Identifying and analyzing digital payment flows regarding illegal purposes on the Internet : I samarbete med CGI och Finanskoalitionen

Abstract: The aim of this study was to illustrate an unexplored illegal exploitation of legal businesses, with the purpose of limiting this market and especially the related transactions. The issue of transactions regarding illegal material executed with credit cards was solved through involving the companies who issues the credit cards, making the market more transparent and thus preventing this kind of transactions. The thesis will illustrate how cryptocurrencies, such as Bitcoin, are being exploited regarding illegal transactions and more specifically, transactions regarding selling and purchasing Child Abusive Material within file hosting services (cyberlockers). The analyzed data was gathered using a webcrawler and different methods for analyzing correlation were implemented on the data to find relationships between different data points. The data points were then clustered, using an algorithm to create a relationship network. The developed model analyzed the data to identify trends and patterns regarding the illegal transactions and the results can be used to find the most prominent users who are potential perpetrators that actively distributes illegal material. A deeper analysis is then performed on the, according to the model, most interesting users in an attempt to identify their underlying identity. When cryptocurrencies are used by perpetrators to pay and get paid for illegal material, the transaction flows cannot immediately be connected to specific identities and therefore it is required to first identify potential perpetrators and track their transactions, to later compare them with the transactions that has already been identified as payments for illegal material. Apart from this model, a framework has been created to identify certain patterns and trends regarding the cyberlockers’ transaction flows. This was performed through analysis of the transaction flows connected to cyberlockers that were suspected to contain Child Abusive Material or other illegal material. With the results from the first and second model, the most interesting cyberlockers for future investigations were discovered, according to the trends and patterns in their surrounding transaction flows. When that analysis was performed and the first model was implemented, potential perpetrators was identified through collaborations between the investigating unit, the Police, the cyberlockers in question and the relevant exchange services. Through this collaboration the identities of the perpetrators are revealed and the transaction flows can then be analyzed to limit further distribution of Child Abusive Material within cyberlockers and consequently limit the illegal transactions with cryptocurrencies. Keywords: Bitcoin, Child Abusive Material, Cyberlockers, Illegal payments, Cryptocurrency, Webcrawler, Correlation, Relationship network.