Terrorists’ tactics evolve with the times. Just as we have seen an adaption of terrorist methods for sowing fear and distrust, so, too, we have seen their propaganda machines evolve to inspire audiences globally. Gone are the days of printed manifestos, pamphlets, or fuzzy VHS tapes. The internet now facilitates many-to-many recruitment messaging that reaches spectators in real time.
The key to bankrolling terrorist causes could also soon be found in the cyber domain.
One such mode of financing is the growth of virtual currencies, particularly pseudo-anonymous cryptocurrencies such as bitcoin, capable of obscuring the identities of those transacting, and efficiently and verifiably funneling finances around the world. Bitcoin is the most common cryptocurrency, with one bitcoin worth about $2,800 in a market capped at $17 billion, but others exist. Terrorist use of virtual currency remains anecdotal at the moment, but that does not mean the strategic threat that extremist groups use of the technology could pose should be ignored.
Part of the reason virtual currency has yet to become a foundation of terrorism financing is that conventional payment methods, such as cash, remain effective. Most terrorist funding presently occurs through an informal cash-based money transfer mechanism known as hawala networks. Cash is liquid, easily exchangeable, anonymous, and does not require the technical infrastructure missing in many places terrorists operate, particularly northern Nigeria, Yemen, and the Horn of Africa.
The few examples of terrorist groups showing an interest in cryptocurrencies take place where there is relatively stable internet access. Last year, the Ibn Taymiyya Media Center, an online jihadist media unit based in the Gaza Strip, attempted a social media fundraising campaign by asking for donations in bitcoin. Indonesia has said members of the local ISIS-affiliated militants have conducted transactions with individuals in Syria in bitcoin and through Paypal. A year ago, a Virginia teen was charged for providing material support to ISIS by using Twitter to instruct supporters in how to use bitcoin. All of this experimentation suggests an interest in eventually using the new technology.
Virtual currencies such as bitcoin are already pervasive among cybercriminal groups dealing in stolen data, hacking toolkits, counterfeit documents, drugs, and weapons in illicit marketplaces on the dark web, a portion of the internet accessible only through encrypted browsers such as Tor. The WannaCry ransomware that hit over 150 countries last month sought to extract bitcoins by holding critical data for ransom. A mysterious hacking group known as the Shadow Brokers sought to auction stolen NSA tools and documents for bitcoin, and is now offering a subscription to access to further dumps using the more anonymous Zcash.
Criminals and terrorists have differences in motivation, especially when terrorists want to conduct loud and disruptive attacks to draw attention to their cause, while criminals seek to operate under the radar. The two often converge, though, particularly when money is involved. Cybercriminal groups could use their technical expertise to launder terrorist cryptocurrencies or even conduct cyber operations for payment, including ransomware campaigns that could further finance terrorist operations.
Extremist groups can also resort to illicit marketplaces on the dark web to buy and sell for their operational needs – illegal commerce that is nearly all conducted using various cryptocurrencies. Purchasing false passports could enable extremists to easily cross borders and rent vehicles and safe houses. The availability of arms, bomb-making supplies, small hobby drones, and even stolen sensitive data on targets could facilitate operations. Criminal groups wouldn’t even know they are enabling terrorism because of the anonymity cryptocurrencies provide – particularly monero, which, unlike bitcoin, does not even indicate the sending and receiving accounts or the amount transferred on public ledgers.
David Carlisle, an associate fellow at the Royal United Services Institute's Centre for Financial Crime and Security Studies, points out that, “Organizations such as Europol have noted both the growing nexus between terrorist groups and organized crime, as well as the increasing use of technology by both organized criminals and terrorists.”
“If those phenomena accelerate,” Carlisle argues, “there would certainly be plenty of opportunity for terrorists to utilize and benefit from activity on the dark web, whether directly or indirectly.”
Yaya Fanusie, the director of analysis for the Foundation for Defense of Democracies’ Center on Sanctions and Illicit Finance and former CIA counterterrorism analyst, agrees. “What law enforcement and intelligence officials should be watching out for is terrorist technical adaption and any converging motivations and allegiance with cyber criminals,” he argues.
Groups like ISIS may not have more aggressively adopted the use of cryptocurrencies to date because they control large swathes of territory that allow them to generate revenue through taxation, extortion, and the extraction of national resources. However, this could change as U.S.-backed coalition forces continue to push ISIS fighters out of Mosul in Iraq, and allied militias alongside coalition partners begin their siege of the terror group’s de facto capital of Raqqa in Syria. While denying the group physical safe haven is an immediate priority, thought must also be given to how ISIS, and other terrorist groups, will adapt to their changing environments.
We have already seen an increase in lone wolf attacks in the West, with some based almost entirely on remote inspiration without the logistical support of centralized groups. It is becoming more and more common for terrorists to resort to attacking soft targets such as markets, parades, stadiums, and concert halls using unsophisticated explosives, smalls arms, and even vehicles and knives. While terrorists turning to cryptocurrency at scale to support a centralized state could be a major threat, the much smaller scale of remotely facilitating lone wolf attacks around the world is much more probable.
However, “If terrorists began using virtual currencies, rather than cash or cards, to finance the hiring of cars or other basic supplies, it would hardly present an entirely unique problem,” Carlisle argues. “Detecting and disrupting the financing of small cell attacks remains an enormous challenge, if not a near impossibility, regardless of the means of funding.”
What could change is the scope and speed of financial transactions that enable lone wolf attacks to occur more frequently and with less preparation time for governments to disrupt. For this potential strategic threat to become a reality, however, “a shift would have to happen where terrorists become more cyber-minded and technically oriented for this to be a major way of security equipment,” says Fanusie.
Given that the number of internet users has more than tripled in the last decade – from 1 billion in 2005 to an estimated 3.2 billion at the end of 2015 – it is safe to say terrorists will eventually become more cyber-minded.
“The key to good counterterrorism work is staying ahead of the terrorist curve,” says Fanusie.
—
View our expert commentary on this topic:
Money-Laundering Laws Should Cover Virtual Currency Exchange Businesses by David Carlisle, Associate Fellow with the Centre for Financial Crime and Security Studies at the Royal United Services Institute
Will A New Generation of Terrorists Turn to Bitcoin? by Yaya Fanusie, Director of Analysis at the Center on Sanctions and Illicit Finance, part of the Foundation on the Defense of Democracies
Levi Maxey is a cyber and technology analyst at The Cipher Brief. Follow him on Twitter @lemax13.
