Abstract: To help increase understanding of terrorist exploitation of digital currencies, this article narrowly explores examples emerging from networks operating in Syria. After a brief discussion about the benefits and drawbacks of digital currencies for illicit actors, including terrorists, the authors explore some of the specific factors in Syria that might influence the use of digital currencies by networks linked to the Islamic State and al-Qa`ida’s past and present Syria-based associates. An analysis of three different clusters of activity demonstrates how some terrorists in the country raise, move, hide, and access funds using digital currencies. The article concludes with a brief discussion about what counterterrorism policymakers, practitioners, and researchers can learn about terrorist exploitation of digital currencies from the Syrian context.
In recent years, the security community’s degree of concern about terrorist exploitation of digital currencies has varied. While some entities argue the threat is understated, others suggest that terrorist adoption of digital currencies is overstated. Ultimately, as numerous factors may influence the financial behaviors of individuals, networks, and groups, it is crucial to recognize that the use of digital currencies is often context-dependent.
Relative to other topics, publicly available information about terrorism financing is limited because terrorists strive to act clandestinely, and the entities working to counter their activities need to protect sensitive details for security reasons.1 As a result, commentary on terrorist exploitation of digital currencies is often hypothetical, speculative, and anecdotal, raising questions about the threat based on limited evidence.a Such analyses can be valuable when consumers recognize the limitations of the work, but research drawing on concrete examples can also help piece together a clearer understanding of trends in specific networks and environments. Consequently, this article narrowly examines examples of digital currency usage in Syria by the Islamic State as well as al-Qa`ida and its past and present Syria-based associates. The authors use publicly available information from various sources to highlight some of the tactics, techniques, and procedures adopted by terrorists with interests in the region. For added depth, the article also draws on the authors’ interview with Collin Almquist, the head of Intel Production at Chainalysis, a company providing cryptocurrency data, software, and services to numerous governmental and non-governmental organizations (NGOs).
Before delving into specific instances where terrorists in Syria exploit digital currencies, it is helpful to review what digital currencies are and discuss why terrorist organizations and their members occasionally use these tools, particularly in Syria. In examining the specific cases in Syria, this article outlines some broader observations and walks through examples, highlighting some of the logistical nuances of various schemes. Finally, it concludes with a discussion about what policymakers, practitioners, and scholars can learn about terrorist exploitation of digital currencies from the Syrian context.
Digital Currencies and Terrorists: A Primer
The global financial system is experiencing notable disruptions from new financial technology, notably blockchain,2 cryptocurrencies,b and decentralized finance (DeFi).c In short, these innovations offer alternatives to the traditional banking system by making it possible to transact online without the involvement of centralized financial institutions. Since more actors worldwide are using DeFi and cryptocurrencies, terrorist and criminal networks’ adoption of these technologies is unsurprising. Even so, international organizations, governments, and financial institutions are still learning how to navigate the proliferation of these financial instruments and practices. Unpacking why these financial services have a place in some terrorists’ toolkits may help inform relevant stakeholders’ efforts to prevent, detect, and disrupt the exploitation of DeFi infrastructure.
For starters, DeFi infrastructure offers logistical benefits that may appeal to terrorists and other illicit actors.3 In short, it affords individuals speed, ease, and security with less oversight than traditional banking. Again, in a decentralized network, users can transact with any other user without clearing from any central authority. Creating a virtual wallet, which essentially amounts to opening an account or a node on the network, does not require contact details or additional personally identifiable information.d Generally, after incurring a comparatively modest fee,e transactions are nearly instantaneous and verified by “smart contracts,” which help increase security by creating records in ledgers. The ledgers are immutable, irreversible, and stored across the network using blockchain technology,4 though different technical configurations affect “who can join and participate in the core activities of the blockchain networks.”5 While blockchain technology has uses in many industries, this article focuses on digital currencies such as Bitcoin (BTC) and Ethereum (ETH).f
Taking a step back, decentralized financial networks involve interactions between multiple people, technologies, and businesses.6 People can exchange cryptocurrencies directly with peers or through exchanges and other intermediaries, like money service businesses (MSBs). As third parties, exchanges and MSBs do not issue currency but provide a marketplace for transactions. They also facilitate converting digital currency to other forms of money, primarily real (fiat) currency. Some bad actors think they can abuse this system to raise, move, or launder money and evade sanctions with digital currencies. For the most part, registered exchanges that comply with internationally recognized anti-money laundering and combating the financing of terrorism standards (AML/CFT) and “know your customer” (KYC) requirements help prevent these activities.7 However, if exchanges are unlicensed, unregistered, or non-compliant with such standards and requirements, they create more opportunities for terrorists to act without interference.8 While international transfers through traditional banking systems are accountable to international protocols such as SWIFT or CHIPS,g decentralized networks and exchanges lack such supervision. As networks and exchanges transcend borders, many governments and institutions have yet to determine how best to create and enforce standards in different jurisdictions. Even if various jurisdictions developed more consistent regulations for decentralized finance, many emerging economies and areas of conflict might lack the will or resources to enforce them, creating vulnerabilities that bad actors can exploit.9
Although DeFi and digital currencies may appeal to terrorists in some ways, these tools also have drawbacks. First, the most widely adopted digital currencies are not genuinely anonymous since all transactions on public ledgers can be viewed. Despite misconceptions to the contrary, private and public entities can trace transactions across BTC, ETH, and other open ledgers. Although bad actors may leverage additional evasion tactics while using digital currencies, such as using private coins,10 h virtual private networks (VPNs), single-use wallets, or digital money laundering techniques involving “mixing” services,i there are still security limitations and vulnerabilities.11
Second, digital currencies are subject to varied economic risks and nuances. On this point, characterizations of market values, changes, and functions of money also warrant discussion. For one, increased security may come at a cost: Digital currencies with private ledgers, for example, may promote anonymity, but those tokens often do not carry high market value, ability to convert, and subsequent utility (the transparency of BTC and ETH arguably drives much of their value).j Another important point on value is volatility. Digital currencies are volatile, and coins with low adoption and market value (typically private ledger currencies) are even more so. Increased volatility invites the risk of a quick loss of value as assets are stored, especially with delays in converting to real currency. Such realities may reduce the appeal of digital currencies.
Third, virtual currencies do not eliminate the need to convert into more traditional forms of money like cash, and they do not make legacy terrorism financing techniques obsolete. While some actors may be inclined to use digital currencies as a medium of exchange, many prefer traditional methods of funds transfer. Even if anonymous transactions occur on a private chain, a trusted exchange or MSB must convert those currencies into widely accepted currencies for that value to be utilized. Such businesses are not necessarily common or accessible in many parts of the world, especially areas affected by conflict. Individuals may use additional financial facilitators, the hawala system, or cash couriers to help move funds, but these logistics can add the sort of costs and vulnerabilities that bad actors try to avoid in the first place. That said, the potential utility of digital currencies (including private coins) for illicit online services where vendors accept them as a medium of exchange for services is cause for concern, especially if private coins become more popular, valuable, and easy to convert.
After this brief discussion of the potential merits and drawbacks of DeFi and cryptocurrencies for terrorists at the tactical level, it is helpful to reflect on research about digital currency usage in general. A blog post by Chainalysis, a blockchain services firm, reports that total crypto volume grew from $2.4tr in 2020 to $15.8tr of value (+558% year-over-year) in 2021.12 Within that, illicit use grew from $7.8bn to $14bn of value (+79% YoY).13 Interestingly, although illicit use increased in 2021, that growth did not occur at the same rate as cryptocurrency usage writ large. The overwhelming majority of cryptocurrency usage was assessed to be legitimate, and Chainalysis assesses that in 2021, as little as 0.15% of transactions involved an illicit address.14 k Even though illicit transactions only comprise a small segment of cryptocurrency usage overall, the reality that such transactions can help advance nefarious actors means these trends still warrant further analysis.15
Considering the Economic Environment in Syria
Turning the focus to the Syrian context, the macroeconomic situation could incentivize many actors’ pursuit of alternative money solutions, including DeFi and digital currencies. The defunct financial system and negligible economic growth in Syria are pertinent as they affect everyone, albeit with regional nuances.l Today, the Syrian pound is worth about one-four hundredth of what it was against the USD in 2010, before the start of the Syrian civil war.16 m A suite of economic sanctions stifles financial transactions for many actors in Syria,17 and violence and economic depression have disrupted every service and industry, especially oil.n Meanwhile, humanitarian assistance to Syria by governments and NGOs is limited due to security concerns, among other factors, and a marked change from the status quo is unlikely. Against this backdrop, informal employment, markets, and mediums of exchange are only likely to grow.o
Given the economic situation, one might expect that people across the fragmented country want to find ways to work around enduring liquidity, inflation, and capital issues. In northeastern Syria, an area controlled by the Administration of North and East Syria (AANES), the USD has become an increasingly popular alternative to the Syrian pound.18 Meanwhile, in northwest Syria in 2019, Hayat Tahrir al-Sham (HTS) reportedly “called bitcoin the ‘Currency of the Future Economy’ and released a 26-minute video of a HTS cleric discussing its compliance with Shariah-law.”19 By mid-2020, HTS-controlled parts of northwestern Syria (namely Idlib), and separately, Turkish-controlled parts of northern Syria moved to replace the Syrian pound with the Turkish lira.20 However, when the value of the Turkish lira to the U.S. dollar crashed in late 2021, along with inflation, it negatively affected parts of Syria that had adopted the Turkish lira.21 With most currencies proving unreliable or challenging to access, some individuals and networks may be more interested in exploring other money solutions, such as digital currencies.
With this backdrop in mind, this article focuses on some digital currency-related activities by terrorists in Syria. This assessment is beneficial for understanding the broader nexus between digital currencies and terrorism for several reasons. First, Syria’s economic and political environment and the terrorist organizations operating in the country may incentivize a shift for some away from the traditional financial system and real currencies toward DeFi and digital currencies. Second, there is a decent amount of publicly available information about terrorists’ use of digital currencies in the country, making it easier to observe potential trends. Third, increasing understanding of dynamics in Syria might offer insights into how terrorists in other countries might leverage digital currencies, particularly in similar political and economic contexts.
Terrorist Use of Digital Currencies in Syria
This section will highlight some general observations about terrorist use of digital currencies in Syria and then unpack some specific examples. First, an evolving list of terrorist groups and affiliate networks experimenting with digital currencies in Syria includes the Islamic State, al-Qa`ida, and a complex string of past and present al-Qa`ida-associated groups such as Al-Nusra Front, Hay’at Tahrir al-Sham, and Hurras al-Din (which receives necessary attention in the following footnote).22 p Digital currencies are not the most popular method of funds transfer among terrorists in Syria, who more often rely on various financial institutions, including banks, money services businesses, the hawala system (registered and unregistered), courier networks, and other financial technologies, such as crowdfunding platforms.23 Numerous factors limit digital currency usage in Syria: At the very least, groups generally need internet access, people who understand the basics of using digital currencies, and access to vendors who accept digital currencies or facilitators who can convert them into cash or other financial assets.
A compilation of sources suggests that a list of digital currencies used by terrorists in Syria includes BTC and ETH, and expands to anonymity-enhancing cryptocurrencies that sometimes use private ledgers such as Monero, Dash, Lumens, Zcash, and Verge.24 Some of the actors promoting the use of digital currencies also encourage others to adopt specific operational security practices within this funds transfer method. Such actions can involve using other security-minded technologies, like VPNs, single-use wallets, and cryptocurrency mixing services.25 Additionally, increased security might require individuals using virtual currencies to be more vigilant about practicing operational security and learning new measures as needed.
For example, accounts raising funds on social media or messengers might try to vet prospective donors in online conversation before providing an address for a digital wallet.26
According to Almquist, the analyst from Chainalysis, the terrorist networks using digital currencies in Syria tend to be more consolidated or centralized (i.e., involve fewer institutions and facilitators) than the traditional, non-digital-currency-using networks operating in the country.27 At least in part, this is because “fewer facilitators in Syria are knowledgeable about and comfortable using digital currencies” compared to other methods of moving and hiding funds.28 Even so, some online actors linked to terrorist groups in Syria are opportunistic in their efforts to teach others how to use digital currencies and try to promote operational security practices.29 The following sections will review three different cases to show how terrorists in Syria leverage digital currencies to raise, move, hide, and use funds.
Al-Qa`ida, HTS, and BitcoinTransfer
In August 2020, the U.S. Department of Justice (DOJ) announced the disruption of three terror finance cyber-enabled campaigns, stating that this effort represented the “largest ever seizure of terrorist organizations’ cryptocurrency accounts.”30 According to DOJ, al-Qa`ida and some of its affiliates in Syria managed one of the three campaigns, leveraging digital currencies to raise, move, and obscure funds for terrorism financing.31 In greater detail, a criminal complaint explains that “[al-Qa`ida] and affiliated terrorist groups have been operating a BTC money laundering network using Telegram channels and other social media platforms to solicit BTC donations to further their terrorist goals.”32 Posing as charitable organizations to promote fundraising campaigns online, these entities allegedly used multi-layered transactions to mask their movement of funds.33 Additionally, the criminal complaint notes that a “central hub” collected and later redistributed funds to entities within the money laundering scheme.34
Through blockchain analysis, Chainalysis revealed that the hub described in the criminal complaint was the BitcoinTransfer office in Idlib, Syria.35 A blog post by Chainalysis explains that “BitcoinTransferq purports to be a cryptocurrency exchange but has been implicated in several terrorism financing schemes and appears to be fully under the control of terrorist groups. Since the service became active in late December 2018, more than $280,000 worth of Bitcoin has passed through BitcoinTransfer, much of it related to terrorism financing.”36 Some of the clusters of entities involved in the network include Al Sadaqah, Al Ikhwa, Malhama Tactical, and Reminders from Syria.37 A few of these entities are described below.
Some campaigns in the network were relatively transparent about their intentions: Al Sadaqah, for instance, allegedly described itself as “‘an independent charity organization that is benefiting and providing the Mujahidin in Syria with weapons, finical [sic] aid and other projects relating to the jihad.’”38 In testimony for a 2018 hearing before the U.S. House of Representatives Subcommittee of Terrorism and Illicit Finance, analyst Yaya Fanusie explained how Al Sadaqah “encouraged followers to purchase bitcoin vouchers for a website that took payment in euros. The group posted sites where supporters could use bitcoin ATMs to buy cryptocurrencies. Clearly, the campaign organizers were trying to make the bitcoin process easier for novices.”39
Within the broader scheme, another cluster of activity involved a supposedly charitable entity called “Al Ikhwa,” which claimed to be “‘supporting the brothers in Syria, Wives of [martyrs] and their families … [and] … help those who defend the Muslims in [Syria].’”40 Despite U.S. efforts to disrupt the scheme, some entities appear to remain operational. On Telegram, for example, the authors have observed the latest iteration of the Al Ikhwa campaign soliciting donations, often posting photos of children receiving aid from the group, and offering prospective donors multiple payment methods including PayPal, Western Union, and Bitcoin.
Malhama Tactical’s apparent use of digital currencies and the BitcoinTransfer office in Idlib warrants further attention. Malhama Tactical, occasionally nicknamed the “Blackwater of Jihad,” is a small jihadi private military that advertises its training services online and sometimes participates more directly in the Syrian conflict.41 Reportedly, Malhama Tactical’s membership is comprised mostly of foreign fighters from Russia and Muslim-majority federal republics of the former Soviet Union, but it also has members and trainees from diverse backgrounds.42 While known for its connections to HTS and a range of groups fighting for HTS, Malhama Tactical appears to have multiple sources of funds.43 For example, the group fundraises on social media and messengers [messaging apps], sometimes partnering with other networks, but it does not necessarily position itself as a charitable organization.44 Malhama Tactical’s methods of funds transfer for online donations reportedly include “services such as Wallet One and QIWI Koshelek” and “online cryptocurrencies.”45 On Twitter and Telegram, Malhama Tactical and some of its leadership have reportedly mentioned the group’s use of Bitcoin Wallet, an “online ‘Bitcoin mixing’ service,” and Monero, which is another digital currency.46 Researchers following the group’s activities note that Malhama Tactical’s efforts to promote itself online face some challenges due to content moderation and account suspensions by social media providers.47 However, researchers caveat the setbacks, explaining that “to circumvent increasing counterterrorism financing obstacles, Malhama Tactical has started to explore alternative ways of raising funds.”48 The organization’s use of digital currencies and involvement in the network that used the BitcoinTransfer office in Idlib demonstrate part of that effort.49
Finally, based on blockchain data explored on the Chainalysis Reactor platform, other entities with suspected ties to violent extremists in Syria also used the BitcoinTransfer office.50 r At least anecdotally, it is worth noting that there are some indications that the BitcoinTransfer office in Idlib had interactions with Islamic State-linked entities as well. In mid-2020, BitcoinTransfer received .44 BTC from a cluster associated with a likely pro-Islamic State initiative.s All in all, this case of the BitcoinTransfer office in Idlib, and the networks surrounding that hub, shows how complex and interconnected terrorism financing activity involving digital currencies can be. Despite U.S. efforts to disrupt this activity, new iterations of the BitcoinTransfer office and some groups from the original scheme remain operational today.t
Idlib, Syria, that is accused of facilitating a Bitcoin money laundering scheme involving
terrorist organizations in Syria. (Photo made available by Chainalysis)
Transnational Networks Supporting HTS and HTS Elements with Digital Currenciesu
Noteworthy activities concerning the use of digital currencies by terrorists in Syria often involve transnational ties that help raise and move funds. As discussed earlier, Malhama Tactical, the jihadi mercenary group that trains personnel and sometimes fights in support of HTS, has worked with other groups to raise funds. The Abu Ahmed Foundation, an Indonesian fundraising group demonstrating interest in multiple al-Qa`ida-associated groups in the Syrian conflict, has coordinated fundraising campaigns with Malhama Tactical.51 In October 2018, the Abu Ahmed Foundation and Malhama Tactical coordinated a fundraising campaign and reportedly directed prospective donors to use Bitcoin, Monero, Dash, and Verge to send funds.52
As a different example of a transnational network, in September 2020, French authorities conducted an operation across France to disrupt a scheme that moved funds to Islamist extremists in Syria using cryptocurrencies; that effort culminated in the arrest of 29 people suspected of involvement in the network.53 Initially discovered by Tracfin, a specialized unit within the French Ministry of Finance focused on uncovering financial fraud, money laundering, and terrorism financing, the scheme had allegedly operated since 2019.54 Beyond those arrested in France, two French jihadis, both suspected members of HTS believed to be living in northwest Syria, were reportedly central to the broader financing scheme.55
Although most of those arrested in France were suspected of donating funds to the network, two of the 29 detained by authorities were believed to have distinct logistical roles in managing the scheme.56 In short, the plan centered around “the purchase of cryptocurrency coupons for relatively small amounts in tobacco shops across France.”57 Citing the prosecutor’s office, some reporting on the arrangement explained that “dozens of people in France constantly and anonymously bought cryptocurrency coupons worth 10 to 150 euros ($11 to $165).”58 From there, “beneficiaries in Iraq and the Syrian Arab Republic were able to recover the funds following receipt of a code sent through encrypted text messages,”59 and facilitators could then convert the cryptocurrencies into cash. In total, “hundreds of thousands of euros are thought to have been supplied via the network,” and in addition to supporting al-Qa`ida-associated groups like HTS, some funds reportedly benefited the Islamic State as well.60 In an interview with the authors, Almquist also confirmed that this network had touchpoints with the previously mentioned BitcoinTransfer office in Idlib,61 demonstrating the relative centralization of entities using digital currencies in Syria.
Digital Currency Activity Concerning Islamic State Detainees
Financial networks raising, moving, and obscuring funds supposedly intended for Islamic State affiliates held in detention facilities in Syria, particularly those in the northeastern part of the country, offer more insights on the use of digital currencies. Amidst an ongoing humanitarian and detention crisis, the circumstances of Islamic State-affiliated adults and minors held under guard in camps and prisons have drawn attention from sympathizers worldwide.v These facilities, managed by the Autonomous Administration of North and East Syria (AANES); its military arm, the Syrian Democratic Forces (SDF); and non-governmental organizations, are notoriously under-resourced and insecure.w Ultimately, since many detainees have no clear legal pathway out of the facilities, many need funds for daily life (especially in the camps) and aspire to escape. Research about financing trends concerning Islamic State affiliates held in detention facilities, particularly the camps, suggests several pathways allow funds to reach detainees, and digital currencies appear to be an evolving part of that process.x
To unpack this trend, it is helpful to remember that people in various countries may send funds to Islamic State detainees, including friends and family, sympathetic donors, and charitable organizations. The donors’ considerations of efficiency and security within their respective operating environments can influence how they raise and move funds for detainees.62 One news article highlights how this dynamic manifests among some families in Europe: “While families have long sent money to the refugee camps via money transfer agencies such as Western Union and MoneyGram, in recent months many have reported being barred from using such services – leading them to turn to cybercurrencies [i.e., digital currencies] such as Bitcoin.”63 The U.N. Secretary-General’s 12th report on the Islamic State threat (published in early 2021) reinforces this observation, stating, “The reported use of cryptocurrency in the Syrian Arab Republic has increased in recent months. There are ongoing reports of terrorist fighters or their family members seeking to raise funds via cryptocurrency wallet addresses.”64
Cases where individuals use digital currencies to send funds to Syria for Islamic State detainees also shed light on the global reach of fundraisers operating in Syria. For example, in July 2021, a jury in the United Kingdom found Hisham Chaudhary guilty of using Bitcoin to send money to the Islamic State to help free members from detention camps.65 According to a news report about the case, electronic records revealed that Chaudhary purchased over 50,000 of Bitcoin and discussed how to move those funds covertly.66 In another case emerging around March 2020, Indian authorities reportedly arrested a man and woman in Delhi after discovering their interest in attack planning.67 According to a news article citing the National Investigation Agency’s charge sheet, the couple also connected with a woman in Syria who used the Threema messaging app to share a Bitcoin wallet address and solicit donations.68 According to reporting referencing the charge sheet, the man directed his contacts to deposit funds into that wallet address.69
Many online crowdfunding campaigns geared toward assisting Islamic State detainees promote several methods of funds transfer to attract prospective donors.70 While monitoring social media for an ongoing CTC project investigating how funds move into, around, and out of camps holding Islamic State affiliates, the authors noticed that most of these campaigns do not explicitly list a wallet address. Instead, along with offering other funds transfer methods, like PayPal, Western Union, or bank details, these campaigns tend to encourage interested parties to reach out for more information.71 This approach is likely part of a broader effort to enhance security and vet potential donors on a case-by-case basis rather than broadly posting financial information that is easily detected by law enforcement and intelligence practitioners.72 Among pro-Islamic State crowdfunding campaigns observed by the authors, Bitcoin and Monero appear to be the most common digital currencies.
Conclusion
Many policymakers, practitioners, and academics are still developing a clearer understanding of how terrorists exploit digital currencies. In an effort to support that process, this article examined some instances in which terrorist organizations operating in Syria used digital currencies.y In short, this analysis finds that some terrorist networks in Syria exploit digital currencies and experiment with DeFi, mainly with the intent to raise, move, and hide funds. Operational security appears to be a priority among some actors, but so is convenience, particularly among networks trying to promote supposedly safe and easy methods of funds transfer to prospective donors online. In the cases detailed above, opportunism is also a recurring theme, as Islamic State-linked digital currency activities sometimes use financial infrastructure and businesses associated with al-Qa`ida and its evolving network in Syria, like the BitcoinTransfer office in Idlib. All in all, digital currencies are not replacing other methods of terror finance. Instead, terrorists in Syria often use digital currencies in conjunction with other money service businesses and transfer methods. Moreover, especially in the context of raising and moving funds, social media and messengers are also commonly used to coordinate activities and connect with donors.
While discussing Chainalysis’ analytical work concerning Syria, Almquist observed, “Cryptocurrency isn’t a great mechanism for purchasing arms, explosives, or other weapons; the hawala networks and other traditional MSBs still work for those transactions. What we do see, however, is that terrorist groups use cryptocurrencies for things like fundraising, strategic procurement, and online infrastructure.”73 Although these trends invite security concerns, they also punctuate the vulnerabilities practitioners can exploit to detect and disrupt facilitation networks using digital currencies. Commenting on the utility of blockchain analysis to trace terrorist actors using digital currencies, Almquist explained, “It is a great mechanism for both partner nation and interagency collaboration because it’s entirely unclassified. That means that information related to such activities is very easily shareable and actionable.” He added, “Blockchain data as a whole doesn’t work out really well [for criminals using cryptocurrencies] because of its evidentiary nature. It’s documented; it’s immutable. There are no questions of manipulation.”74
Looking forward, security-minded policymakers, practitioners, and researchers should continue to develop more awareness about digital currency usage for illicit purposes and understand how various conditions might influence terrorist adoption of digital currencies.z This recommendation concerns terrorist activity in Syria and other regions where conflict and other factors might motivate violent extremists and other illicit actors to pursue alternative money solutions, such as Afghanistan.75 Reflecting on the broader landscape, cryptocurrency adoption and the operational security practices associated with cryptocurrency usage will continue to evolve and challenge the security community. Based on the cases highlighted in this article and a range of other sources, some countries, companies, and financial institutions are rising to meet these challenges, often through collaboration.76 aa To expand efforts to counter terrorism financing activities involving digital currencies in Syria and other countries, these stakeholders across multiple sectors must maintain a pulse on terrorist networks using digital currencies; trace nefarious actors’ tactics, techniques, and procedures; and communicate effectively with partners to detect and disrupt terrorist networks. CTC
Audrey Alexander is a researcher and instructor at the Combating Terrorism Center at West Point. She studies terrorist exploitation of technology, terrorism financing, and the nexus of gender and violent extremism.
Teddy MacDonald is a Captain in the United States Army and a rotating instructor of economics in the Department of Social Sciences at the U.S. Military Academy. His research interests include decentralized finance, blockchain, and applications to the economics of great power competition.
The views expressed in this article are those of the authors and do not necessarily reflect those of the Combating Terrorism Center, United States Military Academy, Department of Defense, or U.S. Government.
© 2022 Audrey Alexander, Teddy MacDonald
Substantive Notes
[a] In an interview with the authors, Collin Almquist, the head of Intel Production at Chainalysis, said, “[We] see a lot of misinformation in the headlines about millions of dollars of Bitcoin being raised for terrorist organizations, and that’s not true.” Authors’ interview, Collin Almquist, January 2022.
[b] Cryptocurrencies, or digital currencies, are various types of decentralized digital money. For a primer on digital currencies, see “What is Cryptocurrency?” CoinBase, February 9, 2022.
[c] In short, decentralized finance, or “DeFi,” is a term for financial services on public blockchains. For a primer on decentralized finance, see “What is DeFi?” CoinBase, February 9, 2022.
[d] No Personally Identifiable Information (PII) is needed for a node to mine for tokens. However, PII and “know your customer” protocols are required for exchanges and real currency conversions. These procedures, and potential challenges concerning compliance, are discussed in greater detail later in the article.
[e] The fees described are known as “gas,” and they vary depending on trading volume and mining on a network relative to its maximum capability in “transactions per second.” Transactions can lag, but they are still relatively instantaneous compared to most other methods of funds transfer.
[f] Today, the most renowned digital currencies are Bitcoin (BTC) and Ethereum (ETH), which have the highest market value and (in original form) both provide open (i.e., “public,” as opposed to “closed” or “private) ledgers. The distinction of a public ledger is critical as any person on the network can see every transaction after every “block” update on the chain. New and competing applications and coins are constantly developed and released, to include closed ledgers, but BTC and ETH historically and currently are the most transacted digital currencies both for legitimate and illicit use.
[g] The Society for Worldwide Interbank Financial Telecommunication (SWIFT) is a global messaging platform to facilitate transfers; the Clearing House Interbank Payments System (CHIPS) is the largest private USD clearing system.
[h] In short, private coins and ledgers use the same DeFi blockchain principles as public but have certain technical aspects that obscure who is behind a transaction: either by providing anonymity of who the node is, transaction details such as the amount or time, or not allowing everyone to see the entire ledger (blockchain).
[i] Malign users can also seek to evade capture by using a single use wallet (opened, used once, closed) or digital money laundering techniques known as “mixing” (multiple, rapid transactions with “clean” and “dirty” crypto; often across networks and across several jurisdictions). Tom Keatinge, David Carlisle, and Florence Keen, “Virtual currencies and terrorist financing: assessing the risks and evaluating responses,” Policy Department for Citizens’ Rights and Constitutional Affairs, European Parliament’s Special Committee on Terrorism, May 2018.
[j] Private coins are less common on main exchanges or MSBs, making conversion more difficult. Of some of the more suspicious coins (Monero, Zcash, ShadowCash, Dash, BlackCoin), only two are available to trade on CoinBase. Lesser-known exchanges may accept them, but with fewer resources at those exchanges’ disposal they are less compliant and incur greater risk of theft. Even if private coins become accepted on secure exchanges, that does not guarantee that exchanges or MSBs will be available in a conflict area.
[k] To reiterate, these figures speak to a global trend and are not limited to one region.
[l] Though macro indicators relate generally to the remaining regime-controlled areas, they still provide valuable snapshots of the economic destruction since the beginning of the Syrian civil war. GDP per capita in 2019 was approximately one-tenth of what it was in 2010, even with a population decline of approximately 20 percent left holding the wealth (that is, four million fewer people). “Syrian Arab Republic,” World Bank Data, February 23, 2022.
[m] Even Iran, a stalwart ally, temporarily stopped selling oil to Assad on credit in 2018. Karam Shaar, “The Syrian Oil Crisis: Causes, Possible Responses, and Implications,” Middle East Institute, August 27, 2019.
[n] The regime currently produces approximately less than a quarter of the oil than in did in 2010 and a little more than a third of the gas than it did around the start of 2011. The regime also relies heavily on Iranian assistance. Of the oil, over three-quarters is produced in U.S.-backed SDF controlled territory, with revenue splitting difficult to ascertain. “Losses [incurred by Syria’s petroleum sector] since the start of the civil war in 2011 have come to $100.5bn, the [oil] ministry said without elaborating on whether this was in terms of lost hydrocarbon revenues, losses due to damaged infrastructure or both.” Leva Paldaviciute, “Syria oil sector losses top $100bn since start of war,” Argus, February 6, 2022.
[o] The United Nations Economic and Social Commission for Western Asia (UNESCWA) projects sustained or increased poverty, unemployment, hyperinflation, trade deficits, migration, and capital flight for the next several years. “Realities and Prospects: Survey of the Economic and Social Developments in the Arab Region 2020-2021,” UNESCWA, February 23, 2022, p. 50.
[p] Al-Qa`ida’s past and present Syria-based associates include a dynamic matrix of players with changing names, postures, and allegiances. Various stakeholders in the counterterrorism community have different assessments of the organizations. Tracing back to late 2011, Abu Bakr al-Baghdadi, the leader of the Islamic State movement in Iraq (then known as the Islamic State of Iraq and formerly al-Qa`ida in Iraq), instructed Abu Muhammad al-Julani to create an affiliate group in Syria. Commonly known as Jabhat al-Nusra or al-Nusra Front, the group emerged in 2012, and by 2013, it rejected the Islamic State and its leadership and moved to pledge allegiance to al-Qa`ida. In 2014, the U.S. State Department recognized al-Nusra Front as a Foreign Terrorist Organization, since before, it was seen as a group within the Islamic State. By mid-2016, al-Julani and his group reportedly wanted to distance al-Nusra from al-Qa`ida. The organization rebranded to Jabhat Fatah al-Sham (JFS) and later Hay’at Tahrir al-Sham (HTS). There is no clear consensus about the motivation for and sincerity of these rebranding efforts within the extremist movement and separately the counterterrorism community. See Tore Hamming and Pieter Van Ostaeyen, “The True Story of al-Qaeda’s Demise and Resurgence in Syria,” Lawfare, April 8, 2018. See also “Terrorist Designations of Groups Operating in Syria,” U.S. Department of State, May 14, 2014. See also “Country Reports on Terrorism 2017 – Foreign Terrorist Organizations: al-Nusrah Front,” U.S. Department of State, September 19, 2018. Despite this, both the U.S. State Department and the United Nations amended designations and sanctions of al-Nusra Front to include Hay’at Tahrir al-Sham (HTS) and other affiliates in 2018. See “Amendments to the Terrorist Designations of al-Nusrah Front,” U.S. Department of State, Office of the Spokesperson, May 31, 2018. See also “Al-Nusrah Front for the People of the Levant,” United Nations Security Council, June 5, 2018. In recent years, al-Julani and HTS have continued to push against claims that HTS is linked to al-Qa`ida and acted in some ways that support that claim. Al-Qa`ida loyalists defected to form Hurras al-Din (HAD), and HTS has worked to beat back the HAD and other challengers. For more on this, see Charles Lister, “Twenty Years After 9/11: The Fight for Supremacy in Northwest Syria and the Implications for Global Jihad,” CTC Sentinel 14:7 (2021). See also Orwa Ajjoub, “HTS is not al-Qaeda, but it is still an authoritarian regime to be reckoned with,” Middle East Institute, June 24, 2021. Regardless of HTS’ efforts to reposition itself, the group still demands scrutiny, especially since rivalries and partnerships between al-Qa`ida’s past and present Syria-based associates are not always clear-cut. For example, according to a recent U.N. report citing some member states, fighters in the Eastern Turkistan Islamic Movement/Turkistan Islamic Party (ETIM/TIP) “continue to serve under the HTS. They also collaborate with HAD and Katiba al-Tawhid wal-Jihad (KTJ) on joint attacks on Syrian armed forces.” See “Twenty-ninth report of the Analytical Support and Sanctions Monitoring Team submitted pursuant to resolution 2368 (2017) concerning ISIL (Da’esh), Al-Qaida and associated individuals and entities,” United Nations Security Council, February 3, 2022. This observation indicates that elements of HTS, here ETIM/TIP, sometimes work with HAD, the offshoot of HTS that remains committed to al-Qa`ida. Ultimately, since the United States and the United Nations still recognize HTS and some of its leaders as part of al-Nusra Front, this article regards HTS and its subsidiaries as associates of al-Qa`ida, even if that relationship is complex and evolving. Moreover, when citing or drawing from sources, this article defers to the terminology used by the original source.
[q] Whenever BitcoinTransfer is mentioned in this article, it refers to the single business/hub based in Idlib.
[r] Chainalysis’ Reactor tool also indicated that entities called The Merciful Hands and Tawheed & Jihad Media were among those that used the BitcoinTransfer office.
[s] At the time of the transfers in mid-2020, .44 BTC was about 4,000 USD.
[t] For example, at the time of writing, social media monitoring by the authors shows that Al Ikhwa is still promoting fundraisers on Telegram asking for Bitcoin donations. Additionally, Collin Almquist confirmed that a new iteration of the BitcoinTransfer office and its management are using a new wallet address. Authors’ interview, Collin Almquist, January 2022.
[u] In this context, the term “detainee(s)” refers to the population of alleged Islamic State affiliates, including adults and children, held under guard in AANES, SDF, and NGO-run camps and prisons. The word “detainee” is not universally adopted by stakeholders working on this topic, but this article uses a similar conceptualization about what constitutes a “detainee” in the current situation as the International Crisis Group and the U.S. Defense Intelligence Agency. For more on differing definitions, see “Operation Inherent Resolve, Lead Inspector General Report to the United States Congress, October 1, 2019-December 31, 2019,” U.S. Department of Defense, February 4, 2020, p. 48.
[v] The detainee population encompasses Islamic State-affiliated Syrians and Iraqis, and many other nationalities as well. Bel Trew and Rajaai Bourhan, “Cryptocurrency and the crumbling caliphate: The high tech money trail left as jihadi families try to flee refugee camps,” Independent, November 29, 2020.
[w] The composition of the camps and prisons can vary in important and complicated ways. In this article, the authors use the term “detention facilities” to refer to the network of prisons and camps in northeastern Syria managed by the AANES, generally alongside the SDF and non-governmental organizations. For more context on the facilities, see Charlie Savage, “The Kurds’ Prisons and Detention Camps for ISIS Members, Explained,” New York Times, October 22, 2019. See also the “Background” section in Audrey Alexander, Cash Camps: Financing Detainee Activities in Al-Hol and Roj Camps (West Point, NY: Combating Terrorism Center, 2021).
[x] A CTC report by one of the authors (Alexander) narrowly studied how funds for Islamic State detainees move into, around, and out of al-Hol and Roj camps. The report summarized trends regarding the transfer of funds, explaining: “Before money intended for Islamic State detainees in Al-Hol and Roj arrives in the camps, it may move through banks and other financial institutions, money services businesses, the hawala system, cash couriers, and a range of financial technologies, including crowdfunding platforms, cryptocurrencies, and possibly online retail platforms.” See Alexander, p. 14. For more sources on this topic, see also “Treasury reported that during this quarter ISIS and its supporters also relied on cryptocurrencies and online fundraising platforms, apart from traditional methods of transferring funds into Iraq and Syria” in “Operation Inherent Resolve, Lead Inspector General Report to the United States Congress, January 1, 2021- March 31, 2021,” U.S. Department of Defense, May 4, 2021, p. 107; Vera Mironova, “Crowdfunding the Women of the Islamic State,” Lawfare, October 29, 2020; and Trew and Bourhan.
[y] All in all, although this article is not a comprehensive review of terrorist activities involving digital currencies in Syria, these cases offer concrete examples of how members of terrorist groups in the country use digital currencies to raise, move, and hide funds for their causes. Some other interesting examples involving funds supposedly destined for groups in Syria, though largely facilitated outside of Syria, include Zoobia Shahnaz, Murat Cakar, and the FaceMaskCenter scheme. For more on this, see Andrew Mines and Devorah Margolin, “Cryptocurrency and the Dismantling of Terrorism Financing Campaigns,” Lawfare, August 26, 2020.
[z] For example, if MSBs and other real currency conversion options become more common in Syria and the ability to convert digital currencies was easier, would terrorist usage increase? Additionally, if coins like BTC or ETH became a more commonly accepted medium of exchange in Syria, how might it affect the activities of terrorist organizations operating in the area? What if private coins become more popular, valuable, and easy to convert?
[aa] For example, a recent U.N. report stated: “One Member State observed that its financial intelligence unit is beginning to receive high-quality suspicious transaction reports from virtual currency exchanges, which, upon investigation, have shown links to terrorism financing. That observation underscores the developing maturity of both the analytical tools necessary to identify suspicious activity involving blockchain transactions and the regulatory frameworks that require it to be reported to authorities.” See “Twenty-ninth report of the Analytical Support and Sanctions Monitoring Team submitted pursuant to resolution 2368 (2017) concerning ISIL (Da’esh), Al-Qaida and associated individuals and entities.”
Citations
[1] “Terrorism Financing in Early Stages with Cryptocurrency But Advancing Quickly,” Chainalysis, January 17, 2020.
[2] For more information, see “What is a blockchain?” CoinBase, February 9, 2022.
[4] For more on blockchain technology, see “What is blockchain technology?” IBM, February 9, 2022. Additionally, see “What is a blockchain?” via CoinBase.
[5] Shobhit Seth, “Public, Private, Permissioned Blockchains Compared,” Investopedia, June 29, 2021. See also “Types of Blockchain Networks,” IBM, February 9, 2022.
[6] For more, see “The Basics” and “Figure 2: Anatomy of a Cryptocurrency Transaction” in “Report of the Attorney General’s Cyber Digital Task Force.”
[7] “Report of the Attorney General’s Cyber Digital Task Force.” For more information, see also “KYC vs AML – What is the difference?” Dow Jones, February 23, 2022.
[8] “Report of the Attorney General’s Cyber Digital Task Force.”
[10] Robert Stevens, “What Are Privacy Coins and Are They Legal?” CoinDesk, January 10, 2022.
[11] Authors’ interview, Collin Almquist, January 2022.
[13] Ibid.
[14] Ibid.
[15] Ibid.
[16] “Syrian Pound to USD,” Trading Economics, February 23, 2022.
[20] Nicholas Frakes, “Turkish lira becomes unofficial currency in Syria as economy sinks,” Al Arabiya, June 15, 2020; Nisreen Al-Zaraee and Karam Shaar, “The Economics of Hayat Tahrir al-Sham,” Middle East Institute/Operations & Policy Center, June 21, 2021.
[22] For clarity on how this report discusses al-Qa`ida’s past and present Syria-based associates, see footnote P of this article; O’Leary; “Global Disruption of Three Terror Finance Cyber-Enabled Campaigns,” U.S. Department of Justice, August 13, 2020; Rita Katz, “Tales of Crypto-Currency: Bitcoin Jihad in Syria and Beyond,” Daily Beast, October 13, 2021.
[23] “Twenty-fifth report of the Analytical Support and Sanctions Monitoring Team submitted pursuant to resolution 2368 (2017) concerning ISIL (Da’esh), Al-Qaida and associated individuals and entities,” United Nations Security Council, January 20, 2020; Jessica Davis, “New Technologies but Old Methods in Terrorism Financing,” Project CRAAFT, Research Briefing No. 2, 2020; Christian Vianna de Azevedo, “ISIS Resurgence in Al Hawl Camp and Human Smuggling Enterprises in Syria: Crime and Terrorism Convergence,” Perspectives on Terrorism 14:4 (2020).
[24] “Survey of Terrorist Groups and Their Means of Financing,” Hearing Before the Subcommittee of Terrorism and Illicit Finance of the Committee on Financial Services, U.S. House of Representatives One Hundred Fifteenth Congress Second Session, September 7, 2018; “Global Disruption of Three Terror Finance Cyber-Enabled Campaigns;” Katz; O’Leary; Vera Mironova, “Crowdfunding the Women of the Islamic State,” Lawfare, October 29, 2020; Bel Trew and Rajaai Bourhan, “Cryptocurrency and the crumbling caliphate: The high tech money trail left as jihadi families try to flee refugee camps,” Independent, November 29, 2020.
[25] O’Leary.
[27] Authors’ interview, Collin Almquist, January 2022.
[28] Authors’ interview, Collin Almquist, January 2022.
[29] “Jihadists Capitalize on Cryptocurrency Price Surges with Dedicated Training Courses,” Flashpoint Blog, February 11, 2021; Bridget Johnson, “ISIS Cyber Group Warns of Tracking Through Bitcoin Use,” Homeland Security Today, April 20, 2021; JihadoScope, “Islamic State tech group promotes Monero cryptocurrency, noting …,” Twitter, July 26, 2021.
[30] “Global Disruption of Three Terror Finance Cyber-Enabled Campaigns.”
[31] Ibid.
[32] Ibid.; “United States’ Verified Complaint for Forfeiture IN REM,” USA v. 155 Virtual Currency Assets, United States District Court for the District of Columbia, 2020.
[33] “United States’ Verified Complaint for Forfeiture IN REM.”
[34] Ibid.
[36] Ibid.
[37] For greater detail on the actions of these entities, see “United States’ Verified Complaint for Forfeiture IN REM.”
[38] “United States’ Verified Complaint for Forfeiture IN REM.”
[39] “Survey of Terrorist Groups and Their Means of Financing.”
[40] “United States’ Verified Complaint for Forfeiture IN REM.”
[41] Alessandro Arduino and Nodirbek Soliev, “Malhama Tactical: The Evolving Role of Jihadist Mercenaries in the Syrian Conflict,” Middle East Institute and National University of Singapore, June 22, 2021; Rao Komar, Christian Borys, and Eric Woods, “The Blackwater of Jihad,” Foreign Policy, February 10, 2017.
[42] Joanna Paraszczuk’s interview with Ali al-Shishani, interviewer’s personal blog titled “From Chechnya to Syria,” September 12, 2019; Arduino and Soliev; Abdirahim Saeed, “Analysis: How Malhama Tactical became the ‘Blackwater of the Syrian jihad,’” BBC Monitoring, December 8, 2018.
[43] Saeed; Arduino and Soliev.
[44] Arduino and Soliev.
[45] Ibid.
[46] Saeed.
[47] Arduino and Soliev.
[48] Ibid.
[49] “United States’ Verified Complaint for Forfeiture IN REM.”
[50] For more, see Chainalysis, “Thread: Here’s a quick summary of our blog on how blockchain analysis aided agents …,” Twitter, August 13, 2020.
[51] Nodirbek Soliev, “Charity for ‘Jihad’ in Syria: The Indonesian-Uyghur Connection,” RSIS Commentary, March 12, 2020; “Indonesian Fundraising Group Abu Ahmed Foundation Continues To Encourage Supporters To Donate Using Cryptocurrencies,” MEMRI, November 28, 2018; The following article adds that “[Jemaah Islamiyah] has also involved the delivery of funding by informal Indonesian charities to HTS and other pro-Al Qaeda militant groups in Syria, including Huras ad-Din (HaD) and Malhama Tactical,” see V. Aranti and Nodirbek Soliev, “The Pro-Al Qaeda Indonesian Connection with HTS in Syria: Security Implications,” Middle East Institute, August 10, 2021.
[52] “Indonesian Fundraising Group Abu Ahmed Foundation Continues To Encourage Supporters To Donate Using Cryptocurrencies;” Soliev.
[54] Ibid.
[55] Ibid.
[56] Ibid.
[58] “French arrest 29 in cryptocurrency scheme to finance jihadis.”
[59] “Twenty-seventh report of the Analytical Support and Sanctions Monitoring Team.”
[60] “French arrest 29 in cryptocurrency scheme to finance jihadis.”
[61] Authors’ interview, Collin Almquist, January 2022.
[62] For more context and information, see the “Methods of Funds Transfer” section in Alexander.
[65] “Sales consultant guilty of Bitcoin Islamic State terrorism funding,” BBC, July 6, 2021.
[66] “Leicestershire man ‘used Bitcoin to fund Islamic State terrorism,’” BBC, June 9, 2021.
[68] Ibid.
[69] Ibid.
[70] Mironova. See also Alexander. For specific examples, see the following images in the appendix in Alexander’s Cash Camps report: IMG_1551.PNG, File_052.png, IMG_1709.PNG, File_075.png, IMG_2208.PNG.
[71] For specific examples, see the following images in the appendix of Alexander’s Cash Camps report: IMG_1514.PNG; File_052.png; IMG_1552.PNG, IMG_1762.PNG; Screen Shot 20210608.png.
[72] For more information, see the “Trends Regarding Crowdfunding Campaigns Directed Toward the Camps” section in Alexander’s Cash Camps report.
[73] Authors’ interview, Collin Almquist, January 2022. For additional commentary on trends, see also “Using Cryptocurrency Directly to Commit Crimes or to Support Terrorism” in “Report of the Attorney General’s Cyber Digital Task Force.”
[74] Authors’ interview, Collin Almquist, January 2022.
[75] “The 2021 Global Crypto Adoption Index: Worldwide Adoption Jumps Over 880% With P2P Platforms Driving Cryptocurrency Usage in Emerging Markets,” Chainalysis, October 14, 2021. See also Phillip Inman, “Cryptocurrencies rise in popularity in world’s conflict zones,” Guardian, February 9, 2021.
[76] Authors’ interview, Collin Almquist, January 2022.
