From cubicles in a nondescript office building in the Denver Tech Center, two of the world’s leading cryptocurrency investigators spend their days trying to unmask people selling drugs, computer viruses and guns in the darkest corners of the internet.
Arran McWhirter and Ryder Wells, special agents in the Denver office of Homeland Security Investigations, work to identify the people using the system for illegal trades. The wide variety of contraband spans the dangerous to the absurd: social security numbers, fake passports, cocaine, dinosaur bones, manuals to build weapons, counterfeit cash, murder-for-hire services, fake Christian Louboutin slippers.
“Whatever your imagination is, it’s there,” Wells said.
When the pair aren’t digging in on an investigation, they’re traveling the world training other law enforcement on their techniques. This month, they traveled to Singapore at the invitation of the United Nations Office on Drugs and Crime. They never planned to specialize in tracking the quicksilver transactions of the dark web, but their work has only become more essential as criminal use of cryptocurrencies such as bitcoin have become more common and online markets for illegal products have proliferated.
“They really became the experts on it,” said Special Agent in Charge Steve Cagen, who leads Homeland Security Investigations for Colorado, Montana, Utah and Wyoming. “Our border that we look at is virtual.”
It’s difficult to track the number of cases that involve cryptocurrency because the money system is often a small piece of a larger investigation, Wells and McWhirter said. But the use of cryptocurrency to commit criminal transactions is becoming more common. Last year, the Denver office of Homeland Security Investigations seized $1.1 million worth of 187 types of cryptocurrency. The Department of Justice even created a prosecutor position to focus entirely on crimes involving digital currency.
Cryptocurrencies are entirely digital money systems that do not rely on banks or any third party to create a transaction, allowing people to remain fairly anonymous and avoid fees. Transactions of such currencies are recorded in a technology called blockchain and are encrypted, which is meant to make them more secure. More than 2,500 types of cryptocurrencies, such as bitcoin, are traded publicly and together are worth approximately $246 billion, according to CoinMarketCap.com, a website that tracks the currencies.
The use and exchange of cryptocurrencies is completely legal, unless they’re used to buy contraband or launder the profits of the sale of illegal items. Many of those transactions happen on the dark web, a part of the internet that is accessible only with certain software or passwords. The organization of many dark web sites mimics eBay. Sellers even have star ratings, except those on the dark web are also rated for their stealth.
McWhirter and Wells became interested in cryptocurrency crimes during a 2013 case where a package of drugs was intercepted at a border crossing. Investigators allowed the drugs to be delivered to the intended recipient in Colorado and then arrested him. During the investigation, law enforcement learned that the man had used cryptocurrency to buy the drugs online.
McWhirter and Wells had been to trainings about financial crimes and the future of online currencies, but this was the first case that brought the issues into the real world. Much of their training has been trial and error. Even though the agents are the cutting edge of such investigations, the criminals are always one step ahead, Wells said.
Their job, essentially, is to follow the money to the supplies of contraband and identify people who work hard to remain anonymous. The transactions are largely anonymous, convoluted and take place in hidden corners of the internet. Marketplaces where contraband are sold frequently are taken down and rebuilt under another name.
“The people you’re dealing with are very smart and very savvy,” McWhirter said.
The agents can’t divulge much of their work in detail for fear it will compromise later investigations. People who use the dark web pay close attention to law enforcement, the investigators said, even publishing manuals explaining how such crimes are investigated.
For years they worked a case tracking drugs being shipped to the U.S. from a European trafficking organization, called “ItalianMafiaBrussels”. They helped arrest a dozen people in Bruges, Belgium, and Bucharest, Romania. In recent years, people who sell child pornography have started to accept payment in cryptocurrency. The duo investigated a server based in South Korea that stored child pornography, and they helped arrest dozens of people who used the server.
The most common case they see in Colorado is people purchasing ecstasy in bulk online from Europe and then reselling it for a steep markup at electronic music festivals. Across all cases, most of their suspects are white men between the ages of 18 and 40, often with libertarian leanings.
The agents describe working each case as solving a puzzle, except the shapes for the pieces constantly change and there are no borders to put together first. The cases cross a wide variety of crimes, from guns to trafficking and money laundering to drugs.
The intricacy is what keeps Wells and Ryder interested in the complicated cases.
“We’re nerds,” Wells said.
