The Internal Revenue Service (IRS) plans to send four agents specializing in investigating cybercrime to Australia, Singapore, Colombia and Germany starting this summer. These four new positions represent a significant increase in the IRS’ global efforts to fight cybercrime, such as those involving cryptocurrency, decentralized finance, and crypto money laundering services.
In recent years, agents from the Criminal Investigation (IRS-CI) branch of the IRS have played a key role in investigating crimes on the dark web as part of groundbreaking international operations: market closure for drug and hacking services AlphaBay along with the administrator’s arrest; the failure of the largest child abuse website on the Internet; and the removal of a marketplace for stolen social security numbers, among other things.
Until now, the IRS has only had one cyber investigator abroad, in The Hague, Netherlands, who has been working mainly with Europol since 2021. The expansion was first revealed by Guy Ficco, the IRS’s executive director for global operational policy and support for IRS-CI, during a panel at the Chainalysis Links conference on April 4.
“We are now really going to start piloting additional posts, placing dedicated cyber attachés in Bogota, Colombia, in Frankfurt, Germany, in Singapore and in Sydney, Australia,” Ficco said. “I think the benefits – at least with The Hague and with Europol posts – have been very tangible.”
IRS spokesperson Carissa Cutrell told MinRegion in an email that the four new positions are part of a pilot program that will run for 120 days, from June to September 2023, and were created “to promote the use of cryptocurrency, decentralized finance and blending services in the fight against. international financial and tax crimes.”
After the 120-day pilot program, the IRS will evaluate whether the agents should continue to work in the new states.
“Success will depend on the attaches’ ability to collaborate and train our foreign law enforcement counterparts and build criminal investigation leads,” Cutrell said.
Chris Janczewski, who worked as a special agent in the IRS-CI Cyber Crimes Unit, said expanding the IRS’ presence abroad is an important step toward streamlining international investigations.
“The US-based agent cannot always travel to coordinate with foreign partners for research needs and the cyber attaché must act as a proxy for the agent,” Janczewski told MinRegion in an email. “Their expertise in knowing what questions to ask, what evidence can reasonably be obtained, and the impact of any cultural or legal implications.”
Janczewski led the investigation into the largest child abuse site on the dark web, which was called Welcome to Video. He is now the head of global investigations at TRM Labs, a blockchain intelligence firm. He explained that depending on which country the IRS works with, there may be different legal processes for obtaining evidence, “but often informal information in real time is needed in fast-moving investigations.”
“In these situations, it comes down to professional relationships, knowing who to call and what to say,” he said.
Aside from the five cyber investigators, the IRS has 11 attache posts around the world, including Mexico, Canada, Colombia, Panama, Barbados, China, Germany, the Netherlands, the UK, Australia and the United Arab Emirates.
“These partnerships give CI the ability to develop leads for domestic and international investigations with international consistency. In addition, attachés provide support and direction to investigations involving international issues, foreign witnesses, foreign evidence or conducting sensitive investigative activities in collaboration with our international partners,” the IRS-CI writes in its 2022 annual report.
“Attachés also help uncover emerging schemes being committed by promoters, professional enablers and financial institutions. These entities facilitate tax evasion of federal tax liabilities by U.S. taxpayers, as well as other financial crimes.”
Do you have more information about cryptocurrency hacks? We’d love to hear from you. You can safely contact Lorenzo Franceschi-Bicchierai on Signal at +1 917 257 1382, or via Wickr, Telegram and Wire @lorenzofb, or email lorenzo@techcrunch.com. You can also contact MinRegion via SecureDrop.