Communications of the ACM
Beating Bitcoin Bad Guys
Andrew Cox leads Sandia's team developing tools that will help track illicit digital currency transactions.
Credit: Dino Vournas / Sandia
As Bitcoin, the most widespread cryptocurrency in use, becomes an increasingly accepted medium of exchange across the global economy, criminals have turned to the digital currency for their transactions, making it harder for law enforcement to keep track of users.
To assist law enforcement, researchers at Sandia National Laboratories have created a set of requirements for an analysis tool that can be used to overcome the challenges brought by Bitcoin.
Andrew Cox, who is leading the work for Sandia, says the law enforcement community has identified the need for new approaches and tools to aid in a variety of investigation scenarios, including complex money-laundering schemes, cyber thefts, and straightforward transactions of illegal goods. Law enforcement's most immediate need is to reduce the time and resources necessary to trace illicit commerce.
The Dark Side
"Our job was to understand how Bitcoin works," says Cox. "Bitcoin is a new semi-anonymous currency that holds the potential to change the way all sorts of transactions work in a way that might really benefit the economy. Some of the potential benefits include making monetary transactions much more efficient, and thereby driving down the costs of doing business, making transaction histories more transparent, which could help both financial markets and financial regulation, and — depending on who you ask — reducing the risks associated with inflation and reliance on centralized monetary institutions. All that being said, it has been clear that criminals have been pioneers in using Bitcoin. They use it for drugs, for guns, child pornography, and all sorts of terrible stuff."
Sandia's work, conducted for the U.S. Department of Homeland Security Science and Technology (S&T) directorate, could ultimately be delivered to other federal law enforcement agencies. DHS S&T requested Sandia to set up a graphical user interface or a front end on the research environment so agents can test the algorithms Sandia is using in actual investigations.
"This will allow us to adjust what we're doing to make sure we're being of maximal use to them," Cox says.
The Sandia team includes Mark Boyd, Lynne Burks, Maggie Todd, Kiran Lakkaraju, Jovana Helms, Patricia Cordeiro, and Ethan Chan.
Battle-Tested Tools
Challenges faced by law enforcement include the significant time and resources needed to pinpoint users, especially since traditional means of establishing identity are not always possible. Since Bitcoin will likely spawn innovations that will enable new forms of both legitimate and illicit commerce, authorities have few battle-tested legal, policy, and technical tools to counter those illicit uses.
"The basic obstacle was trying to truly understand all of the various patterns associated with Bitcoin transactions," Cox says. "We can use past investigations as examples of patterns that will enable us to find other configurations."
There is not a "silver bullet" algorithm to effectively de-anonymize Bitcoin, says Cox, explaining that to do so would involve cross-referencing anonymous data with other, traditional sources of investigative data to identify suspects.
"To be successful, the reality is it's going to take different types of algorithms and additional types of investigative techniques including good old-fashioned police work," he says. "They're all going to have to be combined."
A prime example of law enforcement trying to overcome a Bitcoin challenge, Cox says, was an online market called Silk Road that was used to sell drugs. The market was successful for several years before law enforcement was able to eventually shut it down. The success of Silk Road also demonstrated the effectiveness of The Onion Router (Tor) in maintaining the anonymity of online criminals. By using Tor, the site's operators supported up to $1.2 billion in drug sales from more than 950,000 registered users.
"Even with the shutdown of the most famous example," Cox says, "the problem didn't really abate. It just sort of slowed down but then has picked up pace again."
Whatever its legitimate benefits, as the acceptance of Bitcoin spreads, its use as a means of conducting illicit commerce is likely to increase as well. Criminal enterprises have used Bitcoin at least in part because of the perceived ease with which transactions can be anonymized. Although anonymization of Bitcoin transactions is far from fool-proof, it has proved to be a non-trivial barrier to authorities slowing the growth of electronic illicit commerce.
"In many ways," says Cox, "figuring out how to effectively combat illicit Bitcoin commerce and reduce its perception as a tool of criminals can encourage more people and companies to adopt Bitcoin for legitimate purposes."
Systems Analysis
Sandia conducted a systems analysis of illicit e-commerce focusing on Bitcoin. The team set up a research environment to experiment with other algorithms that can de-anonymize illicit Bitcoin users. The research includes a mix of traditional and novel investigative techniques, along with existing financial regulation and innovative policy and process tools.
Once de-anonymization occurs, law enforcement can link the Bitcoin addresses to a specific alias and they will know all of the Bitcoin addresses they need to deal with.
"When you exchange Bitcoin, you don't have information such as an e-mail address," Cox says. "Instead, it's a completely random set of numbers and an anonymous Bitcoin address. Bitcoin users can use one or many Bitcoin addresses. This allows criminals to evade obvious patterns of transactions."
The researchers were able to use some published methods to track down and understand that the same users are using the different Bitcoin addresses. They are now in the process of generating their own methods by characterizing transactions of Bitcoin users and applying machine learning methods to uncover patterns of interest.
"It doesn't mean that we get their actual name because there aren't any names associated with Bitcoin," Cox says, "But it will show that some transactions are controlled by the same user."
Sandia will continue to work on the algorithmic research and focus on developing a graphical user interface so law enforcement officers can easily interact and make queries against Sandia's research environment and what Bitcoin calls the "blockchain."
"Our clients are happy about the requirements we've developed and the research we've done on what types of tools and capabilities are needed ," Cox says. "The bottom line is, the work is about spending time with law enforcement officers and making sure that we put their needs first."
No entries found