This May, the analysis commissioned by the European Parliament TERR Committee[i] about terrorism financing by virtual currencies, “Virtual currencies and terrorist financing: assessing the risks and evaluating responses[ii]”, has depicted the complex nature of the actors generally involved in extremist groups’ online financing. The study gathers the subjects involved in this cyber-threat into distinct groups (lone actors, small-cells, command and control organizations, territory controlling groups) associating them with different funding methods (raising funds, moving funds, storing) that are helpful to identify the actors taking part in the terrorist illegal use of cryptocurrencies and what would be their main purposes in this field.
Despite the current attention at a local, State and international level aimed at countering terrorist groups from exploiting the online realm to raise funds or finance terrorist attacks, sometimes the lack of reliable data represents this issue as a grey area that only recently has been discussed as a real threat.
Hence, in order to try to prevent the next steps in online Islamic terrorist financing field, it is crucial to analyze this phenomenon through a perspective based on a crime-terror nexus[iii], by comparing criminals’ use of digital currencies (that, since now, are far more documented) with the last development of global terrorism. This approach can help to provide a picture of where the real threat of terrorism online financing lies.
Global terrorist organizations and their support groups
Terrorist organizations which are usually relying on the occupation of territories (as Daesh in Iraq and Syria or al-Shabaab in Somalia), those without a single established base (as al-Qaeda) and their support groups (e.g. Haq Web site, Akhbar al-Mulsilimin website, Jahezona group) have already started to exploit the potential of modern financial tools. Despite, in most cases, could be important to study separately the peculiarity and rationale of each global Islamic terrorist group (as much as possible in the complex nature of Islamic extremism), the fact that terrorist exploitation of cryptocurrencies is still at an early stage, allows to find common trends even among totally different extremist Islamic groups which could develop in the following areas:
- Purchase or sale of illegal items on the dark web[iv]: A large part of global Islamic terrorist groups online activities are still detectable on the surface web but most of it, especially which of those concern operative instructions or one-to-one communications, have been shifted on dark web websites[v] or encrypted end-to-end chat groups (e.g. WhatsApp or Telegram)[vi]. Besides the radicalization and propaganda purposes, the dark web also represents a sort of Amazon-like open black markets with no regulations, which allows the match of demand and supply of illegal items (e.g. drugs or weapons), where crypto-values have become the prominent mean of payment[vii]. Even though there is not yet documented evidence of terrorists massive use of the dark web illegal markets, cases as the drug selling dark website “Silk Road” or the recently dismantled criminal network operating in Spain, which was producing and distributing synthetic drugs worldwide on the dark web by accepting payments in cryptocurrencies[viii], suggest that this trend has the potential to become a growing threat which should be carefully monitored. Furthermore, the increasing bond between Islamic terrorists and criminals[ix], rooted either in the fact that terrorist organizations are inciting their supporters to commit criminal activities by encouraging them to use funds raised through criminality as a legitimate way of financing the jihad[x] or in their cooperation with international crime organizations from low-scale criminality (e.g. sale of counterfeited clothes or electronic devices[xi]) to organized crime (e.g. trafficking in drugs, weapons, cultural artifacts)[xii], shows a potential growing threat of terrorists’ use of dark web black-markets. Moreover, the new terrorist youngest recruits, which are computer literate, will inevitably grow Islamic extremism crime rate on the online realm and, as a consequence, could push more and more in order to increase the exploitation of cryptocurrencies and the dark web to raise funds[xiii].
- Receive donations to store or invest money: global Islamic terrorist organizations have always being relying on large or small, anonymous public donations coming from West-based individuals, members of the diaspora community[xiv], wealthy supporters (often from Gulf state countries) or like-minded terrorist groups (as in 2012, the Nigerian group Boko Haram reportedly received $250,000 from al-Qaeda)[xv], to get financial support. Thus, as already seen in the cases of the donations request by bitcoins on the Al-Qaeda affiliated, Syrian- jihadi group, Al-Sadaqah donation campaign[xvi] or with the media group associated with Daesh, “Technical Support of Afaq Electronic Foundation”, which offered an alternative to secure online purchasing via the Zcash virtual currency[xvii], global Islamic terrorist organizations are already inciting their followers, scattered across the globe, to give economic support (warping the Islamic principles of zakat[xviii] or sadaqha[xix]) through the online realm. The money collected by these donation campaigns, as in the case of the Akhbar al-Muslimin campaign which was expressively aimed at reinforcing Daesh’s military equipment, can be stored into digital values dark-wallets. Despite in many cases these money deposits or transfers can be traceable[xx], with the emergence of alternative cryptocurrencies that are more opaque and better at concealing a user’s activity (e.g. Dash, ZCash or Gram), these financial tools are going to give to jihadists movements a secure economic resource that can be potentially used to finance terrorist attacks abroad, buy weapons or strengthen their propaganda machine[xxi].
- Extortions, ransom and other illicit activities: on May 20, 2018 a 13 years old boy waskidnapped in the town of Witbank in the eastern province of Mpumalanga, South Africa, by three men, demanding $123,000 worth (15 bitcoins) for his release[xxii]. In Ukraine, in 2017 on December 26, Pavel Lerner, a leading analyst and blockchain expert, was abducted and released after giving more than $1 million in bitcoins as ransom[xxiii]. According to an agent speaking at a digital-asset industry conference in New York, the FBI has 130 cases tied to cryptocurrencies which of them, besides the cases related to drugs black-markets on the dark web, registered a significant rise in extortion schemes related to virtual currencies[xxiv]. Moreover, approximately 25% of all bitcoin users and close to one-half of bitcoin transactions (44%) are associated with illegal activity[xxv]. Terrorist groups as Daesh or Al-Qaeda in West Africa have always been using methods as extortions, kidnapping (even on a daily basis) or human trafficking to generate considerable revenues and, the high skills they’ve proven to have in being flexible and always up to date in technological terms, could make harder to keep track of all their illicit revenues in these fields.
Lone-actors
This cluster represents individuals who are generally inspired by a central Islamic terrorist group without having formal connection with it. As in the case of lone-wolves, these individuals are, in many cases, radicalized entirely online[xxvi], without the need of being in contact with other followers, leaders of affiliated to the terrorist organization but mostly as the result (among other reasons ususally related to marginalization, lack of self-recognition or mental disorders) to a constant exposure to Islamic extremist online propaganda on the surface web, dark web and encrypted chats. Furthermore, as previously described, these people are usually extremely young and computer literate. These factors make them unpredictable (given the fact that they have not a direct connection with other jihadists online nor offline) and, being usually digital natives and very high-skilled in using modern technological tools, undetectable and with a high harmful potential.
The threat represented by lone-actors’ use of cryptocurrencies could develop as follows:
- Lone-wolves attacks equipment on the dark web: there are several cases that highlight the dangerous threat of exploitation of crypto-values on the dark web black-markets. The Munich shooter, Ali David Sonboly, who bought a Glock 17 pistol and 350 round of ammunition on an e-commerce on the dark web by using bitcoins[xxvii]. Mohammed Ali, 31, from Liverpool, who was diagnosed with mild Asperger’s or autistic traits, bought five vials of ricin (enough to murder 1.400 people), under the online moniker of “Weirdos 0000”, by using bitcoins, in 2015[xxviii]. These are just two of a large number of cases related to the arms purchases (of any kind) on the dark web which highlight how easy for anyone has become to have access to dangerous items. Such weapons are smuggled in small quantities, sometimes just components that are later reassembled[xxix]. Hence the dark web has the potential to become the platform of choice for individuals (e.g. lone-wolves terrorists) to obtain weapons and ammunition behind the anonymity curtain provided by cryptocurrencies[xxx]. Furthermore, the increasing threat of lone-wolves using chemical weapons, as the 29-year-old Tunisian man, Sief Allah H, arrested in Cologne for producing ricin in his apartment or Waheba Issa Dais, a pro-IS Israeli woman, who attempted to provide detailed instructions on how to make ricin and then suggested the individual introduce the ricin to a government post or water reservoirs[xxxi], should increase the awareness of dark web and lone-wolves nexus in order to be prepared to counter it.
- Spread instructions aimed at using cryptocurrencies illegally: as in the case of “Bitcoin wa Sadaqat al-Jihad” (“Bitcoin and the Charity of Jihad,”) an article posted by the 17 year old Ali Shukri Amin in 2014 on an online blog which encouraged jihadists supporters to use digital currencies to finance ISIS and “limit economic support for infidels (Western Banks)” by giving instructions about how to use them[xxxii], many other cases of lone actors which give information to finance terrorist organizations can be found on the dark web and encrypted chats. Furthermore, in case lone-jihadi-actors wouldn’t have enough skills to perpetrate crimes with cryptocurrencies, as described in a 2016 report by Europol, they can rely on Crime-as-a-service (CaaS) available either on the deep web or on the dark web, where professional criminal or groups of criminals develop advanced tools, “kits” and other packaged services which are then offered up for sale or rent (by digital currencies) to other criminals who are usually less experienced[xxxiii].
- Money laundering, scams and terrorism financing: as already seen in the cases of Zoobia Shahnaz[xxxiv], who was financing IS by transferring money stolen by bank frauds in form of bitcoin and other cryptocurrencies, or Ardit Ferizi, an IS supporter who demanded payment in bitcoins from an Illinois Internet retailer, in exchange for removing bugs from its computers[xxxv], there are signals that show an increasing trend in terrorism financing through online scams or money laundering. Some of these online money laundering methods, developed around transactions of small amounts of money, can take place inside the most unexpected web platform as, for instance, (without the knowledge of their developer) Massive Online Role Playing Games (MMORPG), as Second Life or World of Warcraft. By opening an account on a MMORPG then purchasing its virtual currency (usually with a stolen credit card or with cash by purchasing a prepaid card) and by selling back the virtual currency through the black market community, or to virtual money exchange platform, it is quite easy to launder serial small amount of illegal money without being traced[xxxvi]. Or, keeping with the online scams, the case of the 19-year old Israeli-American hacker, arrested this March and convicted on June 28, who received payment in bitcoin (allegedly almost $250.000) by selling “intimidation” and extortion services to clients, charging (among other “services”) $40 to make a call warning of a massacre in a private home; $80 to threaten a massacre at a school; and $500 to phone in a threat of a bomb on a plane[xxxvii].
Even though, as revealed by Edward Snowden in 2012, intelligence agencies seem to have a clear picture of what really happens inside the dark web and through online money transactions, this is not yet enough to precisely detect and prevent cyber-jihadist activities. One of the reasons can be found in the fact that the possibilities to exploit cryptocurrencies for illegal activities are countless and many times can be very inclusive and imaginative.
Global terrorism, and especially Daesh after shifting from the management of the physical caliphate to a decentralized “virtual caliphate”[xxxviii], has brought a new protagonist in the hybrid warfare: the Lone-Wolfe. Just as Lone-Wolves, the cyber-jihadists lone-actors are generally young and motivated subject, that can increase their motivation and operational capabilities directly in the online realm, by checking a few websites on the surface web or by searching for like-minded people which can help them reach Islamic extremist forums or chats or instructions in the dark web. Indeed, global terrorist groups and lone-actors seem to be more and more linked to each other by either a top-down effect of terrorist groups’ propaganda, which is fragmentary able to radicalize people scattered across the globe, or by a bottom-up effect, which allows the terrorist groups to learn and use at their own advantage the modern methods or approaches brought up by their youngest followers. These actors, being fragmented and unpredictable, are able to spread more panic and fear than any terrorist organization itself.
Indeed, the HUMan INTelligence or COMmunication INTelligence seem to be still the most used sources to make the first steps to investigate suspicious terrorist activities which subsequently allow understanding the online network hidden behind some terrorist’s actions[xxxix]. But it should be taken into account that, the advantage represented by the increasing threat of these activities online (lone-actors’ activity as well) is that they are always leaving a trace of what they do or of what they say. Thus, investigations should concentrate more efforts in strengthening their Open Source Intelligence (OSINT) methods, which is the key factor (with a strong and constant cooperation at local, State, and international level with the private sector[xl]) to understand, fight and prevent this growing phenomenon.
You can read our previous contributions here:
Contemporary Measures to Counter the Misuse of Cryptocurrencies
Bitcoin and other types of cryptocurrency: modern and undetectable ways to finance terrorism
REFERENCES
[i] European Parliament Committees – Terrorism. http://www.europarl.europa.eu/committees/en/terr/home.html
[ii] T. Keatinge, D. Carlisle, F. Keen (May 2018) Virtual currencies and terrorist financing: assessing the risks and evaluating responses. European Parliament’s Policy Department for Citizens’ Rights and Constitutional Affairs. Available at http://www.europarl.europa.eu/RegData/etudes/STUD/2018/604970/IPOL_STU(2018)604970_EN.pdf
[iii] R. Basra, P. R. Neumann, C. Brunner (2016) Criminal Pasts, Terrorist Futures: European Jihadists and the New Crime-Terror Nexus. The International Center for Studies on Radicalization and Political Studies. Available at http://icsr.info/wp-content/uploads/2016/10/Criminal-Pasts-Terrorist-Futures.pdf
[iv] The deep web (Academic databases, Medical and financial records, subscription only content, organization-specific content) and the Dark web (TOR, illegal activities) make up over 99.8% of the entire web and only less than 0.2% of the web is visible (i.e. surface or public web). It is in this untraceable places of the online network, built around hidden browsers, where the most majority of illegal online activities are perpetrated. Dark web is built around web browsers, the most frequently used are TOR or OPERA, which were meant to protect the anonymity of vulnerable people online. These type of browsers operate in the same way of Google Chrome or Internet Explorer but are able to encapsulate communications in layers of encryption that mask the identity of who is browsing and what they’re looking at.
[v] G. Weimann (November 3, 2016) Terrorist Migration to the Dark Web. Univeriteit Leiden – The Netherlands. Available at http://www.terrorismanalysts.com/pt/index.php/pot/article/view/513/html
[vi] C. McCoogan (February 2, 2016) Dark web browser Tor is overwhelmingly used for crime, says study. The Telegraph – Technology Intelligence. Available at https://www.telegraph.co.uk/technology/2016/02/02/dark-web-browser-tor-is-overwhelmingly-used-for-crime-says-study/
[vii] (July 21, 2017) Two of the biggest dark-web markets have been shut down – History suggests that other sites will soon fill the void. The Economist. Available at https://www.economist.com/graphic-detail/2017/07/21/two-of-the-biggest-dark-web-markets-have-been-shut-down
[viii] EUROPOL Press Release (June 28, 2018) POLICE SEIZE MORE THAN EUR 4.5 MILLION IN CRYPTOCURRENCIES IN EUROPE’S BIGGEST EVER LSD BUST. Available at https://www.europol.europa.eu/newsroom/news/police-seize-more-eur-45-million-in-cryptocurrencies-in-europe%E2%80%99s-biggest-ever-lsd-bust
[ix] N. Malik (May 2018) Terror In the Dark. Centre of the Response to Radicalization and Extremism. Available at http://henryjacksonsociety.org/wp-content/uploads/2018/04/Terror-in-the-Dark.pdf
[x] R. Basra, P. R. Neumann, C. Brunner (2016) Criminal Pasts, Terrorist Futures: European Jihadists and the New Crime-Terror Nexus. The International Center for Studies on Radicalization and Political Studies. Available at http://icsr.info/wp-content/uploads/2016/10/Criminal-Pasts-Terrorist-Futures.pdf
[xi] E. Kaplan (April, 4 2006) Tracking Down Terrorist Financing. Council on Foreign Relations. Available at https://www.cfr.org/backgrounder/tracking-down-terrorist-financing
[xii] Committee of Experts on the Evaluation of Anti-Money Laundering Measures and the Financing of Terrorism – Financing of terrorism. Council of Europe. Available at https://www.coe.int/en/web/moneyval/implementation/financing-terrorism
[xiii] TE SAT European Union (2017) Terrorism Situation and Trend Report 2017. Available at https://www.europol.europa.eu/tesat/2017/
[xiv] L. Dearden (July 12, 2017) UK residents donate thousands of pounds a year to Islamist extremist organisations, Home Office reveals. Independent. Available at https://www.independent.co.uk/news/uk/home-news/british-people-islamist-funding-extremist-organisations-home-office-amber-rudd-uk-isis-terrorism-a7837451.html
[xv] T. Keatinge (December 12, 2014) Finances of jihad: How extremist groups raise money. BBC News. Available at http://www.bbc.com/news/world-middle-east-30393832
[xvi] Al Sadaqah Twitter page. https://twitter.com/alsadaqah1
[xvii] E. Azani N. Liv (January 30, 2018) Jihadists’ Use of Virtual Currency. IDC Herzliya – ICT International Institute for Counter-Terrorism. Available at https://www.ict.org.il/images/Jihadists%20Use%20of%20Virtual%20Currency.pdf
[xviii] An Arabic word referring to a payment made annually under Islamic law on certain kinds of property and used for charitable and religious purposes, one of the Five Pillars of Islam. The word “Zakat” origins comes from Persian and Kurdu languages, meaning “almsgiving”
[xix] An Arabic word referring to a charitable giving
[xx] B. Brown (June 18, 2018) Tracing a Jihadi cell, kidnappers and a scammer using the blockchain — an open source investigation. Medium. Available at https://medium.com/@benjamindbrown/tracing-syrian-cell-kidnappers-scammers-finances-through-blockchain-e9c52fb6127d
[xxi] The Meir Amit Intelligence and Terrorism Information Center (June 12, 2017) DRIVE FOR BITCOIN DONATIONS ON AN ISIS-AFFILIATED WEBSITE. Available at https://www.terrorism-info.org.il/en/drive-bitcoin-donations-isis-affiliated-website/
[xxii] S. Busari (May 24, 2018) The 13-year-old South African boy kidnapped for a bitcoin ransom has been found. CNN. Available at https://edition.cnn.com/2018/05/24/africa/south-africa-bitcoin-ransom-boy-found/index.html
[xxiii] P. Politiuk (December 29, 2017) Ukraine kidnappers free bitcoin analyst after $1 million ransom paid. Reuters. Available at https://uk.reuters.com/article/uk-ukraine-kidnapping/ukraine-kidnappers-free-bitcoin-analyst-after-1-million-ransom-paid-idUKKBN1EN1QE
[xxiv] L. Katz, A. Massa (June 27, 2018) FBI Has 130 Cryptocurrency-Related Investigations, Agent Says. Bloomberg. Available at https://www.bloomberg.com/news/articles/2018-06-27/fbi-has-130-cryptocurrency-related-investigations-agent-says
[xxv] S. Foley J.R. Karlsen T.J. Putniņš (January 2018) Sex, drugs, and bitcoin: How much illegal activity is financed through cryptocurrencies? University of Sydney – University of Technology Sydney – Stockholm School of Economics in Riga. Available at https://bit.ly/2GtHg5r
[xxvi] C.S. Liang (May 02, 2018) DEAD OR ALIVE? THE FUTURE OF THE ISLAMIC STATE. Geneva Center for Security Policy. Available at https://www.gcsp.ch/News-Knowledge/Global-insight/Dead-or-Alive-The-Future-of-the-Islamic-State#.WvQi7nQLSJI.linkedin
[xxvii] K. Sengupta (August 26, 2016) The Dark Web is a Dangerous New Frontier for Those who try to keep Terrorists a Bay. Independent. Available at https://www.independent.co.uk/voices/germany-munich-attack-shooting-ali-david-sonboly-a7212151.html
[xxviii] M. Robinson (September 18, 2015) Breaking Bad-inspired computer geek who tried to buy enough ricin to kill 1,400 people from undercover FBI agent on hidden ‘Dark Web’ is jailed for eight years. Mail Online. Available at http://www.dailymail.co.uk/news/article-3239810/Computer-geek-tried-buy-ricin-kill-1-400-people-undercover-FBI-agent-hidden-Dark-Web-jailed-eight-years.html
[xxix] J. Burke (April 18, 2018) Military grade firearms increasingly available to terrorists in Europe – report. The Guardian. Available at https://www.theguardian.com/world/2018/apr/18/arms-race-criminal-gangs-helping-terrorists-get-weapons-report-warns
[xxx] G. Persi Paoli, J. Aldridge, N. Ryan, R. Warnes (July 19, 2017) International Arms Trade on the Dark Web. RAND Corporation. Available at https://www.rand.org/randeurope/research/projects/international-arms-trade-on-the-hidden-web.html
[xxxi] Justice News (June 13, 2018) Wisconsin Woman Charged With Attempting to Provide Material Support to ISIS. The United States Department of Justice – Office of Public Affairs. Available at https://www.justice.gov/opa/pr/wisconsin-woman-charged-attempting-provide-material-support-isis
[xxxii] Bitcoin wa Sadaqat al-Jihad. Available at https://krypt3ia.files.wordpress.com/2014/07/btcedit-21.pdf
[xxxiii] Institute for Economics and Peace (IEP) (2016) Global Terrorism Index – Measuring and Understanding the Impact of Terrorism. Available at http://economicsandpeace.org/wp-content/uploads/2016/11/Global-Terrorism-Index-2016.2.pdf
[xxxiv] The Meir Amit Intelligence and Terrorism Information Center (December 20, 2017) SPOTLIGHT ON GLOBAL JIHAD. Available at http://www.terrorism-info.org.il/en/spotlight-global-jihad-december-14-20-2017/
[xxxv] T. Johnson (July 20, 2016) Computer hack helped feed an Islamic State death list. Mc Clatchy DC Bureau. Available at http://www.mcclatchydc.com/news/nation-world/national/article90782637.html
[xxxvi] J.L. Richet (2013). Laundering Money Online: a review of cybercriminals’ methods. Tools and Resources for Anti‐Corruption Knowledge, United Nations Office on Drugs and Crime (UNODC). Available at http://arxiv.org/ftp/arxiv/papers/1310/1310.2368.pdf
[xxxvii] R. Hovel (June 28, 2018) Israel Convicts Israeli-American Hacker Who Terrorized U.S. Jews With Bomb Threats. Haaretz. Available at https://www.haaretz.com/israel-news/.premium-israeli-american-convicted-of-bomb-hoaxes-against-u-s-jewish-targets-1.6220106
[xxxviii] N. Spagna (December 5, 2017) Daesh cambia forma. Resta (aumenta) la minaccia. ITSTIME – Italian Team for Security, Terroristic Issues & Managing Emergencies. Available at https://www.itstime.it/w/daesh-cambia-forma-resta-aumenta-la-minaccia-by-nicolo-spagna/
[xxxix] F. Tonacci (July 26, 2016) Terrorismo, la rete criptata: così la cyber-jihad comunica con i lupi solitari in Europa. La Repubblica. Available at http://www.repubblica.it/esteri/2016/07/26/news/terrorismo_rete_criptata_stato_islamico_cyber_jihad-144816976/
[xl] HM Government (June 2018) The United Kingdom’s Strategy for Countering Terrorism. Available at https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/716907/140618_CCS207_CCS0218929798-1_CONTEST_3.0_WEB.pdf