Examining Digital Currency Usage by Terrorists in Syria.

• Author: Alexander, Audrey

In recent years, the security community's degree of concern about terrorist exploitation of digital currencies has varied. While some entities argue the threat is understated, others suggest that terrorist adoption of digital currencies is overstated. Ultimately, as numerous factors may influence the financial behaviors of individuals, networks, and groups, it is crucial to recognize that the use of digital currencies is often context-dependent.

Relative to other topics, publicly available information about terrorism financing is limited because terrorists strive to act clandestinely, and the entities working to counter their activities need to protect sensitive details for security reasons. (1) As a result, commentary on terrorist exploitation of digital currencies is often hypothetical, speculative, and anecdotal, raising questions about the threat based on limited evidence. (a) Such analyses can be valuable when consumers recognize the limitations of the work, but research drawing on concrete examples can also help piece together a clearer understanding of trends in specific networks and environments. Consequently, this article narrowly examines examples of digital currency usage in Syria by the Islamic State as well as al-Qa'ida and its past and present Syria-based associates. The authors use publicly available information from various sources to highlight some of the tactics, techniques, and procedures adopted by terrorists with interests in the region. For added depth, the article also draws on the authors' interview with Collin Almquist, the head of Intel Production at Chainalysis, a company providing cryptocurrency data, software, and services to numerous governmental and non-governmental organizations (NGOs).

Before delving into specific instances where terrorists in Syria exploit digital currencies, it is helpful to review what digital currencies are and discuss why terrorist organizations and their members occasionally use these tools, particularly in Syria. In examining the specific cases in Syria, this article outlines some broader observations and walks through examples, highlighting some of the logistical nuances of various schemes. Finally, it concludes with a discussion about what policymakers, practitioners, and scholars can learn about terrorist exploitation of digital currencies from the Syrian context.

Digital Currencies and Terrorists: A Primer

The global financial system is experiencing notable disruptions from new financial technology, notably blockchain, (2) cryptocurrencies, (b) and decentralized finance (DeFi). (c) In short, these innovations offer alternatives to the traditional banking system by making it possible to transact online without the involvement of centralized financial institutions. Since more actors worldwide are using DeFi and cryptocurrencies, terrorist and criminal networks' adoption of these technologies is unsurprising. Even so, international organizations, governments, and financial institutions are still learning how to navigate the proliferation of these financial instruments and practices. Unpacking why these financial services have a place in some terrorists' toolkits may help inform relevant stakeholders' efforts to prevent, detect, and disrupt the exploitation of DeFi infrastructure.

For starters, DeFi infrastructure offers logistical benefits that may appeal to terrorists and other illicit actors. (3) In short, it affords individuals speed, ease, and security with less oversight than traditional banking. Again, in a decentralized network, users can transact with any other user without clearing from any central authority. Creating a virtual wallet, which essentially amounts to opening an account or a node on the network, does not require contact details or additional personally identifiable information. (d) Generally, after incurring a comparatively modest fee, (e) transactions are nearly instantaneous and verified by "smart contracts," which help increase security by creating records in ledgers. The ledgers are immutable, irreversible, and stored across the network using blockchain technology, (4) though different technical configurations affect "who can join and participate in the core activities of the blockchain networks." (5) While blockchain technology has uses in many industries, this article focuses on digital currencies such as Bitcoin (BTC) and Ethereum (ETH). (f)

Taking a step back, decentralized financial networks involve interactions between multiple people, technologies, and businesses. (6) People can exchange cryptocurrencies directly with peers or through exchanges and other intermediaries, like money service businesses (MSBs). As third parties, exchanges and MSBs do not issue currency but provide a marketplace for transactions. They also facilitate converting digital currency to other forms of money, primarily real (fiat) currency. Some bad actors think they can abuse this system to raise, move, or launder money and evade sanctions with digital currencies. For the most part, registered exchanges that comply with internationally recognized anti-money laundering and combating the financing of terrorism standards (AML/CFT) and "know your customer" (KYC) requirements help prevent these activities. (7) However, if exchanges are unlicensed, unregistered, or non-compliant with such standards and requirements, they create more opportunities for terrorists to act without interference. (8) While international transfers through traditional banking systems are accountable to international protocols such as SWIFT or CHIPS, (g) decentralized networks and exchanges lack such supervision. As networks and exchanges transcend borders, many governments and institutions have yet to determine how best to create and enforce standards in different jurisdictions. Even if various jurisdictions developed more consistent regulations for decentralized finance, many emerging economies and areas of conflict might lack the will or resources to enforce them, creating vulnerabilities that bad actors can exploit. (9)

Although DeFi and digital currencies may appeal to terrorists in some ways, these tools also have drawbacks. First, the most widely adopted digital currencies are not genuinely anonymous since all transactions on public ledgers can be viewed. Despite misconceptions to the contrary, private and public entities can trace transactions across BTC, ETH, and other open ledgers. Although bad actors may leverage additional evasion tactics while using digital currencies, such as using private coins, (10) (h) virtual private networks (VPNs), single-use wallets, or digital money laundering techniques involving "mixing" services, (i) there are still security limitations and vulnerabilities. (11)

Second, digital currencies are subject to varied economic risks and nuances. On this point, characterizations of market values, changes, and functions of money also warrant discussion. For one, increased security may come at a cost: Digital currencies with private ledgers, for example, may promote anonymity, but those tokens often do not carry high market value, ability to convert, and subsequent utility (the transparency of BTC and ETH arguably drives much of their value). (j) Another important point on value is volatility. Digital currencies are volatile, and coins with low adoption and market value (typically private ledger currencies) are even more so. Increased volatility invites the risk of a quick loss of value as assets are stored, especially with delays in converting to real currency. Such realities may reduce the appeal of digital currencies.

Third, virtual currencies do not eliminate the need to convert into more traditional forms of money like cash, and they do not make legacy terrorism financing techniques obsolete. While some actors may be inclined to use digital currencies as a medium of exchange, many prefer traditional methods of funds transfer. Even if anonymous transactions occur on a private chain, a trusted exchange or MSB must convert those currencies into widely accepted currencies for that value to be utilized. Such businesses are not necessarily common or accessible in many parts of the world, especially areas affected by conflict. Individuals may use additional financial facilitators, the hawala system, or cash couriers to help move funds, but these logistics can add the sort of costs and vulnerabilities that bad actors try to avoid in the first place. That said, the potential utility of digital currencies (including private coins) for illicit online services where vendors accept them as a medium of exchange for services is cause for concern, especially if private coins become more popular, valuable, and easy to convert.

After this brief discussion of the potential merits and drawbacks of DeFi and cryptocurrencies for terrorists at the tactical level, it is helpful to reflect on research about digital currency usage in general. A blog post by Chainalysis, a blockchain services firm, reports that total crypto volume grew from $2.4tr in 2020 to $15.8tr of value (+558% year-over-year) in 2021. (12) Within that, illicit use grew from $7.8bn to $14bn of value (+79% YoY). (13) Interestingly, although illicit use increased in 2021, that growth did not occur at the same rate as cryptocurrency usage writ large. The overwhelming majority of cryptocurrency usage was assessed to be legitimate, and Chainalysis assesses that in 2021, as little as 0.15% of transactions involved an illicit address. (14) (k) Even though illicit transactions only comprise a small segment of cryptocurrency usage overall, the reality that such transactions can help advance nefarious actors means these trends still warrant further analysis. (15)

Considering the Economic Environment in Syria Turning the focus to the Syrian context, the macroeconomic situation could incentivize many actors' pursuit of alternative money solutions, including DeFi and digital currencies. The...