Foreign media: Sexual crimes, cryptocurrency transactions, and the challenges of technical investigations

This article was published by The Paper, originally appeared in Foreign Policy, authors: Corinne Redfern & Seulki Lee, translation: Gong Siliang.

[Editor's Note] On February 4, a South Korean court sentenced the main perpetrator, Dr. Jo (real name Jo Joo-bin), to a total of 45 years in prison for the "Nth Room" case. However, there are still numerous websites hosted on the dark web containing content of sexual assault against women and children that attempt to conduct transactions using cryptocurrency. Currently, many investigators indicate that tracking and investigating this emerging technology of cryptocurrency requires appropriate training and allocation of resources. The advancement of this investigation still requires cooperation among authorities, investigators, and cryptocurrency exchanges to bring to justice those criminals attempting to evade sanctions. The author of this article, Seulki Lee, is a freelance writer based in Seoul, South Korea; Corinne Redfern is an Asia correspondent for the Fowler Project. This article originally appeared in Foreign Policy.

At that time, Chris Janczewski was preparing to conclude a lengthy investigation into "online drug trafficking in Thailand"; a source called him, inquiring about a website in South Korea. The site, hosted on the "darknet," encouraged users (including American citizens) to pay in Bitcoin to access over a million videos of the rape and sexual assault of children, the youngest of whom was only six months old.

Janczewski is a special agent with the IRS Criminal Investigation Division, assigned to track cryptocurrency transactions and investigate money laundering and other forms of organized crime, but he had never investigated child sexual assault cases. He recalled, "I thought at the time that the FBI, the Department of Homeland Security, or someone else must be investigating this. For example, why would the IRS need to take action on this? Then I inquired around, and I eventually realized: no one was investigating this."

In the following two years, until the end of 2019, Janczewski found himself at the forefront of investigating and shutting down what the U.S. Department of Justice called the world's "largest darknet child pornography site."

Cryptocurrency is increasingly being used to fund child sexual exploitation, creating new opportunities for law enforcement to track down criminals. However, experts say successful cases are rare: unlike those responsible for investigating major financial crimes such as drug trafficking and money laundering, agents investigating child exploitation lack training, knowledge, and resources to track the growing operations funded by Bitcoin and other cryptocurrencies. Due to law enforcement lagging behind, thousands of offenders remain uninvestigated, allowing them to continue to harm children freely.

Contrary to popular belief, some of the most mainstream cryptocurrencies, such as Bitcoin, Ethereum, or Litecoin, can be easily tracked; every transaction is recorded in a shared public ledger known as the blockchain. Criminals can use various means to obfuscate their spending, but these records (though difficult to find) still exist. "If I pay you $2,000 in a dark alley, who witnesses this transaction? Just you and me, right?" said Pamela Clegg, director of financial investigations and education at blockchain analysis firm CipherTrace. "With cryptocurrency… the whole world can be a witness."

However, due to a lack of understanding of cryptocurrency and its use in child exploitation, anti-human trafficking investigators in the U.S. and globally often refuse to take on cases or miss key evidence. Clegg cited an example from 2017, where a team of experienced law enforcement officials from Central America discovered a website containing child sexual abuse material (CSAM) with a complete Bitcoin address that could identify dozens of users. However, the team did not know how to collect data before shutting down the site, resulting in the loss of all information.

"I don't want to portray this as 'law enforcement has no experience in the crypto space,'" Clegg explained. "Law enforcement has done amazing work in the crypto space. What I'm mainly referring to are those teams focused on human trafficking and child sexual abuse material." In 2019, she spoke to 750 law enforcement members from nearly 100 countries, each of whom were experts in investigating human trafficking and child exploitation. "I asked, 'How many of you have actually handled cases involving cryptocurrency?'" To Clegg's disappointment, only five people raised their hands.

In this regard, Neil Walsh, head of the Cybercrime, Anti-Money Laundering/Counter-Terrorism Financing Division at the United Nations Office on Drugs and Crime (UNODC), agreed. Governments around the world have failed to prioritize cryptocurrency analysis in child exploitation investigations. "In my view, this is still seen as a niche area: it's a bit odd and not common."

Meanwhile, the speed at which offenders spend virtual currency far exceeds the ability of anti-human trafficking agencies to track them. According to data from U.S. blockchain analysis firm Chainalysis, the amount paid in Bitcoin and Ethereum to websites containing child sexual abuse material nearly quadrupled from 2017 to 2019, exceeding $1.75 million.

Some pioneers in cryptocurrency are making transactions completely anonymous by enhancing privacy and data protection, which complicates tracking criminal behavior. Among the approximately 4,000 cryptocurrencies currently listed on the price tracking site "CoinMarketCap," private analysts and senior IRS investigators indicate that only a few, like Bitcoin and Ethereum, can be directly tracked. Even so, tracking these currencies requires the right training and tools.

"We are in an arms race," said Rebecca Portnoff, data science director at THORN, an organization dedicated to developing technology to combat child sexual abuse. "It's a rather complex arms race."

But Clegg stated that the department has not prioritized training for these cases because the amounts involved in buying and selling online child sexual abuse materials are just a small fraction of the transactions in white-collar or drug crimes: most transaction amounts are between $10 and $50.

To shut down the South Korean child exploitation site Welcome To Video, Janczewski and a core team of investigators from the IRS and the Department of Homeland Security collaborated with the National Police of Korea. They spent two years tracking thousands of Bitcoin addresses and ultimately arrested 340 men in 38 countries (including the U.S., U.K., and Saudi Arabia), rescuing at least 25 children from abuse.

Janczewski believes that other federal agencies ignored "Welcome to Video" because they lacked expertise or necessary manpower. "Investigators focused on child exploitation cases are very good, but they rarely need to pay attention to cryptocurrency, which is a big learning task for them," Janczewski said. "They are too busy." Sometimes, when Janczewski shared a lead with other agencies, he often found weeks later that they had made no progress. "In one instance, an agent said, 'Yes, I really want to handle this case, but it would take a lot of effort to figure out what this is all about.'"

For South Korean officials, the time spent on this case was no less. Since 2018, Jong-sang Choi has been the head of the cyber investigation department of the National Police of Korea, overseeing dozens of agents investigating the "Welcome to Video" site. The site had up to a million users, making it challenging to track their crypto transactions: "It's a battle between spear and shield," Choi recalled.

Despite the best efforts of Choi and Janczewski, most users of Welcome to Video likely "got away" with their crimes. In several cases, investigators traced Bitcoin addresses abroad, but the relevant authorities ignored their reports. Choi stated, "They are not only uninterested in this, but they also lack the capacity (to track down the offenders)."

Walsh from the UN Office on Drugs and Crime stated, "This is about turning this 'technical challenge' into a mainstream investigative technique. It requires political leadership at both domestic and international levels."

Consumers of child sexual abuse material are ubiquitous, but the demand is primarily driven by people in wealthy countries. A study from the Philippines found that three-quarters of those purchasing child sexual abuse materials were from the U.S., Sweden, and Australia. According to data from the Global Partnership to End Violence Against Children, 81% of child sexual abuse materials are produced in low-income regions such as Southeast Asia, Africa, and Latin America. In these countries, the tools for analyzing virtual transactions are very expensive. Walsh said, "If you are in the UK or the U.S., it is possible to invest in blockchain analysis. However, if you come from a developing country, it is very difficult to do so."

Some experts call for not relying on resource-strapped agencies and governments in low-income countries to independently investigate child sexual exploitation crimes using cryptocurrency, but rather to introduce protocols through financial institutions, such as "exchanges" that can convert cryptocurrency into other assets (including traditional, government-issued currency), to identify suspicious activities and report them to authorities.

In May 2020, Aaron Kahler, founder of the Anti-Trafficking Intelligence Initiative, established the Anti-Trafficking Cryptocurrency Alliance after witnessing the "huge failures" of U.S. law enforcement and financial institutions in investigating child sexual abuse. He stated, "This is still not a priority." He explained that this nonprofit alliance is working to encourage exchanges to collaborate with law enforcement while providing much-needed tools and expertise to U.S. investigators.

Since the shutdown of the Welcome to Video site, Janczewski has collaborated with European investigators to track over 300 Bitcoin addresses related to a Dutch site called "Dark Scandal," which sold videos of the rape of over 2,000 women and children. In March of last year, authorities arrested the site's administrator.

Janczewski admitted that he initially did not understand how widespread the use of cryptocurrency was in child sexual exploitation, nor did he know the role the IRS played in combating this behavior. But he knows now.

"When I started digging deeper into the investigation, I realized how important this was."