Cryptocurrencies and National Security

By Ankit Panda

In 2009, an anonymous software engineer using the pseudonym Satoshi Nakamoto created Bitcoin, the first cryptocurrency. In the years since, the market for Bitcoin and some 1,300 other cryptocurrencies has swollen to $500 billion; they are used in hundreds of thousands of transactions daily to buy everything from software to real estate to illegal drugs.

So called for their use of cryptography principles to imbue virtual coins with value, cryptocurrencies present unique challenges for governments. For others, including terrorist organizations, sanctioned states,
and transnational criminal groups, these technologies represent a source of opportunity.

How does a transaction work?

Most cryptocurrencies are exchanged on decentralized networks[PDF] between peers who control virtual wallets secured with public key encryption. All transactions of most cryptocurrencies are recorded publicly on a universal and immutable distributed ledger known as the blockchain.

Cryptocurrency users send funds between wallet addresses on the blockchain. Imagine two users, Alice and Bob. If Alice wants to send one Bitcoin to Bob, she first needs to know the address of Bob’s Bitcoin wallet. Alice then uses her private key to securely sign a transaction containing Bob’s wallet address and the amount to be transferred. Alice then sends the signed transaction to the Bitcoin network, where it is confirmed across the blockchain by “miners” and recorded into a transaction “block.” Once this occurs, the transaction is complete: one Bitcoin is debited from Alice’s wallet and added to Bob’s. The Bitcoin network retains a record of this transfer on the blockchain forever.

Are transactions anonymous?

Bitcoin and Ethereum, the two most popular cryptocurrencies, offer something close to pseudo-anonymity. The blockchain does not record real names or physical addresses, but if the owner of a wallet becomes known, their transactions, which are public, can be traced back to them.

Bitcoin and Ethereum, the two most popular cryptocurrencies, offer something close to pseudo-anonymity.

Other cryptocurrencies, such as Monero, offer anonymity-enhancing features that make them especially appealing for individuals and entities looking to avoid government scrutiny. Researchers have found [PDF], however, that even Monero does not offer watertight anonymity.

How are cryptocurrencies made?

Cryptocurrencies vary in how they manage supply, but many of the popular ones, including Bitcoin and Ethereum, are “mined” up to a fixed total supply. For example, only twenty-one million Bitcoins can ever be mined; nearly seventeen million have been so far.

Mining is the process of computers solving specific cryptographic problems to confirm transactions on the blockchain. Miners are rewarded with coins for solving these problems before others.

Are they a legitimate investment?

Many cryptocurrencies have seen wild volatility and exponential price appreciation in recent years, rewarding early adopters with immense profits. For example, the price of a single Bitcoin was just a few U.S. dollars in 2012, but it spiked to more than $19,000 in December 2017. This has made cryptocurrencies a popular speculative asset. However, a recent survey found that most economists suspect Bitcoin is experiencing a bubble.

How do criminals, terrorist organizations, and sanctioned states use cryptocurrencies?

For decades, the global banking system has been subject to heavy regulations concerning money laundering, terrorist financing, and customer identification. National governments led by the United States greatly enhanced these rules in the wake of the September 11, 2001, terrorist attacks. However, because cryptocurrencies hinge on peer-to-peer transactions independent of regulated financial institutions, they have removed an important source of friction for various illicit activities.

Dark web markets. Shortly after its inception, Bitcoin became a popular medium of exchange on so-called dark net marketplaces—highly anonymized online markets for illegal goods and services, primarily narcotics. In 2013, U.S. authorities, including the Federal Bureau of Investigation (FBI) and the Drug Enforcement Administration (DEA), shut down Silk Road, the first and largest dark net marketplace, and arrested its owner, Ross Ulbricht. Tens of thousands of users had bought and sold more than $200 million worth of illegal goods and services on Silk Road, according to investigators. U.S. and European law enforcement agencies have since shut down successors to Silk Road, including AlphaBay and Hansa Market.

Terrorist organizations. The self-proclaimed Islamic State saw the benefits of cryptocurrencies [PDF] as early as 2014, when it first declared its purported caliphate in Iraq and Syria. In 2015, a Virginia man pleaded guilty to conspiringto provide material support to the Islamic State for attempting to teach others how to use Bitcoin to anonymously fund the terrorist group. Although most of the group’s financing still comes through conventional means, there is anecdotal evidence that the Islamic State has used cryptocurrencies to acquire weapons and pay affiliated fighters for carrying out attacks. Analysts say the group’s use of cryptocurrencies [PDF] has been limited to small transactions.

Criminal groups. Criminal groups, including transnational drug cartels and money launderers, are also keen to leverage cryptocurrencies, according to the DEA’s most recent annual assessment. The report highlights Bitcoin’s popularity as a means for such groups to evade capital controls in China. While these organizations once relied on creative methods to smuggle large amounts of physical cash across borders, in cryptocurrencies they have found a frictionless means of virtually transferring ill-gotten wealth.

Sanctioned states. States including Russia and Venezuela have taken an interest in creating their own cryptocurrencies to circumvent international sanctions. Neither government has put a state-backed cryptocurrency into use, but a group of Russian banks has started experimenting with Ethereum technology, and Venezuela is expected to issue $6 billion worth of its “petro” coin in 2018.

Meanwhile, North Korea has turned to hacking tools such as ransomware to coerce victims to pay it

States including Russia and Venezuela have taken an interest in creating their own cryptocurrencies.

cryptocurrency. Ransomware attacks infect a computer or network [PDF], encrypt its files, and demand that a ransom be paid in cryptocurrency to decrypt them. The most prominent and widely damaging ransomware attack in recent times, the WannaCry worm, was attributed to the North Korean government in late 2017. The law enforcement consortium EUROPOL confirmed that WannaCry was the largest ransomware attack ever, infecting systems in more than 150 countries. The U.S. government did not specify what the attackers gained in ransom payments, but the Bitcoin addresses associated with the attack contained about $150,000 worth of the cryptocurrency by August 2017. An independent damage assessment by a cybersecurity firm estimated that the attacks cost $8 billionworldwide.

North Korea is reportedly also experimenting with other malware-enabled means of raising revenue through cryptocurrencies. In January 2018, a U.S. cybersecurity firm found that hackers in the country were hijacking foreign computers and forcing them to mine Monero, the more anonymous alternative to Bitcoin. (The WannaCry attackers could have traded the Bitcoin gained through the attack for Monero.) North Korea has also sponsored efforts to steal cryptocurrency from investors outright.

What have governments done to address the security challenges?

Authorities have focused their efforts on exchanges that allow users to convert cryptocurrencies to U.S. dollars and other official currencies. Many of the largest U.S.-based exchanges, including Coinbase and Gemini, adhere to strict know-your-customer and anti–money laundering requirements by collecting identifying data from their users, which makes it challenging for criminal groups to convert their cryptocurrency into hard currency. In 2015, proponents of cryptocurrency technologies, including technologists and exchange providers, joined with law enforcement officials and regulators to found the Blockchain Alliance, a public-private partnership. The organization says that its purpose is to enable “the blockchain community and law enforcement to work together to help combat criminal activity.”

U.S. law enforcement and intelligence agencies, meanwhile, have learned to make the most of the quasi-anonymity of most cryptocurrencies by using the blockchain to analyze and track criminal and terrorist activity. U.S. authorities have also, since 2015, collaborated with EUROPOL to better understand and track cryptocurrency use by criminal and terrorist groups.