Decentralized Cryptocurrencies in CSAM clubs as a matter of Decentralized Forensics

Author: Carolina Christofoletti

Link in original: Click here

According to UNODC Basic Manual on the Detection and Investigation of the Laundering of Crime Proceeds Using Virtual Currencies, apart from the record of transactions that take place involving two particular Bitcoin addresses, there is no way to associate an address with any other address in the Bitcoin network. There is also no way within the Bitcoin network to associate an address with a real-world identity.

Consequently, when examining crimes perpetrated through the Internet, one should also work with the possibility that, hidden somewhere, there might be a cryptocurrency wallet. Stored somewhere on the Cloud structure or hidden somewhere in a password protected URL, there might be a crypto wallet. And if things are so, we are facing cases where, sometimes, possession crimes reveal itself a cash-intermediate transaction, what could be very well the hypothesis of a Child Sexual Abuse Material (CSAM) crimes.

But why would Law Enforcement people be interested in, when a commercial child sexual exploitation ring as such in found, describing what the singular features of those criminal scenarios are? Because, sometimes, even if extensive collections of Child Sexual Abuse Imagery are seized, not only criminals are arrested in a “softer” version of their crimes (“possession” ones) but, if those crypto wallets are not found, criminals will profit eternally on the harm they caused to those victims. Keep in mind that, as financial markets are today, owning cryptocurrencies as a financial asset is often more profitable than owning, for example, shares in a large company.

If we can identify, through forensics, the origin of the file and therefore prove that, due to where it came from it could have only been intermediated through a transaction, one must go after this data. In order to know where to look at, we need to know how the financial model there works. Is it so that, after paying the “toll” to the underworld, do they access it immediately, clicking or downloading anything in the next seconds or minutes? Is Browser Forensics able to identify where the “password requested” access is done?

Are payments conditioned on approval and, if so, how long does it take? Are “prices” constant or, if they change, how do they and accordingly to what metric? Historical data are always an important track to keep. Which are, after all, comparing to the seized images found with other suspects of the same CSAM club, things that we can presume that were acquired through payment.

Crossing the forensic data for the suspects of the same criminal environment shall be highly important… and how much. How much, to understand what is going on there. You complete your database, knowing where to look for within the next target. Concealing mechanic, curiously as it might be, are the glue that glues the puzzle pieces together.

Unfortunately, this is but a data that is hardly ever (if ever) crossed.

Cryptocurrencies work, equally, with the time stamp data (as anything that involves mathematics, orders of operations must be observed) and the number of transferred coins is part of the chain. Briefly, if we are looking for financial tracks, where should investigators look? Where do they start? If we are looking to a cryptocurrency chain… what data we are looking for there? I have given you some ideas.

How great wouldn’t it have been if forensic analysis of CSAM clubs were done in a centralized way. In a way that databases have the change of becoming visible. Where Browser, Images and Cloud Forensics are compared transversally between targets. Where criminals could finally know that any kind, minimal as they wish that to be, of organization becomes highly traceable. Where perceived anonymity can be defeated by, as Edward Snowden mentioned, the eternal record of everything.

Think about it.