The first instance of cryptocurrency can be tracked back to
the early 2000s, when Bit Gold was created by Nick Szabo. However, a few years
later during 2009, the popular cryptocurrency known as Bitcoin, currently worth
over £12500, was created by the possible alias name or group, Satoshi Nakamoto.
Over the following years, several other forms of cryptocurrencies were created,
such as Litecoin, Ethereum & Ripple, and as of 2017, the current market
value of all the cryptocurrencies, according to coinmarketcap.com, totals near
$515 billion dollars.
In recent years, however, the use of cryptocurrency has
rapidly become an ever-increasing solution to transferring digital money
securely and anonymously over the dark web, in exchange for various services,
such as hiring a hacking group, buying drugs, weapons and much more. There are
however several services and companies which accept cryptocurrencies as a form
of payment, such as Microsoft when buying Xbox Live Gold membership or other
The most recent and notable use of a cryptocurrency would be
the ransomware attack on the NHS and other organisations around the globe, known
as WannaCry, which encrypted critical files used by organisations and normal
users. Once the system was infected, the malware then spread to other
computers/systems on that network. Once infected, the group behind the attack demanded
that the organisations and people pay in the form of bitcoins for the files to
be decrypted. Thankfully however, a security developer managed to find a way to
stop the spread of the attack due to a flaw in the malwares coding.
Due to the lack of research conducted in cryptocurrency, it
poses new issues for digital investigators, this is due in part to the forensic
tools used are only capable of discovering some artifacts but can leave key
pieces of evidence undiscovered and potentially hinder cases. Not only does
cryptocurrency pose issues for digital investigators but also issues relating
to how laws are used in relation to cryptocurrency.
Doran (2015) stated that ‘Tools such as Internet Evidence
Finder have the capability to recover some Bitcoin artifacts. However, because
the cryptocurrency technology is relatively new, very little research has been
dedicated to what other forensic artifacts are left on a user’s system as a
result of Bitcoin’ (p.1). This supports the theory that due to the nature of how
recent cryptocurrencies are, investigative forensic tools need to be updated or
developed to search for all types of evidence left by these forms of currencies
as potential evidence can be left undiscovered.
Not only is it proving to be challenging for forensic
investigators but also for the legal side which deals with cryptocurrency as
well. ‘There is a growing concern in the legal community that cryptocurrencies
do not operate in the same manner as traditional currencies and that they are
not subject to the same regulations’ (Hatziavramidis, 2017).
Cryptocurrency Laws within UK & EU
In the UK and EU, laws based around cryptocurrency are few
at best, and have only recently started to take effect; this is due to the
recent surge of users and organisations using such methods as payment and as a
result, new laws are being created and introduced. As cryptocurrencies have
been around for just over a decade, it would stand to reason that laws for this
type of money would have been developed or other laws amended within a year or
so of its creation, due to the potential for it to be used to traffic money,
money laundering and much more. Recently however there have been plans to amend
the anti-money laundering and counter-terrorism financial legislation1 to include
cryptocurrencies as suggested by the Finance Ministry.
This is would allow the Treasury to regulate these forms of
currency and make traders disclose their identities2. By amending this
regulation, it will allow law enforcement organisations to seize the form of
digital currency being used in a case and classify it under EU and UK law if
they are suspected to be used in terrorist finances or money laundering. For
forensic investigators and expert witnesses, this will allow them not only to
analyse the user’s digital wallets but also track what they did with the funds
and who they received the cryptocurrency from and where the funds were sent to.
With regards to how law enforcement organisations can
acquire cryptocurrencies, section 19 of the PACE Act (Police and Crime
Evidence)3 is going to be amended to
include digital evidence, such as cryptocurrencies. This would include anything
stored on a digital device which could potentially store information about the
digital wallet used to store the digital currency and its digital location,
such as which servers its stored on regardless of location.
This allows police and other such agencies to seize this
type of evidence under this act but as cryptocurrencies are stored on servers
in various locations, it would pose several hurdles from a law point of view as
they would need to speak to not only the owners of the servers but also the
country of which those servers are located in. This also creates issues for
forensic investigators as, depending on the server location, they would need to
make sure that when searching for evidence, that they know when the funds were
deposited onto that server, if multiple funds came onto that server but into
the same account and where they came from.
In 2014, the UK’s revenue and customs released brief 94, outlining how they plan
to tax and regulate Bitcoin and other cryptocurrencies. According to the brief,
the reason for such regulation is because the use of bitcoin minors, traders,
exchanges, payment processors and other services can make money without paying
capital gains tax or VAT, Income Tax or Corporation Tax.
By implementing this, police and law enforcement can charge
people or companies with any of the mentioned items above if there is enough
evidence to back the investigation. However, for forensic investigators, there
lies an underlying issue in that they would need to distinguish between the
digital money obtained legally and illegally as well as if the money has been
obscured with the intention of avoiding these taxes. As a result, this law
would need to be designed with forensic investigators in mind, specifically
about how they can obtain and identify these currencies.
Cases & outcomes
This section will cover several cases which each have some
aspect of cryptocurrencies involved, along with what happened during the case,
why it was important for law and forensic agencies and what was the verdict.
The first case which will be discussed will be Regina v Adam Lewis Christopher
Regina v Adam Lewis Christopher Mudd
In this case, the appellant (Mr Mudd) was convicted of
creating and supplying a DDoS (Direct Denial of Service) tool known as Titanium
Stresser, in exchange for the cryptocurrency known as Bitcoin. The arrest
occurred during 2015 and he was charged under the Computer Misuse Act 1990
sections 1, 3 and 6 6along with section 327 of
the Proceeds of Crime Act 20027. In total, the appellant,
had received 269.81 in the form of Bitcoin followed by several other PayPal
transactions which when converted, totalled £248000 at the time of the arrest.
Analysis & Discussion
under the computer misuse act has been increasingly difficult for law
enforcement, as only 120 cases have ever been successfully convicted under this
legislation. Therefore, the conviction of Mudd marks a considerable achievement
as it shows a development in the abilities of forensic investigators and law
enforcement. From a forensic perspective, it shows that cryptocurrencies leave
a digital paper trail of when they were deposited and how much was deposited.
This evidence allows forensic investigators to better understand what to look
for when investigating crimes involving cryptocurrency under the computer
The rarity of
this conviction in itself shows the need for laws to be updated to include
increasing computer crimes involving cryptocurrencies such as Bitcoin and how
these crimes are classified. In this case, law enforcement were only able to
successfully convict Mudd as they found evidence in documents on his hard drive
that he was selling a tool known as Titanium Stresser on the dark web. This
means that, under the current legislation, people cannot be convicted as a
direct result of the use of cryptocurrency. This is because the use of Bitcoin
or other cryptocurrencies itself is not necessarily illegal under the present
Navee Ltd v Revenue and Customs Commissioners
Regarding the case between Navee Ltd v Revenue and Customs
the appellants argued in a letter that they were taxed unwillingly by HMRC for
£99,873, for one or more transactions which were designed to evade VAT.
However, when the case went to court, the appellant did not show up and was not
represented. As such, HMRC refused Mr Navee’s claim and acted in accordance
with the European Court of Justice, and the HMRC provided reasoning in that
“Payment for all the transactions was made and received in Bitcoin. There is no
audit trail to prove payment had ever been received”.
Analysis & Discussion
From a law perspective, this is showing how cryptocurrencies
can be used to avoid paying any form of tax which can have a serious effect on
the economy, as if more and more people start using bitcoin or other digital
currencies as a form of payment and there aren’t any laws in place to regulate such
currencies then there will be an increase in tax evasion. For a forensic
investigator, it is also difficult to prove what a person or organisation did
with cryptocurrency without obtaining the digital wallet of the user. Even if
the investigators do manage to obtain the wallet used, the information stored
within them is sometimes difficult to analyse due to the technology around
cryptocurrencies being relatively new and changing, along with investigative
tools not being able to fully distinguish between evidence and normal
Skatteverget v David Hedqvist
In the case regarding Skatteverget v David Hedqvist9, Mr Hedqvist wished to set
up a Bitcoin exchange but needed to know what the VAT procedure would be in
Sweden, this resulted in the CJEU (Court of Justice of the European Union)
ruling that bitcoin and other such cryptocurrencies are VAT exempt throughout
the EU. This was the first case of its kind that influenced several countries
revolving around a cryptocurrency and as a result marks a significant step into
creating and adapting laws and regulations around cryptocurrencies.
Analysis & Discussion
From a law point of view, this has added several hurdles, as
the ruling could allow for potential fraud and money laundering to take place
without breaking the law. This is because cryptocurrencies are not regulated
and currently there are no laws which govern how cryptocurrencies can be used.
This creates several issues for forensic investigators as cryptocurrencies are
not regulated under UK law nor the same as each other. Not only are there
different cryptocurrencies but also there are multiple way in which to store
the currency such as a physical wallet like a USB or a logical wallet which is
store locally on the user’s computer and online. They would also need to be
able to successfully analyse all these types of wallets and currencies to be
able to produce a strong case.
Law enforcement operations
Due to cryptocurrencies being used more and more frequently,
both in legal and illegal transactions, there have been several major police
operations within the EU & UK to try and stop such illegal transactions
from taking place. These transactions normally take place on the dark net but
have recently expanded over to normal sites as mentioned previously.
Operation Sparrow10 is currently an ongoing
operation conducted by the Avon and Somerset police into the investigation of
the now defunct trading platform MintPal and the former CEO for fraud and theft
of funds from the platform. Many previous users of the trading service have
been getting emails from the police related to the operation and how they can
report how they have been affected financially.
As the platform used various types of cryptocurrencies, it
has proven difficult to track who lost what form of digital currency and how
much they lost overall. For law enforcement agencies, this marks a step in the
right direction into policing cryptocurrencies and bring those accountable to
justice. Back in 2014, the most popular trading platform at the time, known as
Mt Gox11, processed almost 80% of
the internets Bitcoin, was shutdown, however the CEO has recently been charged
with embezzlement as at the time, he was accused of transferring money from
customers bitcoin accounts into his own.
From a law perspective, this is another achievement in the
fight against online crime involving cryptocurrencies as they were able to
arrest the former CEO but also are currently in the process of recovering funds
for those affected. However, due to the nature of cryptocurrencies and their
volatility, recovering these funds is going to be difficult along with
successfully tracing down the users who lost their money. For forensic
investigators, this again proves that cryptocurrencies do leave some evidence behind
which can be used successfully in a case but as mentioned previously, the tools
used can miss out on critical evidence which could aid in a successful
Boiler Room Scam
Another police operation, which currently doesn’t have a
name, recently took down a cryptocurrency boiler room scam12 in London. The type of
scam was known to have cold called people to try and persuade them into buying
a faking cryptocurrency. As a result, a total of nearly £160,000 was lost by
the people who were affected. From a law perspective, this is showing that
bitcoin crimes are increasing in not only online but also in the real world.
This is highlighting the point that police and the
government need to introduce more laws which protect consumers from fraudulent
scams involving cryptocurrencies but also how people or organisations
conducting those types of crimes are punished accordingly. For forensic
investigators this is also showing that more needs to be done in the research
field, so they know what to look for but also how to effectively trace down the
people who were affected by this type of scam.
AlphaBay & Hansa
One major example of international cooperation involving
cryptocurrencies would be when the FBI, DEA, Europol, Thailand, Canada, UK,
France, The Dutch National Police and various other law enforcement agencies,
took down the popular illegal trading sites known as AlphaBay and Hansa13 on July 20th,
2017. These sites were known to have allowed the sale of drugs, weapons and
other types of illegal material for Bitcoin and various other types of
For a forensic investigator, this would have proven
difficult to track all the users of the sites along with their activities, and
successfully build a case against them, this is due to the anonymity of the
sites and its users. From the legal perspective, this would have proved even
more difficult, as not only would they have to secure international cooperation
but also decide on which country the people would be charged and under which
laws, as each country has different laws relating to cryptocurrencies.
Upon analysing the operations mentioned above, it has become
clear that more and more crimes are beginning to surface, despite being hosted
on the dark web where anonymity is a core feature, and that law enforcement
agencies are acting against such activities to not only bring those to justice
but also to prevent such actions from occurring again in the future.
As with the nature of cryptocurrencies and how they have
boomed in recent months, as mentioned previously, it has become clear that the
need for more laws and regulations has increased dramatically. Granted, there
have been some significant results as of late in bringing down illegal services
and operations which operate on the dark web and which accept cryptocurrencies
as a form of payment, but there are many more websites and organisations which
use cryptocurrencies for illegal purposes.
As highlighted above, cryptocurrencies such as Bitcoin need
to be regulated to prevent such illegal activity from occurring as well as to
bring the currency into line with UK law and to allow more legal uses of
cryptocurrencies. Not only do they need to be regulated but more laws need to
be developed along with procedures, so law enforcement can acquire the funds if
used for money laundering or terrorist financing.
As such, specialist tools would need to be developed or
updated to include cryptocurrencies in their search parameters so forensic
investigators can better acquire evidence without leaving some evidence