August 24, 2016 | The Cipher Brief

The New Frontier in Terror Fundraising: Bitcoin

When I worked as a counterterrorism analyst for the CIA, I always looked out for signs of terrorist groups adapting their methods. Now, as someone outside of government who analyzes how nefarious groups fund themselves, I am concerned about terrorists using innovative technologies to bolster their finances. And I recently came across a troubling case of terrorist financial innovation.

The Ibn Taymiyya Media Center (ITMC), an online jihadist propaganda unit based in the Gaza Strip, is running a social media fundraising campaign that is the first publicly verifiable instance of a terrorist group using bitcoin. Although the campaign has not yet raised much digital currency, this effort shows how terrorists are experimenting with new financial technology to expand funding.

ITMC is the media wing of the Mujahideen Shura Council in the Environs of Jerusalem (MSC), a collection of Salafi-jihadist groups in Gaza that is designated by the U.S. State Department as a foreign terrorist organization. Although the MSC mainly targets Israel, its leadership also supports the Islamic State (IS), and Treasury designated the MSC deputy head in February 2016 for facilitating financial resources and foreign fighter travel for IS. The group’s videos feature high-quality production, showcasing its training, bomb making, and explosives testing.

ITMC’s online campaign Jahezona (“Equip us” in Arabic) began in July 2015 (see this interactive timeline). It calls for Muslims worldwide to donate funds, arguing that such donations fulfilled a religious obligation to fight for Islam. The campaign regularly posts graphics showing the group’s desired weapons and ammunition, alongside the cost for each. Initially, most posts pointed followers to an email address or an account on the encrypted messaging platform Telegram as a way to communicate securely.

However, in late June 2016 the campaign added the option to pay in bitcoin, posting infographics on Twitter with QR codes linking to a bitcoin address. The campaign sought at least $2,500 for each fighter, but so far, the address has received roughly 0.929 BTC (approximately $580) through two transactions six days apart (0.893 BTC on July 1 and 0.0359 BTC on July 7). On August 20, the funds were transferred to other addresses whose ownership is publicly unknown.

As recently as August 23, ITMC continued to seek bitcoin donations, even after a number of news sources reported on its fundraising campaign. Social media platforms have also taken notice. Twitter regularly deletes the Jahezona account, but it resurfaces through different handles, relying on followers to retweet its graphics.

It is possible that the campaign’s organizers made the above transactions themselves to test the bitcoin address. Although it is unclear who placed the deposits in the address, the transactions’ blockchain data suggest that those responsible are most likely proficient bitcoin users and are employing techniques to preserve anonymity. 

  • Both deposits into the Jahezona address come through separate chains of bitcoin transactions originating from the popular cryptocurrency exchange BTC-e.com (See image at end of article for an illustration of these transactions). BTC-e’s ownership and incorporation location are not publicly disclosed, and it is unclear if the transactions were handled by the same entity (or entities) that deposited into the Jahezona address. Still, the exchange may be attractive to illicit actors, since identifying a clear jurisdiction with legal authority to subpoena BTC-e’s records would be difficult.
  • One chain of transactions mapped to the Jahezona address also deposited bitcoin funds into addresses owned by other bitcoin sites, like matbea.com and cloudbet.com. This chain also transacts with localbitcoins.com, a site for selling bitcoins in person and a popular resource for people seeking anonymity to cash out bitcoins. Much of the second chain has characteristics of an exchange withdrawal service.

Although these deposits appear anonymous, bitcoin technology provides advantages for tracking and disrupting this fundraising effort. Bitcoin and other cryptocurrencies are built on digital-ledger infrastructure, also known as a blockchain, spread across computers that no single person controls. The blockchain is public, so even if the identity behind a transaction is unknown, movements can be tracked – a dream for investigators looking to find connections.

So while ITMC keeps posting requests for bitcoin, the blockchain’s transparency may be keeping more people from funding the campaign. The platform’s open nature also provides an opportunity for bitcoin enthusiasts to help police criminal behavior and combat some of bitcoin’s stigma. Illicit activity unchecked on the blockchain will only make financial regulators less receptive to growing financial technology (fintech) innovation and the public more skeptical about using digital currencies.

U.S. law enforcement engages digital currency companies through the Blockchain Alliance, a public-private partnership to communicate with firms and help prevent illicit activity on blockchain platforms. However, organized efforts by fintech-savvy individuals to flag criminal activity have been few and far between. Bitcoin companies cannot be expected to regularly search for illicit transactions outside of their direct business operations, and there is no evidence that any of these companies did anything illicit themselves. And most law enforcement agencies around the world will never have as much fintech expertise as the private sector.

Still, digital currency advocates who are familiar with cryptocurrency exchanges, forums, and even darknet websites should set up watchdog groups that look for nefarious bitcoin activities. Such groups could inform blockchain companies, the media, and even law enforcement of digital malfeasance that would otherwise go ignored. Financial technologists should be proactive in flagging such digital currency transactions, in the same way that some cybersecurity specialists become “white hat” hackers to report computer vulnerabilities and cyber threats.

In February 2016, Europol noted that it could not confirm any reports of terrorist organizations using bitcoin. Now, theJahezona campaign reveals that at least one group is experimenting with the digital currency. An opportunity exists to leverage this innovative technology to disrupt illicit activity. It is time for the fintech community to show the MSC and other terrorist groups that financing on the blockchain is bad for business.

Yaya Fanusie is director of analysis at the FDD’s Center on Sanctions and Illicit Finance. Follow them on Twitter @SignCurve and @FDD_CSIF.

Issues:

Cyber Cyber-Enabled Economic Warfare