Brother
Professional
- Messages
- 2,590
- Reaction score
- 539
- Points
- 113
Lieutenant Colonel Stanislav Makarov, an investigator for particularly important cases of the Department for Investigation of Organized Criminal Activities in the Sphere of Illicit Drug Trafficking of the Investigative Department of the Ministry of Internal Affairs of Russia, talks about the positive experience of seizing cryptocurrency assets.
The practice of investigating crimes related to the illegal sale of narcotic drugs shows that persons carrying out these criminal activities, both when receiving payment from purchasers of narcotic drugs and when distributing profits between accomplices, use cryptocurrency. A striking example is crimes committed using trading platforms located in the shadow segment of the Internet, including the Hydra platform, which operated for more than 7 years and was practically a “monopolist” in the market for the illegal sale of narcotic drugs, psychotropic substances, their precursors, counterfeit money, documents and the provision of other illegal services.
The choice of cryptocurrency as a unit of account is one of the conditions that excludes the de-anonymization of parties to transactions carried out in violation of current legislation.
Basic concepts necessary to work on the seizure and seizure of cryptocurrency assets:
Cryptocurrency is a type of digital currency, a product of programming and cryptography, processes of technologization and digitalization of the modern information society. Currently, there are a significant number of different cryptocurrencies in the world, one of the most popular is Bitcoin (Bitcoin, BTC).
Bitcoin is a decentralized cryptocurrency without a single regulator or administrator that can be transferred from user to user through peer-to-peer transactions.
A cryptocurrency wallet is a tool (physical device, program or online service) for managing digital currencies, which stores public and/or private keys for cryptocurrency transactions.
Generally, cryptocurrency wallets can be divided into two categories:
Custodial wallet is a service that owns the private key of the wallet and stores the owner’s assets. When using a non-custodial wallet, only its owner has full control over the assets.
In the context of popularization of payments in cryptocurrency in the Russian Federation, measures are being taken to regulate it. However, in accordance with subsection 3 of the Civil Code of the Russian Federation “Objects of civil rights”, virtual assets (cryptocurrency) are not a separate object of civil rights.
On the territory of the Russian Federation, in accordance with the Federal Law of July 31, 2020 No. 259-FZ “On digital financial assets, digital currency and on amendments to certain legislative acts of the Russian Federation,” a general term is applied to such virtual assets as cryptocurrency - digital currency, under which, in accordance with Part 3 of Art. 1 of this Law, is understood as a set of electronic data (digital code or designation) contained in an information system that is offered and (or) can be accepted as a means of payment that is not a monetary unit of the Russian Federation, a monetary unit of a foreign state, an international monetary or settlement unit, as an investment and in respect of which there is no person obligated to each owner of such electronic data, with the exception of the operator and (or) nodes of the information system, who are obliged only to ensure compliance with the procedure for issuing this electronic data and carrying out actions in relation to them to introduce (change ) records in such an information system according to its rules.
Cryptocurrency is purchased using electronic and non-cash funds and can be converted into them.
Non-cash funds in accordance with Art. 128 of the Civil Code of the Russian Federation are other property. Thus, cryptocurrency is a digital expression of the value of other property, which at a particular moment corresponds to a certain amount of non-cash funds, depending on the exchange rate of the digital currency to the corresponding type of monetary unit.
In addition, in accordance with the Federal Law of July 31, 2020 No. 259-FZ “On digital financial assets, digital currency and on amendments to certain legislative acts of the Russian Federation” for the purposes of applying federal laws of August 7, 2001 No. 115 - Federal Law “On Combating the Legalization (Laundering) of Proceeds from Crime and the Financing of Terrorism”, dated October 26, 2002 No. 127-FZ “On Insolvency (Bankruptcy)”, dated October 2, 2007 No. 229-FZ “On Enforcement Proceedings” , dated December 25, 2008 No. 273-FZ “On Combating Corruption,” digital currency is recognized as property.
At the same time, the criminal procedural legislation of the Russian Federation does not establish comprehensive rules for the seizure and subsequent seizure of cryptocurrency assets, including those obtained as a result of committing crimes, and therefore the problem of regulating the procedure and developing a unified mechanism for performing these actions is relevant, in including within the framework of the activities of preliminary investigation bodies.
During the investigation of criminal cases related to illegal drug trafficking, practice is being developed to seize and seize cryptocurrency assets, both in order to ensure the confiscation of illegal proceeds received as a result of crimes, and to ensure the execution of the sentence in terms of possible additional punishment in in the form of a fine.
According to the practice established in the Department for Investigation of Organized Criminal Activities in the Sphere of Illegal Drug Trafficking of the Investigative Department of the Ministry of Internal Affairs of Russia (hereinafter referred to as UROPD NON), preliminary investigation authorities can seize cryptocurrency assets in the following cases:
– access was obtained to carry out transactions with cryptocurrency (when stored on a non-custodial and custodial service) stored on a crypto-wallet, accessed from a computer device discovered and seized from the accused, or in other cases establishing public and private keys that provide access to cryptocurrency the accused;
– it is possible to influence the transfer of cryptocurrency stored on the custodial service into fiat money.
Thus, in 2021, the investigator of the UROPD NON was investigating a criminal case accusing Sh. of committing crimes under Art. Art. 210, 228. 1 of the Criminal Code of the Russian Federation, during the investigation of which a pre-trial cooperation agreement was concluded with the said accused.
In the course of fulfilling the obligations assumed by the accused within the framework of the pre-trial cooperation agreement, Sh. informed the preliminary investigation authorities about the presence of cryptocurrency assets received as a result of committing the crimes incriminated against him, which he wishes to voluntarily surrender. During the investigative experiment, Sh., demonstrating the methods he used in criminal activities to obtain income from the sale of drugs, through the cryptocurrency exchange “B”, he exchanged his cryptocurrency into fiat money with the registration of their transfer in cash. In turn, the accused’s authorized representative (his close relative), who received cash converted from cryptocurrency, handed it over to the preliminary investigation authorities.
For fiat funds received in this way as a result of the investigative experiment, in accordance with Art. 115 of the Code of Criminal Procedure of the Russian Federation were seized and they were placed in a specialized account of the Ministry of Internal Affairs of Russia.
When using the above method of seizing cryptocurrency assets (that is, with the active assistance of the accused), it is also possible to transfer fiat funds received from the cryptocurrency through the appropriate exchanger or exchange to the bank account of the accused. However, with this method, it is necessary to first seize the funds located and arriving at the account to which it is planned to transfer cryptocurrency in fiat equivalent, with a ban on outgoing transactions through it.
When exchanging cryptocurrencies into fiat funds and subsequently seizing them, the investigator must carefully select the cryptocurrency exchange through which the exchange operation is planned to be carried out, in order to exclude the possibility of turning to unscrupulous participants in the cryptocurrency market and the loss of discovered assets.
In addition to the above, UROPD NON investigators also used the method of detecting and seizing cryptocurrency in “natural” form, in conditions of the accused’s refusal to cooperate.
Thus, during the investigation of a criminal case against citizen G., accused of committing crimes under Art. Art. 210, 228. 1 of the Criminal Code of the Russian Federation, the investigation proved that the accused received remuneration for his criminal activities in the Bitcoin cryptocurrency. As a result of a series of searches, several laptops belonging to the accused were seized. During the inspection of one of the seized devices with the participation of a specialist with special knowledge in the field of detecting on computer information media information about the cryptocurrency wallets used, using specialized software, information about the public and private keys used by the accused to carry out cryptocurrency transactions was decrypted and extracted.
As a result of checking through open data sources on the Internet (blockchain browsers on the platform www.blockchain.com and www.blockchair.com), it was established that the digital currency Bitcoin is stored at the detected cryptocurrency addresses.
Due to the fact that there was a real possibility of withdrawal of cryptocurrency from the discovered cryptocurrency wallets by persons aware of the private keys to them (alleged accomplices), during the investigative action (inspection) it was decided to transfer it to a new, specially created by the investigator, hardware wallet .
Hardware wallets are physical, electronic devices such as USB flash drives that can generate private keys offline and are the most secure way to store crypto assets.
The hardware wallet at the investigator’s disposal is registered through an application specially installed on the computer (in the specific example under consideration, Ledger Live), through which an access password is set, consisting of digital values and known only to the investigator. After creating a password to access the wallet on the device, 24 words are generated - seed phrases to restore the cryptocurrency wallet in case of loss of the private key or impossibility of physical access to the wallet. The above application then generates a Bitcoin cryptocurrency address corresponding to the hardware device.
In order to ensure the safety of the detected digital currency, as part of the inspection, transactions of funds were made from the detected cryptocurrency accounts to a cryptocurrency address on a hardware wallet at the disposal of the preliminary investigation authority.
When drawing up the protocol of the investigative action, it indicated only the public key corresponding to the hardware device, and the password chosen for it and the generated seed phrases were not reflected in order to exclude access to the seized crypto-assets of third parties, including the accused and their defenders, who may become familiar with the specified inspection protocol when fulfilling the requirements of Art. 217 of the Code of Criminal Procedure of the Russian Federation.
The specified hardware crypto wallet, the password for access to working with it, and the seed phrases for it are packaged in three different packages and sealed. Packages with a hardware crypto-wallet, a password for access to working with it, seed phrases are placed for storage separately in the appropriate storage rooms with a warning to responsible persons to prohibit access to them by any persons, with the exception of the investigator in charge of the criminal case and the head of the investigation organ.
Thus, from the moment the detected cryptoassets are received on the hardware crypto-wallet, their storage is ensured, excluding any transactions.
After the described seizure procedure, the preliminary investigation authorities applied to the court with a request to seize the seized cryptocurrency assets stored on the hardware wallet, which the court, in accordance with Art. 115 of the Code of Criminal Procedure of the Russian Federation satisfied the order.
Taking into account these positive examples of detection, seizure and seizure of cryptocurrency assets, it is necessary to pay special attention to the presence of “cryptotraces” when seizing and inspecting technical equipment, for which purpose attract the appropriate specialists and increase the level of digital literacy of personnel.
We further propose to continue developing the practice of seizing and seizing cryptocurrency assets obtained as a result of committing crimes, or to ensure the execution of the sentence in terms of possible additional punishment in the form of a fine and possible confiscation of property specified in Art. 104.1 of the Criminal Code of the Russian Federation, and recommend that investigative units use the described approaches in practical activities when investigating crimes.
The practice of investigating crimes related to the illegal sale of narcotic drugs shows that persons carrying out these criminal activities, both when receiving payment from purchasers of narcotic drugs and when distributing profits between accomplices, use cryptocurrency. A striking example is crimes committed using trading platforms located in the shadow segment of the Internet, including the Hydra platform, which operated for more than 7 years and was practically a “monopolist” in the market for the illegal sale of narcotic drugs, psychotropic substances, their precursors, counterfeit money, documents and the provision of other illegal services.
The choice of cryptocurrency as a unit of account is one of the conditions that excludes the de-anonymization of parties to transactions carried out in violation of current legislation.
Basic concepts necessary to work on the seizure and seizure of cryptocurrency assets:
Cryptocurrency is a type of digital currency, a product of programming and cryptography, processes of technologization and digitalization of the modern information society. Currently, there are a significant number of different cryptocurrencies in the world, one of the most popular is Bitcoin (Bitcoin, BTC).
Bitcoin is a decentralized cryptocurrency without a single regulator or administrator that can be transferred from user to user through peer-to-peer transactions.
A cryptocurrency wallet is a tool (physical device, program or online service) for managing digital currencies, which stores public and/or private keys for cryptocurrency transactions.
Generally, cryptocurrency wallets can be divided into two categories:
Custodial wallet is a service that owns the private key of the wallet and stores the owner’s assets. When using a non-custodial wallet, only its owner has full control over the assets.
In the context of popularization of payments in cryptocurrency in the Russian Federation, measures are being taken to regulate it. However, in accordance with subsection 3 of the Civil Code of the Russian Federation “Objects of civil rights”, virtual assets (cryptocurrency) are not a separate object of civil rights.
On the territory of the Russian Federation, in accordance with the Federal Law of July 31, 2020 No. 259-FZ “On digital financial assets, digital currency and on amendments to certain legislative acts of the Russian Federation,” a general term is applied to such virtual assets as cryptocurrency - digital currency, under which, in accordance with Part 3 of Art. 1 of this Law, is understood as a set of electronic data (digital code or designation) contained in an information system that is offered and (or) can be accepted as a means of payment that is not a monetary unit of the Russian Federation, a monetary unit of a foreign state, an international monetary or settlement unit, as an investment and in respect of which there is no person obligated to each owner of such electronic data, with the exception of the operator and (or) nodes of the information system, who are obliged only to ensure compliance with the procedure for issuing this electronic data and carrying out actions in relation to them to introduce (change ) records in such an information system according to its rules.
Cryptocurrency is purchased using electronic and non-cash funds and can be converted into them.
Non-cash funds in accordance with Art. 128 of the Civil Code of the Russian Federation are other property. Thus, cryptocurrency is a digital expression of the value of other property, which at a particular moment corresponds to a certain amount of non-cash funds, depending on the exchange rate of the digital currency to the corresponding type of monetary unit.
In addition, in accordance with the Federal Law of July 31, 2020 No. 259-FZ “On digital financial assets, digital currency and on amendments to certain legislative acts of the Russian Federation” for the purposes of applying federal laws of August 7, 2001 No. 115 - Federal Law “On Combating the Legalization (Laundering) of Proceeds from Crime and the Financing of Terrorism”, dated October 26, 2002 No. 127-FZ “On Insolvency (Bankruptcy)”, dated October 2, 2007 No. 229-FZ “On Enforcement Proceedings” , dated December 25, 2008 No. 273-FZ “On Combating Corruption,” digital currency is recognized as property.
At the same time, the criminal procedural legislation of the Russian Federation does not establish comprehensive rules for the seizure and subsequent seizure of cryptocurrency assets, including those obtained as a result of committing crimes, and therefore the problem of regulating the procedure and developing a unified mechanism for performing these actions is relevant, in including within the framework of the activities of preliminary investigation bodies.
During the investigation of criminal cases related to illegal drug trafficking, practice is being developed to seize and seize cryptocurrency assets, both in order to ensure the confiscation of illegal proceeds received as a result of crimes, and to ensure the execution of the sentence in terms of possible additional punishment in in the form of a fine.
According to the practice established in the Department for Investigation of Organized Criminal Activities in the Sphere of Illegal Drug Trafficking of the Investigative Department of the Ministry of Internal Affairs of Russia (hereinafter referred to as UROPD NON), preliminary investigation authorities can seize cryptocurrency assets in the following cases:
– access was obtained to carry out transactions with cryptocurrency (when stored on a non-custodial and custodial service) stored on a crypto-wallet, accessed from a computer device discovered and seized from the accused, or in other cases establishing public and private keys that provide access to cryptocurrency the accused;
– it is possible to influence the transfer of cryptocurrency stored on the custodial service into fiat money.
Thus, in 2021, the investigator of the UROPD NON was investigating a criminal case accusing Sh. of committing crimes under Art. Art. 210, 228. 1 of the Criminal Code of the Russian Federation, during the investigation of which a pre-trial cooperation agreement was concluded with the said accused.
In the course of fulfilling the obligations assumed by the accused within the framework of the pre-trial cooperation agreement, Sh. informed the preliminary investigation authorities about the presence of cryptocurrency assets received as a result of committing the crimes incriminated against him, which he wishes to voluntarily surrender. During the investigative experiment, Sh., demonstrating the methods he used in criminal activities to obtain income from the sale of drugs, through the cryptocurrency exchange “B”, he exchanged his cryptocurrency into fiat money with the registration of their transfer in cash. In turn, the accused’s authorized representative (his close relative), who received cash converted from cryptocurrency, handed it over to the preliminary investigation authorities.
For fiat funds received in this way as a result of the investigative experiment, in accordance with Art. 115 of the Code of Criminal Procedure of the Russian Federation were seized and they were placed in a specialized account of the Ministry of Internal Affairs of Russia.
When using the above method of seizing cryptocurrency assets (that is, with the active assistance of the accused), it is also possible to transfer fiat funds received from the cryptocurrency through the appropriate exchanger or exchange to the bank account of the accused. However, with this method, it is necessary to first seize the funds located and arriving at the account to which it is planned to transfer cryptocurrency in fiat equivalent, with a ban on outgoing transactions through it.
When exchanging cryptocurrencies into fiat funds and subsequently seizing them, the investigator must carefully select the cryptocurrency exchange through which the exchange operation is planned to be carried out, in order to exclude the possibility of turning to unscrupulous participants in the cryptocurrency market and the loss of discovered assets.
In addition to the above, UROPD NON investigators also used the method of detecting and seizing cryptocurrency in “natural” form, in conditions of the accused’s refusal to cooperate.
Thus, during the investigation of a criminal case against citizen G., accused of committing crimes under Art. Art. 210, 228. 1 of the Criminal Code of the Russian Federation, the investigation proved that the accused received remuneration for his criminal activities in the Bitcoin cryptocurrency. As a result of a series of searches, several laptops belonging to the accused were seized. During the inspection of one of the seized devices with the participation of a specialist with special knowledge in the field of detecting on computer information media information about the cryptocurrency wallets used, using specialized software, information about the public and private keys used by the accused to carry out cryptocurrency transactions was decrypted and extracted.
As a result of checking through open data sources on the Internet (blockchain browsers on the platform www.blockchain.com and www.blockchair.com), it was established that the digital currency Bitcoin is stored at the detected cryptocurrency addresses.
Due to the fact that there was a real possibility of withdrawal of cryptocurrency from the discovered cryptocurrency wallets by persons aware of the private keys to them (alleged accomplices), during the investigative action (inspection) it was decided to transfer it to a new, specially created by the investigator, hardware wallet .
Hardware wallets are physical, electronic devices such as USB flash drives that can generate private keys offline and are the most secure way to store crypto assets.
The hardware wallet at the investigator’s disposal is registered through an application specially installed on the computer (in the specific example under consideration, Ledger Live), through which an access password is set, consisting of digital values and known only to the investigator. After creating a password to access the wallet on the device, 24 words are generated - seed phrases to restore the cryptocurrency wallet in case of loss of the private key or impossibility of physical access to the wallet. The above application then generates a Bitcoin cryptocurrency address corresponding to the hardware device.
In order to ensure the safety of the detected digital currency, as part of the inspection, transactions of funds were made from the detected cryptocurrency accounts to a cryptocurrency address on a hardware wallet at the disposal of the preliminary investigation authority.
When drawing up the protocol of the investigative action, it indicated only the public key corresponding to the hardware device, and the password chosen for it and the generated seed phrases were not reflected in order to exclude access to the seized crypto-assets of third parties, including the accused and their defenders, who may become familiar with the specified inspection protocol when fulfilling the requirements of Art. 217 of the Code of Criminal Procedure of the Russian Federation.
The specified hardware crypto wallet, the password for access to working with it, and the seed phrases for it are packaged in three different packages and sealed. Packages with a hardware crypto-wallet, a password for access to working with it, seed phrases are placed for storage separately in the appropriate storage rooms with a warning to responsible persons to prohibit access to them by any persons, with the exception of the investigator in charge of the criminal case and the head of the investigation organ.
Thus, from the moment the detected cryptoassets are received on the hardware crypto-wallet, their storage is ensured, excluding any transactions.
After the described seizure procedure, the preliminary investigation authorities applied to the court with a request to seize the seized cryptocurrency assets stored on the hardware wallet, which the court, in accordance with Art. 115 of the Code of Criminal Procedure of the Russian Federation satisfied the order.
Taking into account these positive examples of detection, seizure and seizure of cryptocurrency assets, it is necessary to pay special attention to the presence of “cryptotraces” when seizing and inspecting technical equipment, for which purpose attract the appropriate specialists and increase the level of digital literacy of personnel.
We further propose to continue developing the practice of seizing and seizing cryptocurrency assets obtained as a result of committing crimes, or to ensure the execution of the sentence in terms of possible additional punishment in the form of a fine and possible confiscation of property specified in Art. 104.1 of the Criminal Code of the Russian Federation, and recommend that investigative units use the described approaches in practical activities when investigating crimes.
