On December 2, 2019, prosecutors in the Southern District of New York unsealed a criminal complaint against Virgil Griffith for conspiracy to violate U.S. sanctions authorized by the International Emergency Economic Powers Act by providing services to the Democratic People’s Republic of Korea (North Korea). The indictment of Griffith, one of the developers of the Ethereum blockchain, is the first instance where the Department of Justice has publicly announced charges against a US citizen for conspiring to use cryptocurrency in an attempt to evade sanctions. It’s an interesting case of a developing technology being applied to laws dating back to 1977 (not long in years but generations in technological breakthroughs).
The complaint against Griffith alleges that he visited North Korea in April 2019 to give a presentation at the Pyongyang Blockchain and Cryptocurrency Conference, where the main topic of discussion was how blockchain and cryptocurrency technology could be used to launder money and evade international sanctions that keep it from becoming a developed nation.
The United States’ efforts to combat such sanctions evasion began in September 2018, when the DOJ and the Department of Treasury’s Office of Foreign Assets Control (“OFAC”) simultaneously announced criminal charges and civil sanctions against Park Jin Hyok, a North Korean citizen, someone the FBI had been tracking for years and subsequently put on its most wanted list. OFAC also sanctioned Hyok’s employer, Chosun Expo Joint Venture, an agency, instrumentality, or controlled entity of the North Korean government. The DOJ’s complaint alleges that Hyok used a ransomware attack named “WannaCry 2.0,” which encrypts files on the computers of its victims (mostly in the US) demanding Bitcoin ransom payments. North Korea’s Ministry of Foreign Affairs issued a statement claiming that Hyok “is a non-existent entity, and furthermore, the act of cyber crime mentioned by the Justice Department has nothing to do with us.”
In September 2019, OFAC announced sanctions against Lazarus Group and two of its sub-groups, Bluenoroff and Anaderiel, asserting they were directly involved in WannaCry 2.0 and the 2014 cyberattacks of Sony Pictures Entertainment. Joel Androphy, partner at Berg & Androphy said, “For a rogue nation like North Korea, it’s not just about evading sanctions, it’s a revenue stream.”
North Korea appears to have been relatively successful in generating revenue through this type of indirect sanctions evasion. Citing an unreleased confidential United Nations report, Reuters reported in August 2019 that North Korea is estimated to have raised up to $2 billion by using cyberspace to launch sophisticated attacks on financial institutions and cryptocurrency exchanges to generate income. It has become a burgeoning business model.
Although that revenue was earned prior to OFAC’s announcement of sanctions against Lazarus Group, the sanctions do not appear to have deterred North Korea from continuing to explore ways to use cryptocurrency to generate illicit revenue. Days after the sanctions were announced, the Korean Friendship Association posted information about the second Pyongyang Blockchain and Cryptocurrency Conference, which was scheduled for February 24 and 25, 2020. The “FAQ” page of the conference website expressly states that individuals with United States passports “are welcome” and that “for your convenience we will provide a paper visa separated from your passport, so there will be no evidence of your entry to the country.” Nothing like trusting North Korea to keep a secret.
Shortly after Reuters report came out, United Nations sanctions experts were warning people not to attend the Pyongyang Cryptocurrency Conference, noting that attendance at the conference could be a sanctions violation. The timing of the website’s removal strongly suggests that the threat of international penalties from the United Nations had a deterrent effect much stronger than the threat of penalties from the United States alone.
Countries other than North Korea that are not subject to international sanctions also appear undeterred by United States penalties. For example, in March 2018, President Trump issued an Executive Order prohibiting United States persons and entities from engaging in transactions involving the Petro, Venezuela’s cryptocurrency. Around the same time, OFAC announced sanctions against Evrofinance Mosnarbank, a bank that was involved in facilitating the Petro’s launch. Despite the sanctions and the Petro’s apparent lack of popularity among Venezuelans – many of whom still do not know how or where to buy Petros – Venezuelan president Nicolas Maduro announced efforts designed to strengthen the Petro in 2020, including exploratory sales of Venezuelan oil for Petros and the payment of taxes and utility bills in Petros.
OFAC’s announcement of sanctions against two Iranian men who allegedly converted the proceeds of a ransomware scheme from Bitcoin into Iranian rial appears to have been similarly ineffective. One of the two men sanctioned told the New York Times that he had resumed exchanging Bitcoin within a week using a new anonymous Bitcoin address. The Iranian government has also reportedly shown interest in developing a cryptocurrency. At the Kuala Lumpur Summit in December 2019, Iranian president Hassan Rouhani suggested that leaders from Turkey, Qatar, Iran, and Malaysia create a “Muslim cryptocurrency” to “save themselves from the domination of the United States dollar and the American financial regime.”
The apparent effectiveness of the threat of international sanctions, and the collaborative efforts of other nations to develop cryptocurrencies that could be used to harm United States interests, underscore the need for the United States to work with its allies to combat cryptocurrency-based sanction evasions. Although many countries believed to be involved in sanctions evasion (such as Venezuela) are not subject to international sanctions, there are other ways in which the United States can seek support from its allies.
With cooperation from its allies, US prosecutors can use various statutes to indict and extradite those who commit offenses involving cryptocurrency abroad as well as in the United States. “The world can be a small place when it comes to the reach of US government agencies,” Androphy said, “and many people who get caught up in this stuff simply don’t know the laws that can get them in big trouble.”
While each ally’s existing statutes and needs will be different, the global Financial Action Task Force (“FATF”) recently issued standards designed to provide an international framework for the regulation of virtual currencies and other virtual assets. As the FATF noted in a statement following its January 9, 2020 Supervisors’ Forum, the “challenge is now to effectively implement these standards.” The United States should be leading efforts to do so, because international cooperation will be an invaluable tool in amassing the economic power necessary to prevent cryptocurrency-based sanctions evasion by actors within and outside the US.
Make no mistake about it, people using cryptocurrencies to commit offenses are taking a significant risks. While some who drift on the wrong side of the law do so with intent, they may not know the extent of the trouble that they can get into with the criminal justice system in the US. The Federal Sentencing Guidelines, something many people have no familiarity with, can put offenders in prison for decades. Just to be extradited from a foreign country can take months or years … imagine that sitting in a Venezuelan prison. Sealed indictments and cross-border cooperation with authorities makes traveling that much more precarious. One minute you can be headed to some part of the world on vacation and the next you could be sitting in a prison on what you thought was supposed to be a layover of two hours.
Emily Burgess, an attorney who works with Androphy, told me, “Cryptocurrency transactions are only pseudonymous, not anonymous, and a user whose identity is uncovered faces significant penalties.”
For those who think crypto will hide them detection and, eventually punishment, you better think twice.