Cyber crime: Without a trace

The Liberty Reserve case casts light on the dangers of web fraud and virtual currencies

High quality global journalism requires investment. Please share this article with others using the link below, do not cut & paste the article. See our Ts&Cs and Copyright Policy for more detail. Email [email protected] to buy additional rights. http://www.ft.com/cms/s/0/c30bd528-c9d5-11e2-af47-00144feab7de.html#ixzz2UwgB8SVa

Last month, an undercover federal agent set up an account with Liberty Reserve, a virtual currency exchange based in Costa Rica. Registering online, the agent entered the name “Joe Bogus”, typed the account name as “tostealeverything,” and chose the address “123 Fake Main Street”.
With a few keystrokes, the US secret service agent had entered the world of the cyber exchange and unlocked a way of converting dollars into LR, the virtual currency of Liberty Reserve.

High quality global journalism requires investment. Please share this article with others using the link below, do not cut & paste the article. See our Ts&Cs and Copyright Policy for more detail. Email [email protected] to buy additional rights. http://www.ft.com/cms/s/0/c30bd528-c9d5-11e2-af47-00144feab7de.html#ixzz2UwgHjUwi

He transmitted hundreds of LR dollars between the Joe Bogus account and another undercover account, identifying one transaction as “your share of the cashout” and another “for the cocaine”.
The transactions revealed how easy it was to transfer criminal proceeds. They were also among the final steps before the US authorities closed in on Liberty Reserve and its founder Arthur Budovsky. Along with six current and former employees, Mr Budovsky is facing charges including conspiracy to commit money laundering and operating an unlicensed money transmitting business.
Five of the seven men, including Mr Budovsky, were arrested on May 24 in three different countries. Two remain at large. They all face up to 20 years in prison if convicted.

The charges have offered a rare insight into the way that some of the world’s most virulent criminals are now running their businesses. US authorities say Liberty Reserve had become the “bank of choice” for drug traffickers, computer hackers, child pornographers and identity thieves.

“If Al Capone were alive today, this is how he would be hiding his money,” says Richard Weber, chief of criminal investigations at the Internal Revenue Service. Liberty Reserve “attracted and maintained a customer base of criminals by making the financial activity anonymous and untraceable.”

The arrests also come as regulators are expressing increasing fears about the broader use of virtual currencies; the Bitcoin, for example, has also been used by drug traffickers online. Shortly before the closure of Liberty Reserve, the Department of Homeland Security seized the US bank accounts of the largest Bitcoin exchange because the owner failed to register it correctly.
When the authorities raided Mr Budovsky’s home in a gated community outside San José, Costa Rica’s capital, they seized not only computer files but three Rolls-Royces, a Jaguar and a Mercedes, according to officials.

The cars on the driveway were an indication of the scale of the operations alleged by the US authorities. In announcing the charges on Tuesday, Preet Bharara, the US attorney for Manhattan, described the case as the largest international money laundering prosecution. He alleged the “black market bank” had processed 55m transactions and laundered $6bn in criminal proceeds over six years of operations. It had 1m users worldwide with 200,000 in the US.

This is not Mr Budovsky’s first brush with the law. He and Vladimir Kats, co-founder of Liberty Reserve, were prosecuted by New York county authorities in 2006 for running Gold Age, an exchanger for E-Gold, then the most popular digital currency business, out of their apartments in Brooklyn.

Both men pleaded guilty to receiving money for transmission and transmitting it without a licence. In January 2007 they were sentenced to five months’ probation.
Mr Budovsky, a US citizen of Ukrainian descent, moved to Costa Rica and in 2006 launched Liberty Reserve with Mr Kats, who ran the operation from Brooklyn.

Mr Budovsky set up shop in the business district just outside San José, at the foot of the mountains in the Central Valley. The men used aliases: Mr Budovsky went by Eric Paltz or Arthur Belanchuk. Mr Kats used the moniker Ragnar, according to authorities. Mr Budovsky protected himself and the offices with armed Russian guards, according to the Tico Times, a Costa Rican newspaper.
The key to the alleged crime at Liberty Reserve is the anonymity of the transactions, which made it difficult to establish a paper trail.

To open an account a user needs only to give a name and address. Unlike a regulated bank, Liberty Reserve never required documentation to verify that information. Once registered, a user could exchange LR currency with other users.

Liberty Reserve charged 1 per cent fees for each transfer. Users could pay an additional 75 cents per transaction in a “privacy fee” to hide their account number on the transfers, essentially making the transaction untraceable.

To avoid a paper trail leading back to the users, Liberty Reserve relied on third-party “exchangers” to process LR transactions between the customers and Liberty Reserve. Several of the preapproved exchangers, including MoneyCentralMarket and AsianaGold, were owned by the defendants, the authorities allege.

The exchangers, located in less regulated countries including Malaysia, Russia and Nigeria, converted real dollars into virtual currency. They charged fees of 5 per cent of the funds being transferred, which the defendants split among themselves, authorities allege. After being laundered and traded as LRs, money could be reconverted by exchangers.
US authorities say this scam helped Liberty Reserve become “the predominant digital form of money laundering used by cyber criminals worldwide”.
Account holders with Liberty Reserve included computer hackers for hire and unregulated gambling enterprises that registered accounts called “Russia Hackers” and “Hacker Account”, prosecutors say. Other clients included credit-card thieves and computer-hacking rings in Vietnam, Nigeria, China and the US.

Liberty Reserve was also used to distribute some of the proceeds of a $45m theft ring involving two Middle Eastern banks, according to court filings in that case.
In 2009 the authorities started asking questions. Superintendencia General de Entidades Financieras (Sugef), the Costa Rican financial supervisor, notified Liberty Reserve that it needed to obtain a licence as a money transmitting business. Sugef denied its application after concluding that Liberty Reserve did not have basic “know-your-customer” rules.
Two years later, Liberty Reserve – despite trying to trick Costa Rican regulators – still had not won a licence, officials say, and the regulatory heat was intensifying.
Mr Budovsky renounced his US citizenship in 2011, telling immigration officials that the “software” his company had developed “might open him up to liability in the US”, according to court filings. Switching passports was critical: Costa Rica will not extradite its citizens for prosecution in the US.

Then, in November 2011, the US government issued a warning to banks not to do business with Liberty Reserve because it was “used by criminals”.
At about the same time, the authorities allege, Liberty Reserve told the Costa Rican regulator it had been sold to a foreign buyer. But Mr Budovsky and others secretly continued to run the business from shell companies.

The US’s “Global Illicit Financial Team” – a task force led by the IRS and involving the secret service and the Department of Homeland Security – had also opened an investigation.
US investigators and prosecutors obtained search warrants for more than 30 separate email accounts. They installed more than two dozen pen registers on phone and email accounts, devices that allow investigators to see who is contacting whom but not the details of the conversation.

In addition to sifting through hundreds of thousands of documents, the authorities conducted one of the first “cloud” based search warrants, which orders an internet service provider to permit an inspection of a virtual cache of information. Officials also read real-time email exchanges between some of the defendants by obtaining a court-approved wiretap on one of their email accounts.
Under pressure, Mr Budovsky and others began moving millions of dollars offshore to two dozen accounts held in shell companies in Cyprus, Hong Kong, Morocco, China, Australia and Spain, officials say. The authorities were getting closer. On May 20 prosecutors secured sealed indictments charging the individuals.

Some of the men were charged in separate indictments that barely described the alleged crime. That was done, one official said, to give them the flexibility to arrest some of the men when they had a window without alerting the other targets.

Last Friday that window opened. In a co-ordinated international effort, Spanish officials arrested Mr Budovsky as he was disembarking from a plane in Madrid, en route to Costa Rica from Morocco.
Mr Kats, who left Liberty Reserve in 2009 after a dispute with Mr Budovsky, was arrested in Brooklyn. A judge ordered him to be kept in custody until his trial. The US is seeking Mr Budovsky’s extradition. Neither man has yet entered a plea.

“The internet is an amazing gift,” says Mr Bharara. “But it also has an ugly underbelly.”