ABA Tax Fraud Panel to Discuss IRS CI and Crypto Criminals

The Internal Revenue Service – Criminal Investigation (IRS CI) has made it clear that it is focusing on the abuse of digital currencies to further tax evasion, money laundering, and other offenses. IRS-CI also has made it clear that this is an international effort, and that it is trying to partner with law enforcement agencies across the globe in order to coordinate and share investigative leads.

This is a hot topic, and we are honored that Ballard Spahr will be moderating a panel on these very same issues, at the ABA’s annual Tax Fraud/Tax Controversy Conference in Las Vegas on December 12, entitled Charging Cryptocurrency Violations—Tax Crimes or Money Laundering.  We are pleased to be joined by our wonderful panelists, Evan J. Davis, Betty J. Williams, and Ian M. Comiskey.  This is a unique conference, and we invite you to attend if you are interested in the fascinating cross-section of tax evasion and money laundering.

This blog will discuss the recent efforts by IRS-CI to “up its game” in investigating cross-border offenses committed through cryptocurrency, such as its participation in the international Joint Chiefs of Global Tax Enforcement task force. We then will discuss a recent high-profile case which exemplifies these two goals of fighting crypto-related crime and collaborating with foreign law enforcement officials to do so: the notorious “Welcome to Video” case, which led to a global takedown of a darkweb child pornography website, its administrator, and its customers. The Welcome to Video investigation, led by IRS-CI, also illustrates a key point we will discuss at the ABA conference: that cryptocurrency is only “pseudo-anonymous,” and that its protections can yield to a determined combination of modern digital forensics and old-fashioned investigative techniques.

A Focus on Crypto, at Home and Abroad – With an Emphasis on Gathering and Sharing Data

According to the IRS, less than 900 U.S. individuals reported capital gains or losses from virtual currency transactions in 2015, despite the fact that many millions of people globally owned virtual currencies that same year. So, it is not surprising that the lack of compliance in this area has been a recent focus of the IRS. On July 26, 2019, the IRS announced that it had commenced sending more than 10,000 letters to U.S. taxpayers that may have failed to report, or failed to properly report, virtual currency transactions. In October 2019, the IRS issued its second detailed guidance on the U.S. federal tax considerations relating to virtual currency transactions and released a draft 2019 Form 1040 that now asks individual taxpayers whether they received, sold, sent, exchanged or otherwise acquired any financial interest in any virtual currency during the taxable year. All of these steps are following up on the efforts of the IRS to compel virtual currency exchanger Coinbase to produce records regarding certain customers for the tax years 2013 to 2015.

In addition to these domestic efforts, the IRS naturally has increased its global focus, as individuals around the world continue to exploit cryptocurrency, engaging in potential cross-border money laundering and tax evasion. Specifically, the IRS announced this past summer that it would partner with the U.K., Canada, Australia and the Netherlands to continue its fight against tax evasion committed using cryptocurrencies. The announcement came after the Organization for Economic Co-operating and Development (OECD) had put pressure on the international community to increase its efforts to combat the criminal use of cryptocurrencies. This task force, known as the Joint Chiefs of Global Tax Enforcement or J5, is committed to combating transnational tax crime through increased enforcement collaboration. The J5 is focused on sharing strategies to gather information and intelligence, and conducting joint investigations. In addition to enhancing existing investigations and identifying significant targets for new investigations, the J5 seeks to raise international awareness of their efforts to reduce transnational tax crime, cybercrime and money laundering and to try to deter those who seek to commit such offenses.

Most recently, the J5 met in Los Angeles last month to “remove some barriers and work together collaboratively to identify the most egregious tax offenders in the world,” according to Ryan Korner, the Special Agent-in-Charge of the Los Angeles Field Office of IRS-CI. During the event, also known as “The Challenge,” members of each country split into teams with the goal of generating leads and finding tax offenders using cryptocurrency, based on the new data available to them through the Challenge. IRS-CI Special Agent Chris Hueston stated “[w]e’re using the J5 as a force multiplier, bringing together the leading experts from each country and their toolsets and toolkits to collaboratively target those transnational actors who are tax evaders and the financers of transnational criminal organizations.” At the end of the Challenge, IRS-CI announced that it had identified “dozens” of leads and several new investigations of cryptocurrency tax evaders as a result of such collaboration. The IRS also announced at a separate event after the Challenge that it intends to station one or more agents in Singapore, the Netherlands, and Dubai on a permanent basis to address virtual currency money laundering and tax evasion.

Welcome to Video

A recent high-profile indictment involving a notorious darkweb child pornography website provides a clear example of IRC-CI simultaneously pursuing its goals of fighting crypto-related crime and collaborating with foreign law enforcement officials in order to do so. This is the “Welcome to Video” case – an elaborate and far-flug investigation which clearly was brewing for quite some time prior to the announcement this summer of the J5’s focus on crypto crime.

On October 16, 2019, an indictment returned in August 2018 by a grand jury in the District of Columbia was unsealed; the indictment charges the alleged site administrator of the largest darkweb child pornography website in history, a Korean national named Jong Woo Son, on nine counts of child pornography and exploitation charges, carrying with them a potentially massive sentence. Son is currently in custody in South Korea, and the U.S. is reportedly pursuing his extradition.

The site, called “Welcome to Video,” operated for almost three years and had over one million downloads by users. Welcome to Video was one of the first darkweb sites to trade in child exploitation using the digital currency Bitcoin—a pseudo-anonymous vehicle for transacting that induces many users to misperceive that their transactions are untraceable. A user of Welcome to Video would set up an account with the site on the dark web, meaning it could not be accessed by normal internet browsers and shielded the user’s IP address. Then, Son allegedly would send the user a unique address, known as a digital wallet, for that user to deposit Bitcoin payments.  The government’s press release package included this example of a screenshot:

However, digital forensic tracking of these transactions ultimately led to the site’s demise. According to the press release from the Department of Justice (DOJ), IRS-CI agents, “through the sophisticated tracing of bitcoin transactions, . . . were able to determine the location of the Darknet server, identify the administrator of the website and ultimately track down the website server’s physical location in South Korea[.]” According to the government, the investigation has produced a global impact: data from the seized server has been shared

with law enforcement around the world to assist in identifying and prosecuting customers of the site. This has resulted in leads sent to 38 countries and yielded arrests of 337 subjects around the world. The operation has resulted in searches of residences and businesses of approximately 92 individuals in the United States. Notably, the operation is responsible for the rescue of at least 23 minor victims residing in the United States, Spain and the United Kingdom, who were being actively abused by the users of the site.

The Takedown

As noted, IRS-CI has been publicly credited as being instrumental in the takedown of Welcome to Video. Although the IRS traditionally “follows the money” to investigate tax fraud, IRS CI recently has attempted to adapt to the rise of crypto crimes by developing sophisticated forensic tracing to follow the money—even into the darkweb. The agency describes itself as being at the forefront of de-anonymizing cryptocurrency transactions, and it was uniquely positioned to help. In this case, IRS-CI reportedly used highly advanced bitcoin surveillance techniques to track down and de-anonymize the site’s main server.

However, old-school investigative tactics are still key, particularly when married to evolving digital forensics. One particularly effective method for investigating Welcome to Video was an undercover operation, in which agents deposited Bitcoin into the digital wallets that were set up for users of the site. IRS CI then was able to trace the flow of Bitcoin through numerous accounts and eventually to the account of Son. Agents ultimately tracked down Son’s home address, found the physical server operating the darkweb site, and de-anonymized the site’s users.

Finally, and underscoring the international nature of the investigation and arrests, the DOJ press release observed that IRS-CI and the U.S. Department of Homeland Security coordinated with the National Crime Agency of the United Kingdom, the Korean National Police of the Republic of Korea, and the German Federal Criminal Police (the Bundeskriminalamt) in their parallel investigations of Welcome to Video.

If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. Please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.