Archives for November 2020

It has been five years since that iconic character from my daughter’s favorite childhood movie, the Dread Pirate Roberts, was sentenced to life in prison for the piratical life he led. Not really. But it has been five years since Ross Ulbricht, a/k/a “The Dread Pirate Roberts,” a/k/a DPR, was sentenced to life in prison for operating the Silk Road, a darknet market website where illegal narcotics, firearms and other forms of contraband were bought and sold using a secure web browser known as Tor. The website, with Ulbricht as its master, operated for several years, selling goods worth billions of dollars before the government seized the website and arrested Ulbricht. Following a jury trial, Ulbricht was convicted on multiple counts of a federal Indictment.

The aftermath of the Ulbricht prosecution has spawned a number of interesting prosecutions.  In addition to the prosecution of the normal assortment of co-conspirators, two members of the federal task force investigating the Silk Road were also charged with criminal conduct involving the Silk Road. Shaun Bridges, a former Secret Service Agent, was sentenced to nearly six years in prison for stealing nearly $800,000 in Bitcoin from the Silk Road. Another federal agent responsible for investigating the Silk Road, Special Agent Carl Force of the Drug Enforcement Administration, received a six and one half year sentence for taking payments from Ulbricht to misdirect the investigation.

It now appears that corrupt government agents were not the only ones stealing from Ulbricht. On November 3, 2020, the U.S. Attorney for the Northern District of California filed a civil complaint seeking the forfeiture of over $1 billion dollars in Bitcoin connected to the New Silk Road. According to the Complaint, over 100,000 customers used the Silk Road generating vast amounts of revenue in the process. The government was able to identify one transaction on April 9, 2013, where a Bitcoin addressee that received the 70,411.46 Bitcoin from Silk Road sent 69,471.082201 (approximately $14 million at the time of transfer) to address 1HQ3Go3ggs8pFnXuHVHRytPCq5fGG8Hbhx (hereafter “1HQ3”). Later in April, a small fraction of the funds was provided to BTC-e, a Bitcoin services company. The remainder of the funds was left untouched from 2013 until the government’s seizure of the funds in 2020.

Although not directly related to the case, it is noteworthy that in 2017, the owner of BTC-e,   Alexander Vinnik, a Russian citizen was arrested in Greece. Following his arrest, the United States, the Russian Federation and France all sought his extradition to face criminal charges in each country. In the United States, he is charged with operating an unlicensed money exchange, conspiracy, and unlawful currency transaction. In January of 2020, he was extradited to France where he remains.

According to the government’s investigation, 1HQ3 was owned or controlled by a hacker identified in the Complaint as Individual X. In 2013, Individual X hacked into the New Silk Road and was able to divert over 70,000 Bitcoin from the Silk Road into his or her own account. Despite threats from Ulbricht, Individual X did not return the Bitcoin, and it remained untouched on the account until seized by the U.S. government. Today, the Bitcoin is worth over $1 billion.[1] According to the Complaint, Individual X has agreed to forfeit the Bitcoin to the government.

It is not known how much money was transferred during the time of the Silk Road’s operations between 2011 and 2013, but the amounts involved were vast and remain, in large measure, untraced. The Silk Road was seized by the U.S. government several years ago, but the U.S. government and other governments around the world continue to attempt to penetrate its secrets. Even as these attempts continue, persistent press reports point to new versions of the website dubbed Silk Road 3.0 and Silk Road 3.1. The battle continues.

[1] As of the date of publication, a single Bitcoin is worth approximately $18,000.  See, https://markets.businessinsider.com/currency-converter/btc_united-states-dollar.

On October 23, 2020, the Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned a Russian government research laboratory that created the Triton malware. The lab in question is the Central Scientific Research Institute of Chemistry and Mechanics in Moscow. It is supported by the State Research Center of the Russian Federation FGUP Central Scientific Research Institute of Chemistry and Mechanics (TsNIIKhM), a state-controlled research institution responsible for building customized tools that enabled the attack. The Triton malware is a dangerous and malicious malware designed  specifically to target and manipulate industrial safety systems. The cyber activity surrounding the Triton malware has been described by those in the cybersecurity industry as “the most dangerous threat activity publicly known.”

Treasury Secretary Steven T. Mnuchin said, “The Russian Government continues to engage in dangerous cyber activities aimed at the United States and our allies. This Administration will continue to aggressively defend the critical infrastructure of the United States from anyone attempting to disrupt it.”

Triton Malware

The first record of Triton malware’s use dates back to August 2017, when a petrochemical facility in Saudi Arabia, Petro Rabigh, was targeted by the malware. Tens of millions of dollars were lost as a result of the cyberattack. John Hultquist, senior director of intelligence analysis at the cybersecurity company Mandiant, claimed that the malware was found almost by accident. Mandiant was among the firms called in to investigate the incident. Experts remain uncertain of why Russia targetted this Saudi plant.

When the attack occurred at Petro Rabigh, the hackers triggered a safety system, causing the plant to shut down while experts conducted a cyber investigation. The Triton malware was intended to disable safety systems in the plant that are designed to prevent conditions that could lead to a potentially fatal leak or explosion. There was a coding error in the malware that prevented dozens of people from being killed, experts said.

Triton malware has reportedly been detected scanning and probing U.S. facilities. Russia has a long history of cyberattacks in foreign countries, including the NotPetya attack in 2017 that affected Ukraine, Denmark, and several others.

The Sanctions

According to an article by the U.S. Secretary of the Treasury, TsNIIKhM is being designated pursuant to Section 224 of CAATSA for knowingly engaging in significant activities undermining cybersecurity of any person, democratic institution, or government on behalf of the Government of the Russian Federation.

The new sanctions designate that all property and interests in TcNIIKhM that come into contact with any U.S. persons are blocked. Additionally, any non-U.S. person that engages in transactions with the institution may incur sanctions.

Robert M. Lee, CEO and co-founder of industrial cybersecurity firm Dragos, said in an email statement, “An OFAC sanction by the U.S. Treasury is significant and compelling; not only will it impact this research institution in Russia, but anyone working with them will have their ability to be successful on the international stage severely hampered.” Dragos was another company that, like Mandiant, identified the malware in the Saudi plant in 2017.

While OFAC’s sanctions may be a step in the right direction, Triton malware’s existence still poses a tremendous threat to cybersecurity in the U.S. and elsewhere.

On October 26, 2020, Felicien Kabuga, implicated as a key perpetrator in the Rwandan genocide, was extradited to The Hague to face seven charges, including genocide and attempt to commit genocide. French authorities first arrested him in Paris. However, many parties, including Interpol and Rwandan authorities, were involved in the effort to find and charge the man who has been at large for over a quarter century. Initially, Kabuga was to be extradited to Arusha, Tanzania where the Mechanism for International Criminal Tribunals (MICT) was to begin the trial. However, Kabuga, now 87, claimed that his health was too poor from him to travel. At first, a French appellate court ruled he was safe to make the journey. But ultimately, because the courts had insufficient medical records for Kabuga, they moved him to The Hague to avoid a move as strenuous as the planned extradition to Arusha.

He is thought to have funneled money into militia groups. At the outbreak of the Rwandan genocide, Kabuga was the chairman of the National Defense Fund. He was also the richest man in Rwanda, having made his fortune in tea profits. He was related to the former president of the country through marriage.

One of the charges against Kabuga is conspiracy. His business was thought to be a base for aiding the creation of plans for the genocide. Furthermore, Kabuga was the main owner of a radio station used to promote anti-Tutsi propaganda. Though reward for Kabuga’s whereabouts was set to 5 million dollars, he had previously evaded capture by assuming different identities and moving from country to country. At his initial trials in France, Kabuga referred to these allegations as “lies”.

This trial has several serious implications. It proves that the MICT is able to flexibly find a way to provide justice for the victims of the genocide, regardless of whether or not the accused uses his or her advanced age or poor health as a buffer to stand trial. Furthermore, the success of French authorities in arresting and extraditing him indicates that international integration and cooperation can yield tremendous results for law enforcement. It has been 25 years since those 800,000 lives were lost, due to prejudice of the nature that Kabuga’s radio station propagated. But the day that the victims receive justice may be coming soon.