A Law Enforcement Approach To Digital Assets - Michael Halepas | BlockAML

the floor is yours thank you very much thank you everyone for joining thank you yes good morning uh thanks for joining us today uh my name is Michael halip pass as you can see uh this talk is titled a law enforcement approach to digital assets obviously I can't talk you through every topic in this subject in the time allowed I've got quite a few slides I shall fly through them if there are any questions uh on any of the slides if you'd like to see copies of the slides or the underlying documents please feel free to approach me later uh I am a barrister from London in England most of my career so about 99% I've practiced in criminal law I'm currently uh a consultant to the uh Council of Europe's economic crime and Corporation division I'm also a consultant to the uh Legal Services panel of the uh government of the British uh Virgin Islands uh this year I launched uh my own project uh block AML which offers Consulting and trading Services uh at the intersection of financial crime anti-money laundering suspicious activity reporting and digital assets formerly I was the uh lead digital assets prosecutor in an offshore jurisdiction that role involved me um plugging gaps in the jurisdiction's crypto capabilities I drafted the uh jurisdiction's uh parallel virtual assets investigation strategy I uh devised and delivered uh Law Enforcement Training um um feel free to find me on on social media ready great okay so regardless of who's in my audience whether they be uh tax officers police officers intelligence staff uh Regulators ethereum devs the message is the same the the initial message is the same digital assets are a Bonafide asset class they're not criminal per se and we need to begin in my view considering them as capable of constituting property property that could be held stored transferred stolen held on trust uh obviously the people in this room know that blockchain enables uh permissionless borderless uh instant immutable transfers of value across the internet rails so instantly we should see that there are significant moneya laundering terrorist financing crime risks using this technology uh from a law enforcement uh background uh everything that we do as Law Enforcement Officers or when I was a law enforcement officer uh is concerned with protecting the public the law enforcement purpose requires that we prevent detect investigate and disrupt criminals uh where possible now before I go any further it's really important um that I emphasize that apparently uh last year 3.1 trillion dollar uh of illicit funds passed through trfi uh so criminals are already laundering uh their their criminal proceeds so that is a property that is generated from the uh from Criminal conduct or uh property that is intended to be used in in criminal conduct so the criminals they already have their methods uh and they're doing it already so this is certainly not um um a talk uh to talk down people's use of digital assets far from it um so what I'd like to discuss today is to share some ideas some experiences some data uh with you uh just looking at the current landscape uh I know those of you who were in The the previous talk we heard quite a bit about regulation and you might have heard of a financial action task force or fat as I call them for short uh it's an intergovernmental uh organization which sets the standards or makes recommendations uh to jurisdictions around the world uh sets the bar quite High to uh help jurisdictions to tackle to combat the the crime risk of money laundering terrorist financing um June June 2019 was quite a seminal year uh as far as fatf and digital assets are concerned because uh fatf uh acknowledged that um digital assets are quite important um and uh it brought them within their their standards vasp or virtual asset service providers or casps crypto asset service providers if you're in Europe um since 2019 are expected to implement measures such as uh customer due diligence to know the identity of the customers that you're dealing with uh to uh introduce recordkeeping and to report suspicious transactions uh as a speaker before me mentioned uh there is uh something called the travel rule uh I won't delve into it too deeply uh but it's introducing the requirement or the expectation that uh vasp will uh collect store transfer beneficiary and originator data with uh transactions so from a law enforcement purpose in theory that's wonderful because if we are investigating a suspected crime uh in theory we can go to a a a a Cooperative uh vasp and ask them for uh proof of uh identity documents account opening documents transactional history of the uh account that we that we're interested in that we're that we are investigating a few documents here if you'd like to know more about these documents I can share them with you later really really interesting documents uh the top one um is an Interpol paper that was released in April this year uh regarding the cyber crime threats in the continent of Africa uh really interesting document really well thought out and I think what's really important from it is that ransomware is rampant and is on the rise we know that ransomware payments are often demanded in uh virtual assets digital assets um it's said that currently there are over 650 million uh Africans uh who who use mobile phone devices as their primary means of accessing the internet now I've included that in there just to emphasize that as an attack area as an attack surface that's huge 650 million devices uh and that will only grow we know that cyber crime is surging ac across the continent um and it requires uh it requires attention um the other document is is uh again from January this year um the state of financial crime it said that cyber crime uh is anticipated uh to cost uh $9.5 trillion dollar this year by 2027 um it's expected that the number of connection points across the internet of things will almost double to 29 billion so again um reminding that as an attack surface for criminals it's massive and we need it requires our attention um 2031 as you can see ransomware victims are expected to lose 26 5 billion with a tax expected every two seconds that that blew my mind when I read that uh so you've all heard of CH analysis I've got some um useful um charts of of theirs to talk you through um annually chain chain analysis uh produced their uh state of uh crypto crime report really really useful data and I've included uh these two charts here you can see at the at the top of the screen um what I noticed is interesting interesting here with the total crypto currency value received by wallets that are identified as illicit is that you can see that there's a huge uptick in 2022 and 2023 in um sanctions activity so uh there was a major event in Eastern Europe uh uh q1 of 20 uh 22 and you can see that um in a US dollar sanctioned environment um unsurprisingly perhaps um sanctioned activ U has has increased something to be aware of if if you're a vasp uh bottom half of the screen you can see I've included this one because it's so important in a world of fud in crypto and we don't need any more fud it said that a minuscule amount 0.34% of all crypto transactions in the world uh are ilicit now to my mind that's relatively small obviously we want to work together in the space to to reduce that number to as little as we can but but my point is that we already have tremendous amounts of fud in this space with 0.34% of the transactions being elicited I wouldn't like to think how much fud will flow if that number increases in the coming years um again here uh again from from the CH analysis report uh at the top half of the screen you can see uh illicit transaction volume by by crime category and what's interesting is that um with both of these charts actually Bitcoin traditionally was a preferred choice for Bad actors Mis using uh digital assets stable coins now something to bear in mind uh for for for devs I think uh the next slide uh so this is this is total cryptocurrency laundered by year at the top so you can see there's been a reduction uh in the in the overall volume between 22 and 23 um which I suppose is is ca for optimism but again think of that number 22.

2 billion US of illicit uh crypto trans transactions compare that to $3.1 trillion of uh illicit traditional Finance activity just to put it in perspective um uh in the bottom half um you can see the destination of crypto leaving wallets that have been identified as it as illicit and why this is interesting why I've included it is that you can see that most uh illicit crypto if I can call it that travels to uh centralized exchanges which is really pleasing for someone like me for law enforcement offices because although as you know you cannot Trace transactions on the blockchain through a centralized exchange we know that if we're dealing with a Cooperative exchange uh in a Cooperative jurisdiction and bear in mind not all not all VPS are the same and not all jurisdictions are the same but in theory that gives us hope because those vasp should be storing um really helpful useful identifying information on the persons controlling the wallet because bless you uh because we can't prosecute we can't prose Ute a pseudonymous wallet address we're looking to identify with reasonable certainty the person or persons controlling that wallet uh again a few more um charts to show you um because I'm at I'm at an E Event so I wanted to to focus a little bit on Def and hacking uh top slide uh top half of the screen I've included that because You' see that um whereas 21 and 22 there quite a lot lot of value stolen through hacks there was a there was a drop a sizable drop 23 interested to hear what your thoughts are on that my my suggestion is that perhaps that drop has to do with uh more robust security features on on platforms maybe developers are improving um their services uh the bottom half we can see that um in terms of crypto value stolen hacks by victim platform type defi is the number one now taking my lawyer hat off and putting my crypto native hat on one of the reasons causing me to hold back from involving myself in defi platforms is the fear that my funds will be stolen and hacked so I hope I hope that with time the security measures will improve further um again sticking with defi hack uh so you can see the top chart shows you the value uh of of crypto stolen I'm included the bottom chart because I think it's interesting to see that uh the the three main attack vectors uh when it comes to defi hacks are price manipulation price manipulation hacks compromis private Keys uh and smart contract uh exploitations uh also I've included this for Pump and dumps because again we're at an e events uh uh these are just My Views um but you can see here that um the um the coins have been identified as uh potentially uh pump and dump schemes um okay the value they're they're decreasing in number but here on the bottom bottom chart in December 23 I mean we won't talk about May 23 but December 23 it was almost 10% still of erc20 tokens were categorized as potentially pump and dump my view is that uh these data here erode trust in in the network and I would hope that I would hope that over time those numbers decrease right let's move on to some case studies and of course I you'll understand I'm not going to share any sensitive information uh I'll talk you through some examples like this one you might recognize the port top left and you might recognize the court bottom right this is a CA this is not a case from Belgrade this is one of my previous cases now I've included this because it's is really important it might have a most important slide I'd say it's probably this one I want you to think that when we're talking about criminal investigations we're not simply talking about identifying illicit funds identifying illicit uh ethereum uh Bitcoin or whatever and confiscating it that's great if we can do that in the public interest but there's so much more to this that we need to open our minds to so for instance there are issues in criminal proceedings that parallel virtual asset investigations can assist with let me give you this example so again no no names this is definitely not a case from bgrade this is one of mine from elsewhere so let's say uh on a fairy from another country uh an 18-year-old uh will say that he is a trainee plumber 18-year- old traine plumber not earning much money arrives in a a fancy looking uh 4x4 uh Customs officers at the Port Terminal search the vehicle and they locate 1 kilogram of cocaine in the rear of the vehicle the street value of that cocaine is six figures uh in pounds um and and obviously uh Import in cocaine Class A drug uh possession of cocaine with intense Supply they can carry quite Hefty prison sentences but of course in a criminal organization uh those at the bottom those who are mere careers uh those who perhaps are doing it as a one-off will will expect to receive a lower prison sentence than say top of the chain the organizer now this individual this 18-year-old we'll call him a plumber trainee plumber admitted to possession of the co co okay and said yes you've got me it's a one-off I'm a mere Courier I have nothing more to do with with drug Supply I was just doing this as a one-off I have no profit to gain from this activity so police sentence me accordingly now having defended people in the past that's great if you can agree a basis of plea with the prosecution is to commit your client to being at the very bottom of the run of the organization that's fantastic when it comes to mitigating in their sentence hearing well what if we conducted a parallel virtual asset investigation into this individual so the the drugs case proceeded with my colleagues and what if we we looked into the digital assets Holdings of this individual and what if we identified that one of this 18-year-old trainee plumbers crypto Exchange accounts saw $100,000 US worth of stable coin passing through it in the previous year would that indicate that perhaps this individual is not a mere Courier in the organization would it be information that the sentencing Court would want to rely on to paint a more accurate picture of their activity so this is why I say these virtual asset investigations are so much more important than simply identifying illicit crypto to confiscate right another two uh one on the left this is not one of my cases this is from uh England from the northwest of England and I'm included these because the point I want to make here is that again we cannot we're not looking to identify a wallet and prosecute a wallet very often we are relying on or law enforcement officers of relying on traditional investigative techniques so you might look at bank statements messages um handwritten notes um uh confessions perhaps an interview now uh you're looking at a message chain from a um cash Courier for a heroin Distributing gang in the UK now The Courier was stopped searched the phone was found the message chain was um analyzed there's a Bitcoin wallet address in there with some other important information and from that mobile phone the whole heroin Distributing gang uh was captured the whole the whole uh gang unraveled so again just the point is that um it's traditional investigative techniques obviously we need to improve and increase training to Law Enforcement Officers to know what uh a randomly generated uh sequence of of digits means what to look out for on the right um this is that's a Google image but that's uh that's related to a a case of mine that I I worked in where there was no evidence in bank statements of of money moving from bank to exchange there was no evidence in text messages no admissions in interview uh one of the defendants had a journal seized from them on arrest uh admittedly I didn't spot the evidence first time I reviewed the journal but the second time I review the journal I found on one page in fact in a corner of one page of a journal um that that there was evidence that this defendant um held owned controlled digital assets we investigated and it turned out that there were perhaps um interested parties law enforcement agencies in at least one other jurisdiction so again this is more for police police need to understand what to look for in customs officers um these ones here uh so we'll go left to right so the the again the law enforcement purpose um is is essentially to protect the public um and it includes efforts such as Public public Outreach campaigns so the top left one very s case um of um a scam a scam U I don't want to say crypto crime it was a scam uh and crypto was involved but in this one I advise the police on um recommendations that they can make to the public so lawyers worked with police public Outreach to help educate the public on what to watch out for I mean each one of these slides separately is respons I for tremendous fud in this space and one of the things I tried to do is to tackle the fud uh in the center you see an article relating to Pig Bing I'm sure you've heard what that is essentially it's a a social engineering scam that involves crypto and on the right we have uh the gentleman who is single-handedly probably uh responsible for most of the fud in the space it's described in various articles is a crypto crime but it's anything but that is a fraud and if you read the prosecution and defense documents that were made public in that case in in my description it is a case of a Relentless and serious fraud and that's all it is and in fact if you read the forer documents on that case over half of the Fuller application document relates not to crypto assets but to Illegal uh political donations essentially here I believe that we need to increase communication and we need to increase um education of the public to at least understand the basics of blockchain and really self- custody because if the public knew more about self- custody articles like these wouldn't have such punch okay so challenges and limitations just a few some of them that I that I can think of um you heard the previous speaker talking about regulations and so on white and it's great but what is clear today well in fact that paper up there is from uh April 2024 as at April 2024 um 76 of the uh fatf member jurisdictions uh had not even made a start on a crypto regulatory regime now that that needs the change but there are weaknesses in the system and you're looking at them if we if we um talk about the geographic region with the most unregulated virtual asset service providers is the continent of Europe uh and over here bottom left you can see u a a chart showing the jurisdictions that that haven't started in purple uh the ones that have regulatory regimes in place if I were a criminal looking to launder criminal uh digital assets or tainted digital assets tainted by criminality I'm probably going to send them to a VP in an unregulated jurisdiction uh law enforcement offices if they're dealing with one of these parallel virtual asset investigations should be alive to uh individuals who insist on always transacting with unregulated jurisdictions why would you why would you be doing that is a question to be asked um here so just some of the challenges Moving Forward Air drops yield uh Dynamic NFS so traditionally it's a bag of cash or it's jewelry or it's a car that is Tainted by criminality that's great it's nice and easy it's it's very easy to ascertain the the value a bag of cash can remain in the police store room but what I want people Regulators uh deves and so on just to apply their minds to is that we have entered a world now where um criminal property in this realm is capable in certain circumstances of increasing in value and generating criminal property on top of criminal property on top of criminal property so for instance if I'm a criminal if I if I steal a car and sell a car for cash and buy a dynamic nft with that cash the dynamic nft uh as with the uh other side I'm sure you're aware of um has a potential to generate resources and to increase in value of over time well in theory if the digital asset if the dynamic nft is is Criminal is Tainted when I purchase it we need to be thinking when I say we Law Enforcement Officers need to be thinking about the potential for the criminal property to generate resources that are tainted and they should be considered in confiscation proceedings as well again I don't have any real affiliation to Jupiter it's just it was quite a cool graphic um if if I'm a criminal interacting with um with the Dex and I'm rewarding rewarded by airdrop for my activity using tainted crypto Law Enforcement Officers need to be aware of the potential for the air drops to be tainted and therefore uh subjects or targets of confiscation again the same with with with Stak ethereum if the ethereum that I have is is Tainted by my criminality then what about the yield we shouldn't ignore these uh again I had to include a slide about terrorist financing wouldn't be a law enforcement talk on crypto if I didn't um so it's it's not just these ones here but we we've got to think about especially defi platforms um the the North Korean missile program is said to have been funded by by tainted crypto uh terrorist groups have discovered that setting up a crypto wallet is a lot easier for them than opening up a bank account um and it's happening this activity is happening there is one um extremist Group which has an ideological preference for crypto I won't tell you on camera I'll tell you later if you want to know but we need to be alive to these right future directions as I see them I had to include this one um this gentleman's appeal is pending so I won't say too much about it and I don't know all of the facts but I want clearly there are individual rights to privacy clearly defi has the potential for tremendous Financial inclusion in places where Banks don't operate so defi can be a force for good at the same time a balance will have to be in future somehow if we want this technology to go mainstream don't shoot the messenger but we have to acknowledge that transparency must increase I don't have the answer to these questions but I know that a Dutch Court a court in Europe deci whether right or wrong it might have been a boomer judge who doesn't understand technology properly but courts increasingly are cracking down on uh uh developers of of platforms and my suggestion is that over time uh turning a blind eye saying well I set up the contract and that's it I can't do anything about uh illicit activity on the platform it probably won't wash will this mean that developers will go pseudonymous like Satoshi I don't know will it push people to develop platforms using AI to scan the the wallets they interact with possibly uh I I hope that might be one of the solutions but this is something for devs in particular to think about um okay mining if you don't know what cryptojacking is ask me later um but mining shouldn't be forgotten about because typically miners are not required to implement anti-money laundering rules regulations such as know your customer and there's at least one case I can think of I think it's in Spain where a criminal organization bought bought a warehouse bought lots of mining equipment with criminal property so the mining equipment is Criminal and they just generate they just mine uh uh clean if we can call it that uh digital assets that's something to be aware of as well we know that the Iranian regime is is mining to generate funds uh and then this one lastly so this is a very interesting document europol put out a document in I think October 22 talking about crimes in in the metaverse Interpol followed it with a really really thoughtful uh document that I can share with you later if you like and it discusses uh crimes in web 3 in the metaverse which it I believe I believe I might be wrong but I believe this is the first document that has has given a title a name to these offenses meta crimes this chart here is is again it's it's thought for provoking because it suggest suggests a range of crime types that can be committed in and through web 3 and as we move into this web 3 future this web 3 world we're still very early but we need to um open our minds to the potential uh for abuse uh sex offenses uh Data Theft uh stolen digital assets all sorts of crime types that be committed in there however it's not all negative web 3 um holds the potential for real gains in terms of uh training uh meetings uh imagine if you could take a jury uh to a virtual crime scene rather than having to rely on a witness to to draw an x on on a on a map uh or um a high stress for instance uh terrorist scenarios for training police officers to replicate these uh training scenarios in web 3 just these can't be done traditionally so it's not all bad but we need to be uh open to the potential for criminality nfts even being used in crime in in in the metaverse and in conclusion just some points for me so if we're focusing on law enforcement it's essential that law enforcement offices uh agencies public agencies around the world stay updated on the technology uh the training has to be continuous you can't just do one course on what are digit digital assets and then forget about it the training we know that the technology develops at such a rap it pays that the uh training and education should be continuous uh and should focus on emerging Technologies in my view um cooperation collaboration communication between private public between between devs I I've I recommend that devs contact their regulators and engage them in dialogue to introduce them to some of the ideas that you're working on um and one of the weaknesses at the moment is the compliance function the compliance tools are very often not interoperable that should change over time I hope it does um and that's it thank you for joining me thank you for your patience you have any questions far away there is one hi thank you so uh I just want to confirm if I got got this uh correctly so from the standpoint of the law enforcement is the is there a push or desire to get um crypto and web Tre regulated to the amount of the other uh financial institutions so it's like as a regular practice get like same as you getting bank statements to get uh everything sorted thank you thank you thanks for that question uh I think that there's a push to move move more in line with trfi obviously the two industries are different obviously data protection is very important even with bank statements when we obtain bank statements you're not interested in every transaction on the bank statement just some of them so gdpr in Europe plays a part but yes it does and I think over time over I don't know what the answer is we're in such an exciting space we're so early I don't know what that future looks like but if I had to place a bet on it over time transparency will increase and for this technology to go mainstream it's inevitable it's inevitable in regulated jurisdictions that this will happen more I hope that answers your question um if I understood correctly uh we're moving towards um uh time an era where developers will be held accountable for uh permissionless systems and they cannot just uh deny responsibility over criminal activity that happens there does it mean that um developers could be criminally charged for not enforcing enough security to prevent criminal activity on protocols thank you you remind me of something else by the way so one of the suggestions I have is maybe that we will see platforms move to more for example like tether where they have the ability to freeze the funds I wonder if if that will increase over time is tricky because we know that especially in America uh and here in Europe um there's a push the crack down on this activity and they want to hold people accountable uh one of the appeal points in this in the tornado cash case I believe is the is the fact that well look it was it was a tool he just set up a tool right um what I'm certain of uh is that there will have to be a balance struck there has to be the the the Privacy tools have a real legitimate use case right it's not all it's not all criminals the trouble is fud fud is really extreme in this industry um I don't know I'm here to speak to devs I hope that you have some suggestions but all I know is that turning up to court and saying tough what can I do about it it's not my problem it's probably not going to wash so far it hasn't washed so somehow we need to we need to engage discuss with each other and figure out what that balance is going to look like so I don't mean to scare people I'm just sharing ideas that's well thank you for your question thank you very much for a very tonight's presentation