The Internal Revenue Service (IRS) plans to send four agents who specialize in investigating cybercrime to Australia, Singapore, Colombia, and Germany starting this summer. These four new positions represent a significant increase in the IRS’s global efforts to fight cybercrimes, such as those involving cryptocurrency, decentralized finance and crypto laundering services.
In the last several years, agents working for the IRS’s Criminal Investigation (IRS-CI) branch have had a key role in investigating crimes on the dark web as part of landmark international operations: the shutdown of the drug and hacking services marketplace AlphaBay along with the arrest of its administrator; the bust of the internet’s biggest child abuse website; and the takedown of a marketplace for stolen Social Security numbers, among several others.
Until now, the IRS only had one cyber investigator abroad, in The Hague, Netherlands, mostly working along Europol since 2021. The expansion was first revealed by Guy Ficco, the IRS’s executive director for global operations policy and support for IRS-CI, during a panel at the Chainalysis Links conference on April 4.
“Starting really now we’re going to be piloting for additional posts, putting dedicated cyber attaches in Bogota, Colombia, in Frankfurt, Germany, in Singapore, and in Sydney, Australia,” Ficco said. “I think the benefits have been — at least with the Hague and with Europol posts — have been very tangible.”
IRS spokesperson Carissa Cutrell told TechCrunch in an email that the four new positions are part of a pilot program that will last 120 days, from June to September 2023, and are created “to help combat the use of cryptocurrency, decentralized finance and mixing services in international financial and tax crimes.”
After the 120-day pilot program, the IRS will evaluate whether to continue having the agents in the new countries.
“Success will hinge on the attachés’ ability to work cooperatively and train our foreign law enforcement counterparts, and build leads for criminal investigations,” Cutrell said.
Chris Janczewski, who worked as a special agent in the IRS-CI Cyber Crimes Unit, said that growing the IRS’s presence abroad is an important step toward streamlining international investigations.
“The U.S.-based case agent can’t always travel to coordinate with foreign partners on investigative needs and the cyber attaché has to act as the proxy for the case agent,” Janczewski told TechCrunch in an email. “Their expertise on knowing what questions to ask, what evidence can reasonably be obtained, and the impact of any cultural or legal implications.”
Janczewski led the investigation into the largest dark web child abuse site, which was called Welcome to Video. He is now the head of global investigations at TRM Labs, a blockchain intelligence company. He explained that depending on which country the IRS is working with, there may be different legal procedures to obtain evidence, “but often informal information in real-time is needed in fast moving investigations.”
“In these situations, it comes down to professional relationships, knowing who to call and what to say,” he said.
Apart from the five cyber investigators, the IRS has 11 attaché posts around the world, including Mexico, Canada, Colombia, Panama, Barbados, China, Germany, the Netherlands, the U.K., Australia and the United Arab Emirates.
“These partnerships give CI the ability to develop leads for domestic and international investigations with an international nexus. In addition, attachés provide support and direction for investigations with international issues, foreign witnesses, foreign evidence, or execution of sensitive investigative activities in collaboration with our international partners,” the IRS-CI wrote in its 2022 annual report.
“Attachés also help uncover emerging schemes perpetrated by promoters, professional enablers, and financial institutions. These entities facilitate tax evasion of federal tax obligations by U.S. taxpayers, as well as other financial crimes.”
Do you have more information about any cryptocurrency hacks? We’d love to hear from you. You can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Wickr, Telegram and Wire @lorenzofb, or email lorenzo@techcrunch.com. You can also contact TechCrunch via SecureDrop.