|Anonymous Payment Schemes Thriving on Web |
By NICOLE PERLROTH
Published: May 29, 2013
SAN FRANCISCO — Eight years ago, Ernie Allen, the head of the International Center for Missing and Exploited Children, called the heads of major banks and credit card companies. Why, he wanted to know, were they letting child pornographers move illicit profits through their systems?
And so began a collaboration between his organization, major banks, credit card companies, Internet service providers, payment processors, and Internet companies like Google and Microsoft. They had hoped to follow the money and quash child pornography for good.
But at some point the money trail went cold. For the last year, Mr. Allen has been working with global law enforcement and financial leaders to find out why.
He may be getting closer to an answer. Today, cybersecurity experts say billions of dollars made from child pornography and illicit sales of things like national secrets and drugs are being moved through anonymous Internet payment systems like Liberty Reserve, the currency exchange whose operators were indicted Tuesday for laundering $6 billion. Preet Bharara, the United States attorney in Manhattan, described it as the largest online money-laundering case in history.
“What we have concluded is that illegal enterprises — commercial child pornography, human trafficking, drug trafficking, weapons trafficking and organized crime — has largely moved to an unregulated system that is not connected to any central bank or national authority,” Mr. Allen said. “The key to all of this has been anonymity.”
Liberty Reserve was shut down last weekend, but cybersecurity experts said it was just one among hundreds of anonymous Internet payment systems. They said online systems like the Moscow-based WebMoney, Perfect Money, based in Panama, and CashU, which serves the Middle East and North Africa, require little more than a valid e-mail address to initiate an account. The names and locations of the actual users are unknown and can be easily fabricated. And they worry that the no-questions-asked verification system has created a safe harbor for illicit activity.
“There are a multitude of anonymous payment systems out there, similar to Liberty Reserve, of which there are over one hundred,” said Tom Kellermann, a vice president at the security company Trend Micro. “Many pretend to ‘know your customer’ but do not actually do due diligence.”
Representatives for WebMoney, Perfect Money and CashU did not return e-mailed requests for comment.
Currency exchanges like Liberty Reserve do not take or make payments of actual cash directly. Instead, they work with third parties that take payments and, in turn, credit the Liberty Reserve account.
After the authorities went after Liberty Reserve, underground forums buzzed with comments from people mourning the potential loss of frozen funds and others offering alternatives, including Bitcoin, the peer-to-peer payment network started in 2009 to offer a decentralized way to create and transfer electronic cash around the world.
In closed underground Russian-language forums, one person wrote, “I had almost 6k there. Where to now?” Another suggested, “Maybe another alternative is Perfect Money? I wonder if Bitcoin exchange rate will go up or not.”
Indeed, the value of the Bitcoin virtual currency spiked temporarily on news of the Liberty Reserve shutdown. But law enforcement officials say Liberty Reserve operated with more anonymity than Bitcoin. Unlike Liberty Reserve and other anonymous payment systems, Bitcoin transactions are stored in a public ledger, called a block chain, that make it possible to trace Bitcoin transactions even years after the fact.
“You can track specific Bitcoin movements just as you would the serial number on a U.S. dollar,” said Jeff Garzik, a Bitcoin developer. The real concern, security experts say, are private payment services that claim to do due diligence, but do not do even the most basic verification.
Typically, money transfers are subject to strict regulation, which include maintaining customer identification records, filing suspicious activity reports, mandatory reporting on large currency transfers, and “know-your-customer requirements.” But security experts say there are a multitude of anonymous payment systems that require no customer identification and have little capability to detect or report suspicious activities.
“You would think they would be regulated but there is no regulation,” Mr. Kellermann said.
Of online payment processors, PayPal is considered the gold standard. The company, now owned by eBay, has payment experts to ensure PayPal is compliant with “know-your-customer” regulations and with law enforcement agencies in each country in which it operates.
“It’s unfortunate that as many of these new services come on board, it’s the people looking to abuse them who are the first to use them,” said Anuj Nayar, a spokesman at PayPal. “There’s a lot more than just having the right technology in place to be an efficient global payment processor.”
In March, the Treasury Department’s Financial Crimes Enforcement Network, or FinCen, began applying anti-money laundering rules to virtual currencies, amid worries that new forms of cash purchased on the Web, like Bitcoin, were being used to finance illicit enterprises.
While Bitcoin is just a software system, there are multiple gateways and exchange points that allow Bitcoin owners to exchange their Bitcoins for cash. Federal authorities recently seized accounts associated with a United States intermediary of Mt. Gox, the world’s largest Bitcoin exchange, because it was not FinCen compliant. That, and other exchanges in the United States are now racing to be fully compliant with “know-your-customer laws” and anti-money laundering requirements.
Mr. Allen said he believed that was a good first step.
“With anonymous payment systems, tracking has become virtually impossible,” he said. “How do you prevent these kinds of problems when you are dealing with an unregulated currency, monitored by nobody? The answer, I think, is there has to be some kind of structure.”
This article has been revised to reflect the following correction:
Correction: May 30, 2013
Because of an editing error, an earlier version of this article referred incorrectly to Bitcoin, a peer-to-peer payment network started in 2009. It was meant to offer a decentralized way to create and transfer electronic cash, not a centralized way.