IRS sends four investigators around the world to combat cybercrime

The Internal Revenue Service (IRS) plans to send four agents who specialize in investigating cybercrime to Australia, Singapore, Colombia and Germany starting this summer. These four new positions represent a significant increase in the IRS’s global efforts to combat cybercrime, such as those related to cryptocurrency, decentralized finance, and cryptocurrency laundering services.

In recent years, agents working for the IRS criminal investigation (IRS-CI) has played a key role in investigating dark web crime as part of landmark international operations: the shutdown of the hacking and drug services marketplace AlphaBay in conjunction with the arrest of its manager; he bust from the largest child abuse website on the internet; and the demolition of a marketplace for stolen social security numbersbetween several others.

Until now, the IRS only had one cyber investigator abroad, in The Hague, Netherlands, working primarily alongside Europol since 2021. The expansion was first disclosed by Guy Ficco, IRS executive director for operations policy. and support for IRS-CI, during a panel at the Chainalysis Links conference on April 4.

“Starting really now, we are going to be testing additional positions by placing dedicated cyber associates in Bogota, Colombia, in Frankfurt, Germany, in Singapore and in Sydney, Australia,” Ficco said. “I think the benefits have been, at least with the Hague and Europol posts, they have been very tangible.”

IRS spokeswoman Carissa Cutrell told TechCrunch in an email that the four new positions are part of a 120-day pilot program, from June to September 2023, and are created “to help combat the use of cryptocurrencies, decentralized finance and mixed services in international financial and tax crimes”.

After the 120-day pilot program, the IRS will evaluate whether to continue to have the agents in the new countries.

“Success will depend on the ability of the attachés to work cooperatively and train our foreign law enforcement counterparts, and create leads for criminal investigations,” Cutrell said.

Chris Janczewski, who worked as a special agent in the IRS-CI CyberCrime Unit, said increasing the IRS presence abroad is an important step in expediting international investigations.

“The US-based case agent cannot always travel to coordinate with foreign partners on investigative needs and the cyber attaché has to act as the case agent’s representative,” Janczewski told TechCrunch in an email. “His experience of him knowing what questions to ask, what evidence can be reasonably obtained, and the impact of any cultural or legal implications.”

Janczewski led the research on the largest child abuse site on the dark web, which was called Welcome to Video. He is now the head of global research at TRM Labs, a blockchain intelligence company. He explained that depending on the country the IRS works with, there may be different legal procedures for obtaining evidence, “but real-time informal information is often needed in fast-moving investigations.”

“In these situations, it all comes down to professional relationships, knowing who to call and what to say,” he said.

In addition to the five cyber investigators, the IRS has 11 attaché positions around the world, including Mexico, Canada, Colombia, Panama, Barbados, China, Germany, the Netherlands, the United Kingdom, Australia, and the United Arab Emirates.

“These partnerships give CI the ability to develop leads for national and international investigations with an international nexus. Additionally, attachés provide support and direction for investigations involving international affairs, foreign witnesses, foreign evidence, or the execution of sensitive investigative activities in collaboration with our international partners.” wrote the IRS-CI in its 2022 annual report.

“Aggregates also help uncover emerging schemes perpetrated by developers, professional enablers, and financial institutions. These entities facilitate tax evasion of federal tax liabilities by US taxpayers, as well as other financial crimes.”

---

Do you have more information about any cryptocurrency hack? We would love to hear from you. You can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Wickr, Telegram and Wire @lorenzofb, or email lorenzo@techcrunch.com. You can also contact TechCrunch via SecureDrop.