; therefore it is difficult and problematic to draw firm conclusions about exactly what form more widespread terrorist adoption of virtual currencies might take. However, the limited public reporting offers some hint that terrorists would likely be most inclined to use it for one of three purposes in the near term: charitable donations, as international peer-to-peer funds transfers that avoid the banking systems, or for purchasing (or selling) contraband on the dark web. More generally, terrorists could look to centralized virtual currency schemes or other digital payment systems to transfer money internationally as a mechanism for bypassing the mainstream banking system.
There certainly exists the possibility that terrorist organizations could look to ransomware or other forms of cybercrime that rely heavily on virtual currencies as a fundraising method. Cyber attacks may be most appealing to terrorists as a form of disruption, rather than as a method of financing. But that could certainly change with time.
TCB: Could groups begin dealing in dark web marketplaces to purchase weapons or other equipment?
Carlisle: They certainly could, and indeed it would be surprising if some had not yet done so. False passports and other items useful to terrorists are available on the dark web as well as arms.
Organizations such as Europol have noted both the growing nexus between terrorist groups and organized crime, as well as the increasing use of technology by both organized criminals and terrorists. If those phenomena accelerate, there would certainly be plenty of opportunity for terrorists to utilize and benefit from activity on the dark web, whether directly or indirectly.
TCB: Would this be a major development in how terrorist groups financially and materially support lone wolf attacks?
Carlisle: Terrorists are constantly adapting their methods, so in that sense it would be greatly concerning, but not necessarily be a great surprise, if evidence emerged of terrorists dealing in the dark web in significant volumes, or if lone wolf attackers acquired arms or other equipment in such a manner. Insofar as dark web marketplaces present new challenges to law enforcement agencies and provide users with greater anonymity, widespread terrorist use of the dark web would present resourcing and tracking hurdles to already strained agencies.
With respect to self-directed attacks such as that which recently occurred in Westminster, authorities already face significant challenges in tracking and disrupting them. If terrorists began using virtual currencies, rather than cash or cards, to finance the hiring of cars or other basic supplies, it would hardly present an entirely unique problem. Detecting and disrupting the financing of small cell attacks remains an enormous challenge, if not a near impossibility, regardless of the means of funding.
TCB: Could this also indicate a growth in terrorist cyber activity if groups are able to pay for hacking tools or hire hackers as a service?
Carlisle: As terrorist groups expand their online presence, they may be increasingly tempted to utilize crime as a service or engage in ransomware campaigns.
TCB: How should governments go about disrupting terrorist use of virtual currencies in the future without hindering their legitimate use?
Carlisle: The most straightforward and sensible approach for managing the risks without hindering legitimate users is to bring businesses that act as virtual currency exchangers within the scope of national anti-money laundering laws. This measure provides a basic level of transparency at the point where users “cash out” from virtual currencies to fiat currencies while doing nothing to disrupt peer-to-peer transfers among legitimate users; however, many countries still have not regulated virtual currency exchanges.
Enhanced training among law enforcement agencies and national financial intelligence units to improve investigations into virtual currencies and other digital payment systems is essential. Such efforts should be closely coordinated with general law enforcement efforts focused on disrupting cybercrime activity.
More generally, cooperation among law enforcement agencies and the providers of virtual currency services can help to improve the intelligence picture. The Blockchain Alliance in the U.S. is a public-private partnership that brings together bitcoin businesses and law enforcement agencies to discuss methods for identifying and disrupting illicit activity on the bitcoin blockchain. Efforts of this sort can assist law enforcement and industry in anticipating new illicit financing methods.
