CyberWire Daily - Andy Greenberg Interview: Tracers in the Dark. [CSO Perspectives]

Episode Date: January 16, 2023

Rick Howard, N2K’s CSO and the CyberWire’s Chief Analyst, and Senior Fellow, interviews Andy Greenberg, Senior Writer at WIRED, regarding his new book, “Tracers in the Dark.” Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the CyberWire Network, powered by N2K. Calling all sellers. Salesforce is hiring account executives to join us on the cutting edge of technology. Here, innovation isn't a buzzword. It's a way of life. You'll be solving customer challenges faster with agents, winning with purpose, and showing the world what AI was meant to be. Let's create the agent-first

future together. Head to salesforce.com slash careers to learn more. You're a mean one, Mr. Grinch. You're listening to the late, great Thurl Ravenscroft, the singing voice behind this 1966 animated Christmas classic, How the Grinch Stole Christmas,

which means it's that time of year again. We are winding things down here at the Cyber Wire to get ready for the holidays. All the interns in the Sanctum are about ready to put their tools away and start decorating the Sanctorum in a jolly fashion. Hey, hey, hey, Kevin, what are you doing? Get out of the fridge. It's not time to break out the eggnog yet. Are you finished with today's script? Sorry, you still have to watch him like a hawk. As I was saying, Sorry. You still have to watch them like a hog. As I was saying, since this is the last CSO Perspective show for the year,

I have a special holiday gift for you all. Andy Greenberg, the senior writer for Wired Magazine and one of my all-time favorite authors, has just published his latest book. And we are one of the first people who get to talk to him about it. So, hold on to your butts. This is going to be great. My name is Rick Howard, and I'm broadcasting from the CyberWire's secret Sanctum Sanctorum studios,

located underwater somewhere along the Patapsco River near Baltimore Harbor, Maryland, in the good old U.S. of A. And you're listening to CSO Perspectives, my podcast about the ideas, strategies, and technologies that senior security executives wrestle with on a daily basis. and technologies that senior security executives wrestle with on a daily basis. Andy Greenberg is a longtime tech and security writer and has been working for Wired magazine since 2014. He's also an author of three books, one, a New York Times bestseller in 2012 called This Machine Kills Secrets about WikiLeaks. A second in 2019, a cybersecurity canon hall of fame book called Sandworm about the Russian cyber attacks against Ukraine from 2014 to 2017.

And now a third called Tracers in the Dark, the global hunt for the crime lords of cryptocurrency that just came out this year. Andy, thanks for coming on to talk about your book. Thank you so much for that, Rick. I really appreciate it. Well, I appreciated your review of Sandworm, and I'm really glad to be talking about this new one. So I want to congratulate you on this book. I just finished reading it, and I have to say, it's the best cybercrime book I've read in over five years, easily. I would place it on the same

shelf with two other Cybersecurity Canon Hall of Fame books on cybercrime, Future Crimes by Mark Goodman and Kingpin by Kevin Paulson back in 2011. Can you give the audience a summary of what the book is about? Sure. It's about essentially the advent of cryptocurrency tracing as a law enforcement investigative technique. I mean, people forget this, but a little over a decade ago, when Bitcoin kind of first came into the limelight, people believed, including even, I would say to some degree,

Satoshi Nakamoto himself or herself, believed that Bitcoin could be used anonymously, that it might be this kind of digital cash for the internet, that you could put like a briefcase full of unmarked bills into a package and send it across the internet, essentially, without revealing your identity. As Andy said, we're not sure who Satoshi Nakamoto is. He or she published the seminal paper called Bitcoin, a peer-to-peer electronic cash system, in October of 2008, essentially the beginning of Bitcoin as arguably the first viable cryptocurrency. Nakamoto has never appeared in public, and the last time anybody has heard from him or her

was in April 2011 via email. As far as anybody can tell, Satoshi Nakamoto is a pseudonym. It may represent one person or a collective. In 2014, Newsweek wrongly pointed to a 64-year-old Japanese-American named Dorian Prentiss. Researchers from Aston University attribute the author to be Nick Szabo, based on writing style comparisons, something called stylometry, from the original paper and Szabo's public writing. Nakamoto gives credit to Szabo in the original paper for a precursor cryptocurrency called Bitgold. Whomever the Nakamoto collective is, they're worth about $8.8 billion because of all the Bitcoins in their possession. $108 billion because of all the Bitcoins in their possession.

It seems so crazy to me that a system that rides on the blockchain which is supposed to be transparent, that we would think that it would be anonymous. How do we rectify those two ends of the equation there? Well, we can get into like how cryptocurrency tracing works, which is such a big part of the techniques used by the main players in this book. But back in 2011, when I wrote the first print magazine piece about Bitcoin, I'm guilty of this too. I believed that Bitcoin could be used anonymously because, yes, there was this thing called the blockchain that recorded every single Bitcoin transaction. But those transactions, as they were listed there, only seemed to be between Bitcoin addresses, these long,

inscrutable strings of characters. And there were no identifying details on the blockchain. If you couldn't figure out who somebody's addresses were, then how were you going to follow their money or identify their transactions? And that seemed to have convinced even Satoshi Nakamoto wrote in the first email to a cryptography mailing list introducing Bitcoin that participants can be anonymous, in quotes. Even Satoshi believed in this potential anonymity or untraceability of Bitcoin. And from Gavin Andreessen, one of the first Bitcoin programmers. And he had given a talk about it where he described it as a kind of cyberpunk invention. The cyberpunks were this movement of privacy advocates who I was super interested in, who believed that

you could use encryption technologies to take power away from governments and corporations and give it to individuals. And Gavin described Satoshi as having kind of created this cyberpunk holy grail, as he put it, like truly anonymous,

potentially untraceable digital cash for the internet. That's what Bitcoin was perceived to be back then. And so I interviewed Gavin and wrote a piece for Forbes magazine about Bitcoin back then. But I did even try to get comment from Satoshi, who back then had not yet disappeared. And Gavin even relayed a message to Satoshi for me.

And I included in the story, Satoshi Nakamoto declined to comment, which I think is maybe the only media story that ever had that phrase in it because he actually did decline. Or she or they or whoever Satoshi is. Because we don't know, right? Nobody knows who Satoshi is, right?

That's the whole game here. But this is like the funny thing about it. Satoshi wrote, participants can be anonymous about Bitcoin. And it has since turned out that that may be true in a sense, but only in the sense that Satoshi himself has remained anonymous. And almost no one else ever has been able to use Bitcoin anonymously, it turns out. I mean, the story of this book is about how over the last decades, it slowly became apparent that, I mean, as is now clear,

as is now clear to you from what you just said about the blockchain, that Bitcoin is incredibly traceable, that it is actually far more traceable once you know kind of like how to crack the code of the blockchain's Bitcoin addresses then even the traditional financial system and a small group of detectives who are who are really the main characters of this book figured this out I mean first in the in the sort of research world then the tech

industry then law enforcement and this group kind of went on a just a spree of one massive cyber criminal takedown after another each one bigger than the last, that, you know, kind of still is persisting to this day. I guess that's the takeaway from the book. If there's any doubt in anybody's mind today, I think we can wipe that away. That cryptocurrencies, specifically Bitcoin, but others for sure, we can use the same techniques.

Not all of them, I would say. But, say, but almost all of them, except the ones that are specifically designed, I think you're about to get to this, to foil that kind of tracing, like Monero and Zcash, or others that are, you call them privacy coins. But everyone that's sort of based on a blockchain, like the sort of traditional blockchain, the way that Bitcoin is, yeah, they turned out to be not only traceable, but given the way that they were perceived originally, almost like a trap for people seeking financial privacy

and for all kinds of criminals. So the technique's called Chainalysis. Is that right? Well, Chainalysis is the company. Chainalysis is this, sorry to interrupt, but Chainalysis, is that right? Well, Chainalysis is the company. Chainalysis is this, sorry to interrupt, but Chainalysis is the tech startup that has become kind of the world's leading purveyor of cryptocurrency tracing tools and services.

They're now, you know, Chainalysis' origin story is a big part of this book, the way that they figured out how to trace cryptocurrency. And then they, and now a whole industry of companies like them, are playing this cat and mouse game with all of these cryptocurrency users and criminals trying to stay a step ahead. So I'm glad you clarified that because I was thinking Chainalysis was the name of the technique they were using, but you're right.

That's the name of the company that developed a lot of these algorithms. Is there a different name for the technique that they are using? Or is it just a bunch of different techniques that this company uses? Well, I think that the techniques as a whole are called blockchain analysis, which is where I guess the name chain analysis comes from, that company. But yeah, I mean, the chain analysis adopted like a whole bunch of techniques and built them into a kind of slick piece of software called Reactor that became this very powerful tool in the hands of law enforcement. core techniques that Chainalysis built a company out of came from the research world and specifically from the work of one University of California, San Diego researcher at the time, Sarah Micklejohn, who in 2013, a couple of years after the appearance of the Silk Road and when I first

discovered Bitcoin, she and her co-authors published a paper that laid out these really surprisingly effective techniques to trace Bitcoin, which was, and of course, really to trace cryptocurrencies of other kinds as well, but Bitcoin was the big one back then. For those that can't remember, the Silk Road was the name for an online black market founded in 2011 by Ross Ulbrich, hacker named The Dread Pirate Roberts, a nod to the famous movie The Princess Bride. His site facilitated the transactions of all kinds of illicit material, mostly drugs, and were hidden by the encrypted Onion Router Network, or the Tor Network,

where network transactions were scrambled and obscured by the underlying Tor technology. The FBI shut it down in 2013, and Obreg was convicted of seven charges related to Silk Road in the U.S. federal court in Manhattan and was sentenced to life in prison without possibility of parole. He's currently starting his 10th year in prison. starting his 10th year in prison. After the break, Andy and I will talk about how a grad student kicked off this entire crypto analysis research area. Come right back. I love the way you described how she started

because she was like a grad student, right? And just started buying things with Bitcoin just to see if she could track the transactions as they moved around the web. Can you describe what she was doing there? Yeah, well, I mean, Sarah had a few really clever ideas about ways to essentially break through that thin barrier between someone's Bitcoin addresses and their real identity. That seemed kind of impermeable to me when I first wrote about Bitcoin. But she really did figure out how to connect people to their Bitcoin addresses.

And one way, as you were getting at, is that she kind of became almost like an undercover cop herself. She just started interacting with almost every Bitcoin service there was, just moving her own Bitcoins into and out of cryptocurrency exchanges and gambling sites and even the Silk Road, this dark web drug market that offered every kind of hard drug imaginable. She just moved Bitcoins into and out of the market without ever buying anything, she says, at least to me.

And that allowed her to see her transactions and then she could see on the blockchain, she could match up the blockchain transactions with the ones that she knew she had made and therefore start to identify some of the addresses of these services. But then the real trick was that she also combined that with the ability to create clusters of addresses. The blockchain was, and still is,

just this vast collection of millions upon millions of distinct addresses. But she started to figure out that sometimes dozens or thousands of addresses all belonged to one person or service. And she had a few tricks to do that. But she started to see that if she could identify just one Silk Road address, she could also tie it through some of these clever

kind of almost logic games to a whole cluster of eventually thousands of Silk Road addresses. And she therefore could see other people sending money into the Silk Road too. And she also figured out that if you could then follow that money out of the Silk Road to a cryptocurrency exchange or into the Silk Road to a cryptocurrency exchange or into the Silk Road from a cryptocurrency exchange, then you, if you were a law enforcement agent, could send a subpoena to that exchange,

which actually often legally was required to have identifying information on users and start to truly unmask people and identify their criminal activities with cryptocurrency. That turned out to be incredibly powerful. And that's kind of where the story forks a little bit, right? You follow a couple of different lines in the book, which I loved. The IRS has a big play in this and the company we were talking about, Chain Analysis.

So let's talk about the IRS piece of this. How did those guys get involved in this kind of analysis in the criminal world? Well, it all starts with this one guy who is really, if anybody is, the main character of the book. It's this guy, Tigrin Gumbarian. And he worked within IRS, but within the IRS Criminal Investigations Division, which is this interesting part of IRS. Which I didn't even know they had until I read your book. It's like, wow. Yeah, I sort of barely heard of them myself

until I got into this story. But they are this little-known law enforcement agency, their own kind of little FBI or something within the IRS. They are forensic accountants, but they also carry guns and make arrests and get, I think they would say, very little respect from the FBIs and DEAs of the world who don't really take them seriously. But it kind of figures that this underdog law enforcement agency within IRS was the one that

began to crack this code. And it was really Tigran who, in 2014, after the Silk Road takedown, he was based in Oakland at the time. And the Silk Road, it turned out, had been run by this 29-year-old Texan living in San Francisco, just across the bay. Ross Ulbricht, who ran and created the Silk Road, was arrested in San Francisco.

Tigran's superiors in IRS criminal investigations were kind of like, why didn't we get this guy? I mean, he was right there under our nose. Tigran had always looked at Bitcoin from the beginning and thought, like you just said, there's a whole blockchain here, a ledger of every transaction. This has got to be traceable. I mean, he had spent years auditing people's tax returns. He was a forensic accountant, and he, I think, his kind of accountant brain saw that potential. So he started sort of looking closer

at the Silk Road investigation after the Silk Road was taken down. And to be clear, the Silk Road was taken down not through cryptocurrency tracing, but through some kind of sloppy mistakes made by Ross Ulbricht. And Teagreen got a tip from a cryptocurrency exchange that this guy, Karl Markforce, was cashing out hundreds of thousands of dollars worth of bitcoins of unknown origin through this exchange. to that case and found that Karl Mark Forrest was a DEA agent who had been

working on the Silk Road investigation and then essentially sat down at home after hours. Nobody thought this was possible, but he just kind of thought differently and sat down and hand-traced on the blockchain Karl Mark Forrest's Bitcoin transactions

to show that this kind of mysterious fortune he'd amassed had come from the Silk Road, that the Dread Pirate Roberts, the creator of the Silk Road who went under that name, had been sending payments to Karl Mark Force in exchange for inside law enforcement information that Karl Mark Force had been a mole inside the DEA for the Silk Road, essentially, and had tried to extort the Silk Road for money and, you know, just incredibly corrupt behavior.

So the story twists, which is fantastic that there's a corrupt cop at the end of this that the IRS guy is tracking just by doing manual analysis of the blockchain, right? He wasn't writing programs to do it, right? He was doing it manually. Right, I mean, this was in the days before chain analysis. Yeah. And T-G right? He was doing it manually. Right. I mean, this was in the days before Chainalysis.

And Tigran was just really doing this on his own. But this was the end of the Silk Road story, but really just the beginning of the story of the book. Because that was when Tigran realized that Bitcoin can be traced. And he had just proved somebody's guilt through cryptocurrency tracing for the first time in the history of law enforcement. And not only that, but he soon followed another thread of like a kind of loose thread of like missing Bitcoins from the Silk Road to show that they had been taken by another corrupt agent, a Secret Service agent who worked in the same Baltimore office as Karl Markforce, that was Sean Bridges. And the two of them were both corrupt agents, both investigating the Silk Road and simultaneously trying to enrich themselves from

that investigation. Anyway, they just taking whatever dirty bitcoins they could. And both of them had thought that those bitcoins would be untraceable, so they could never be caught. And Teagreen caught them both and they both went to prison. You know, if I was writing a novel about this, the editor would say, this is too incredible. No one would believe this, right? So it's unbelievable this happened in real life. Right?

So I knew a bit about that story, but the details of it and then some of the cases that followed, they truly were just like, kind of like truth is more dramatic than fiction, kind of true crime stories. But I don't want to like get ahead of myself. So I'm a little foggy at this point,

but somehow the IRS agent becomes friends with the Chain Analysis CEO, right? And they begin to share information with each other. So Michael Groninger at this point was this Danish entrepreneur. He is now the CEO and co-founder of Chain Analysis, which has grown into an $8.6 billion startup. But back then was just his little idea. And he sort of picked up Sarah

Micklejohn's tricks from her paper and wrote... He was not a researcher. He was a real entrepreneur and coder and built a very slick and fast tool that implemented those ideas and others that he came up with. And then he sort of just by chance met Tigran Gumbarian, the IRS agent in San Francisco, helped him out with that Sean Bridges tracing case. And then they kind of together went on to take on this other massive mystery in the cryptocurrency economy, which in 2014 was the fact that Mt. Gox, the first cryptocurrency exchange, had been just catastrophically hacked

and emptied out, essentially, by hackers who had stolen half a billion dollars worth of Bitcoins from it. And Michael Groninger, just in his kind of first days after founding Chainalysis, this company took the Mt. Gox bankruptcy trustees on as a pro bono customer, basically, and just decided that he was going to solve this case. And he and Tigran essentially did just that. T-Grain was actually looking into this cryptocurrency exchange called BTCE, which, if you remember, was like this very mysterious and shady exchange at the time. And nobody could figure out where it was located.

Some people thought it was like Singapore or Hong Kong or some people had pointed towards other countries. It was just this like black hole. Nobody could figure out who ran it. And it was one of the biggest cryptocurrency exchanges at the time. And also, anybody could use chain analysis or cryptocurrency tracing tools to see that tons of dirty money was flowing into it from ransomware, which was just starting to be a thing back then, and dark web drug markets that had replaced the Silk Road. And so T-Coin started to look into BTCE, and the amazing thing turned out to be that BTCE had been founded by this Russian guy named Alexander Vinik,

who Michael Groninger, through cryptocurrency tracing, proved was part of the group of hackers stealing the Mt. Gox fortune. This guy, Alexander Vinik, allegedly at least, had amassed so many bitcoins from that heist that he had created his own exchange, BTCE, just for the purposes of laundering this fortune. And then BTCE, you know, as this

kind of criminal exchange, became the go-to place to launder all sorts of criminal cryptocurrency. And so they essentially both solved the Mt. Gox mystery and took down BTCE. That takedown of BTCE and the solving of the Mt. Gox mystery is really like the beginning of a new era because that was Chainalysis' first big case. It proved that cryptocurrency tracing could be used to solve some of the biggest cybercrimes happening on the internet, period.

And it's kind of the beginning of this golden age of cryptocurrency tracing. The rest of the book tells these bigger and bigger stories of law enforcement wins that they take down of AlphaBay, this dark web drug market that's 10 times the size of the Silk Road, and the welcome to video child sexual abuse video dark web market. All of that was taken out through cryptocurrency tracing. I love the way you ended the book.

I think it's a perfect bookend. And I thought it was going to go one way and it didn't go that way. But you end up with Sarah Micklejohn again. And I really thought that she was going to end up being the number two at Chainalysis. But she went a different way, which I thought was fantastic. You know, I didn't want to just leave readers with the impression that financial surveillance is 100% good or, you good or that it's not an ethically complicated thing. It is. And luckily for me, like Sarah Micklejohn, who begins this whole story with

the techniques that she invented, she also serves as kind of a conscience of the story because she was always very ambivalent about the fact that what she had created had been adopted by law enforcement and used in these incredibly powerful surveillance operations and as you say like I hope it's not a spoiler to say that you know she is in the one of the final scenes of the books she was offered a job by

Michael Groninger who had created chain analysis and what it was very quickly growing. And if she had taken that job, she probably would have made a fortune. Rich beyond her wildest dreams, yeah. But she did not take that job. And she turned him down.

And she told me that it was because she just didn't want to be as, as she put it, a cyber narc for a living. You know, she, that was what her, her academic advisor had once joked about it, about, called her as a joke. And when she was tracing cryptocurrency and she just, her, her, you know, Bitcoin tracing work, she saw it as a kind of public service announcement, like a sort of a warning about the fact that Bitcoin was anything but private. But she didn't want to be on the side of the cats in this cat and mouse game. She wanted to kind of like remain outside of it. And she sees that I agree with her that there is a real need for anonymity technologies for journalists and dissidents and activists and people in repressive regimes. And the fact that, you know, cryptocurrency was once held up as a way for those people to evade financial surveillance. And the fact that it has turned out to be the

opposite of that is in some ways tragic, even though cryptocurrency tracing was also used to take down a bunch of people doing bad things. So is that the takeaway, Andy? If I was going to boil the book down to the learning point, it's that Bitcoin specifically can be traced by law enforcement and governments now. So if you thought that you were anonymous there, you should change your mind because you are absolutely not anonymous. Yeah, if you have to boil it down to one lesson,

I guess that that's it. I mean, there are now cryptocurrencies like Monero and Zcash that do things with their blockchains that are designed to foil tracing and work probably pretty well to varying degrees, depending on which one we're talking about. Yeah, but as you said in the book, the adoption rate for those is really small compared to Bitcoin and stuff. So we're not there yet. Right. And there may still be vulnerabilities in those

that Chainalysis has figured out. They have a lot of money and smart people and a lot of competitors trying to one-up them and find new ways to trace cryptocurrency. So that cat and mouse game continues. But I appreciate you trying to that cat and mouse game continues. But I, you know, I appreciate you trying to boil it down to like a lesson. But really, it's like, it's more like, it's like, once I saw that Bitcoin and the cryptocurrency could be traced, you know, it turned out that

that created just like an incredible decadelong true crime drama, just a crazy story that had never really been told. And I kind of couldn't believe how much there was to tell. And also just like a lot of really interesting ethical questions about the role of anonymity in society and the role of surveillance. Well, it's good stuff, Andy. And I said at the top of the show that it's the best cybercrime book I've read in a long time. So my hat is off to you. You as, I mean, you of all people, I mean, you probably read more of these books than anybody. So I really appreciate that. I'm very grateful for that. And I have to say like Kingpin, Kevin Poulsen's work is amazing. And just, I appreciate any comparison. Thank you. Well, you're quite welcome. But we're going to have to leave it there, Andy. That's Andy Greenberg.

He's the senior writer for Wired and the author of the next great cybercrime book. So, Andy, thanks for coming on the show. We really appreciate it. Thanks as always, Rick. Thank you very much. I'd like to thank Andy Greenberg for coming on the show to talk about his book. And if you haven't read Sandworm yet, stop what you're doing, don't pass go, and get it done. Like I said before, it's a Cybersecurity Canon Hall of Fame book.

But more specifically, with all the activity going on in Ukraine today, Sandworm is especially relevant. And then go straight out to read Tracers in the Dark. It's fantastic. And that's a wrap. Not only for this show, but for the complete CSO Perspective season, season 11, and for the entire year of 2022. What a year. As we move into the holiday season, enjoy your downtime. I know I'm going to. We are just about ready here at the Howard House. All the decorations are up both inside and outside, following the Howard motto of

more is always better. And as you see your neighbors and your relatives this season, remember to be kind. Yes, even with Uncle Kevin and his crazy conspiracy stories. We still love him, even with all that.

And if you're having trouble rising to the holiday spirit, just remember these immortal words from Dr. Seuss and How the Grinch Stole Christmas. Welcome Christmas, bring your cheer, cheer to all who's far and near. Christmas day is in our grasp so long as we have hands to clasp. Christmas day will always be just as long as we have been. Welcome Christmas while we stand, heart to heart and hand in hand.

The Cyber Wire CSO Perspective is edited by John Petrick and executive produced by Peter Kilby. Our theme song is by Blue Dot Sessions, remixed by the insanely talented Elliot Peltzman, who also does the show's mixing, sound design, and original score. And I'm Rick Howard. Happy holidays, and we'll see you in the new year. Thank you.